@hominis/fireforge 0.44.0 → 0.44.2

package/dist/src/commands/test-run.d.ts

@@ -40,6 +40,11 @@ export interface TestRunContext {
     headless: boolean;
     /** Extra environment variables for the mach process. */
     env?: Record<string, string>;
+    /**
+     * Pass full mozbuild verbosity through for the TEST phase, by unsetting
+     * the coding-agent markers that quiet it. Off by default.
+     */
+    fullOutput?: boolean;
 }
 /** Outcome of one (possibly retried) harness invocation. */
 export interface TestRunOutcome {

package/dist/src/commands/test-run.js

@@ -60,10 +60,17 @@ async function runTestsWithRetriesInner(ctx, paths, env) {
     let verdict;
     for (;;) {
         attempts += 1;
-        result = env
-            ? await dispatch(ctx.engineDir, paths, extraArgs, env)
-            : await dispatch(ctx.engineDir, paths, extraArgs);
-        result = await retryAfterXpcshellSymlinkRepair(ctx.engineDir, ctx.objDir, result, ctx.classification, paths, extraArgs, env, dispatch);
+        // Arity is kept minimal when there is nothing extra to pass: the
+        // dispatchers' trailing parameters are optional, and appending explicit
+        // `undefined`s would only make every call site's shape depend on
+        // features the run is not using.
+        result =
+            ctx.fullOutput === true
+                ? await dispatch(ctx.engineDir, paths, extraArgs, env, true)
+                : env
+                    ? await dispatch(ctx.engineDir, paths, extraArgs, env)
+                    : await dispatch(ctx.engineDir, paths, extraArgs);
+        result = await retryAfterXpcshellSymlinkRepair(ctx.engineDir, ctx.objDir, result, ctx.classification, paths, extraArgs, env, dispatch, ctx.fullOutput);
         const combined = `${result.stdout}\n${result.stderr}`;
         verdict = classifyHarnessRun(result.exitCode, combined, paths);
         if (verdict.kind !== 'harness-crash' || attempts >= maxAttempts)

package/dist/src/commands/test-verdict.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: EUPL-1.2
+import { getActiveRunLogPath } from '../core/run-log.js';
 import { formatFireforgeVerdictLine } from '../core/test-harness-crash.js';
 import { setStdoutSealed } from '../utils/logger.js';
 let emitted = false;
@@ -38,7 +40,14 @@ function writeVerdictLine(line) {
     if (emitted)
         return;
     emitted = true;
-    process.stdout.write(`${line}\n`);
+    // The run log's path rides the verdict line because the verdict must stay
+    // the run's LAST stdout write — a separate announcement after it would
+    // break that contract, and one before it is the first thing a `tail` cuts.
+    // Appended as an additive `key=value`, so consumers that tokenize the line
+    // are unaffected and a truncated tail still says where the full output is.
+    const logPath = getActiveRunLogPath();
+    const suffix = logPath === undefined ? '' : ` log=${logPath}`;
+    process.stdout.write(`${line}${suffix}\n`);
     setStdoutSealed(true);
 }
 /**

package/dist/src/commands/test.js

@@ -8,6 +8,7 @@ import { assertBuildArtifacts } from '../core/mach-build-artifacts.js';
 import { assertMarionettePortAvailable, ensureLaunchableBrowserNotRunning, ensureMarionettePortAvailable, extractForwardedMarionettePort, forwardedMachArgsIncludeMarionetteClient, shouldAutoForwardMarionettePortToMach, } from '../core/marionette-port.js';
 import { formatMarionettePreflightLine, reportMarionettePreflight, runMarionettePreflight, } from '../core/marionette-preflight.js';
 import { ensureMochitestServerPortAvailable } from '../core/mochitest-server-port.js';
+import { closeActiveRunLog, openRunLog, setActiveRunLog } from '../core/run-log.js';
 import { createPostRebuildFailureContext } from '../core/test-harness-output.js';
 import { analyzeTestPathScopes, formatScopeNotice, } from '../core/test-path-scope.js';
 import { assertObjdirMatchesTreeMarker } from '../core/tree-store.js';
@@ -276,6 +277,10 @@ const TEST_BUILD_PREFLIGHT = {
 export async function testCommand(projectRoot, testPaths, options = {}) {
     intro('FireForge Test');
     resetVerdictEmission();
+    // Opened before ANY work so a preflight refusal is logged too — those are
+    // exactly the runs whose only output a `tail` throws away. Closed in
+    // `finally`, after the verdict line has already read the path.
+    setActiveRunLog(await openRunLog(projectRoot, 'test'));
     try {
         await runTestCommandBody(projectRoot, testPaths, options);
     }
@@ -284,6 +289,9 @@ export async function testCommand(projectRoot, testPaths, options = {}) {
             emitFailVerdict('preflight');
         throw error;
     }
+    finally {
+        await closeActiveRunLog();
+    }
 }
 /**
  * Verifies `engine/` did not change under the run before any PASS verdict
@@ -422,6 +430,7 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
         baseExtraArgs: extraArgs,
         harnessRetries,
         headless: options.headless === true,
+        ...(options.fullOutput === true ? { fullOutput: true } : {}),
         ...(perfSampleEnv ? { env: perfSampleEnv } : {}),
     };
     const postRebuildContext = options.build

package/dist/src/commands/token.js

@@ -35,6 +35,27 @@ async function normalizeTokenNameForProject(projectRoot, rawTokenName) {
     }
     return normalizeTokenName(rawTokenName);
 }
+/**
+ * Reports a no-op add, naming WHERE the existing declaration lives.
+ *
+ * A variant skip has no category to name — the declaration lives in a
+ * `:root<selector>` block — so the location reads as that block. The
+ * variant path used to report no location at all, so a re-run meant to
+ * CHANGE a value exited 0 having silently changed nothing.
+ *
+ * @param tokenName - Full token name including prefix
+ * @param result - Result carrying the skip location, when known
+ * @param options - The invocation's options
+ */
+function reportSkippedToken(tokenName, result, options) {
+    const scope = options.variant !== undefined
+        ? `:root${options.variant}`
+        : `category "${result.skippedExisting?.category ?? options.category ?? ''}"`;
+    const where = result.skippedExisting
+        ? ` in ${scope} (line ${String(result.skippedExisting.line)}), unchanged`
+        : '';
+    info(`Token ${tokenName} already exists${where} (skipped)`);
+}
 /**
  * Adds a design token to the CSS file and documentation.
  *
@@ -68,8 +89,8 @@ export async function tokenAddCommand(projectRoot, tokenName, value, options) {
         await validateTokenAdd(projectRoot, {
             tokenName,
             value,
-            category: options.category,
             mode: options.mode,
+            ...(options.category !== undefined ? { category: options.category } : {}),
             ...(options.description !== undefined ? { description: options.description } : {}),
             ...(options.darkValue !== undefined ? { darkValue: options.darkValue } : {}),
             ...(options.createCategory === true ? { createCategory: true } : {}),
@@ -83,7 +104,7 @@ export async function tokenAddCommand(projectRoot, tokenName, value, options) {
             info(`  Variant: :root${options.variant}`);
         }
         else {
-            info(`  Category: ${options.category}${options.createCategory === true ? ' (created if missing)' : ''}`);
+            info(`  Category: ${options.category ?? '(none)'}${options.createCategory === true ? ' (created if missing)' : ''}`);
         }
         info(`  Mode: ${options.mode}`);
         if (options.description)
@@ -96,24 +117,21 @@ export async function tokenAddCommand(projectRoot, tokenName, value, options) {
     const result = await addToken(projectRoot, {
         tokenName,
         value,
-        category: options.category,
         mode: options.mode,
+        ...(options.category !== undefined ? { category: options.category } : {}),
         ...(options.description !== undefined ? { description: options.description } : {}),
         ...(options.darkValue !== undefined ? { darkValue: options.darkValue } : {}),
         ...(options.createCategory === true ? { createCategory: true } : {}),
         ...(options.variant !== undefined ? { variant: options.variant } : {}),
     });
     if (result.skipped) {
-        const where = result.skippedExisting
-            ? ` in category "${result.skippedExisting.category ?? options.category}" (line ${String(result.skippedExisting.line)})`
-            : '';
-        info(`Token ${tokenName} already exists${where} (skipped)`);
+        reportSkippedToken(tokenName, result, options);
     }
     else {
         const forgeConfig = await loadConfig(projectRoot);
         const tokensCssFile = getTokensCssPath(forgeConfig.binaryName).split('/').pop();
         if (result.categoryCreated)
-            success(`Created category "${options.category}"`);
+            success(`Created category "${options.category ?? ''}"`);
         if (result.cssAdded)
             success(`Added ${tokenName} to ${tokensCssFile}`);
         if (result.docsAdded)
@@ -141,7 +159,9 @@ export function registerToken(program, { getProjectRoot, withErrorHandling }) {
     token
         .command('add <token-name> <value>')
         .description('Add a design token to CSS and documentation. The token name is a positional argument, but most tokens start with `--` (CSS custom property syntax), which Commander reads as an option flag. Use the standard `--` separator to mark the end of options before the token name, e.g. `fireforge token add --mode static --category Colors -- --my-token "#fff"`. Bare names without `--` are accepted directly and prefixed using the configured Furnace `tokenPrefix`.')
-        .requiredOption('--category <cat>', 'Token category (e.g., "Colors — Canvas", "Spacing")')
+        .option('--category <cat>', 'Token category (e.g., "Colors — Canvas", "Spacing"). Required for a base declaration; ' +
+        'not required with --variant, which routes into a :root<selector> block where no ' +
+        'category applies')
         .addOption(
     // Use Commander's .choices() so invalid --mode values are rejected with
     // the built-in "argument must be one of …" message and --help lists the
@@ -161,14 +181,16 @@ export function registerToken(program, { getProjectRoot, withErrorHandling }) {
         .option('--dark-value <val>', 'Dark mode value (required if mode is "override")')
         .option('--variant <selector>', 'Attribute selector fragment routing the declaration into a `:root<selector>` block ' +
         "(e.g. '[data-skin=precision]' or '[data-private]'); creates or updates the block. " +
-        'CSS-only — cannot be combined with --mode override.')
+        'CSS-only — cannot be combined with --mode override or --create-category. To author ' +
+        'a new category and its variants, add the BASE token first (with --create-category), ' +
+        'then add each variant with --variant.')
         .option('--create-category', 'Declare the category banner in the tokens CSS if it does not exist yet')
         .option('--dry-run', 'Show what would be changed without writing')
         .action(withErrorHandling(async (tokenName, value, options) => {
         await tokenAddCommand(getProjectRoot(), tokenName, value, {
-            category: options.category,
             mode: options.mode,
             ...pickDefined({
+                category: options.category,
                 description: options.description,
                 darkValue: options.darkValue,
                 dryRun: options.dryRun,

package/dist/src/core/build-audit-resolve.js

@@ -20,6 +20,7 @@
 import { readdir } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { pathExists } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 /** Maximum directory depth to traverse when scanning a tree root. */
 const MAX_SCAN_DEPTH = 12;
 /**
@@ -54,11 +55,19 @@ export function isTestPath(sourcePath) {
     return false;
 }
 /**
- * Splits a POSIX path into segments, dropping empties.
- * @param path POSIX-separated path
+ * Splits a path into segments, dropping empties.
+ *
+ * Separators are normalized first because the candidates come from `join()`
+ * over a `readdir` walk of the dist tree: on Windows those carry backslashes,
+ * which a `/`-only split collapses into a SINGLE segment. Every candidate then
+ * scores the same, so the trailing-overlap heuristic that disambiguates
+ * same-basename artifacts (`branding/…/aboutDialog.css` versus
+ * `browser/…/aboutDialog.css`) silently picks an arbitrary one.
+ *
+ * @param path Path in either separator style
  */
 function pathSegments(path) {
-    return path.split('/').filter(Boolean);
+    return normalizePathSlashes(path).split('/').filter(Boolean);
 }
 /**
  * Counts how many trailing segments two paths share. Used to score

package/dist/src/core/build-audit.js

@@ -37,6 +37,7 @@ import { readdir, stat } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { pathExists } from '../utils/fs.js';
 import { info, verbose, warn } from '../utils/logger.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { detectPlatformGate } from './build-audit-platform.js';
 import { collectSameBasenameCandidates, findRegisteredTarget, resolveArtifactByRegistration, } from './build-audit-registration.js';
 import { countTrailingSegmentMatches, GENERIC_PATH_SEGMENTS, isTestPath, resolveBestArtifact, } from './build-audit-resolve.js';
@@ -229,8 +230,11 @@ function isConfidentMatch(source, candidate) {
     if (countTrailingSegmentMatches(source, candidate) >= MIN_TRAILING_SEGMENT_OVERLAP) {
         return true;
     }
-    const sourceSegs = source.split('/').filter(Boolean);
-    const candSegs = candidate.split('/').filter(Boolean);
+    // The candidate is an absolute path built by `join` over a dist/ walk, so on
+    // Windows it arrives backslash-separated; a `/`-only split collapses it into
+    // one segment and the non-generic-segment bonus can never fire.
+    const sourceSegs = normalizePathSlashes(source).split('/').filter(Boolean);
+    const candSegs = normalizePathSlashes(candidate).split('/').filter(Boolean);
     const generic = GENERIC_PATH_SEGMENTS;
     // Skip the basename itself (which trail-matches by definition).
     for (let i = 0; i < sourceSegs.length - 1; i += 1) {

package/dist/src/core/config-mutate.js

@@ -18,21 +18,16 @@ function cloneConfigDocument(config) {
     return cloned;
 }
 /**
- * Key segments that would walk into or rewrite the object prototype chain
- * if used as plain property names. Blocked up-front so the descent in
- * {@link mutateConfig} cannot be weaponized to mutate `Object.prototype`
- * process-wide — e.g. `fireforge config __proto__.polluted 1 --force`
- * would otherwise land in `getOrCreateChildRecord(raw, "__proto__")`.
+ * The error every sentinel-segment refusal raises. Only the MESSAGE lives
+ * here: the comparison itself is spelled inline at each write site, because
+ * that is what both a reader and CodeQL's `js/prototype-pollution-utility`
+ * barrier detection need — the latter is not interprocedural, so a check
+ * hidden behind a helper leaves the descent below looking unguarded.
  */
-const SENTINEL_KEY_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
-function assertNoSentinelSegments(key, parts) {
-    for (const part of parts) {
-        if (SENTINEL_KEY_SEGMENTS.has(part)) {
-            throw new ConfigError(`Config key "${key}" contains a reserved segment "${part}". ` +
-                'Segments "__proto__", "constructor", and "prototype" are not permitted ' +
-                'because they would mutate the object prototype chain.');
-        }
-    }
+function sentinelSegmentError(key, part) {
+    return new ConfigError(`Config key "${key}" contains a reserved segment "${part}". ` +
+        'Segments "__proto__", "constructor", and "prototype" are not permitted ' +
+        'because they would mutate the object prototype chain.');
 }
 function getOrCreateChildRecord(parent, key) {
     const existing = parent[key];
@@ -45,21 +40,27 @@ function getOrCreateChildRecord(parent, key) {
 }
 export function mutateConfig(config, key, value, skipValidation = false) {
     const parts = key.split('.');
-    // Reject prototype-chain sentinel segments before any write so
-    // `--force` cannot be used to mutate Object.prototype. This guard must
-    // run against the original key parts, not any subset — the final leaf
-    // assignment `current[lastPart] = value` would otherwise stay vulnerable.
-    assertNoSentinelSegments(key, parts);
     const raw = cloneConfigDocument(config);
+    // Every segment is checked at the point it is USED as a property name —
+    // the descent below and the leaf assignment — rather than once up front,
+    // so `--force` cannot be used to mutate Object.prototype and neither write
+    // can drift out from behind the guard. `raw` is a private clone, so a
+    // refusal here has mutated nothing the caller can observe.
     let current = raw;
     for (let i = 0; i < parts.length - 1; i++) {
         const part = parts[i];
         if (part === undefined)
             continue;
+        if (part === '__proto__' || part === 'constructor' || part === 'prototype') {
+            throw sentinelSegmentError(key, part);
+        }
         current = getOrCreateChildRecord(current, part);
     }
     const lastPart = parts[parts.length - 1];
     if (lastPart !== undefined) {
+        if (lastPart === '__proto__' || lastPart === 'constructor' || lastPart === 'prototype') {
+            throw sentinelSegmentError(key, lastPart);
+        }
         current[lastPart] = value;
     }
     if (!skipValidation) {

package/dist/src/core/furnace-apply-ftl.js

@@ -14,6 +14,7 @@
 import { join, relative } from 'node:path';
 import { toError } from '../utils/errors.js';
 import { copyFile, pathExists, readText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { escapeRegex } from '../utils/regex.js';
 import { resolveFtlChromeSubPath, resolveFtlLocaleJarMnPath } from './furnace-constants.js';
 import { addLocaleFtlJarMnEntry, removeLocaleFtlJarMnEntry } from './furnace-registration.js';
@@ -133,7 +134,9 @@ export async function applyCustomFtlFile(ctx, affectedPaths, stepErrors, rollbac
         await snapshotFile(rollbackJournal, ftlDest);
     }
     await copyFile(ftlSrc, ftlDest);
-    affectedPaths.push(relative(engineDir, ftlDest));
+    // Sibling pushes on this list are POSIX literals (`localeJarRel`); keep
+    // the computed one in the same spelling.
+    affectedPaths.push(normalizePathSlashes(relative(engineDir, ftlDest)));
     const chromeSubPath = resolveFtlChromeSubPath(ftlDir);
     const localeJarRel = resolveFtlLocaleJarMnPath(ftlDir);
     if (chromeSubPath === undefined || localeJarRel === undefined)

package/dist/src/core/furnace-apply-helpers.js

@@ -6,6 +6,7 @@ import { FurnaceError } from '../errors/furnace.js';
 import { toError } from '../utils/errors.js';
 import { copyFile, ensureDir, pathExists, readText, removeFile } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { buildCustomDryRunActions } from './furnace-apply-dry-run.js';
 import { applyCustomFtlFile, applySharedFtlPrune, removeCustomFtlJarMnEntry, } from './furnace-apply-ftl.js';
 import { normalizeForChecksum } from './furnace-checksum-utils.js';
@@ -70,7 +71,12 @@ export function getOverrideEngineTargetPath(engineDir, config, fileName, ftlDir)
  * caller should treat that as a successful no-op rather than an error.
  */
 export async function restoreOverrideFileToBaseline(engineDir, enginePath, journal) {
-    const relPath = relative(engineDir, enginePath);
+    // Engine-relative paths are IDENTIFIERS here, not filesystem arguments:
+    // they are handed to git, recorded in furnace state, and compared against
+    // the POSIX paths furnace.json and jar.mn already carry. `relative()`
+    // returns backslashes on Windows, so without this the same file has two
+    // spellings and every cross-check misses.
+    const relPath = normalizePathSlashes(relative(engineDir, enginePath));
     // Snapshot before mutation so a later rollback can undo both restoration
     // (writes whatever content we removed back) and deletion (recreates the
     // file). Snapshotting a missing path records `{ existed: false }`, which
@@ -129,7 +135,7 @@ export async function undeployCustomFiles(engineDir, config, deletedFiles, ftlDi
         }
         if (await pathExists(enginePath)) {
             await removeFile(enginePath);
-            removed.push(relative(engineDir, enginePath));
+            removed.push(normalizePathSlashes(relative(engineDir, enginePath)));
         }
         // When an `.ftl` is deleted from the workspace the corresponding locale
         // jar.mn entry must also be dropped — otherwise the chrome URI points at
@@ -173,7 +179,7 @@ export async function undeployOverrideFiles(engineDir, config, deletedFiles, ftl
     for (const fileName of deletedFiles) {
         const enginePath = getOverrideEngineTargetPath(engineDir, config, fileName, ftlDir);
         const action = await restoreOverrideFileToBaseline(engineDir, enginePath, rollbackJournal);
-        const relPath = relative(engineDir, enginePath);
+        const relPath = normalizePathSlashes(relative(engineDir, enginePath));
         if (action === 'restored')
             restored.push(relPath);
         else if (action === 'removed')
@@ -332,7 +338,7 @@ export async function applyCustomComponent(ctx, config, dryRun = false, rollback
         const src = join(componentDir, entry.name);
         const dest = join(targetDir, entry.name);
         await deployFileWithFragments(src, dest, sharedDir);
-        affectedPaths.push(relative(engineDir, dest));
+        affectedPaths.push(normalizePathSlashes(relative(engineDir, dest)));
         copiedFileNames.push(entry.name);
     }));
     // See buildCustomDryRunActions for the rationale: when `sharedFtl` is set
@@ -425,7 +431,7 @@ export async function applyOverrideComponent(ctx, config, dryRun = false, rollba
         const src = join(componentDir, entry.name);
         const dest = getOverrideEngineTargetPath(engineDir, config, entry.name, ftlDir);
         await copyFile(src, dest);
-        affectedPaths.push(relative(engineDir, dest));
+        affectedPaths.push(normalizePathSlashes(relative(engineDir, dest)));
     }));
     if (affectedPaths.length === 0) {
         throw new FurnaceError(`No matching files found in override directory for "${name}"`, name);

package/dist/src/core/furnace-jsconfig.js

@@ -26,7 +26,7 @@ import { FurnaceError } from '../errors/furnace.js';
 import { toError } from '../utils/errors.js';
 import { pathExists, readText, writeTextIfChanged } from '../utils/fs.js';
 import { info } from '../utils/logger.js';
-import { normalizePathSlashes } from '../utils/paths.js';
+import { isPathInsideRoot, normalizePathSlashes } from '../utils/paths.js';
 import { getFurnacePaths } from './furnace-config.js';
 /** Chrome URL prefix under which registered custom-element files deploy. */
 const CHROME_ELEMENTS_URL_PREFIX = 'chrome://global/content/elements/';
@@ -84,8 +84,10 @@ function isManagedEntry(key, value, jsconfigDir, customDir) {
         return false;
     if (!Array.isArray(value) || value.length !== 1 || typeof value[0] !== 'string')
         return false;
-    const target = resolve(jsconfigDir, value[0]);
-    return target.startsWith(resolve(customDir) + '/') || target === resolve(customDir);
+    // Containment via `relative`, not a string prefix: a hard-coded `'/'`
+    // separator never matches the backslashes `resolve` emits on Windows, which
+    // demoted every managed entry to "unmanaged" there — no pruning, no updates.
+    return isPathInsideRoot(customDir, resolve(jsconfigDir, value[0]));
 }
 /**
  * Reconciles the managed `compilerOptions.paths` entries of the configured

package/dist/src/core/furnace-operation.d.ts

@@ -56,8 +56,16 @@ export interface RunFurnaceMutationOptions {
      */
     dryRun?: boolean;
     /**
-     * Override the default 30s lock timeout. The watch-mode caller may want a
-     * shorter window so an interactive rebuild fails fast instead of stalling.
+     * Override the default 30 s furnace-lock timeout.
+     *
+     * Set from the caller's resolved `--wait-lock` budget, so ONE flag governs
+     * both locks a furnace mutation takes. Before that it was declared and
+     * never passed: `furnace deploy --wait-lock 1800` waited 1800 s for the
+     * engine session lock and then met `.fireforge/furnace.lock` with a fixed
+     * 30 s, which is the worst shape a budget can have — it pays the whole
+     * wait and still refuses. When absent, {@link sessionWaitLockMs} supplies
+     * the session-wide budget so the twelve furnace mutators that declare no
+     * flag are covered too.
      */
     lockTimeoutMs?: number;
     /**
@@ -67,6 +75,21 @@ export interface RunFurnaceMutationOptions {
      */
     skipPendingRepairCheck?: boolean;
 }
+/**
+ * Converts a resolved `--wait-lock` budget in seconds into the
+ * {@link RunFurnaceMutationOptions} slice that applies it to the furnace
+ * lock. Undefined in, empty out — so the caller can spread it
+ * unconditionally without assigning `undefined` under
+ * `exactOptionalPropertyTypes`.
+ *
+ * A helper rather than three inline spreads: the seconds-to-milliseconds
+ * conversion is exactly the kind of thing that gets copied once correctly
+ * and once with the factor dropped.
+ *
+ * @param waitLockSeconds - Resolved budget in seconds, or undefined
+ * @returns `{ lockTimeoutMs }`, or `{}` when no budget applies
+ */
+export declare function waitLockMutationOptions(waitLockSeconds: number | undefined): Pick<RunFurnaceMutationOptions, 'lockTimeoutMs'>;
 /**
  * Returns true while a signal-driven rollback is in progress. The bin entry
  * point uses this as a re-entrancy guard so a user mashing Ctrl+C cannot

package/dist/src/core/furnace-operation.js

@@ -4,12 +4,30 @@ import { FurnaceError } from '../errors/furnace.js';
 import { assert } from '../utils/assert.js';
 import { toError } from '../utils/errors.js';
 import { verbose, warn } from '../utils/logger.js';
+import { sessionWaitLockMs } from '../utils/options.js';
 import { FIREFORGE_DIR } from './config-paths.js';
 import { readLockStatus, releaseLockIfOwned, withFileLock } from './file-lock.js';
 import { loadFurnaceState, updateFurnaceState } from './furnace-config.js';
 import { restoreRollbackJournal, restoreRollbackJournalOrThrow, } from './furnace-rollback.js';
 /** Sidecar lock filename used to serialize concurrent furnace mutations. */
 const FURNACE_LOCK_FILENAME = 'furnace.lock';
+/**
+ * Converts a resolved `--wait-lock` budget in seconds into the
+ * {@link RunFurnaceMutationOptions} slice that applies it to the furnace
+ * lock. Undefined in, empty out — so the caller can spread it
+ * unconditionally without assigning `undefined` under
+ * `exactOptionalPropertyTypes`.
+ *
+ * A helper rather than three inline spreads: the seconds-to-milliseconds
+ * conversion is exactly the kind of thing that gets copied once correctly
+ * and once with the factor dropped.
+ *
+ * @param waitLockSeconds - Resolved budget in seconds, or undefined
+ * @returns `{ lockTimeoutMs }`, or `{}` when no budget applies
+ */
+export function waitLockMutationOptions(waitLockSeconds) {
+    return waitLockSeconds === undefined ? {} : { lockTimeoutMs: waitLockSeconds * 1000 };
+}
 /**
  * Claims the rollback for one operation, or reports that another path
  * already has it.
@@ -338,10 +356,17 @@ export async function runFurnaceMutation(root, kind, body, options = {}) {
     const token = nextOperationToken++;
     const operation = { root, kind, cleanups: [] };
     const lockPath = getFurnaceLockPath(root);
+    // An explicit budget wins; otherwise the session-wide one applies. Naming
+    // the lock in the refusal is load-bearing: a mutation takes two, and a
+    // message that says only "timed out" sends the operator to raise a budget
+    // that was already large enough for the OTHER lock.
+    const timeoutMs = options.lockTimeoutMs ?? sessionWaitLockMs();
     const lockOptions = {
-        ...(options.lockTimeoutMs !== undefined ? { timeoutMs: options.lockTimeoutMs } : {}),
-        onTimeoutMessage: `Timed out waiting for the furnace lock at ${lockPath}. ` +
+        ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+        onTimeoutMessage: `Timed out waiting for the FURNACE lock at ${lockPath} ` +
+            `(this is the second of the two locks a furnace mutation takes; the first is the engine session lock). ` +
             'Another fireforge furnace command may be running. ' +
+            'Raise the budget with --wait-lock <seconds> or FIREFORGE_WAIT_LOCK, which governs both. ' +
             'If no other process is running, remove the stale lock directory and retry.',
         onStaleLockMessage: (ageMs) => `Removing stale furnace lock (age: ${Math.round(ageMs / 1000)}s). ` +
             'A previous fireforge process may have crashed.',

package/dist/src/core/git-base.d.ts

@@ -83,3 +83,17 @@ export declare function chunkPathspecs(paths: string[], budgetBytes?: number): s
  * repositories with hundreds of thousands of files.
  */
 export declare function configureGitPerformance(repoDir: string): Promise<void>;
+/**
+ * Pins the engine repository's line-ending policy to "store and check out
+ * exactly what upstream shipped".
+ *
+ * Git's Windows installer defaults to a global `core.autocrlf=true`, which
+ * rewrites LF to CRLF on checkout and back on staging. FireForge cannot
+ * tolerate that: patch bodies are byte diffs of the working tree, and
+ * `hashObjectBatch` deliberately delegates to git so `.gitattributes` and
+ * `core.autocrlf` DO apply to the hashes `status` compares against. Under the
+ * global default the same tree hashes differently on Windows than everywhere
+ * else, so exported patches and drift detection disagree across machines.
+ * Setting it per-repository leaves the developer's global config alone.
+ */
+export declare function configureGitLineEndings(repoDir: string): Promise<void>;

package/dist/src/core/git-base.js

@@ -120,3 +120,20 @@ export async function configureGitPerformance(repoDir) {
     await git(['config', 'core.fsmonitor', 'false'], repoDir);
     await git(['config', 'feature.manyFiles', 'true'], repoDir);
 }
+/**
+ * Pins the engine repository's line-ending policy to "store and check out
+ * exactly what upstream shipped".
+ *
+ * Git's Windows installer defaults to a global `core.autocrlf=true`, which
+ * rewrites LF to CRLF on checkout and back on staging. FireForge cannot
+ * tolerate that: patch bodies are byte diffs of the working tree, and
+ * `hashObjectBatch` deliberately delegates to git so `.gitattributes` and
+ * `core.autocrlf` DO apply to the hashes `status` compares against. Under the
+ * global default the same tree hashes differently on Windows than everywhere
+ * else, so exported patches and drift detection disagree across machines.
+ * Setting it per-repository leaves the developer's global config alone.
+ */
+export async function configureGitLineEndings(repoDir) {
+    await git(['config', 'core.autocrlf', 'false'], repoDir);
+    await git(['config', 'core.eol', 'lf'], repoDir);
+}

package/dist/src/core/git.js

@@ -9,7 +9,7 @@ import { pathExists, pathExistsStrict, removeFile } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
 import { exec } from '../utils/process.js';
 import { ensureFirefoxIgnorefileCompatibility } from './firefox-ignorefile.js';
-import { chunkPathspecs, configureGitPerformance, ensureGit, git, GIT_ADD_CHUNK_TIMEOUT_ENV_VAR, GIT_ADD_CHUNK_TIMEOUT_MS, GIT_ADD_TIMEOUT_MS, } from './git-base.js';
+import { chunkPathspecs, configureGitLineEndings, configureGitPerformance, ensureGit, git, GIT_ADD_CHUNK_TIMEOUT_ENV_VAR, GIT_ADD_CHUNK_TIMEOUT_MS, GIT_ADD_TIMEOUT_MS, } from './git-base.js';
 import { getWorkingTreeStatus } from './git-status.js';
 // ── Functions that remain in this file ──
 /**
@@ -278,6 +278,7 @@ export async function initRepository(dir, branchName = 'main', options = {}) {
     // Enable performance settings for large trees
     reportProgress('Configuring git performance settings...');
     await configureGitPerformance(dir);
+    await configureGitLineEndings(dir);
     // Add a local-only origin remote so that Firefox's mach bootstrap and
     // build scripts (which shell out to `git remote get-url origin`) don't
     // fail.  Nothing is ever fetched from or pushed to this remote.
@@ -318,6 +319,7 @@ export async function resumeRepository(dir, options = {}) {
     // Ensure performance settings are in place (may not have been set)
     reportProgress('Configuring git performance settings...');
     await configureGitPerformance(dir);
+    await configureGitLineEndings(dir);
     // Clean up any stale index lock left by the killed process
     await cleanupIndexLock(dir);
     // Ensure origin remote exists (may have been added before the interrupt)

package/dist/src/core/mach-known-noise-filter.d.ts

@@ -47,6 +47,23 @@
  * @returns True when the recognized teardown traceback is present
  */
 export declare function hasKnownTeardownNoise(output: string): boolean;
+/**
+ * True when a SINGLE line is the documented teardown family's
+ * `AttributeError`.
+ *
+ * The line-level half of {@link hasKnownTeardownNoise}: the traceback FRAME
+ * lives on a neighbouring line, so a per-line test cannot apply the
+ * two-signal rule by itself. Callers pair this with
+ * `hasKnownTeardownNoise(wholeOutput)` to recover the full recognition —
+ * "this capture carries the incident, and THIS line is its header" — which
+ * keeps the closed attribute allowlist (`stop_time`/`poll_interval`) doing
+ * the same work it does everywhere else. A novel attribute is not this
+ * incident and must stay a candidate failure.
+ *
+ * @param line - A single output line
+ * @returns True when the line is the recognized teardown AttributeError
+ */
+export declare function isKnownTeardownNoiseLine(line: string): boolean;
 /**
  * Shared across the stdout and stderr filter instances of ONE mach run:
  * SUITE_END typically arrives on stdout while the teardown traceback lands

package/dist/src/core/mach-known-noise-filter.js

@@ -70,6 +70,25 @@ function isRecognizedTeardownNoise(block) {
 export function hasKnownTeardownNoise(output) {
     return isRecognizedTeardownNoise(output);
 }
+/**
+ * True when a SINGLE line is the documented teardown family's
+ * `AttributeError`.
+ *
+ * The line-level half of {@link hasKnownTeardownNoise}: the traceback FRAME
+ * lives on a neighbouring line, so a per-line test cannot apply the
+ * two-signal rule by itself. Callers pair this with
+ * `hasKnownTeardownNoise(wholeOutput)` to recover the full recognition —
+ * "this capture carries the incident, and THIS line is its header" — which
+ * keeps the closed attribute allowlist (`stop_time`/`poll_interval`) doing
+ * the same work it does everywhere else. A novel attribute is not this
+ * incident and must stay a candidate failure.
+ *
+ * @param line - A single output line
+ * @returns True when the line is the recognized teardown AttributeError
+ */
+export function isKnownTeardownNoiseLine(line) {
+    return KNOWN_TEARDOWN_ATTRIBUTE_ERROR_PATTERN.test(line);
+}
 /** Fresh per-run context — hand the same instance to both stream filters. */
 export function createTeardownNoiseContext() {
     return { shutdownSeen: false };