@hominis/fireforge 0.47.0 → 0.48.0

package/dist/src/core/run-profile.js

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Profile selection for `fireforge run`.
+ *
+ * `mach run` on desktop has no `--profile` option of its own: its parser's
+ * `--profile/-P` belongs to the Android run parser. On desktop a profile
+ * reaches Firefox as a program parameter (`-profile <dir>`), and mach skips
+ * creating the objdir's `tmp/profile-default` when it sees one among the
+ * params.
+ * Mach's `--temp-profile` does mint a fresh directory, but inside the objdir
+ * and never removes it, so FireForge owns the temporary profile instead:
+ * it creates the directory, seeds the two prefs mach would have written,
+ * passes it as `-profile`, and deletes it when the run ends.
+ */
+import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { InvalidArgumentError } from '../errors/base.js';
+import { isProcessAlive, toError } from '../utils/errors.js';
+import { verbose, warn } from '../utils/logger.js';
+/** Directory-name prefix of every FireForge-owned temporary run profile. */
+export const RUN_PROFILE_PREFIX = 'fireforge-run-profile-';
+/** Marker file naming the pid of the FireForge process that owns the profile. */
+const OWNER_MARKER = '.fireforge-run-owner';
+/**
+ * The prefs `mach run` writes into the profiles it creates itself. A profile
+ * passed with `-profile` gets none of them, and a first-run default-browser
+ * prompt would sit in a headed smoke window.
+ */
+const SEEDED_USER_JS = 'user_pref("browser.shell.checkDefaultBrowser", false);\n' +
+    'user_pref("browser.aboutConfig.showWarning", false);\n';
+/**
+ * Temporary profiles this process created and has not yet removed. The
+ * command's own `finally` loses the race to the entry point's signal
+ * handler, whose `process.exit` never lets it run, so the handler removes
+ * these itself once the browser tree has shut down.
+ */
+const activeTemporaryProfiles = new Set();
+async function removeTemporaryProfile(dir) {
+    try {
+        await rm(dir, { recursive: true, force: true });
+        activeTemporaryProfiles.delete(dir);
+    }
+    catch (error) {
+        warn(`Could not remove temporary run profile ${dir}: ${toError(error).message}`);
+    }
+}
+/**
+ * Removes every temporary run profile this process still holds. Called by
+ * the CLI entry point's signal handler after child shutdown. Never throws.
+ */
+export async function removeActiveRunProfiles() {
+    await Promise.all([...activeTemporaryProfiles].map((dir) => removeTemporaryProfile(dir)));
+}
+const NO_PROFILE = {
+    args: [],
+    temporary: false,
+    dispose: () => Promise.resolve(),
+};
+/**
+ * Chooses the profile for a run.
+ * @param request - The run's profile flags
+ * @returns The profile arguments and their release handle
+ */
+export async function resolveRunProfile(request) {
+    if (request.profile !== undefined && request.tempProfile === true) {
+        throw new InvalidArgumentError('--profile and --temp-profile are mutually exclusive: name a profile or ask for a fresh one.', 'profile');
+    }
+    if (request.profile !== undefined) {
+        const dir = resolve(request.profile);
+        return { args: ['-profile', dir], dir, temporary: false, dispose: NO_PROFILE.dispose };
+    }
+    if (request.tempProfile !== true && !request.smoke) {
+        return NO_PROFILE;
+    }
+    const dir = await mkdtemp(join(request.tempRoot ?? tmpdir(), RUN_PROFILE_PREFIX));
+    activeTemporaryProfiles.add(dir);
+    // The owner marker goes in first, so a FireForge killed past this point
+    // leaves a directory the next run can prove abandoned.
+    await writeFile(join(dir, OWNER_MARKER), `${process.pid}\n`);
+    await writeFile(join(dir, 'user.js'), SEEDED_USER_JS);
+    verbose(`Temporary run profile: ${dir}`);
+    return {
+        args: ['-profile', dir],
+        dir,
+        temporary: true,
+        dispose: () => removeTemporaryProfile(dir),
+    };
+}
+/**
+ * Removes temporary run profiles whose owning FireForge process is gone.
+ * The `finally` that releases a profile covers a clean exit, a failed run
+ * and a forwarded SIGINT/SIGTERM, but not a SIGKILL of FireForge itself;
+ * this sweep is the backstop for that case. A directory whose marker is
+ * missing or unreadable is left alone: nothing proves it is abandoned.
+ * @param tempRoot - Base directory to sweep (defaults to the OS tmpdir)
+ * @returns The number of directories removed
+ */
+export async function sweepAbandonedRunProfiles(tempRoot = tmpdir()) {
+    let entries;
+    try {
+        entries = await readdir(tempRoot);
+    }
+    catch {
+        return 0;
+    }
+    let removed = 0;
+    for (const entry of entries) {
+        if (!entry.startsWith(RUN_PROFILE_PREFIX))
+            continue;
+        const dir = join(tempRoot, entry);
+        let pid;
+        try {
+            pid = Number.parseInt((await readFile(join(dir, OWNER_MARKER), 'utf8')).trim(), 10);
+        }
+        catch {
+            continue;
+        }
+        if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid || isProcessAlive(pid)) {
+            continue;
+        }
+        try {
+            await rm(dir, { recursive: true, force: true });
+            removed += 1;
+        }
+        catch (error) {
+            verbose(`Could not remove abandoned run profile ${dir}: ${toError(error).message}`);
+        }
+    }
+    return removed;
+}

package/dist/src/core/status-binary.d.ts

@@ -26,7 +26,7 @@
  */
 import type { PatchedContentContext } from './patch-apply.js';
 /** Batched patch lookup, injected by callers that classify many files. */
-export type AffectingPatchLookup = Pick<PatchedContentContext, 'getAffectingPatches' | 'readPatchBody'>;
+export type AffectingPatchLookup = Pick<PatchedContentContext, 'getAffectingPatches' | 'readPatchBody'> & Partial<Pick<PatchedContentContext, 'liveBlobHash'>>;
 /**
  * Classification result for a binary comparison. Structurally assignable
  * to `ClassifiedFile` without importing it (which would create a cycle

package/dist/src/core/status-binary.js

@@ -111,7 +111,9 @@ export async function classifyBinaryOwnedFile(args) {
         }
         if (section.hasBinaryDelta && section.indexNewHash !== undefined) {
             const fullPath = join(engineDir, entry.file);
-            const live = (await hashObjectBatch(engineDir, [fullPath])).get(fullPath);
+            const live = args.lookup?.liveBlobHash !== undefined
+                ? await args.lookup.liveBlobHash(fullPath)
+                : (await hashObjectBatch(engineDir, [fullPath])).get(fullPath);
             if (live !== undefined) {
                 // Prefix-compare: recorded hashes may be abbreviated (≥7 chars).
                 const matches = live.startsWith(section.indexNewHash) || section.indexNewHash.startsWith(live);

package/dist/src/core/status-classify.js

@@ -13,6 +13,7 @@ import { readText } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
 import { normalizePathSlashes } from '../utils/paths.js';
 import { isBrandingManagedPath } from './branding.js';
+import { isBinaryFile } from './git-file-ops.js';
 import { createPatchedContentContext } from './patch-apply.js';
 import { classifyBinaryOwnedFile } from './status-binary.js';
 /**
@@ -141,6 +142,7 @@ export async function classifyFiles(files, engineDir, patchesDir, binaryName, fu
     // expected-vs-actual content comparison then routes them into `unmanaged`
     // when the content matches neither owner's expectation.
     const patchClaims = buildPatchClaims(ctx.manifestPatches);
+    await prefetchSingleOwnerContent(files, engineDir, patchClaims, ctx);
     const deps = {
         engineDir,
         patchesDir,
@@ -149,12 +151,37 @@ export async function classifyFiles(files, engineDir, patchesDir, binaryName, fu
         patchClaims,
         ctx,
     };
-    // Bounded pool over per-file classification (each single-owner file
-    // spawns git). Order preserved by the mapper. Per-file failures settle
+    // Bounded pool over per-file classification. Order preserved by the mapper. Per-file failures settle
     // inside classifySingleOwnerFile's catch, so one bad file never rejects
     // the batch.
     return mapWithConcurrency(files, CLASSIFY_CONCURRENCY, (entry) => classifyEntry(entry, deps));
 }
+/**
+ * Fetches, in two git processes, what the per-file comparison would
+ * otherwise spawn git for file by file: the HEAD content of every
+ * single-owner path (one `cat-file --batch`) and the live blob hash of every
+ * one that is binary on disk (one `hash-object` per ARG_MAX chunk). On a
+ * 1,600-file Firefox scan that was ~1,550 `git show` and `hash-object`
+ * spawns. Fetching for a path the classifier ends up routing elsewhere
+ * (a branding path, say) costs a few bytes, never a wrong answer.
+ */
+async function prefetchSingleOwnerContent(files, engineDir, patchClaims, ctx) {
+    const singleOwner = files.filter((entry) => patchClaims.get(entry.file)?.length === 1);
+    if (singleOwner.length === 0)
+        return;
+    await ctx.prefetchBase(singleOwner.map((entry) => entry.file));
+    const present = singleOwner.filter((entry) => getPrimaryStatusCode(entry.status) !== 'D');
+    const binary = await mapWithConcurrency(present, CLASSIFY_CONCURRENCY, async (entry) => {
+        try {
+            return (await isBinaryFile(engineDir, entry.file)) ? join(engineDir, entry.file) : undefined;
+        }
+        catch {
+            // The per-file path probes again and settles the failure itself.
+            return undefined;
+        }
+    });
+    await ctx.prefetchLiveBlobHashes(binary.filter((path) => path !== undefined));
+}
 /** Concurrency bound for per-file classification (matches import's guard). */
 const CLASSIFY_CONCURRENCY = 8;
 /** Classifies one status entry. Extracted so the pool worker stays flat. */

package/dist/src/core/toolchain-preflight.d.ts

@@ -27,6 +27,12 @@
  */
 /** Tools the preflight knows how to probe. */
 export type ToolchainTool = 'cbindgen' | 'rustc';
+/**
+ * Resolves the mach state directory the same way mach itself does:
+ * `$MOZBUILD_STATE_PATH`, else `~/.mozbuild` (same resolution as
+ * `mach-resource-shim.ts`).
+ */
+export declare function mozbuildStateDir(): string;
 /** One probed candidate binary for a tool. */
 export interface ToolchainCandidate {
     /** Binary path (or bare name for the PATH candidate). */

package/dist/src/core/toolchain-preflight.js

@@ -37,7 +37,7 @@ import { verbose } from '../utils/logger.js';
  * `$MOZBUILD_STATE_PATH`, else `~/.mozbuild` (same resolution as
  * `mach-resource-shim.ts`).
  */
-function mozbuildStateDir() {
+export function mozbuildStateDir() {
     return process.env['MOZBUILD_STATE_PATH'] ?? join(homedir(), '.mozbuild');
 }
 /** Where each tool's minimum is declared inside the Firefox tree. */

package/dist/src/core/typecheck.d.ts

@@ -26,6 +26,16 @@ import type { TypecheckProjectResult } from '../types/typecheck.js';
  * in CI logs.
  */
 export declare const CHECK_JS_DISABLED_NOTICE = "Project sets \"checkJs: false\" \u2014 skipping (override the jsconfig to enable typecheck).";
+/** Run-level options for {@link runTypecheck}. */
+export interface RunTypecheckOptions {
+    /**
+     * Directory for the per-project incremental build info. Defaults to
+     * `<projectRoot>/.fireforge/typecheck`.
+     */
+    cacheDir?: string;
+    /** Build every project from scratch and write no build info. */
+    noCache?: boolean;
+}
 /**
  * Runs `fireforge typecheck` against every project listed in `cfg.projects`.
  *
@@ -55,7 +65,7 @@ export declare const CHECK_JS_DISABLED_NOTICE = "Project sets \"checkJs: false\"
  *   in declared order. The CLI is responsible for printing the issues
  *   and computing the exit code.
  */
-export declare function runTypecheck(projectRoot: string, cfg: TypecheckConfig): Promise<TypecheckProjectResult[]>;
+export declare function runTypecheck(projectRoot: string, cfg: TypecheckConfig, runOptions?: RunTypecheckOptions): Promise<TypecheckProjectResult[]>;
 /**
  * Converts an absolute path to a path relative to the project root,
  * for display in CLI output. Falls back to the absolute path when

package/dist/src/core/typecheck.js

@@ -18,10 +18,13 @@
  * without installing it, the function returns a clear error pointing
  * at `npm install typescript`.
  */
-import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { mkdir, readdir, rm } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
+import { sha256Hex } from '../utils/hash.js';
 import { verbose } from '../utils/logger.js';
+import { getPackageVersion } from '../utils/package-root.js';
 import { normalizePathSlashes } from '../utils/paths.js';
 import { composeShimSource, SHIM_FILENAME, SUPPRESSED_DIAGNOSTIC_CODES, UNDEFINED_IDENTIFIER_CODES, UNDEFINED_IDENTIFIER_HINT, } from './typecheck-shim.js';
 /**
@@ -60,7 +63,7 @@ export const CHECK_JS_DISABLED_NOTICE = 'Project sets "checkJs: false" — skipp
  *   in declared order. The CLI is responsible for printing the issues
  *   and computing the exit code.
  */
-export async function runTypecheck(projectRoot, cfg) {
+export async function runTypecheck(projectRoot, cfg, runOptions = {}) {
     // Dynamic import, so typescript stays a dev dependency. Same pattern
     // as `patch-lint-checkjs.ts`. The empty-projects-array case is
     // already rejected by config-validate, so we don't gate the import
@@ -133,7 +136,9 @@ export async function runTypecheck(projectRoot, cfg) {
             });
             continue;
         }
-        results.push(await runTypecheckForProject(ts, projectRoot, projectPath, shimSource, cfg.undefinedIdentifiers ?? 'warning'));
+        results.push(await runTypecheckForProject(ts, projectRoot, projectPath, shimSource, cfg.undefinedIdentifiers ?? 'warning', runOptions.noCache === true
+            ? undefined
+            : (runOptions.cacheDir ?? join(projectRoot, '.fireforge', 'typecheck'))));
     }
     return results;
 }
@@ -151,7 +156,7 @@ function resolveProjectExtraShim(cfg, projectPath) {
     return cfg.extraShim;
 }
 /** Runs typecheck for a single jsconfig path, isolating its failures. */
-async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource, undefinedIdentifiers = 'warning') {
+async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource, undefinedIdentifiers = 'warning', cacheDir) {
     const absConfig = resolve(projectRoot, projectPath);
     if (!(await pathExists(absConfig))) {
         return {
@@ -223,12 +228,12 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
         noEmit: true,
         allowJs: parsed.options.allowJs ?? true,
         checkJs: parsed.options.checkJs ?? true,
-        // No incremental sidecar, ever. A user jsconfig under `engine/` that sets
-        // `incremental` (or names a `tsBuildInfoFile`) would have this command
-        // drop a `.tsbuildinfo` inside the primary engine checkout: a second
-        // writer that invalidates a concurrent `fireforge test`'s engine
-        // fingerprint. This command emits nothing, so the sidecar buys nothing
-        // either.
+        // Never the jsconfig's own incremental sidecar: a user jsconfig under
+        // `engine/` that sets `incremental` (or names a `tsBuildInfoFile`) would
+        // have this command drop a `.tsbuildinfo` inside the primary engine
+        // checkout, a second writer that invalidates a concurrent
+        // `fireforge test`'s engine fingerprint. FireForge's own build info
+        // lives under `.fireforge/typecheck/` instead (see below).
         incremental: false,
         // skipLibCheck is not forced. The user owns it via their jsconfig.
     };
@@ -267,7 +272,38 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
             return defaultHost.readFile(fileName);
         },
     };
-    const program = ts.createProgram(rootFiles, options, host);
+    // Incremental build info, keyed by everything outside the program's own
+    // files that can change a verdict: the composed shim, the TypeScript
+    // version, the compiler options, the undefined-identifier gate and the
+    // FireForge version. A change to any of them selects a different file,
+    // so a stale verdict is never replayed. Files inside the program are
+    // tracked by TypeScript's own per-file hashes in the build info.
+    const buildInfoFile = cacheDir === undefined
+        ? undefined
+        : await prepareBuildInfoFile(cacheDir, projectPath, {
+            shim: sha256Hex(shimSource),
+            typescript: ts.version,
+            fireforge: getPackageVersion(),
+            undefinedIdentifiers,
+            options,
+        });
+    let program;
+    let writeBuildInfo = () => undefined;
+    if (buildInfoFile === undefined) {
+        program = ts.createProgram(rootFiles, options, host);
+    }
+    else {
+        const builder = ts.createIncrementalProgram({
+            rootNames: rootFiles,
+            options: { ...options, incremental: true, tsBuildInfoFile: buildInfoFile },
+            host: withSourceFileVersions(host),
+        });
+        program = builder;
+        // Under noEmit, emit() writes the build info and nothing else.
+        writeBuildInfo = () => {
+            builder.emit();
+        };
+    }
     // Collect the full diagnostic set. patchLint reads only semantic +
     // syntactic, which is fine for hygiene but wrong for CI: a misconfigured
     // `lib: ["es2015"]` or a missing `paths` target should fail
@@ -298,6 +334,7 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
         }
         issues.push(diagnosticToIssue(ts, diag, absConfig, projectPath));
     }
+    writeBuildInfo();
     verbose(`typecheck: ${projectPath} — analyzed ${parsed.fileNames.length} file(s), found ${issues.length} issue(s)`);
     return {
         project: projectPath,
@@ -305,6 +342,43 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
         filesChecked: parsed.fileNames.length,
     };
 }
+/**
+ * Stamps every source file with a content-hash version, which the
+ * incremental builder requires and a plain compiler host never sets.
+ * `ts.createIncrementalCompilerHost` does the same internally, but the
+ * shim here is served by a custom host rather than read from disk.
+ */
+function withSourceFileVersions(host) {
+    const getSourceFile = host.getSourceFile.bind(host);
+    return {
+        ...host,
+        getSourceFile(...args) {
+            const file = getSourceFile(...args);
+            if (file !== undefined) {
+                file.version = sha256Hex(file.text);
+            }
+            return file;
+        },
+    };
+}
+/**
+ * Resolves the build-info path for one project and key, creating the cache
+ * directory and removing the project's build info for any other key: a
+ * shim or TypeScript change leaves the old file unreachable anyway.
+ * @returns Absolute build-info path
+ */
+async function prepareBuildInfoFile(cacheDir, projectPath, keyInputs) {
+    const slug = projectPath.replace(/[^A-Za-z0-9._-]+/g, '_');
+    const key = sha256Hex(JSON.stringify(keyInputs)).slice(0, 16);
+    const fileName = `${slug}-${key}.tsbuildinfo`;
+    await mkdir(cacheDir, { recursive: true });
+    for (const entry of await readdir(cacheDir)) {
+        if (entry !== fileName && entry.startsWith(`${slug}-`) && entry.endsWith('.tsbuildinfo')) {
+            await rm(join(cacheDir, entry), { force: true });
+        }
+    }
+    return join(cacheDir, fileName);
+}
 /**
  * Converts a TS Diagnostic to a TypecheckIssue. The `fallbackFile`
  * is used when the diagnostic carries no source file (typical for

package/dist/src/errors/rebase.d.ts

@@ -31,3 +31,12 @@ export declare class NoRebaseSessionError extends RebaseError {
 export declare class CorruptRebaseSessionError extends RebaseError {
     constructor(sessionPath: string, reason: string);
 }
+/**
+ * Thrown by `rebase --dry-run` when the replay rejects at least one patch.
+ * A dry run that exited 0 regardless used to read as "the rebase is ready".
+ */
+export declare class RebaseDryRunRejectError extends RebaseError {
+    readonly rejected: readonly string[];
+    constructor(rejected: readonly string[]);
+    get userMessage(): string;
+}

package/dist/src/errors/rebase.js

@@ -49,3 +49,23 @@ export class CorruptRebaseSessionError extends RebaseError {
             'or delete the file to start over.');
     }
 }
+/**
+ * Thrown by `rebase --dry-run` when the replay rejects at least one patch.
+ * A dry run that exited 0 regardless used to read as "the rebase is ready".
+ */
+export class RebaseDryRunRejectError extends RebaseError {
+    rejected;
+    constructor(rejected) {
+        super(`Dry run: ${rejected.length} patch(es) would not apply: ${rejected.join(', ')}. ` +
+            'engine/ was not modified.');
+        this.rejected = rejected;
+    }
+    get userMessage() {
+        return (`Rebase Error: ${this.message}` +
+            remedies([
+                'The per-patch lines above name the files that did not apply',
+                'Run "fireforge rebase" to start the real rebase; it stops at the first reject for manual resolution',
+                'Later rejects may cascade from an earlier one; resolve in queue order',
+            ]));
+    }
+}

package/dist/src/index.d.ts

@@ -16,12 +16,14 @@
  * @packageDocumentation
  */
 export { loadConfig, validateConfig } from './core/config.js';
+export type { FindForwardRegistrationsOptions, ForwardRegistration, ForwardRegistrationKind, ForwardRegistrationScope, } from './core/forward-registrations.js';
+export { findForwardRegistrations } from './core/forward-registrations.js';
 export type { ApplyAllComponentsResult } from './core/furnace-apply.js';
 export { applyAllComponents } from './core/furnace-apply.js';
 export { ensureFurnaceConfig, loadFurnaceConfig, loadFurnaceState, saveFurnaceState, validateFurnaceConfig, } from './core/furnace-config.js';
 export { validateAllComponents, validateComponent } from './core/furnace-validate.js';
 export type { PatchSizeTierDecision } from './core/patch-lint.js';
-export { countNonBinaryDiffLines, getPatchSizeThresholds, resolvePatchSizeTier, } from './core/patch-lint.js';
+export { countNonBinaryDiffLines, filesMeasuredByFileTooLarge, getPatchSizeThresholds, resolvePatchSizeTier, } from './core/patch-lint.js';
 export type { AddTokenOptions, AddTokenResult, TokenMode } from './core/token-manager.js';
 export { addToken, getTokensCssPath, validateTokenAdd } from './core/token-manager.js';
 export { CancellationError, CommandError, FireForgeError, GeneralError, InvalidArgumentError, ResolutionError, } from './errors/base.js';

package/dist/src/index.js

@@ -17,10 +17,11 @@
  * @packageDocumentation
  */
 export { loadConfig, validateConfig } from './core/config.js';
+export { findForwardRegistrations } from './core/forward-registrations.js';
 export { applyAllComponents } from './core/furnace-apply.js';
 export { ensureFurnaceConfig, loadFurnaceConfig, loadFurnaceState, saveFurnaceState, validateFurnaceConfig, } from './core/furnace-config.js';
 export { validateAllComponents, validateComponent } from './core/furnace-validate.js';
-export { countNonBinaryDiffLines, getPatchSizeThresholds, resolvePatchSizeTier, } from './core/patch-lint.js';
+export { countNonBinaryDiffLines, filesMeasuredByFileTooLarge, getPatchSizeThresholds, resolvePatchSizeTier, } from './core/patch-lint.js';
 export { addToken, getTokensCssPath, validateTokenAdd } from './core/token-manager.js';
 export { CancellationError, CommandError, FireForgeError, GeneralError, InvalidArgumentError, ResolutionError, } from './errors/base.js';
 export { ExitCode } from './errors/codes.js';

package/dist/src/types/commands/options.d.ts

@@ -85,6 +85,8 @@ export interface SetupOptions {
 export interface DownloadOptions {
     /** Force re-download, deleting existing engine/ */
     force?: boolean;
+    /** With `force`: skip the confirmation for an engine with changes to lose */
+    yes?: boolean;
 }
 /**
  * Options for the source command.
@@ -497,6 +499,13 @@ export interface RebaseOptions {
 export interface RunOptions {
     /** Additional arguments to pass to the browser */
     args?: string[];
+    /** Launch with this profile directory, passed to Firefox as `-profile`. */
+    profile?: string;
+    /**
+     * Launch with a fresh temporary profile, removed when the run ends.
+     * Implied by `smokeExit` unless `profile` is given.
+     */
+    tempProfile?: boolean;
     /**
      * Enable smoke-run mode. Launches the browser, streams the console,
      * sends SIGTERM to the whole process group after `smokeExit` seconds,
@@ -612,9 +621,19 @@ export interface TestOptions extends EngineLockWaitable {
      * project's objdir. The census itself runs on every test dispatch and is
      * report-only. This flag opts into the kill. Survivors slow later runs
      * without appearing in their output, so the visibility is the default and
-     * the termination is the choice.
+     * the termination is the choice. `test.reapOrphans: "reap"` in
+     * `fireforge.json` makes it the repo's default.
      */
     reapOrphans?: boolean;
+    /**
+     * Path to write the harness process-group id to, rewritten on every mach
+     * spawn (each retry attempt and shard) and removed when the run ends under
+     * FireForge's control. mach runs as its own process-group leader, so a
+     * supervisor's kill of its own group never reaches it; a supervisor that
+     * had to SIGKILL FireForge takes the whole harness tree afterwards with
+     * `kill -- -<pgid>`. The file survives exactly that case, by design.
+     */
+    pgidFile?: string;
     /** Permit tests against packageable engine edits newer than the last successful build. */
     allowStaleBuild?: boolean;
     /**
@@ -1105,4 +1124,10 @@ export interface LintCommandOptions {
      * {@link perPatch}.
      */
     report?: string;
+    /**
+     * With `--per-patch`: `'full'` (default) prints every NOTICE line;
+     * `'summary'` prints one line per check with its count and patch count.
+     * Errors and warnings always print in full.
+     */
+    notices?: 'summary' | 'full';
 }

package/dist/src/types/config.d.ts

@@ -47,6 +47,13 @@ export interface TestConfig {
     canaryPath?: string;
     /** Short no-output ceiling for `fireforge test --canary`, in seconds. */
     canaryTimeoutSeconds?: number;
+    /**
+     * What the preflight orphan census does with a harness helper that
+     * survived an earlier run in this objdir: `report` (default) names it and
+     * proceeds; `reap` terminates it and stamps `orphans-reaped=<n>` on the
+     * verdict line. `--reap-orphans` is the per-invocation equivalent.
+     */
+    reapOrphans?: 'report' | 'reap';
 }
 /** A single external executable required by a project-specific toolchain. */
 export interface ExternalToolRequirement {
@@ -348,6 +355,16 @@ export interface PatchLintConfig {
      * scope for the per-patch tier.
      */
     prettier?: PatchLintSeverityGate;
+    /**
+     * Which carriers the `forward-registration` queue rule checks for a line
+     * that names a file only a later patch creates. `'support-files'` (the
+     * default) checks test-manifest `support-files`. `'extended'` also checks
+     * jar.mn pair lines, moz.build path tokens, test-manifest sections and
+     * `head`, and customElements.js chrome URLs resolved through the queue's
+     * own jar.mn lines. Opt-in: a queue that predates the wider rule can carry
+     * such edges, and a new error on install would red its gate.
+     */
+    forwardRegistration?: 'support-files' | 'extended';
     /** Enforce JSDoc on class-method exports in patch-owned .sys.mjs files. Default: 'off'. */
     jsdocClassMethods?: PatchLintSeverityGate;
     /** Require ≥1 assertion in any patch-touched browser_*.js test file (new or modified). Default: 'off'. */

package/dist/src/utils/process-group.d.ts

@@ -32,8 +32,12 @@ interface ProcessGroupSurvivor {
  * about anything that still refuses to die. POSIX only (no-op on win32).
  * The only kill target is `-pgid`, never anything outside the group.
  * A healthy run costs exactly one `pgrep`.
+ *
+ * `context` names why the group is being reaped in the warning; the default
+ * is the post-close sweep. The parent-exit watchdog passes its own, because
+ * there the group is still running when the sweep begins.
  */
-export declare function sweepProcessGroup(pgid: number, graceMs?: number): Promise<{
+export declare function sweepProcessGroup(pgid: number, graceMs?: number, context?: string): Promise<{
     survivors: ProcessGroupSurvivor[];
 }>;
 export {};

package/dist/src/utils/process-group.js

@@ -130,15 +130,19 @@ function describeSurvivors(list) {
  * about anything that still refuses to die. POSIX only (no-op on win32).
  * The only kill target is `-pgid`, never anything outside the group.
  * A healthy run costs exactly one `pgrep`.
+ *
+ * `context` names why the group is being reaped in the warning; the default
+ * is the post-close sweep. The parent-exit watchdog passes its own, because
+ * there the group is still running when the sweep begins.
  */
-export async function sweepProcessGroup(pgid, graceMs = SWEEP_GRACE_MS) {
+export async function sweepProcessGroup(pgid, graceMs = SWEEP_GRACE_MS, context = 'after exit') {
     if (process.platform === 'win32')
         return { survivors: [] };
     const survivors = await listGroupSurvivors(pgid);
     if (survivors.length === 0)
         return { survivors };
-    warn(`Harness process group ${pgid} left ${survivors.length} surviving ` +
-        `process(es) after exit — reaping the group. ${describeSurvivors(survivors)}`);
+    warn(`Harness process group ${pgid} has ${survivors.length} live ` +
+        `process(es) ${context} — reaping the group. ${describeSurvivors(survivors)}`);
     try {
         process.kill(-pgid, 'SIGTERM');
     }

package/dist/src/utils/process-input.d.ts

@@ -0,0 +1,27 @@
+/** Options for {@link execWithInput}. */
+export interface ExecWithInputOptions {
+    /** Working directory for the command */
+    cwd?: string;
+    /** Environment variables merged over `process.env` */
+    env?: Record<string, string>;
+}
+/** Result of {@link execWithInput}: stdout stays raw bytes. */
+export interface ExecBufferResult {
+    /** Standard output, uncapped and undecoded */
+    stdout: Buffer;
+    /** Standard error, decoded as UTF-8 */
+    stderr: string;
+    /** Process exit code */
+    exitCode: number;
+}
+/**
+ * Runs a command, writes `input` to its stdin, and returns stdout as raw
+ * bytes. For batch protocols (`git cat-file --batch`) whose framing counts
+ * bytes: the decoded, 50 MB-capped collector `exec` uses would corrupt
+ * both. The caller bounds the input, and so the output.
+ * @param command - Command to execute
+ * @param args - Command arguments
+ * @param input - Bytes written to stdin, which is then closed
+ * @param options - Execution options
+ */
+export declare function execWithInput(command: string, args: string[], input: string | Buffer, options?: ExecWithInputOptions): Promise<ExecBufferResult>;