@hominis/fireforge 0.44.4 → 0.46.0

package/dist/src/core/patch-transform.d.ts

@@ -18,6 +18,27 @@
  *   binary new-file conflicts as unresolvable rather than auto-resolving.
  */
 export declare function extractNewFileContentFromDiff(diff: string, targetFile?: string): string;
+/**
+ * Projects every TEXT new file a diff creates into a path → content map, for
+ * the cross-patch lint projections that build a synthetic patch-queue entry.
+ *
+ * Binary new files are SKIPPED rather than refused. The map feeds only the
+ * forward-import rule, which scans content for import statements — a binary
+ * blob authors none, so omitting it contributes exactly what including it
+ * would. Refusing instead (which is what
+ * {@link extractNewFileContentFromDiff} correctly does for a caller that
+ * named ONE file) made vendoring a new binary impossible: every projection
+ * site fed it every detected new file, so `export --order`, `re-export
+ * --scan --scan-file`, `patch move-files-into` and `patch split` all died on
+ * a file the export half had just written a valid `GIT binary patch` for.
+ * Nothing is lost by skipping: binary bodies are covered independently by the
+ * `binary-body-not-reconstructable` queue lint, and
+ * `buildPatchQueueContext` already tolerates them for real queue entries.
+ *
+ * One parse for the whole diff, rather than one per new file as the five
+ * call sites previously did.
+ */
+export declare function buildNewFileTextProjection(diff: string): Map<string, string>;
 /**
  * Extracts the complete file content from a "new file" patch.
  * When targetFile is provided, only extracts content for that file
@@ -27,14 +48,6 @@ export declare function extractNewFileContentFromDiff(diff: string, targetFile?:
  * @returns The file content that the patch would create
  */
 export declare function extractNewFileContent(patchPath: string, targetFile?: string): Promise<string>;
-/**
- * Applies a patch's changes to content.
- * @param content - Original content (null for new files)
- * @param patchPath - Path to the patch file
- * @param targetFile - The file path within the patch
- * @returns Modified content
- */
-export declare function applyPatchToContent(content: string | null, patchPath: string, targetFile: string): Promise<string>;
 /**
  * Applies an already-read patch body to content. Batched callers that hold
  * many (patch, file) pairs use this to read each patch body once instead of

package/dist/src/core/patch-transform.js

@@ -27,6 +27,15 @@ export function extractNewFileContentFromDiff(diff, targetFile) {
     if (binary) {
         throw new PatchError(`Cannot extract text content from binary patch section for ${binary.targetPath}`, binary.targetPath);
     }
+    return contentFromSections(sections);
+}
+/**
+ * Walks the added (`+`) lines of already-parsed sections into file content.
+ * Shared by {@link extractNewFileContentFromDiff} and
+ * {@link buildNewFileTextProjection} so the two cannot drift on the empty-file
+ * and no-trailing-newline cases below.
+ */
+function contentFromSections(sections) {
     // An empty new file is a legitimate git diff: `new file mode` with no
     // hunks at all. It must extract as '' — the historical line-walker
     // returned '\n' for it, creating a one-byte file that failed checksum
@@ -51,6 +60,35 @@ export function extractNewFileContentFromDiff(diff, targetFile) {
     const result = contentLines.join('\n');
     return hasNoNewlineMarker ? result : result + '\n';
 }
+/**
+ * Projects every TEXT new file a diff creates into a path → content map, for
+ * the cross-patch lint projections that build a synthetic patch-queue entry.
+ *
+ * Binary new files are SKIPPED rather than refused. The map feeds only the
+ * forward-import rule, which scans content for import statements — a binary
+ * blob authors none, so omitting it contributes exactly what including it
+ * would. Refusing instead (which is what
+ * {@link extractNewFileContentFromDiff} correctly does for a caller that
+ * named ONE file) made vendoring a new binary impossible: every projection
+ * site fed it every detected new file, so `export --order`, `re-export
+ * --scan --scan-file`, `patch move-files-into` and `patch split` all died on
+ * a file the export half had just written a valid `GIT binary patch` for.
+ * Nothing is lost by skipping: binary bodies are covered independently by the
+ * `binary-body-not-reconstructable` queue lint, and
+ * `buildPatchQueueContext` already tolerates them for real queue entries.
+ *
+ * One parse for the whole diff, rather than one per new file as the five
+ * call sites previously did.
+ */
+export function buildNewFileTextProjection(diff) {
+    const newFiles = new Map();
+    for (const section of parseDiffSections(diff)) {
+        if (!section.isNewFile || section.isBinary)
+            continue;
+        newFiles.set(section.targetPath, contentFromSections([section]));
+    }
+    return newFiles;
+}
 /**
  * Extracts the complete file content from a "new file" patch.
  * When targetFile is provided, only extracts content for that file
@@ -63,16 +101,6 @@ export async function extractNewFileContent(patchPath, targetFile) {
     const content = await readText(patchPath);
     return extractNewFileContentFromDiff(content, targetFile);
 }
-/**
- * Applies a patch's changes to content.
- * @param content - Original content (null for new files)
- * @param patchPath - Path to the patch file
- * @param targetFile - The file path within the patch
- * @returns Modified content
- */
-export async function applyPatchToContent(content, patchPath, targetFile) {
-    return applyPatchTextToContent(content, await readText(patchPath), targetFile);
-}
 /**
  * Applies an already-read patch body to content. Batched callers that hold
  * many (patch, file) pairs use this to read each patch body once instead of

package/dist/src/core/process-cpu-time.js

@@ -34,7 +34,7 @@ export async function readProcessCpuSeconds(pid) {
                 '-NoProfile',
                 '-NonInteractive',
                 '-Command',
-                `(Get-Process -Id ${String(pid)} -ErrorAction SilentlyContinue).CPU`,
+                `(Get-Process -Id ${pid} -ErrorAction SilentlyContinue).CPU`,
             ]);
             const seconds = Number.parseFloat(result.stdout.trim());
             return Number.isFinite(seconds) ? seconds : undefined;

package/dist/src/core/rebase-session.d.ts

@@ -52,6 +52,8 @@ export interface RebaseSession {
     /** Index of the next patch to process (resume point). */
     currentIndex: number;
 }
+/** Absolute path of the session file, for messages that must name it. */
+export declare function getRebaseSessionPath(projectRoot: string): string;
 /**
  * Outcome of reading the session file, following the {@link LockOwner}
  * discriminated-union form rather than collapsing three states into `null`.
@@ -74,8 +76,6 @@ export type RebaseSessionRead = {
     valid: false;
     reason: string;
 };
-/** Absolute path of the session file, for messages that must name it. */
-export declare function getRebaseSessionPath(projectRoot: string): string;
 /**
  * Reads the session file, reporting absent, valid, and corrupt as three
  * distinct outcomes. Never throws for a malformed file: `readJson` calls
@@ -90,12 +90,6 @@ export declare function getRebaseSessionPath(projectRoot: string): string;
  * markers.
  */
 export declare function readRebaseSession(projectRoot: string): Promise<RebaseSessionRead>;
-/**
- * Loads an existing rebase session, or returns `null` when none exists or the
- * file on disk is unusable. Callers that must tell those two apart — every
- * command that reports to an operator — should use {@link readRebaseSession}.
- */
-export declare function tryReadRebaseSession(projectRoot: string): Promise<RebaseSession | null>;
 /**
  * Persists a rebase session atomically.
  */

package/dist/src/core/rebase-session.js

@@ -13,7 +13,8 @@ import { getProjectPaths } from './config-paths.js';
 import { createSiblingLockPath, withFileLock } from './file-lock.js';
 // ── Helpers ──
 const SESSION_FILENAME = 'rebase-session.json';
-function sessionPath(projectRoot) {
+/** Absolute path of the session file, for messages that must name it. */
+export function getRebaseSessionPath(projectRoot) {
     return join(getProjectPaths(projectRoot).fireforgeDir, SESSION_FILENAME);
 }
 const REBASE_PATCH_STATUSES = [
@@ -116,10 +117,6 @@ function isValidSession(data) {
         return false;
     return currentIndex >= 0 && currentIndex <= patches.length;
 }
-/** Absolute path of the session file, for messages that must name it. */
-export function getRebaseSessionPath(projectRoot) {
-    return sessionPath(projectRoot);
-}
 /**
  * Reads the session file, reporting absent, valid, and corrupt as three
  * distinct outcomes. Never throws for a malformed file: `readJson` calls
@@ -134,7 +131,7 @@ export function getRebaseSessionPath(projectRoot) {
  * markers.
  */
 export async function readRebaseSession(projectRoot) {
-    const path = sessionPath(projectRoot);
+    const path = getRebaseSessionPath(projectRoot);
     let data;
     try {
         data = await readJson(path);
@@ -159,20 +156,11 @@ export async function readRebaseSession(projectRoot) {
         session: { ...data, patches: data.patches.map(normalizeEntry) },
     };
 }
-/**
- * Loads an existing rebase session, or returns `null` when none exists or the
- * file on disk is unusable. Callers that must tell those two apart — every
- * command that reports to an operator — should use {@link readRebaseSession}.
- */
-export async function tryReadRebaseSession(projectRoot) {
-    const result = await readRebaseSession(projectRoot);
-    return result.present && result.valid ? result.session : null;
-}
 /**
  * Persists a rebase session atomically.
  */
 export async function saveRebaseSession(projectRoot, session) {
-    const path = sessionPath(projectRoot);
+    const path = getRebaseSessionPath(projectRoot);
     await withFileLock(createSiblingLockPath(path, '.rebase-session.lock'), async () => {
         await writeJson(path, session);
     });
@@ -181,7 +169,7 @@ export async function saveRebaseSession(projectRoot, session) {
  * Removes the rebase session file.
  */
 export async function clearRebaseSession(projectRoot) {
-    const path = sessionPath(projectRoot);
+    const path = getRebaseSessionPath(projectRoot);
     if (await pathExists(path)) {
         await removeFile(path);
     }

package/dist/src/core/register-browser-content.js

@@ -5,6 +5,7 @@
 import { join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { insertJarMnEntry } from './moz-manifest-helpers.js';
 /**
  * Tokenizer-based implementation for browser content registration.
@@ -30,8 +31,8 @@ export async function registerBrowserContent(engineDir, fileName, after, sourceP
     if (!(await pathExists(manifestPath))) {
         throw new GeneralError(`Manifest not found: ${manifest}`);
     }
-    const source = (sourcePath ?? `content/${fileName}`).replace(/\\/g, '/');
-    const entry = `        content/browser/${fileName}    (${source})`.replace(/\\/g, '/');
+    const source = normalizePathSlashes(sourcePath ?? `content/${fileName}`);
+    const entry = normalizePathSlashes(`        content/browser/${fileName}    (${source})`);
     const content = await readText(manifestPath);
     // Idempotency check
     if (content.includes(`content/browser/${fileName}`)) {

package/dist/src/core/register-browser-test.js

@@ -5,6 +5,7 @@
 import { join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { insertMozBuildListEntry } from './moz-manifest-helpers.js';
 /**
  * Tokenizer-based implementation for test manifest registration.
@@ -28,7 +29,7 @@ export async function registerTestManifest(engineDir, testDir, dryRun = false) {
     if (!(await pathExists(manifestPath))) {
         throw new GeneralError(`Manifest not found: ${manifest}`);
     }
-    const entry = `    "content/test/${testDir}/browser.toml",`.replace(/\\/g, '/');
+    const entry = normalizePathSlashes(`    "content/test/${testDir}/browser.toml",`);
     const content = await readText(manifestPath);
     // Idempotency check
     if (content.includes(`content/test/${testDir}/browser.toml`)) {

package/dist/src/core/register-module.js

@@ -5,6 +5,7 @@
 import { join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { insertMozBuildListEntry } from './moz-manifest-helpers.js';
 import { scaffoldModuleMozBuild } from './register-scaffold.js';
 /**
@@ -41,7 +42,7 @@ export async function registerFireForgeModule(engineDir, fileName, moduleDir, dr
         }
         throw new GeneralError(`Manifest not found: ${manifest}. Pass --create-manifest to scaffold it and wire the parent DIRS entry.`);
     }
-    const entry = `    "${fileName}",`.replace(/\\/g, '/');
+    const entry = normalizePathSlashes(`    "${fileName}",`);
     const content = await readText(manifestPath);
     // Idempotency check
     if (content.includes(`"${fileName}"`)) {

package/dist/src/core/register-scaffold.js

@@ -19,6 +19,7 @@
 import { dirname, join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { getLicenseHeader } from './license-headers.js';
 import { findAlphabeticalMozBuildPosition } from './moz-manifest-helpers.js';
 import { tokenizeMozBuildList } from './moz-manifest-tokenizers.js';
@@ -64,7 +65,7 @@ export function upsertMozBuildListEntry(content, directive, value) {
 export async function ensureParentDirsWiring(engineDir, childRelDir, dryRun) {
     const actions = [];
     let childName = childRelDir.split('/').at(-1) ?? childRelDir;
-    let parentRel = dirname(childRelDir).replace(/\\/g, '/');
+    let parentRel = normalizePathSlashes(dirname(childRelDir));
     for (;;) {
         if (parentRel === '.' || parentRel === '' || parentRel === '/') {
             throw new GeneralError(`No moz.build found in any parent of ${childRelDir} up to the engine root; ` +
@@ -90,7 +91,7 @@ export async function ensureParentDirsWiring(engineDir, childRelDir, dryRun) {
             await writeText(parentManifestPath, scaffold);
         actions.push({ manifest: parentManifestRel, change: `created with DIRS += ["${childName}"]` });
         childName = parentRel.split('/').at(-1) ?? parentRel;
-        parentRel = dirname(parentRel).replace(/\\/g, '/');
+        parentRel = normalizePathSlashes(dirname(parentRel));
     }
 }
 /**
@@ -122,7 +123,7 @@ export async function scaffoldModuleMozBuild(engineDir, moduleDir, fileName, dry
  * entry already exists).
  */
 export async function ensureXpcshellManifestWiring(engineDir, manifestRelPath, dryRun) {
-    let dirRel = dirname(manifestRelPath).replace(/\\/g, '/');
+    let dirRel = normalizePathSlashes(dirname(manifestRelPath));
     for (;;) {
         if (dirRel === '.' || dirRel === '' || dirRel === '/') {
             throw new GeneralError(`No moz.build found in any parent of ${manifestRelPath} up to the engine root; ` +
@@ -140,6 +141,6 @@ export async function ensureXpcshellManifestWiring(engineDir, manifestRelPath, d
                 await writeText(mozBuildPath, updated);
             return [{ manifest: mozBuildRel, change: `XPCSHELL_TESTS_MANIFESTS += ["${relEntry}"]` }];
         }
-        dirRel = dirname(dirRel).replace(/\\/g, '/');
+        dirRel = normalizePathSlashes(dirname(dirRel));
     }
 }

package/dist/src/core/register-shared-css.js

@@ -5,6 +5,7 @@
 import { basename, join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { insertJarMnEntry } from './moz-manifest-helpers.js';
 /**
  * Tokenizer-based implementation for shared CSS registration.
@@ -65,7 +66,7 @@ export function buildEntry(name, sourceColumn) {
     const minColumn = target.length + MIN_SOURCE_GAP;
     const column = sourceColumn !== undefined && sourceColumn >= minColumn ? sourceColumn : minColumn;
     const padding = ' '.repeat(column - target.length);
-    return `${target}${padding}(../shared/${name}.css)`.replace(/\\/g, '/');
+    return normalizePathSlashes(`${target}${padding}(../shared/${name}.css)`);
 }
 /**
  * Registers a CSS file in browser/themes/shared/jar.inc.mn.

package/dist/src/core/run-log-redact.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Conservative secret redaction for the run-log FILE tee.
+ *
+ * A run log is a complete copy of mach's output, and mach echoes its
+ * environment in places (configure summaries, `mach env`, harness
+ * diagnostics that print the command line). The terminal already showed
+ * every byte to the operator who ran it; the file, by contrast, is retained
+ * twenty deep and gets attached to bug reports. So the file gets a narrow
+ * masking pass and the terminal does not.
+ *
+ * Deliberately minimal and pattern-based — see {@link redactRunLogText} for
+ * the exact contract. It is a seatbelt against the common accidental leak,
+ * not a guarantee that a log is free of secrets.
+ */
+/**
+ * Masks the obvious secret shapes in run-log text, line by line.
+ *
+ * Redacted:
+ * - the value of an env-style assignment `KEY=value` whose KEY matches
+ *   `/(TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|AUTH)/i` — the value up to the
+ *   next whitespace, or a whole quoted string — becomes `KEY=<redacted>`;
+ *   the `--flag=value` and `-DNAME=value` spellings of the same shape are
+ *   covered (`--password=x` → `--password=<redacted>`);
+ * - the credential of an `Authorization:` header (`Bearer`, `Basic` and
+ *   `Token` schemes keep the scheme word; anything else masks the whole
+ *   value).
+ *
+ * NOT redacted: secrets that appear without one of those key names or
+ * headers (a bare token in a URL query string, a space-separated
+ * `--password foo` CLI argument, JSON `"token": "..."` fields, cookies).
+ * Line structure and every other byte pass through unchanged; `\n`, `\r\n`
+ * and lone `\r` all delimit lines, so carriage-return-repainted progress
+ * output is masked per repaint.
+ *
+ * @param text - One or more complete lines
+ * @returns The same text with masked values
+ */
+export declare function redactRunLogText(text: string): string;

package/dist/src/core/run-log-redact.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Conservative secret redaction for the run-log FILE tee.
+ *
+ * A run log is a complete copy of mach's output, and mach echoes its
+ * environment in places (configure summaries, `mach env`, harness
+ * diagnostics that print the command line). The terminal already showed
+ * every byte to the operator who ran it; the file, by contrast, is retained
+ * twenty deep and gets attached to bug reports. So the file gets a narrow
+ * masking pass and the terminal does not.
+ *
+ * Deliberately minimal and pattern-based — see {@link redactRunLogText} for
+ * the exact contract. It is a seatbelt against the common accidental leak,
+ * not a guarantee that a log is free of secrets.
+ */
+/** Env-style keys whose assigned value is masked. */
+const SECRET_KEY_PATTERN = /(TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|AUTH)/i;
+/**
+ * `KEY=value` where KEY is an identifier and the value runs to the next
+ * whitespace, or is a single/double-quoted string. The leading group keeps
+ * the assignment anchored at a token boundary so `x.y=z` is not split
+ * mid-token. A hyphen IS a boundary: mach and configure echo their argv, so
+ * `--token=…`, `--password=…` and `-DAUTH_TOKEN=…` are exactly the forms a
+ * retained log would otherwise carry verbatim (the lead keeps the dash; the
+ * key is what follows it). Empty values are left alone (nothing to hide).
+ */
+const ENV_ASSIGNMENT_PATTERN = /(^|[\s"'([{,;-])([A-Za-z_][A-Za-z0-9_]*)=("(?:[^"\\]|\\.)*"|'[^']*'|[^\s"',;)\]}]+)/g;
+/** `Authorization: <scheme> <credential>` (scheme optional) in HTTP dumps. */
+const AUTHORIZATION_HEADER_PATTERN = /(authorization\s*:\s*)(?:(bearer|basic|token)\s+)?(\S+)/gi;
+/** Marker written in place of a masked value. */
+const REDACTED = '<redacted>';
+function redactLine(line) {
+    return line
+        .replace(ENV_ASSIGNMENT_PATTERN, (whole, lead, key) => SECRET_KEY_PATTERN.test(key) ? `${lead}${key}=${REDACTED}` : whole)
+        .replace(AUTHORIZATION_HEADER_PATTERN, (_whole, lead, scheme) => scheme === undefined ? `${lead}${REDACTED}` : `${lead}${scheme} ${REDACTED}`);
+}
+/**
+ * Masks the obvious secret shapes in run-log text, line by line.
+ *
+ * Redacted:
+ * - the value of an env-style assignment `KEY=value` whose KEY matches
+ *   `/(TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|AUTH)/i` — the value up to the
+ *   next whitespace, or a whole quoted string — becomes `KEY=<redacted>`;
+ *   the `--flag=value` and `-DNAME=value` spellings of the same shape are
+ *   covered (`--password=x` → `--password=<redacted>`);
+ * - the credential of an `Authorization:` header (`Bearer`, `Basic` and
+ *   `Token` schemes keep the scheme word; anything else masks the whole
+ *   value).
+ *
+ * NOT redacted: secrets that appear without one of those key names or
+ * headers (a bare token in a URL query string, a space-separated
+ * `--password foo` CLI argument, JSON `"token": "..."` fields, cookies).
+ * Line structure and every other byte pass through unchanged; `\n`, `\r\n`
+ * and lone `\r` all delimit lines, so carriage-return-repainted progress
+ * output is masked per repaint.
+ *
+ * @param text - One or more complete lines
+ * @returns The same text with masked values
+ */
+export function redactRunLogText(text) {
+    if (text.length === 0)
+        return text;
+    // Split with a capturing group so the terminators survive the round trip;
+    // odd indices are the terminators themselves.
+    return text
+        .split(/(\r\n|\n|\r)/)
+        .map((part, index) => (index % 2 === 0 ? redactLine(part) : part))
+        .join('');
+}

package/dist/src/core/run-log.d.ts

@@ -22,7 +22,11 @@
 export interface RunLog {
     /** Absolute path to the log file. */
     path: string;
-    /** Appends raw output. Silently drops on any stream error. */
+    /**
+     * Appends output. Complete lines pass through {@link redactRunLogText}
+     * before hitting disk; a trailing partial line is held until its newline
+     * arrives (or until `close`). Silently drops on any stream error.
+     */
     write: (chunk: string) => void;
     /** Flushes and closes. Resolves even when the stream already failed. */
     close: () => Promise<void>;
@@ -45,7 +49,14 @@ export declare function setActiveRunLog(log: RunLog | undefined): void;
 export declare function getActiveRunLogPath(): string | undefined;
 /** Appends to the active run log. A no-op when none is open. */
 export declare function writeToActiveRunLog(chunk: string): void;
-/** Closes and clears the active run log. Resolves even when none is open. */
+/**
+ * Closes and clears the active run log. Resolves even when none is open.
+ *
+ * Also called from the entry point's SIGINT/SIGTERM path: the held partial
+ * line and anything queued in the stream would otherwise be lost across
+ * `process.exit`, and a killed run's last line is usually the one that
+ * says what it was doing.
+ */
 export declare function closeActiveRunLog(): Promise<void>;
 /**
  * A writable that forwards to `base` AND to the active run log.

package/dist/src/core/run-log.js

@@ -23,8 +23,11 @@ import { createWriteStream } from 'node:fs';
 import { mkdir, readdir, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
 import { Writable } from 'node:stream';
+import { toError } from '../utils/errors.js';
 import { verbose } from '../utils/logger.js';
 import { FIREFORGE_DIR } from './config-paths.js';
+import { redactRunLogText } from './run-log-redact.js';
+import { fileSafeTimestamp } from './state-file.js';
 /** Directory under `.fireforge/` holding run logs. */
 const LOGS_DIRNAME = 'logs';
 /**
@@ -33,20 +36,34 @@ const LOGS_DIRNAME = 'logs';
  * most often needs to read together.
  */
 const RETAINED_LOGS_PER_COMMAND = 20;
+/**
+ * Cap on the partial line held back between writes. A child emitting one
+ * enormous unterminated line (a minified dump on stderr) would otherwise
+ * grow the buffer without bound — and, because each write rebuilds
+ * `pending + chunk`, quadratically — with nothing reaching disk until
+ * close. Past the cap the tail is redacted and written as-is; a `KEY=value`
+ * split exactly at the cap boundary is the accepted cost. Same figure as
+ * `line-dispatch.ts` uses for the stream matchers.
+ */
+const MAX_PENDING_LINE_SIZE = 1024 * 1024;
+/**
+ * Index just past the last line terminator in `text`, or -1 when there is
+ * none. `\n` and lone `\r` both terminate — progress-bar output (mach,
+ * cargo) repaints a line with carriage returns and may never send a
+ * newline, which would otherwise pin the whole run in `pending`. A single
+ * trailing `\r` is NOT a terminator yet: it may be the first half of a
+ * `\r\n` split across chunks.
+ */
+function lastLineEnd(text) {
+    const lastNewline = text.lastIndexOf('\n');
+    const lastReturn = text.lastIndexOf('\r');
+    const cut = lastReturn > lastNewline && lastReturn < text.length - 1 ? lastReturn : lastNewline;
+    return cut === -1 ? -1 : cut + 1;
+}
 /** `.fireforge/logs` under `projectRoot`. */
 export function getRunLogDir(projectRoot) {
     return join(projectRoot, FIREFORGE_DIR, LOGS_DIRNAME);
 }
-/**
- * A filesystem-safe, sortable timestamp: `2026-08-28T14-32-05-123Z`.
- *
- * Colons are not portable in filenames (Windows rejects them outright), so
- * the ISO form is punctuated with dashes only. Lexical order still equals
- * chronological order, which is what the pruning below relies on.
- */
-function logTimestamp(now) {
-    return now.toISOString().replace(/[:.]/g, '-');
-}
 /**
  * Makes room for one new log by deleting the oldest, so that at most
  * {@link RETAINED_LOGS_PER_COMMAND} logs for `command` exist once the new
@@ -76,7 +93,7 @@ async function pruneRunLogs(dir, command) {
         }));
     }
     catch (error) {
-        verbose(`Run-log pruning skipped: ${String(error)}`);
+        verbose(`Run-log pruning skipped: ${toError(error).message}`);
     }
 }
 /**
@@ -91,14 +108,14 @@ async function pruneRunLogs(dir, command) {
 export async function openRunLog(projectRoot, command, now = new Date()) {
     const dir = getRunLogDir(projectRoot);
     let stream;
-    const path = join(dir, `${command}-${logTimestamp(now)}.log`);
+    const path = join(dir, `${command}-${fileSafeTimestamp(now)}.log`);
     try {
         await mkdir(dir, { recursive: true });
         await pruneRunLogs(dir, command);
         stream = createWriteStream(path, { flags: 'a' });
     }
     catch (error) {
-        verbose(`Run log unavailable (${path}): ${String(error)}`);
+        verbose(`Run log unavailable (${path}): ${toError(error).message}`);
         return undefined;
     }
     // A stream error after open (disk full, a removed directory) must not
@@ -109,19 +126,44 @@ export async function openRunLog(projectRoot, command, now = new Date()) {
         broken = true;
         verbose(`Run log write failed (${path}): ${error.message}`);
     });
+    // Redaction is per LINE, and chunks arrive at arbitrary byte boundaries,
+    // so a `KEY=value` split across two chunks would slip past a per-chunk
+    // pass. Hold the trailing partial line until its terminator arrives (or
+    // it outgrows MAX_PENDING_LINE_SIZE, or the log is closed).
+    let pending = '';
+    const emit = (text) => {
+        if (broken || text.length === 0)
+            return;
+        try {
+            stream.write(redactRunLogText(text));
+        }
+        catch {
+            broken = true;
+        }
+    };
     return {
         path,
         write: (chunk) => {
             if (broken)
                 return;
-            try {
-                stream.write(chunk);
+            const buffered = pending + chunk;
+            const lineEnd = lastLineEnd(buffered);
+            if (lineEnd === -1) {
+                pending = buffered;
             }
-            catch {
-                broken = true;
+            else {
+                pending = buffered.slice(lineEnd);
+                emit(buffered.slice(0, lineEnd));
+            }
+            if (pending.length > MAX_PENDING_LINE_SIZE) {
+                emit(pending);
+                pending = '';
             }
         },
         close: async () => {
+            const tail = pending;
+            pending = '';
+            emit(tail);
             await new Promise((resolve) => {
                 stream.end(() => {
                     resolve();
@@ -155,7 +197,14 @@ export function getActiveRunLogPath() {
 export function writeToActiveRunLog(chunk) {
     activeRunLog?.write(chunk);
 }
-/** Closes and clears the active run log. Resolves even when none is open. */
+/**
+ * Closes and clears the active run log. Resolves even when none is open.
+ *
+ * Also called from the entry point's SIGINT/SIGTERM path: the held partial
+ * line and anything queued in the stream would otherwise be lost across
+ * `process.exit`, and a killed run's last line is usually the one that
+ * says what it was doing.
+ */
 export async function closeActiveRunLog() {
     const log = activeRunLog;
     activeRunLog = undefined;

package/dist/src/core/signal-critical.js

@@ -18,6 +18,7 @@
  * itself. The bin entry point is responsible for awaiting
  * `waitForActiveCriticalSections` before terminating.
  */
+import { sleep } from '../utils/sleep.js';
 const activeSections = new Set();
 /**
  * Runs `fn` inside a signal-deferred critical section. The CLI entry point's
@@ -57,8 +58,5 @@ export async function waitForActiveCriticalSections(timeoutMs) {
     if (activeSections.size === 0)
         return;
     const snapshot = [...activeSections].map((s) => s.promise);
-    await Promise.race([
-        Promise.allSettled(snapshot).then(() => undefined),
-        new Promise((resolve) => setTimeout(resolve, timeoutMs)),
-    ]);
+    await Promise.race([Promise.allSettled(snapshot).then(() => undefined), sleep(timeoutMs)]);
 }

package/dist/src/core/smoke-patterns.d.ts

@@ -10,7 +10,6 @@
  * warning (e.g. `"pending JavaScript error cleanup"`) do not start with
  * the prefix and should not trip the scanner.
  */
-export declare const SMOKE_ERROR_PATTERNS: readonly RegExp[];
 /**
  * Returns `true` when `line` matches any pattern in
  * {@link SMOKE_ERROR_PATTERNS}. Does not consult the allowlist — that step