@hominis/fireforge 0.45.0 → 0.46.0

package/dist/src/core/patch-lock.js

@@ -16,12 +16,12 @@ const PATCH_DIRECTORY_LOCK = '.fireforge-patches.lock';
  * session lock's progress line so operators read one shape for both locks.
  */
 function formatWaitProgressLine(waitedMs, timeoutMs, holder) {
-    const progress = `${String(Math.round(waitedMs / 1000))}s of up to ${String(Math.round(timeoutMs / 1000))}s`;
+    const progress = `${Math.round(waitedMs / 1000)}s of up to ${Math.round(timeoutMs / 1000)}s`;
     if (holder === undefined) {
         return `Waiting for the FireForge patch directory lock — ${progress}.`;
     }
     const details = holder.metadata.length > 0 ? ` (${holder.metadata.join(', ')})` : '';
-    return `Waiting for the FireForge patch directory lock held by PID ${String(holder.pid)}${details} — ${progress}.`;
+    return `Waiting for the FireForge patch directory lock held by PID ${holder.pid}${details} — ${progress}.`;
 }
 /**
  * Asserts that this process is inside {@link withPatchDirectoryLock} for the
@@ -47,7 +47,7 @@ export async function assertPatchDirectoryLockHeld(patchesDir, context) {
     const status = await readLockStatus(join(patchesDir, PATCH_DIRECTORY_LOCK));
     assert(status.held, () => `patch directory lock is held before ${context}`);
     assert(status.holder === undefined || status.holder.pid === process.pid, () => `patch directory lock is owned by this process before ${context} ` +
-        `(held by PID ${String(status.holder?.pid)}, we are ${String(process.pid)})`);
+        `(held by PID ${status.holder?.pid}, we are ${process.pid})`);
 }
 /**
  * Runs a patch directory mutation while holding an exclusive filesystem lock.

package/dist/src/core/patch-manifest-io.js

@@ -98,17 +98,18 @@ export async function mutatePatchRowsInManifest(patchesDir, filenames, mutator)
     if (!(await pathExistsStrict(manifestPath)))
         return null;
     const rawManifest = await readJson(manifestPath);
+    // `validatePatchesManifest` has already rejected a manifest that is not an
+    // object with an array of object rows (it throws the corruption error the
+    // caller expects), so the shape re-checks below are FireForge's own
+    // invariants, not input validation: failing them means the validator and
+    // this walker disagree about the manifest schema, which is a bug here.
     const beforeManifest = validatePatchesManifest(rawManifest);
-    if (!isObject(rawManifest) || !isArray(rawManifest['patches'])) {
-        throw new Error('patches.json must be a JSON object with a patches array');
-    }
+    assert(isObject(rawManifest) && isArray(rawManifest['patches']), 'validated patches.json is a JSON object with a patches array');
     const filenameSet = new Set(filenames);
     if (filenameSet.size === 0)
         return [];
-    const rawPatches = rawManifest['patches'].map((entry) => {
-        if (!isObject(entry)) {
-            throw new Error('patches.json patches entries must be objects');
-        }
+    const rawPatches = rawManifest['patches'].map((entry, index) => {
+        assert(isObject(entry), () => `validated patches.json row ${index} is an object`);
         return { ...entry };
     });
     const changedIndexes = [];

package/dist/src/core/patch-parse.d.ts

@@ -1,14 +1,25 @@
 /**
- * Pure parsing functions for extracting information from patch files. All
- * functions are synchronous and operate on string content.
+ * Renders a patch order as the zero-padded prefix used in filenames and in
+ * every message that names an order.
  *
- * This module is the ONE unified-diff walker in the codebase. Hand-rolled
- * `diff --git` walkers diverge in ways that matter: CRLF handling (a
- * CRLF-saved patch file silently fails target-file matching and
- * `\ No newline` detection on Windows), quoted-path support, and greedy path
- * captures that mis-split any path containing ` b/`. New diff-shaped parsing
- * must build on {@link parseDiffSections} rather than re-walking lines.
+ * Eleven call sites across `patch-policy`, `patch-export`, `export-flow`,
+ * `export-placement-policy` and `patch move-files` spelled this as
+ * `String(order).padStart(3, '0')`, so the padding width lived in eleven
+ * places while the filenames it has to agree with are produced in one.
+ * @param order - Numeric patch order.
+ * @param width - Prefix width; defaults to the on-disk convention.
+ * @returns The zero-padded order, e.g. `007`.
  */
+export declare function formatPatchOrder(order: number, width?: number): string;
+/**
+ * Renders an inclusive order range the way `patchPolicy` diagnostics name it.
+ * @param range - Inclusive `from`/`to` order bounds.
+ * @returns The range label, e.g. `100-199`.
+ */
+export declare function formatOrderRange(range: {
+    from: number;
+    to: number;
+}): string;
 /**
  * Extracts the order number from a patch filename.
  * Expects format like "001-description.patch"

package/dist/src/core/patch-parse.js

@@ -11,6 +11,31 @@ import { assert } from '../utils/assert.js';
  * captures that mis-split any path containing ` b/`. New diff-shaped parsing
  * must build on {@link parseDiffSections} rather than re-walking lines.
  */
+/** Width of the zero-padded numeric prefix on a patch filename ("001-…"). */
+const PATCH_ORDER_WIDTH = 3;
+/**
+ * Renders a patch order as the zero-padded prefix used in filenames and in
+ * every message that names an order.
+ *
+ * Eleven call sites across `patch-policy`, `patch-export`, `export-flow`,
+ * `export-placement-policy` and `patch move-files` spelled this as
+ * `String(order).padStart(3, '0')`, so the padding width lived in eleven
+ * places while the filenames it has to agree with are produced in one.
+ * @param order - Numeric patch order.
+ * @param width - Prefix width; defaults to the on-disk convention.
+ * @returns The zero-padded order, e.g. `007`.
+ */
+export function formatPatchOrder(order, width = PATCH_ORDER_WIDTH) {
+    return String(order).padStart(width, '0');
+}
+/**
+ * Renders an inclusive order range the way `patchPolicy` diagnostics name it.
+ * @param range - Inclusive `from`/`to` order bounds.
+ * @returns The range label, e.g. `100-199`.
+ */
+export function formatOrderRange(range) {
+    return `${formatPatchOrder(range.from)}-${formatPatchOrder(range.to)}`;
+}
 /**
  * Extracts the order number from a patch filename.
  * Expects format like "001-description.patch"

package/dist/src/core/patch-policy.js

@@ -11,6 +11,7 @@ import { InvalidArgumentError } from '../errors/base.js';
 import { warn } from '../utils/logger.js';
 import { PATCH_CATEGORIES } from '../utils/validation.js';
 import { rewriteStagedDependencyOwners } from './patch-manifest-io.js';
+import { formatOrderRange, formatPatchOrder } from './patch-parse.js';
 /** Default patch filename contract used when a policy omits `filenamePattern`. */
 const DEFAULT_PATCH_POLICY_FILENAME_PATTERN = '^(?<order>\\d{3})-(?<category>[a-z][a-z0-9-]*)-(?<slug>[a-z0-9-]+)\\.patch$';
 function policy(config) {
@@ -19,13 +20,6 @@ function policy(config) {
 function mutationMode(config) {
     return policy(config)?.mutationMode ?? 'error';
 }
-function issueSeverity(config) {
-    return mutationMode(config) === 'warn' ? 'warning' : 'error';
-}
-/** Returns true when the loaded config includes an opt-in patch policy. */
-function hasPatchPolicy(config) {
-    return policy(config) !== undefined;
-}
 /** Returns valid categories for prompts and CLI validation under the config. */
 export function getPatchPolicyCategories(config) {
     const cfg = policy(config);
@@ -42,9 +36,6 @@ export function isCategoryAllowedByConfig(config, category) {
         return PATCH_CATEGORIES.includes(category);
     return cfg.ranges.some((range) => range.category === category);
 }
-function rangeLabel(range) {
-    return `${String(range.from).padStart(3, '0')}-${String(range.to).padStart(3, '0')}`;
-}
 /**
  * Human-readable label for a category's configured ranges, e.g. `300-399`.
  * Exported for the forward-import hint, which must render the
@@ -54,7 +45,7 @@ export function categoryRangeLabel(ranges, category) {
     const matches = ranges.filter((range) => range.category === category);
     if (matches.length === 0)
         return '(no configured range)';
-    return matches.map(rangeLabel).join(', ');
+    return matches.map(formatOrderRange).join(', ');
 }
 function reservedRangeForOrder(cfg, order) {
     return cfg.reservedRanges?.find((range) => order >= range.from && order <= range.to) ?? null;
@@ -73,9 +64,6 @@ export function categoryRangeForOrder(cfg, category, order) {
 function anyRangeForOrder(cfg, order) {
     return cfg.ranges.find((range) => order >= range.from && order <= range.to) ?? null;
 }
-function compileFilenamePattern(cfg) {
-    return new RegExp(cfg.filenamePattern ?? DEFAULT_PATCH_POLICY_FILENAME_PATTERN);
-}
 function parseFilenameWithPolicy(cfg, patch, severity) {
     if (cfg.filenamePattern === undefined) {
         const defaultMatch = /^(?<order>\d{3})-(?<rest>[a-z0-9-]+)\.patch$/.exec(patch.filename);
@@ -117,7 +105,7 @@ function parseFilenameWithPolicy(cfg, patch, severity) {
         }
         return { order: Number.parseInt(orderRaw, 10), category };
     }
-    const pattern = compileFilenamePattern(cfg);
+    const pattern = new RegExp(cfg.filenamePattern ?? DEFAULT_PATCH_POLICY_FILENAME_PATTERN);
     const match = pattern.exec(patch.filename);
     if (!match) {
         return [
@@ -188,7 +176,7 @@ function evaluatePatchMetadata(cfg, patch, severity) {
                 code: 'reserved-range',
                 filename: patch.filename,
                 severity,
-                message: `${patch.filename} is in reserved range ${rangeLabel(reserved)}. ` +
+                message: `${patch.filename} is in reserved range ${formatOrderRange(reserved)}. ` +
                     'Reserved ranges require an exact patchPolicy.reservedRanges[].allowed filename exception.',
             });
             return issues;
@@ -198,7 +186,7 @@ function evaluatePatchMetadata(cfg, patch, severity) {
                 code: 'reserved-documentation',
                 filename: patch.filename,
                 severity,
-                message: `${patch.filename} is allowlisted for reserved range ${rangeLabel(reserved)}, ` +
+                message: `${patch.filename} is allowlisted for reserved range ${formatOrderRange(reserved)}, ` +
                     'but the allowlist entry must include either "adr" or "documentation".',
             });
         }
@@ -210,7 +198,7 @@ function evaluatePatchMetadata(cfg, patch, severity) {
                     code: 'reserved-files',
                     filename: patch.filename,
                     severity,
-                    message: `${patch.filename} is allowlisted for reserved range ${rangeLabel(reserved)}, ` +
+                    message: `${patch.filename} is allowlisted for reserved range ${formatOrderRange(reserved)}, ` +
                         `but touches file(s) outside its reserved allowlist: ${extraFiles.join(', ')}.`,
                 });
             }
@@ -222,8 +210,8 @@ function evaluatePatchMetadata(cfg, patch, severity) {
         const owner = anyRangeForOrder(cfg, patch.order);
         const expected = categoryRangeLabel(cfg.ranges, patch.category);
         const actual = owner !== null
-            ? `${String(patch.order).padStart(3, '0')} is configured for ${owner.category} (${rangeLabel(owner)})`
-            : `${String(patch.order).padStart(3, '0')} is outside all configured ranges`;
+            ? `${formatPatchOrder(patch.order)} is configured for ${owner.category} (${formatOrderRange(owner)})`
+            : `${formatPatchOrder(patch.order)} is outside all configured ranges`;
         issues.push({
             code: 'category-range',
             filename: patch.filename,
@@ -262,10 +250,10 @@ function evaluateGaps(cfg, patches, severity) {
         if (missing.length > 0) {
             issues.push({
                 code: 'numeric-gap',
-                filename: `${range.category}:${rangeLabel(range)}`,
+                filename: `${range.category}:${formatOrderRange(range)}`,
                 severity,
-                message: `${range.category} range ${rangeLabel(range)} has numeric gap(s): ` +
-                    missing.map((order) => String(order).padStart(3, '0')).join(', ') +
+                message: `${range.category} range ${formatOrderRange(range)} has numeric gap(s): ` +
+                    missing.map((order) => formatPatchOrder(order)).join(', ') +
                     '. patchPolicy.allowGaps is false.',
             });
         }
@@ -286,9 +274,9 @@ function evaluateOrderCollisions(patches, severity) {
         const filenames = matches.map((patch) => patch.filename).sort((a, b) => a.localeCompare(b));
         issues.push({
             code: 'order-collision',
-            filename: String(order).padStart(3, '0'),
+            filename: formatPatchOrder(order),
             severity,
-            message: `patchPolicy requires unique numeric orders; order ${String(order).padStart(3, '0')} ` +
+            message: `patchPolicy requires unique numeric orders; order ${formatPatchOrder(order)} ` +
                 `is used by: ${filenames.join(', ')}.`,
         });
     }
@@ -299,7 +287,7 @@ export function evaluatePatchPolicy(config, manifest) {
     const cfg = policy(config);
     if (!cfg)
         return [];
-    const severity = issueSeverity(config);
+    const severity = mutationMode(config) === 'warn' ? 'warning' : 'error';
     const issues = manifest.patches.flatMap((patch) => evaluatePatchMetadata(cfg, patch, severity));
     issues.push(...evaluateOrderCollisions(manifest.patches, severity));
     issues.push(...evaluateGaps(cfg, manifest.patches, severity));
@@ -335,7 +323,7 @@ export function applyRenameMapToManifest(manifest, renameMap) {
 }
 /** Enforces patch policy according to the configured mutation mode. */
 export function enforcePatchPolicy(input) {
-    if (!hasPatchPolicy(input.config))
+    if (policy(input.config) === undefined)
         return;
     const issues = evaluatePatchPolicy(input.config, input.manifest);
     if (issues.length === 0)

package/dist/src/core/patch-source-metadata.d.ts

@@ -1,8 +1,6 @@
 import type { PatchMetadata } from '../types/commands/index.js';
-import type { FirefoxConfig, FirefoxProduct } from '../types/config.js';
+import type { FirefoxConfig } from '../types/config.js';
 /** Metadata fields stamped on new or refreshed patch entries. */
 export declare function buildPatchSourceMetadata(firefox: Pick<FirefoxConfig, 'product' | 'version'>): Pick<PatchMetadata, 'sourceEsrVersion' | 'sourceProduct' | 'sourceVersion'>;
 /** Backward-compatible source version reader for legacy manifests. */
 export declare function getPatchSourceVersion(patch: Pick<PatchMetadata, 'sourceEsrVersion' | 'sourceVersion'>): string;
-/** Backward-compatible source product reader for legacy manifests. */
-export declare function getPatchSourceProduct(patch: Pick<PatchMetadata, 'sourceProduct'>): FirefoxProduct | undefined;

package/dist/src/core/patch-source-metadata.js

@@ -10,7 +10,3 @@ export function buildPatchSourceMetadata(firefox) {
 export function getPatchSourceVersion(patch) {
     return patch.sourceVersion ?? patch.sourceEsrVersion;
 }
-/** Backward-compatible source product reader for legacy manifests. */
-export function getPatchSourceProduct(patch) {
-    return patch.sourceProduct;
-}

package/dist/src/core/patch-transform.d.ts

@@ -48,14 +48,6 @@ export declare function buildNewFileTextProjection(diff: string): Map<string, st
  * @returns The file content that the patch would create
  */
 export declare function extractNewFileContent(patchPath: string, targetFile?: string): Promise<string>;
-/**
- * Applies a patch's changes to content.
- * @param content - Original content (null for new files)
- * @param patchPath - Path to the patch file
- * @param targetFile - The file path within the patch
- * @returns Modified content
- */
-export declare function applyPatchToContent(content: string | null, patchPath: string, targetFile: string): Promise<string>;
 /**
  * Applies an already-read patch body to content. Batched callers that hold
  * many (patch, file) pairs use this to read each patch body once instead of

package/dist/src/core/patch-transform.js

@@ -101,16 +101,6 @@ export async function extractNewFileContent(patchPath, targetFile) {
     const content = await readText(patchPath);
     return extractNewFileContentFromDiff(content, targetFile);
 }
-/**
- * Applies a patch's changes to content.
- * @param content - Original content (null for new files)
- * @param patchPath - Path to the patch file
- * @param targetFile - The file path within the patch
- * @returns Modified content
- */
-export async function applyPatchToContent(content, patchPath, targetFile) {
-    return applyPatchTextToContent(content, await readText(patchPath), targetFile);
-}
 /**
  * Applies an already-read patch body to content. Batched callers that hold
  * many (patch, file) pairs use this to read each patch body once instead of

package/dist/src/core/process-cpu-time.js

@@ -34,7 +34,7 @@ export async function readProcessCpuSeconds(pid) {
                 '-NoProfile',
                 '-NonInteractive',
                 '-Command',
-                `(Get-Process -Id ${String(pid)} -ErrorAction SilentlyContinue).CPU`,
+                `(Get-Process -Id ${pid} -ErrorAction SilentlyContinue).CPU`,
             ]);
             const seconds = Number.parseFloat(result.stdout.trim());
             return Number.isFinite(seconds) ? seconds : undefined;

package/dist/src/core/rebase-session.d.ts

@@ -52,6 +52,8 @@ export interface RebaseSession {
     /** Index of the next patch to process (resume point). */
     currentIndex: number;
 }
+/** Absolute path of the session file, for messages that must name it. */
+export declare function getRebaseSessionPath(projectRoot: string): string;
 /**
  * Outcome of reading the session file, following the {@link LockOwner}
  * discriminated-union form rather than collapsing three states into `null`.
@@ -74,8 +76,6 @@ export type RebaseSessionRead = {
     valid: false;
     reason: string;
 };
-/** Absolute path of the session file, for messages that must name it. */
-export declare function getRebaseSessionPath(projectRoot: string): string;
 /**
  * Reads the session file, reporting absent, valid, and corrupt as three
  * distinct outcomes. Never throws for a malformed file: `readJson` calls
@@ -90,12 +90,6 @@ export declare function getRebaseSessionPath(projectRoot: string): string;
  * markers.
  */
 export declare function readRebaseSession(projectRoot: string): Promise<RebaseSessionRead>;
-/**
- * Loads an existing rebase session, or returns `null` when none exists or the
- * file on disk is unusable. Callers that must tell those two apart — every
- * command that reports to an operator — should use {@link readRebaseSession}.
- */
-export declare function tryReadRebaseSession(projectRoot: string): Promise<RebaseSession | null>;
 /**
  * Persists a rebase session atomically.
  */

package/dist/src/core/rebase-session.js

@@ -13,7 +13,8 @@ import { getProjectPaths } from './config-paths.js';
 import { createSiblingLockPath, withFileLock } from './file-lock.js';
 // ── Helpers ──
 const SESSION_FILENAME = 'rebase-session.json';
-function sessionPath(projectRoot) {
+/** Absolute path of the session file, for messages that must name it. */
+export function getRebaseSessionPath(projectRoot) {
     return join(getProjectPaths(projectRoot).fireforgeDir, SESSION_FILENAME);
 }
 const REBASE_PATCH_STATUSES = [
@@ -116,10 +117,6 @@ function isValidSession(data) {
         return false;
     return currentIndex >= 0 && currentIndex <= patches.length;
 }
-/** Absolute path of the session file, for messages that must name it. */
-export function getRebaseSessionPath(projectRoot) {
-    return sessionPath(projectRoot);
-}
 /**
  * Reads the session file, reporting absent, valid, and corrupt as three
  * distinct outcomes. Never throws for a malformed file: `readJson` calls
@@ -134,7 +131,7 @@ export function getRebaseSessionPath(projectRoot) {
  * markers.
  */
 export async function readRebaseSession(projectRoot) {
-    const path = sessionPath(projectRoot);
+    const path = getRebaseSessionPath(projectRoot);
     let data;
     try {
         data = await readJson(path);
@@ -159,20 +156,11 @@ export async function readRebaseSession(projectRoot) {
         session: { ...data, patches: data.patches.map(normalizeEntry) },
     };
 }
-/**
- * Loads an existing rebase session, or returns `null` when none exists or the
- * file on disk is unusable. Callers that must tell those two apart — every
- * command that reports to an operator — should use {@link readRebaseSession}.
- */
-export async function tryReadRebaseSession(projectRoot) {
-    const result = await readRebaseSession(projectRoot);
-    return result.present && result.valid ? result.session : null;
-}
 /**
  * Persists a rebase session atomically.
  */
 export async function saveRebaseSession(projectRoot, session) {
-    const path = sessionPath(projectRoot);
+    const path = getRebaseSessionPath(projectRoot);
     await withFileLock(createSiblingLockPath(path, '.rebase-session.lock'), async () => {
         await writeJson(path, session);
     });
@@ -181,7 +169,7 @@ export async function saveRebaseSession(projectRoot, session) {
  * Removes the rebase session file.
  */
 export async function clearRebaseSession(projectRoot) {
-    const path = sessionPath(projectRoot);
+    const path = getRebaseSessionPath(projectRoot);
     if (await pathExists(path)) {
         await removeFile(path);
     }

package/dist/src/core/register-browser-content.js

@@ -5,6 +5,7 @@
 import { join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { insertJarMnEntry } from './moz-manifest-helpers.js';
 /**
  * Tokenizer-based implementation for browser content registration.
@@ -30,8 +31,8 @@ export async function registerBrowserContent(engineDir, fileName, after, sourceP
     if (!(await pathExists(manifestPath))) {
         throw new GeneralError(`Manifest not found: ${manifest}`);
     }
-    const source = (sourcePath ?? `content/${fileName}`).replace(/\\/g, '/');
-    const entry = `        content/browser/${fileName}    (${source})`.replace(/\\/g, '/');
+    const source = normalizePathSlashes(sourcePath ?? `content/${fileName}`);
+    const entry = normalizePathSlashes(`        content/browser/${fileName}    (${source})`);
     const content = await readText(manifestPath);
     // Idempotency check
     if (content.includes(`content/browser/${fileName}`)) {

package/dist/src/core/register-browser-test.js

@@ -5,6 +5,7 @@
 import { join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { insertMozBuildListEntry } from './moz-manifest-helpers.js';
 /**
  * Tokenizer-based implementation for test manifest registration.
@@ -28,7 +29,7 @@ export async function registerTestManifest(engineDir, testDir, dryRun = false) {
     if (!(await pathExists(manifestPath))) {
         throw new GeneralError(`Manifest not found: ${manifest}`);
     }
-    const entry = `    "content/test/${testDir}/browser.toml",`.replace(/\\/g, '/');
+    const entry = normalizePathSlashes(`    "content/test/${testDir}/browser.toml",`);
     const content = await readText(manifestPath);
     // Idempotency check
     if (content.includes(`content/test/${testDir}/browser.toml`)) {

package/dist/src/core/register-module.js

@@ -5,6 +5,7 @@
 import { join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { insertMozBuildListEntry } from './moz-manifest-helpers.js';
 import { scaffoldModuleMozBuild } from './register-scaffold.js';
 /**
@@ -41,7 +42,7 @@ export async function registerFireForgeModule(engineDir, fileName, moduleDir, dr
         }
         throw new GeneralError(`Manifest not found: ${manifest}. Pass --create-manifest to scaffold it and wire the parent DIRS entry.`);
     }
-    const entry = `    "${fileName}",`.replace(/\\/g, '/');
+    const entry = normalizePathSlashes(`    "${fileName}",`);
     const content = await readText(manifestPath);
     // Idempotency check
     if (content.includes(`"${fileName}"`)) {

package/dist/src/core/register-scaffold.js

@@ -19,6 +19,7 @@
 import { dirname, join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { getLicenseHeader } from './license-headers.js';
 import { findAlphabeticalMozBuildPosition } from './moz-manifest-helpers.js';
 import { tokenizeMozBuildList } from './moz-manifest-tokenizers.js';
@@ -64,7 +65,7 @@ export function upsertMozBuildListEntry(content, directive, value) {
 export async function ensureParentDirsWiring(engineDir, childRelDir, dryRun) {
     const actions = [];
     let childName = childRelDir.split('/').at(-1) ?? childRelDir;
-    let parentRel = dirname(childRelDir).replace(/\\/g, '/');
+    let parentRel = normalizePathSlashes(dirname(childRelDir));
     for (;;) {
         if (parentRel === '.' || parentRel === '' || parentRel === '/') {
             throw new GeneralError(`No moz.build found in any parent of ${childRelDir} up to the engine root; ` +
@@ -90,7 +91,7 @@ export async function ensureParentDirsWiring(engineDir, childRelDir, dryRun) {
             await writeText(parentManifestPath, scaffold);
         actions.push({ manifest: parentManifestRel, change: `created with DIRS += ["${childName}"]` });
         childName = parentRel.split('/').at(-1) ?? parentRel;
-        parentRel = dirname(parentRel).replace(/\\/g, '/');
+        parentRel = normalizePathSlashes(dirname(parentRel));
     }
 }
 /**
@@ -122,7 +123,7 @@ export async function scaffoldModuleMozBuild(engineDir, moduleDir, fileName, dry
  * entry already exists).
  */
 export async function ensureXpcshellManifestWiring(engineDir, manifestRelPath, dryRun) {
-    let dirRel = dirname(manifestRelPath).replace(/\\/g, '/');
+    let dirRel = normalizePathSlashes(dirname(manifestRelPath));
     for (;;) {
         if (dirRel === '.' || dirRel === '' || dirRel === '/') {
             throw new GeneralError(`No moz.build found in any parent of ${manifestRelPath} up to the engine root; ` +
@@ -140,6 +141,6 @@ export async function ensureXpcshellManifestWiring(engineDir, manifestRelPath, d
                 await writeText(mozBuildPath, updated);
             return [{ manifest: mozBuildRel, change: `XPCSHELL_TESTS_MANIFESTS += ["${relEntry}"]` }];
         }
-        dirRel = dirname(dirRel).replace(/\\/g, '/');
+        dirRel = normalizePathSlashes(dirname(dirRel));
     }
 }

package/dist/src/core/register-shared-css.js

@@ -5,6 +5,7 @@
 import { basename, join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { insertJarMnEntry } from './moz-manifest-helpers.js';
 /**
  * Tokenizer-based implementation for shared CSS registration.
@@ -65,7 +66,7 @@ export function buildEntry(name, sourceColumn) {
     const minColumn = target.length + MIN_SOURCE_GAP;
     const column = sourceColumn !== undefined && sourceColumn >= minColumn ? sourceColumn : minColumn;
     const padding = ' '.repeat(column - target.length);
-    return `${target}${padding}(../shared/${name}.css)`.replace(/\\/g, '/');
+    return normalizePathSlashes(`${target}${padding}(../shared/${name}.css)`);
 }
 /**
  * Registers a CSS file in browser/themes/shared/jar.inc.mn.

package/dist/src/core/run-log-redact.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Conservative secret redaction for the run-log FILE tee.
+ *
+ * A run log is a complete copy of mach's output, and mach echoes its
+ * environment in places (configure summaries, `mach env`, harness
+ * diagnostics that print the command line). The terminal already showed
+ * every byte to the operator who ran it; the file, by contrast, is retained
+ * twenty deep and gets attached to bug reports. So the file gets a narrow
+ * masking pass and the terminal does not.
+ *
+ * Deliberately minimal and pattern-based — see {@link redactRunLogText} for
+ * the exact contract. It is a seatbelt against the common accidental leak,
+ * not a guarantee that a log is free of secrets.
+ */
+/**
+ * Masks the obvious secret shapes in run-log text, line by line.
+ *
+ * Redacted:
+ * - the value of an env-style assignment `KEY=value` whose KEY matches
+ *   `/(TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|AUTH)/i` — the value up to the
+ *   next whitespace, or a whole quoted string — becomes `KEY=<redacted>`;
+ *   the `--flag=value` and `-DNAME=value` spellings of the same shape are
+ *   covered (`--password=x` → `--password=<redacted>`);
+ * - the credential of an `Authorization:` header (`Bearer`, `Basic` and
+ *   `Token` schemes keep the scheme word; anything else masks the whole
+ *   value).
+ *
+ * NOT redacted: secrets that appear without one of those key names or
+ * headers (a bare token in a URL query string, a space-separated
+ * `--password foo` CLI argument, JSON `"token": "..."` fields, cookies).
+ * Line structure and every other byte pass through unchanged; `\n`, `\r\n`
+ * and lone `\r` all delimit lines, so carriage-return-repainted progress
+ * output is masked per repaint.
+ *
+ * @param text - One or more complete lines
+ * @returns The same text with masked values
+ */
+export declare function redactRunLogText(text: string): string;

package/dist/src/core/run-log-redact.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Conservative secret redaction for the run-log FILE tee.
+ *
+ * A run log is a complete copy of mach's output, and mach echoes its
+ * environment in places (configure summaries, `mach env`, harness
+ * diagnostics that print the command line). The terminal already showed
+ * every byte to the operator who ran it; the file, by contrast, is retained
+ * twenty deep and gets attached to bug reports. So the file gets a narrow
+ * masking pass and the terminal does not.
+ *
+ * Deliberately minimal and pattern-based — see {@link redactRunLogText} for
+ * the exact contract. It is a seatbelt against the common accidental leak,
+ * not a guarantee that a log is free of secrets.
+ */
+/** Env-style keys whose assigned value is masked. */
+const SECRET_KEY_PATTERN = /(TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|AUTH)/i;
+/**
+ * `KEY=value` where KEY is an identifier and the value runs to the next
+ * whitespace, or is a single/double-quoted string. The leading group keeps
+ * the assignment anchored at a token boundary so `x.y=z` is not split
+ * mid-token. A hyphen IS a boundary: mach and configure echo their argv, so
+ * `--token=…`, `--password=…` and `-DAUTH_TOKEN=…` are exactly the forms a
+ * retained log would otherwise carry verbatim (the lead keeps the dash; the
+ * key is what follows it). Empty values are left alone (nothing to hide).
+ */
+const ENV_ASSIGNMENT_PATTERN = /(^|[\s"'([{,;-])([A-Za-z_][A-Za-z0-9_]*)=("(?:[^"\\]|\\.)*"|'[^']*'|[^\s"',;)\]}]+)/g;
+/** `Authorization: <scheme> <credential>` (scheme optional) in HTTP dumps. */
+const AUTHORIZATION_HEADER_PATTERN = /(authorization\s*:\s*)(?:(bearer|basic|token)\s+)?(\S+)/gi;
+/** Marker written in place of a masked value. */
+const REDACTED = '<redacted>';
+function redactLine(line) {
+    return line
+        .replace(ENV_ASSIGNMENT_PATTERN, (whole, lead, key) => SECRET_KEY_PATTERN.test(key) ? `${lead}${key}=${REDACTED}` : whole)
+        .replace(AUTHORIZATION_HEADER_PATTERN, (_whole, lead, scheme) => scheme === undefined ? `${lead}${REDACTED}` : `${lead}${scheme} ${REDACTED}`);
+}
+/**
+ * Masks the obvious secret shapes in run-log text, line by line.
+ *
+ * Redacted:
+ * - the value of an env-style assignment `KEY=value` whose KEY matches
+ *   `/(TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|AUTH)/i` — the value up to the
+ *   next whitespace, or a whole quoted string — becomes `KEY=<redacted>`;
+ *   the `--flag=value` and `-DNAME=value` spellings of the same shape are
+ *   covered (`--password=x` → `--password=<redacted>`);
+ * - the credential of an `Authorization:` header (`Bearer`, `Basic` and
+ *   `Token` schemes keep the scheme word; anything else masks the whole
+ *   value).
+ *
+ * NOT redacted: secrets that appear without one of those key names or
+ * headers (a bare token in a URL query string, a space-separated
+ * `--password foo` CLI argument, JSON `"token": "..."` fields, cookies).
+ * Line structure and every other byte pass through unchanged; `\n`, `\r\n`
+ * and lone `\r` all delimit lines, so carriage-return-repainted progress
+ * output is masked per repaint.
+ *
+ * @param text - One or more complete lines
+ * @returns The same text with masked values
+ */
+export function redactRunLogText(text) {
+    if (text.length === 0)
+        return text;
+    // Split with a capturing group so the terminators survive the round trip;
+    // odd indices are the terminators themselves.
+    return text
+        .split(/(\r\n|\n|\r)/)
+        .map((part, index) => (index % 2 === 0 ? redactLine(part) : part))
+        .join('');
+}