@hominis/fireforge 0.47.1 → 0.48.0

package/dist/src/commands/re-export.js

@@ -132,12 +132,14 @@ export async function reExportCommand(projectRoot, patches, options) {
     const driftCtx = buildForeignDriftContext(options);
     // Hoisted lint context, one per run: queue context + checkJs
     // program + per-patch result cache, shared across every loop iteration.
-    const lintCtx = await buildReExportLintContext(projectRoot, paths, config, options.noCache === true);
+    // Taken before the context build, so the elapsed time the progress line
+    // reports includes it.
+    const startedAt = Date.now();
+    const lintCtx = await buildReExportLintContext(projectRoot, paths, config, options.noCache === true, new Set(selectedPatches.map((patch) => patch.filename)));
     let reExported = 0;
     const reExportedFilenames = [];
     const failedFilenames = [];
     const progress = spinner('Preparing re-export...');
-    const startedAt = Date.now();
     await withDryRunReExportLock(paths.fireforgeDir, isDryRun, async () => withDryRunPurityGuard(paths.engine, paths.patches, isDryRun, async () => {
         for (const [index, patch] of selectedPatches.entries()) {
             const assignedScanFiles = scanFilesByPatch?.get(patch.filename);

package/dist/src/commands/rebase/confirm.d.ts

@@ -22,10 +22,21 @@ export interface DirtyEngineConfirmationOptions {
     warningMessage: string;
     promptMessage: string;
     cancelMessage: string;
+    /**
+     * Precomputed dirtiness. A caller that already measured what would be
+     * lost (and may count more than the working tree, such as commits made
+     * on top of the base) passes it here instead of the `hasChanges` probe.
+     */
+    dirty?: boolean;
+    /**
+     * Replaces the generic "Engine has uncommitted changes" opening of the
+     * non-interactive refusal, so the refusal names what would be lost.
+     */
+    refusalDetail?: string;
 }
 /**
  * Checks if the engine has uncommitted changes and prompts for confirmation.
  * Returns true if safe to proceed, false if the user cancelled.
  * Throws in non-interactive mode without --yes.
  */
-export declare function confirmDirtyEngineReset({ engineDir, yes, nonInteractiveCommand, argumentName, warningMessage, promptMessage, cancelMessage, }: DirtyEngineConfirmationOptions): Promise<boolean>;
+export declare function confirmDirtyEngineReset({ engineDir, yes, nonInteractiveCommand, argumentName, warningMessage, promptMessage, cancelMessage, dirty, refusalDetail, }: DirtyEngineConfirmationOptions): Promise<boolean>;

package/dist/src/commands/rebase/confirm.js

@@ -12,13 +12,16 @@ import { cancel, isCancel, warn } from '../../utils/logger.js';
  * Returns true if safe to proceed, false if the user cancelled.
  * Throws in non-interactive mode without --yes.
  */
-export async function confirmDirtyEngineReset({ engineDir, yes, nonInteractiveCommand, argumentName, warningMessage, promptMessage, cancelMessage, }) {
-    if (!(await hasChanges(engineDir)) || yes) {
+export async function confirmDirtyEngineReset({ engineDir, yes, nonInteractiveCommand, argumentName, warningMessage, promptMessage, cancelMessage, dirty, refusalDetail, }) {
+    if (yes || !(dirty ?? (await hasChanges(engineDir)))) {
         return true;
     }
     const isInteractive = stdioIsInteractive();
     if (!isInteractive) {
-        throw new InvalidArgumentError(`Engine has uncommitted changes and interactive confirmation is not available. Run: ${nonInteractiveCommand}`, argumentName);
+        const opening = refusalDetail !== undefined
+            ? `${refusalDetail} Interactive confirmation is not available.`
+            : 'Engine has uncommitted changes and interactive confirmation is not available.';
+        throw new InvalidArgumentError(`${opening} Run: ${nonInteractiveCommand}`, argumentName);
     }
     warn(warningMessage);
     const confirmed = await confirm({

package/dist/src/commands/rebase/index.js

@@ -11,19 +11,20 @@
  * Supports `--continue` (resume after manual fix) and `--abort` (cancel).
  */
 import { Command } from 'commander';
-import { getProjectPaths, loadConfig } from '../../core/config.js';
+import { getProjectPaths, loadConfig, loadState } from '../../core/config.js';
 import { assertEngineGitReady } from '../../core/engine-precondition.js';
 import { clearAppliedFurnaceState } from '../../core/furnace-config.js';
 import { getHead, resetChanges } from '../../core/git.js';
 import { discoverPatches } from '../../core/patch-files.js';
 import { loadPatchesManifest } from '../../core/patch-manifest.js';
 import { getPatchSourceVersion } from '../../core/patch-source-metadata.js';
+import { replayQueueIndexOnly } from '../../core/rebase-dry-run.js';
 import { getRebaseSessionPath, readRebaseSession, saveRebaseSession, } from '../../core/rebase-session.js';
 import { GeneralError } from '../../errors/base.js';
-import { CorruptRebaseSessionError, RebaseSessionExistsError } from '../../errors/rebase.js';
-import { info, intro, outro, spinner } from '../../utils/logger.js';
+import { CorruptRebaseSessionError, RebaseDryRunRejectError, RebaseSessionExistsError, } from '../../errors/rebase.js';
+import { info, intro, outro, spinner, warn } from '../../utils/logger.js';
 import { addWaitLockOption, commanderArgParser, pickDefined, resolveWaitLockSeconds, } from '../../utils/options.js';
-import { parsePositiveIntegerFlag } from '../../utils/validation.js';
+import { compareFirefoxVersions, parsePositiveIntegerFlag } from '../../utils/validation.js';
 import { handleAbort } from './abort.js';
 import { confirmDirtyEngineReset } from './confirm.js';
 import { handleContinue } from './continue.js';
@@ -57,23 +58,51 @@ async function handleFreshStart(projectRoot, options) {
     if (!manifest || manifest.patches.length === 0) {
         throw new GeneralError('No patches found in manifest. Nothing to rebase.');
     }
-    // Determine the "from" version from the patches
-    const patchVersions = new Set(manifest.patches.map((p) => getPatchSourceVersion(p)));
-    const patchProducts = new Set(manifest.patches.map((p) => p.sourceProduct).filter(Boolean));
-    const sortedVersions = [...patchVersions].sort();
+    // Determine the "from" version from the patch stamps. A queue can carry
+    // several: patches re-exported since the last hop are stamped newer than
+    // untouched ones. The oldest stamp is "from", compared semantically (a
+    // lexical sort put 153.10.0esr before 153.2.0esr).
+    const versionCounts = new Map();
+    for (const patch of manifest.patches) {
+        const version = getPatchSourceVersion(patch);
+        versionCounts.set(version, (versionCounts.get(version) ?? 0) + 1);
+    }
+    const sortedVersions = [...versionCounts.keys()].sort(compareFirefoxVersions);
     const fromVersion = sortedVersions[0] ?? currentVersion;
-    const fromProduct = [...patchProducts].sort()[0] ?? config.firefox.product;
-    if (patchVersions.size === 1 && fromVersion === currentVersion) {
+    const fromProduct = manifest.patches.find((p) => getPatchSourceVersion(p) === fromVersion)?.sourceProduct ??
+        config.firefox.product;
+    if (versionCounts.size === 1 && fromVersion === currentVersion) {
         info('All patches already match the current Firefox version. Nothing to rebase.');
         outro('Rebase not needed');
         return;
     }
     info(`Rebasing patches: ${fromVersion} → ${currentVersion}`);
+    if (versionCounts.size > 1) {
+        info(`Patch stamps: ${sortedVersions.map((v) => `${versionCounts.get(v)} at ${v}`).join(', ')}`);
+    }
+    // The rebase replays onto whatever engine/ holds. The pin is the target,
+    // so an engine still on another version means the download step has not
+    // run yet and every verdict below would be against the wrong tree.
+    const engineVersion = (await loadState(projectRoot)).downloadedVersion;
+    if (engineVersion !== undefined && engineVersion !== currentVersion) {
+        warn(`engine/ holds ${engineVersion}, not the pinned target ${currentVersion}. ` +
+            'Run "fireforge download --force" first, or the rebase applies onto the old source.');
+    }
     info(`Found ${manifest.patches.length} patch(es)`);
     info(`Max context-reduction steps (fuzz-like): ${maxFuzz}`);
     if (isDryRun) {
-        info('[dry-run] Would reset engine, apply patches with context reduction, and re-export.');
-        outro('Dry run complete');
+        const patches = await discoverPatches(paths.patches);
+        const replaySpinner = spinner(`Replaying ${patches.length} patch(es) on a private index...`);
+        let replay;
+        try {
+            replay = await replayQueueIndexOnly(paths.engine, patches, maxFuzz);
+            replaySpinner.stop('Replay finished; engine/ untouched');
+        }
+        catch (error) {
+            replaySpinner.error('Replay failed');
+            throw error;
+        }
+        reportDryRunReplay(replay);
         return;
     }
     if (!(await confirmDirtyEngineReset({
@@ -114,6 +143,41 @@ async function handleFreshStart(projectRoot, options) {
     // Run the patch loop
     await runPatchLoop(projectRoot, session, paths, maxFuzz, resolveWaitLockSeconds(options.waitLock));
 }
+/**
+ * Prints one line per patch and a tally, then fails the run when any patch
+ * rejects: a dry run that exits 0 must mean the real rebase would apply the
+ * whole queue.
+ */
+function reportDryRunReplay(replay) {
+    let reduced = 0;
+    const rejected = [];
+    for (const [index, verdict] of replay.verdicts.entries()) {
+        const cascade = replay.firstRejectIndex !== undefined && index > replay.firstRejectIndex
+            ? ' (after an earlier reject; may cascade from it)'
+            : '';
+        switch (verdict.outcome) {
+            case 'clean':
+                info(`  clean            ${verdict.filename}`);
+                break;
+            case 'reduced-context':
+                reduced += 1;
+                info(`  reduced context  ${verdict.filename} (step ${verdict.step}, ${verdict.contextArg})`);
+                break;
+            case 'reject': {
+                rejected.push(verdict.filename);
+                const files = verdict.files.length > 0 ? verdict.files.join(', ') : 'see git output';
+                warn(`  reject           ${verdict.filename}: ${files}${cascade}`);
+                break;
+            }
+        }
+    }
+    const clean = replay.verdicts.length - reduced - rejected.length;
+    info(`[dry-run] ${replay.verdicts.length} patch(es): ${clean} clean, ${reduced} with reduced context, ${rejected.length} rejected.`);
+    if (rejected.length > 0) {
+        throw new RebaseDryRunRejectError(rejected);
+    }
+    outro('Dry run complete: every patch applies');
+}
 // ── Public API ──
 /**
  * Runs the rebase command to orchestrate a Firefox source version upgrade.
@@ -136,7 +200,7 @@ export function registerRebase(program, { getProjectRoot, withErrorHandling }) {
         .description('Semi-automated Firefox source version upgrade — apply patches with drift tolerance and re-export')
         .option('--continue', 'Resume after manually resolving a failed patch')
         .option('--abort', 'Cancel the rebase and restore engine to pre-rebase state')
-        .option('--dry-run', 'Show what would happen without modifying anything')
+        .option('--dry-run', 'Replay the queue onto the engine base commit in a private index and report each patch as clean, reduced-context or reject (exit 6 on any reject); engine/ is not touched')
         .option('--max-fuzz <n>', 'Maximum context-reduction steps for git apply -C<n> (fuzz-like drift tolerance; default: 3)', commanderArgParser((v) => parsePositiveIntegerFlag('--max-fuzz', v)))
         .option('-y, --yes', 'Skip dirty-tree confirmation prompt');
     addWaitLockOption(command).action(withErrorHandling(async (options) => {

package/dist/src/commands/run.js

@@ -8,6 +8,7 @@ import { assertEngineExists } from '../core/engine-precondition.js';
 import { warnIfFurnaceStale } from '../core/furnace-staleness.js';
 import { hasBuildArtifacts, hasRunnableBundle, run, runMachSmoke } from '../core/mach.js';
 import { assertBuildArtifacts } from '../core/mach-build-artifacts.js';
+import { resolveRunProfile, sweepAbandonedRunProfiles, } from '../core/run-profile.js';
 import { compileAllowlistFromFile, compileAllowlistFromStrings, findOverCapAllowlistEntries, matchAllowlist, matchesSmokeError, } from '../core/smoke-patterns.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { BuildError } from '../errors/build.js';
@@ -97,12 +98,38 @@ export async function runCommand(projectRoot, options = {}) {
     await warnIfFurnaceStale(projectRoot);
     // Clean stale profile state to prevent silent startup failures
     await cleanDevProfile(paths.engine);
-    if (options.smokeExit !== undefined) {
-        await runSmokeExit(paths.engine, options);
-        return;
+    // Reclaim temporary profiles a SIGKILLed FireForge could not remove.
+    const swept = await sweepAbandonedRunProfiles();
+    if (swept > 0)
+        verbose(`Removed ${swept} abandoned temporary run profile(s).`);
+    const profile = await resolveRunProfile({
+        profile: options.profile,
+        tempProfile: options.tempProfile,
+        smoke: options.smokeExit !== undefined,
+    });
+    try {
+        if (options.smokeExit !== undefined) {
+            await runSmokeExit(paths.engine, options, profile);
+            return;
+        }
+        info('Launching browser...\n');
+        await runInteractive(paths.engine, options, profile);
+    }
+    finally {
+        await profile.dispose();
     }
-    info('Launching browser...\n');
-    const exitCode = await run(paths.engine, options.headless ? ['--headless'] : []);
+}
+/**
+ * Launches the browser under `mach run` for an interactive session.
+ * @param engineDir - Path to the engine directory
+ * @param options - Run options
+ * @param profile - The profile this run launches with
+ */
+async function runInteractive(engineDir, options, profile) {
+    const exitCode = await run(engineDir, [
+        ...(options.headless ? ['--headless'] : []),
+        ...profile.args,
+    ]);
     // Exit-code whitelist:
     //   0:   clean shutdown
     //   130: SIGINT (Ctrl+C), user-initiated termination
@@ -121,7 +148,7 @@ export async function runCommand(projectRoot, options = {}) {
  * exit contract. The deadline-fires-SIGTERM path is treated as a clean
  * window iff no unallowed errors were observed.
  */
-async function runSmokeExit(engineDir, options) {
+async function runSmokeExit(engineDir, options, profile) {
     // Windows lacks the POSIX process-group primitives --smoke-exit leans on to
     // SIGTERM the whole mach → python → firefox tree. Running through anyway
     // would only kill the top-level wrapper and orphan Firefox content
@@ -194,10 +221,17 @@ async function runSmokeExit(engineDir, options) {
     };
     warnIfHeadedOnDesktop(options.headless === true);
     info(`Launching browser (smoke-exit after ${smokeExit}s)...\n`);
+    if (profile.temporary) {
+        info(`Profile: fresh temporary profile (removed after the run; --profile <path> to use a named one)`);
+    }
+    else if (profile.dir !== undefined) {
+        info(`Profile: ${profile.dir}`);
+    }
     const startedAt = Date.now();
     let result;
     try {
-        result = await runMachSmoke(options.headless ? ['run', '--headless'] : ['run'], engineDir, {
+        const machArgs = ['run', ...(options.headless ? ['--headless'] : []), ...profile.args];
+        result = await runMachSmoke(machArgs, engineDir, {
             smokeTimeoutMs,
             onStdoutLine: (line) => {
                 handleLine('stdout', line);
@@ -358,6 +392,8 @@ export function registerRun(program, { getProjectRoot, withErrorHandling }) {
         .option('--console-allow-file <path>', 'Newline-delimited allowlist regex file. Blank lines and # comments are ignored. A "# max-hits: N" comment directly above an entry caps how many lines it may match in one run; more than that fails the run with exit 12.')
         .option('--capture-console <file>', 'Mirror captured console output to <file> for post-exit inspection.')
         .option('--headless', 'Launch the browser with --headless. Recommended for --smoke-exit on a shared desktop: input into a headed smoke window contaminates the console capture.')
+        .option('--profile <path>', 'Launch with this profile directory (passed to Firefox as -profile). Left in place after the run. With --smoke-exit it replaces the default fresh profile.')
+        .option('--temp-profile', 'Launch with a fresh temporary profile that is removed when the run ends. The default for --smoke-exit.')
         .action(withErrorHandling(
     // `args` is the variadic positional, not a Commander flag, so it
     // never appears in this object.

package/dist/src/commands/status.js

@@ -6,7 +6,7 @@ import { assertEngineExists } from '../core/engine-precondition.js';
 import { formatEngineSessionLockStatus, readEngineSessionLockStatus, } from '../core/engine-session-lock.js';
 import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { getHead, getStatusWithCodes, isGitRepository, isMissingHeadError } from '../core/git.js';
-import { getUntrackedFilesInDir, resolveMaxUntrackedFilesPerDir } from '../core/git-status.js';
+import { listUntrackedFilesInDirs, resolveMaxUntrackedFilesPerDir } from '../core/git-status.js';
 import { renderOwnershipTable } from '../core/ownership-table.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { readProcessCpuSeconds } from '../core/process-cpu-time.js';
@@ -49,9 +49,11 @@ function renderTruncationBanner(truncations) {
 async function expandDirectoryEntries(files, engineDir) {
     const expanded = [];
     const truncations = [];
+    const isCollapsedUntracked = (entry) => entry.file.endsWith('/') && entry.status.includes('?');
+    const untrackedByDir = await listUntrackedFilesInDirs(engineDir, files.filter(isCollapsedUntracked).map((entry) => entry.file));
     for (const entry of files) {
-        if (entry.file.endsWith('/') && entry.status.includes('?')) {
-            const individualFiles = await getUntrackedFilesInDir(engineDir, entry.file);
+        if (isCollapsedUntracked(entry)) {
+            const individualFiles = untrackedByDir.get(entry.file) ?? [];
             const cap = getMaxUntrackedFilesPerDir();
             if (individualFiles.length > cap) {
                 // Recorded once here, reported once by renderTruncationBanner. The

package/dist/src/commands/typecheck.d.ts

@@ -26,6 +26,11 @@ export interface TypecheckCommandOptions {
      * issues without waiting for the full set.
      */
     project?: string;
+    /**
+     * Build every project from scratch and write no incremental build info
+     * (`--no-cache`).
+     */
+    noCache?: boolean;
 }
 /**
  * Resolves the project list to type-check. `--project` wins over

package/dist/src/commands/typecheck.js

@@ -88,7 +88,9 @@ async function runTypecheckCommandBody(projectRoot, options) {
     // use so typecheck checks against the current workspace.
     await regenerateStaleGeneratedJsconfig(projectRoot);
     info(`Running typecheck across ${cfg.projects.length} project(s): ${cfg.projects.join(', ')}`);
-    const results = await runTypecheck(projectRoot, cfg);
+    const results = await runTypecheck(projectRoot, cfg, {
+        ...(options.noCache === true ? { noCache: true } : {}),
+    });
     // Fold the EXPORT-TIME authority into this pass. Per-patch lint runs
     // checkJs over the queue's patch-owned modules in relative isolation and
     // resolves imported typedefs differently from the whole-project pass, so
@@ -193,11 +195,15 @@ export function registerTypecheck(program, { getProjectRoot, withErrorHandling }
         .command('typecheck')
         .description('Run TypeScript type checking against project-owned jsconfig.json files (CI-grade, whole-project)')
         .option('--project <path>', 'Override typecheck.projects with a single jsconfig.json path (one-off run)')
+        .option('--no-cache', 'Check every project from scratch; neither read nor write the incremental build info in .fireforge/typecheck/')
         .action(withErrorHandling(async (options) => {
         const opts = {};
         if (options.project !== undefined) {
             opts.project = options.project;
         }
+        if (options.cache === false) {
+            opts.noCache = true;
+        }
         await typecheckCommand(getProjectRoot(), opts);
     }));
 }

package/dist/src/core/build-prepare.d.ts

@@ -58,6 +58,8 @@ export declare function isBackendInvalidatingFile(path: string): boolean;
  * 3. Sets up branding directory if not already done
  * 4. Applies Furnace components if furnace.json exists
  * 5. Generates mozconfig
+ * 6. Runs `mach configure` when a backend-invalidating input, including
+ * the mozconfig just generated, changed since the previous baseline
  *
  * @param projectRoot - Root directory of the project
  * @param paths - Resolved project paths

package/dist/src/core/build-prepare.js

@@ -14,6 +14,7 @@ import { isBrandingSetup, setupBranding } from './branding.js';
 import { isBuildInputPath, isJarManifestPath } from './build-audit.js';
 import { evaluateJarManifestEscalation, formatJarEscalationNotice, } from './build-jar-escalation.js';
 import { findUnexportedDriftAtRisk, formatUnexportedDriftWarning, } from './build-overwrite-guard.js';
+import { hashEngineFile } from './coverage-extend.js';
 import { collectChangedEnginePaths, dropPathsMatchingFingerprints } from './engine-changes.js';
 import { applyAllComponents } from './furnace-apply.js';
 import { logApplyWarnings } from './furnace-apply-output.js';
@@ -231,6 +232,40 @@ async function applyFurnaceBeforeBuild(projectRoot) {
     }
     return furnaceApplied;
 }
+/**
+ * Runs the auto-configure step (`mach configure`) against the freshly
+ * generated mozconfig, surfacing the underlying mozbuild error on failure.
+ * @param engineDir - Path to the engine directory
+ * @param triggers - Why the backend is being regenerated, for the notice
+ */
+async function runAutoConfigure(engineDir, triggers) {
+    // Warning severity: this is the "why is this run slow" explanation,
+    // and an info-level line does not survive an agent output filter that
+    // keeps only warnings and errors.
+    notice(`Backend config changed; running backend regeneration first (${triggers}). Backend command: mach configure.`);
+    const configureSpinner = spinner('Running mach configure...');
+    try {
+        const captured = await runMachCapture(['configure'], engineDir);
+        const exitCode = captured.exitCode;
+        if (exitCode !== 0) {
+            configureSpinner.error(`mach configure failed with exit code ${exitCode}`);
+            // Surface the underlying mozbuild error (e.g. UnsortedError)
+            // instead of a bare exit code, since the generic message hid the
+            // actual cause, plus any matched mach-error hints (see the helper).
+            throw buildConfigureFailureError(captured);
+        }
+        configureSpinner.stop('Backend regenerated successfully (mach configure exit code 0)');
+        info('Backend regeneration succeeded; continuing with build.');
+    }
+    catch (error) {
+        if (error instanceof BuildError) {
+            throw error;
+        }
+        configureSpinner.error('mach configure failed');
+        verbose(`Auto-configure error: ${toError(error).message}`);
+        throw new BuildError(`Backend regeneration failed while running mach configure: ${toError(error).message}. Build stopped because continuing would hide the real configure failure.`, 'mach configure', error instanceof Error ? error : undefined);
+    }
+}
 /**
  * Runs the shared pre-flight steps for build and package commands:
  * 1. Warns (or refuses) about unexported engine drift the writes below
@@ -239,6 +274,8 @@ async function applyFurnaceBeforeBuild(projectRoot) {
  * 3. Sets up branding directory if not already done
  * 4. Applies Furnace components if furnace.json exists
  * 5. Generates mozconfig
+ * 6. Runs `mach configure` when a backend-invalidating input, including
+ * the mozconfig just generated, changed since the previous baseline
  *
  * @param projectRoot - Root directory of the project
  * @param paths - Resolved project paths
@@ -259,11 +296,16 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
         }
     }
     await reportUnexportedDriftBeforeOverwrite(projectRoot, config, options);
-    // Auto-configure: if any backend-invalidating file (moz.build, moz.configure,
-    // Makefile.in) changed since the last successful build, run `mach configure`
-    // before the build step. Prevents incremental builds from silently skipping
-    // work against a stale recursive-make backend.
-    let reconfigured = false;
+    // Auto-configure census: if any backend-invalidating file (moz.build,
+    // moz.configure, Makefile.in) changed since the last successful build,
+    // `mach configure` runs before the build step. Prevents incremental builds
+    // from silently skipping work against a stale recursive-make backend. The
+    // configure itself waits until the mozconfig below has been regenerated:
+    // run earlier, it configured against the previous engine/mozconfig, and a
+    // configs/ fix for a failing configure (a pinned --with-macos-sdk) could
+    // never take effect because the failure stopped the build before the
+    // regeneration.
+    const configureTriggers = [];
     let fullBuildRequired = false;
     let fullBuildReason;
     if (options.previousBaseline) {
@@ -273,35 +315,7 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
         fullBuildRequired = jarEscalation !== undefined;
         fullBuildReason = jarEscalation;
         if (invalidating.length > 0) {
-            // Warning severity: this is the "why is this run slow" explanation,
-            // and an info-level line does not survive an agent output filter that
-            // keeps only warnings and errors.
-            notice(`Backend config changed; running backend regeneration first (${invalidating.length} file${invalidating.length === 1 ? '' : 's'} touched). Backend command: mach configure.`);
-            const configureSpinner = spinner('Running mach configure...');
-            try {
-                const captured = await runMachCapture(['configure'], paths.engine);
-                const exitCode = captured.exitCode;
-                if (exitCode !== 0) {
-                    configureSpinner.error(`mach configure failed with exit code ${exitCode}`);
-                    // Surface the underlying mozbuild error (e.g. UnsortedError)
-                    // instead of a bare exit code, since the generic message hid the
-                    // actual cause, plus any matched mach-error hints (see the helper).
-                    throw buildConfigureFailureError(captured);
-                }
-                else {
-                    configureSpinner.stop('Backend regenerated successfully (mach configure exit code 0)');
-                    info('Backend regeneration succeeded; continuing with build.');
-                    reconfigured = true;
-                }
-            }
-            catch (error) {
-                if (error instanceof BuildError) {
-                    throw error;
-                }
-                configureSpinner.error('mach configure failed');
-                verbose(`Auto-configure error: ${toError(error).message}`);
-                throw new BuildError(`Backend regeneration failed while running mach configure: ${toError(error).message}. Build stopped because continuing would hide the real configure failure.`, 'mach configure', error instanceof Error ? error : undefined);
-            }
+            configureTriggers.push(`${invalidating.length} file${invalidating.length === 1 ? '' : 's'} touched`);
         }
     }
     // Clean stories before build to ensure they don't leak into production binary
@@ -333,14 +347,32 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
     const furnaceApplied = await applyFurnaceBeforeBuild(projectRoot);
     // Generate mozconfig
     const mozconfigSpinner = spinner('Generating mozconfig...');
+    let mozconfigWritten;
     try {
-        await generateMozconfig(paths.configs, paths.engine, config);
+        mozconfigWritten = await generateMozconfig(paths.configs, paths.engine, config);
         mozconfigSpinner.stop('mozconfig generated');
     }
     catch (error) {
         mozconfigSpinner.error('Failed to generate mozconfig');
         throw error;
     }
+    // A changed mozconfig is itself backend-invalidating. Compare against the
+    // hash the last successful build recorded; a baseline from before that
+    // field existed falls back to whether this run rewrote the file.
+    if (options.previousBaseline) {
+        const recorded = options.previousBaseline.mozconfigHash;
+        const mozconfigChanged = recorded !== undefined
+            ? (await hashEngineFile(paths.engine, 'mozconfig')) !== recorded
+            : mozconfigWritten;
+        if (mozconfigChanged) {
+            configureTriggers.push('engine/mozconfig changed since the last build');
+        }
+    }
+    let reconfigured = false;
+    if (configureTriggers.length > 0) {
+        await runAutoConfigure(paths.engine, configureTriggers.join('; '));
+        reconfigured = true;
+    }
     return {
         furnaceApplied,
         reconfigured,

package/dist/src/core/config-paths.d.ts

@@ -7,7 +7,7 @@ export declare const FIREFORGE_DIR = ".fireforge";
 /** Supported top-level fireforge.json keys backed by the current schema. */
 export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "buildAudit", "test", "externalToolchains", "license", "wire", "patchLint", "patchPolicy", "typecheck", "markerComment"];
 /** Supported config paths that can be read or set without --force. */
-export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
+export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchLint.forwardRegistration", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
 /**
  * Gets all project paths based on a root directory.
  * @param root - Root directory of the project

package/dist/src/core/config-paths.js

@@ -68,6 +68,7 @@ export const SUPPORTED_CONFIG_PATHS = [
     'patchLint.jsdocClassMethods',
     'patchLint.testAssertionFloor',
     'patchLint.chromeScriptJsDoc',
+    'patchLint.forwardRegistration',
     'patchPolicy',
     'typecheck',
     'typecheck.projects',

package/dist/src/core/config-validate.js

@@ -376,6 +376,13 @@ function parsePatchLintBlock(rec) {
     if (fileSizeThresholds !== undefined) {
         out.fileSizeThresholds = parsePatchLintFileSizeThresholds(fileSizeThresholds);
     }
+    const forwardRegistration = rec.raw('forwardRegistration');
+    if (forwardRegistration !== undefined) {
+        if (forwardRegistration !== 'support-files' && forwardRegistration !== 'extended') {
+            throw new ConfigError('Config field "patchLint.forwardRegistration" must be one of: support-files, extended');
+        }
+        out.forwardRegistration = forwardRegistration;
+    }
     for (const key of PATCH_LINT_SEVERITY_GATE_KEYS) {
         const gate = parseSeverityGate(rec.raw(key), `patchLint.${key}`);
         if (gate !== undefined)

package/dist/src/core/discard-baseline.js

@@ -53,11 +53,12 @@ export async function planDiscardBaselines(patchesDir, engineDir, entries) {
     if (claimedEntries.length === 0) {
         return planUpstreamDiscards(entries);
     }
-    const { computePatched } = await createPatchedContentContext(patchesDir, engineDir);
+    const { computePatched, prefetchBase } = await createPatchedContentContext(patchesDir, engineDir);
     const claimedFiles = [
         ...new Set(claimedEntries.flatMap((entry) => entry.originalPath !== undefined ? [entry.file, entry.originalPath] : [entry.file])),
     ];
     const trackedInHead = await listTrackedInHead(engineDir, claimedFiles);
+    await prefetchBase(claimedFiles);
     const computeExpected = async (path) => {
         try {
             return await computePatched(path);

package/dist/src/core/forward-registrations.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Public, queue-level entry point to the `forward-registration` census.
+ *
+ * A consumer that keeps its own audit (a ratchet baseline over forward
+ * edges, say) runs the rule's own predicate here instead of mirroring it.
+ * Lives apart from the rule module because it builds the queue context,
+ * which imports the rule back.
+ */
+import type { FireForgeConfig } from '../types/config.js';
+import type { ForwardRegistration, ForwardRegistrationScope } from './patch-lint-forward-registration-extended.js';
+/** Options for {@link findForwardRegistrations}. */
+export interface FindForwardRegistrationsOptions {
+    /**
+     * Which carriers to check. Defaults to `'extended'` (every carrier the
+     * rule can resolve), since a census wants the whole picture whatever the
+     * lint gate is configured to enforce.
+     */
+    scope?: ForwardRegistrationScope;
+    /** Project config, for the queue's patchPolicy ordering context. Optional. */
+    config?: FireForgeConfig;
+}
+/**
+ * Lists every undeclared forward registration in a patch queue: a line a
+ * patch adds (to a test manifest, jar.mn, moz.build or customElements.js)
+ * that names a file only a later-ordered patch creates. Each record carries
+ * the paste-and-run `patch staged-dependency` command that declares it.
+ *
+ * @param patchesDir - The project's `patches/` directory
+ * @param options - Scope and optional config
+ * @returns One record per (patch, carrier file, created file)
+ */
+export declare function findForwardRegistrations(patchesDir: string, options?: FindForwardRegistrationsOptions): Promise<ForwardRegistration[]>;
+export type { ForwardRegistration, ForwardRegistrationKind, ForwardRegistrationScope, } from './patch-lint-forward-registration-extended.js';

package/dist/src/core/forward-registrations.js

@@ -0,0 +1,16 @@
+import { buildPatchQueueContext } from './patch-lint-cross.js';
+import { collectForwardRegistrations } from './patch-lint-forward-registration.js';
+/**
+ * Lists every undeclared forward registration in a patch queue: a line a
+ * patch adds (to a test manifest, jar.mn, moz.build or customElements.js)
+ * that names a file only a later-ordered patch creates. Each record carries
+ * the paste-and-run `patch staged-dependency` command that declares it.
+ *
+ * @param patchesDir - The project's `patches/` directory
+ * @param options - Scope and optional config
+ * @returns One record per (patch, carrier file, created file)
+ */
+export async function findForwardRegistrations(patchesDir, options = {}) {
+    const ctx = await buildPatchQueueContext(patchesDir, options.config);
+    return collectForwardRegistrations(ctx, options.scope ?? 'extended');
+}