@hominis/fireforge 0.48.0 → 0.49.1

package/dist/src/core/token-category.js

@@ -14,12 +14,6 @@ import { join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText } from '../utils/fs.js';
 import { escapeRegex } from '../utils/regex.js';
-function singleLineBannerPattern(category) {
-    return new RegExp(`\\/\\*\\s*=+\\s*${escapeRegex(category)}\\s*=+\\s*\\*\\/`);
-}
-function multiLineBlockNameMatches(blockLine, category) {
-    return blockLine.replace(/^\s*\*\s*/, '').trim() === category;
-}
 /**
  * Body of the first `/* … *\/` comment on `line`, or `undefined` when the
  * line carries no closed block comment.
@@ -85,37 +79,8 @@ function singleLineBannerName(line) {
  * agree on what "exists" means.
  */
 export function categoryHeaderExists(lines, category) {
-    const singleLinePattern = singleLineBannerPattern(category);
-    for (const [i, line] of lines.entries()) {
-        if (singleLinePattern.test(line)) {
-            return true;
-        }
-        if (/^\s*\/\*\s*=+/.test(line) && !/\*\//.test(line)) {
-            for (let j = i + 1; j < Math.min(i + 6, lines.length); j++) {
-                const blockLine = lines[j] ?? '';
-                if (multiLineBlockNameMatches(blockLine, category)) {
-                    return true;
-                }
-                if (/\*\//.test(blockLine))
-                    break;
-            }
-        }
-    }
-    return false;
+    return parseTokenCategorySections(lines).some((section) => section.name === category);
 }
-/**
- * Scans a tokens CSS file for category header comments and returns the
- * category names in document order. Used to enrich the "category not
- * found" error body with concrete alternatives the operator can copy.
- *
- * Mirrors the shapes `findCategorySection` recognises:
- * - Single-line: `/* = Foo = *\/`
- * - Multi-line: `/* =====` opening, `Foo` on any of the next ~5 lines,
- *   closing `*\/`.
- *
- * This helper exists as a pure inspector. It never throws on malformed
- * headers and silently skips shapes it cannot parse.
- */
 /**
  * Category name declared by the banner starting at `index`, or `undefined`
  * when that line opens no banner.
@@ -128,7 +93,7 @@ export function categoryHeaderExists(lines, category) {
  * @param index - 0-based line index to test
  * @returns The declared category name, or undefined
  */
-export function categoryBannerNameAt(lines, index) {
+function categoryBannerNameAt(lines, index) {
     const line = lines[index] ?? '';
     const extracted = singleLineBannerName(line);
     if (extracted !== undefined)
@@ -149,13 +114,40 @@ export function categoryBannerNameAt(lines, index) {
     return undefined;
 }
 function discoverCategoryHeaders(lines) {
-    const categories = new Set();
-    for (let i = 0; i < lines.length; i++) {
-        const name = categoryBannerNameAt(lines, i);
-        if (name !== undefined)
-            categories.add(name);
+    return [...new Set(parseTokenCategorySections(lines).map((section) => section.name))];
+}
+/** Parses category regions owned by the base root, including nested CSS rules. */
+export function parseTokenCategorySections(lines) {
+    const bounds = findBaseRootBounds(lines);
+    if (bounds === undefined || bounds.close === -1)
+        return [];
+    const masked = maskCommentLines(lines);
+    const sections = [];
+    let current;
+    let bodyStarted = false;
+    for (let index = bounds.open + 1; index < bounds.close; index++) {
+        const line = lines[index] ?? '';
+        const name = categoryBannerNameAt(lines, index);
+        const boundary = name !== undefined || isSingleLineBannerLine(line);
+        if (!boundary) {
+            if ((masked[index] ?? '').trim())
+                bodyStarted = true;
+            continue;
+        }
+        // A decorative rule immediately after a named header belongs to that
+        // header. A later rule, after declarations, ends its section.
+        if (name === undefined && current && !bodyStarted)
+            continue;
+        if (current)
+            current.sectionEnd = index;
+        current = undefined;
+        if (name !== undefined) {
+            current = { name, categoryLine: index, sectionEnd: bounds.close };
+            bodyStarted = false;
+            sections.push(current);
+        }
     }
-    return [...categories];
+    return sections;
 }
 /**
  * Asserts the category banner exists (or that creation was requested).
@@ -204,30 +196,9 @@ export function declareCategoryBanner(lines, category, tokensCssPath) {
 }
 /** Locates and bounds the named category section. Throws when absent. */
 export function findCategorySection(lines, category, tokensCssPath) {
-    const singleLinePattern = singleLineBannerPattern(category);
-    let categoryLine = -1;
-    for (const [i, line] of lines.entries()) {
-        // Check single-line format: /* = Category = */
-        if (singleLinePattern.test(line)) {
-            categoryLine = i;
-            break;
-        }
-        // Check multi-line format: line opens a block comment with === but does not close it
-        if (/^\s*\/\*\s*=+/.test(line) && !/\*\//.test(line)) {
-            for (let j = i + 1; j < Math.min(i + 6, lines.length); j++) {
-                const blockLine = lines[j] ?? '';
-                if (multiLineBlockNameMatches(blockLine, category)) {
-                    categoryLine = i;
-                    break;
-                }
-                if (/\*\//.test(blockLine))
-                    break;
-            }
-            if (categoryLine !== -1)
-                break;
-        }
-    }
-    if (categoryLine === -1) {
+    const sections = parseTokenCategorySections(lines);
+    const section = sections.find((entry) => entry.name === category);
+    if (section === undefined) {
         const discoveredCategories = discoverCategoryHeaders(lines);
         const available = discoveredCategories.length > 0
             ? `Available categories in the file: ${discoveredCategories.map((name) => `"${name}"`).join(', ')}.`
@@ -236,45 +207,73 @@ export function findCategorySection(lines, category, tokensCssPath) {
             `${available}\n\n` +
             'Add a header by hand inside the :root block (format: "/* = My Category = */") or re-run "fireforge furnace init --force" to re-seed the default categories.');
     }
-    // Find the end of this category section (next section header or closing })
-    // Skip past the current header block first
-    let scanStart = categoryLine + 1;
-    for (let i = categoryLine + 1; i < lines.length; i++) {
-        const line = lines[i] ?? '';
-        if (/^\s*\/\*\s*=/.test(line) || /^\s*\*\s*=/.test(line) || /^\s*\*\//.test(line)) {
-            scanStart = i + 1;
+    return { categoryLine: section.categoryLine, sectionEnd: section.sectionEnd };
+}
+/**
+ * Drops complete quoted strings from one CSS line in linear time. An
+ * unterminated quote is kept, and once one fails to close every later quote
+ * of that kind fails too, so no start position is ever rescanned.
+ */
+function stripCssStrings(line) {
+    let out = '';
+    const unterminated = new Set();
+    for (let i = 0; i < line.length; i++) {
+        const quote = line.charAt(i);
+        if ((quote !== '"' && quote !== "'") || unterminated.has(quote)) {
+            out += quote;
             continue;
         }
-        break;
-    }
-    let sectionEnd = lines.length;
-    for (let i = scanStart; i < lines.length; i++) {
-        const line = lines[i] ?? '';
-        if (isSingleLineBannerLine(line) ||
-            (/^\s*\/\*\s*=+/.test(line) && !/\*\//.test(line)) ||
-            /^\s*\}/.test(line)) {
-            sectionEnd = i;
-            break;
+        let end = i + 1;
+        while (end < line.length && line.charAt(end) !== quote)
+            end += line.charAt(end) === '\\' ? 2 : 1;
+        if (end >= line.length) {
+            unterminated.add(quote);
+            out += quote;
+        }
+        else {
+            i = end;
         }
     }
-    return { categoryLine, sectionEnd };
+    return out;
 }
 /** 0-based open/close line indices of the base `:root {` block. */
 export function findBaseRootBounds(lines) {
     const open = lines.findIndex((line) => /:root\s*\{/.test(line));
     if (open === -1)
         return undefined;
-    for (let i = open + 1; i < lines.length; i++) {
-        if (/^\s*\}/.test(lines[i] ?? '')) {
-            return { open, close: i };
+    const masked = maskCommentLines(lines);
+    let depth = 0;
+    for (let i = open; i < lines.length; i++) {
+        // Ignore braces in CSS strings (including data URLs).
+        const code = stripCssStrings(masked[i] ?? '');
+        for (const char of code) {
+            if (char === '{')
+                depth++;
+            if (char === '}' && --depth === 0)
+                return { open, close: i };
         }
     }
     return { open, close: -1 };
 }
 /** Masks block-comment content per line so declarations inside comments never match. */
 export function maskCommentLines(lines) {
-    const masked = lines.join('\n').replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, ' '));
-    return masked.split('\n');
+    const source = lines.join('\n');
+    const parts = [];
+    let cursor = 0;
+    for (;;) {
+        const open = source.indexOf('/*', cursor);
+        if (open === -1)
+            break;
+        const close = source.indexOf('*/', open + 2);
+        // An unfinished edit has no complete comment to mask. Searching only
+        // once prevents restarting a regex at every repeated comment opener.
+        if (close === -1)
+            break;
+        parts.push(source.slice(cursor, open), source.slice(open, close + 2).replace(/[^\n]/g, ' '));
+        cursor = close + 2;
+    }
+    parts.push(source.slice(cursor));
+    return parts.join('').split('\n');
 }
 /**
  * Finds an existing declaration of `tokenName` inside the base `:root`
@@ -288,38 +287,13 @@ export function findTokenDeclarationInRoot(lines, tokenName) {
     if (bounds === undefined || bounds.close === -1)
         return undefined;
     const masked = maskCommentLines(lines);
+    const sections = parseTokenCategorySections(lines);
     const declPattern = new RegExp(`^\\s*${escapeRegex(tokenName)}\\s*:`);
     for (let i = bounds.open + 1; i < bounds.close; i++) {
         if (!declPattern.test(masked[i] ?? ''))
             continue;
-        const category = findSectionNameAbove(lines, i);
+        const category = sections.find((section) => i > section.categoryLine && i < section.sectionEnd)?.name;
         return category === undefined ? { line: i + 1 } : { line: i + 1, category };
     }
     return undefined;
 }
-/** Nearest category banner name above `lineIndex`, if any. */
-function findSectionNameAbove(lines, lineIndex) {
-    const singleLinePattern = /\/\*\s*=+\s*(.+?)\s*=+\s*\*\//;
-    for (let i = lineIndex - 1; i >= 0; i--) {
-        const line = lines[i] ?? '';
-        const singleMatch = singleLinePattern.exec(line);
-        if (singleMatch?.[1]) {
-            const extracted = singleMatch[1].trim();
-            if (extracted.length > 0 && !/^=+$/.test(extracted))
-                return extracted;
-            continue;
-        }
-        if (/^\s*\/\*\s*=+/.test(line) && !/\*\//.test(line)) {
-            for (let j = i + 1; j < Math.min(i + 6, lines.length); j++) {
-                const blockLine = lines[j] ?? '';
-                if (/\*\//.test(blockLine))
-                    break;
-                const trimmed = blockLine.replace(/^\s*\*\s*/, '').trim();
-                if (trimmed.length === 0 || /^=+$/.test(trimmed))
-                    continue;
-                return trimmed;
-            }
-        }
-    }
-    return undefined;
-}

package/dist/src/core/token-inventory.js

@@ -8,12 +8,12 @@
  * categories a project actually has, so the only way to name one correctly
  * was to hand-parse a neighbouring `= Category =` banner out of the file.
  * This module is that report. It reuses the banner and
- * `:root`-bounds primitives from `token-category.ts` rather than parsing
+ * category-region model from `token-category.ts` rather than parsing
  * tokens CSS a second way: two readers that disagree on what a banner is
  * would put `token list` and `token add` in different sections of the same
  * file.
  */
-import { categoryBannerNameAt, findBaseRootBounds, maskCommentLines } from './token-category.js';
+import { findBaseRootBounds, maskCommentLines, parseTokenCategorySections, } from './token-category.js';
 /** Matches a custom-property declaration and captures its name and value. */
 const DECLARATION_PATTERN = /^\s*(--[A-Za-z0-9_-]+)\s*:\s*([^;]*);?/;
 /**
@@ -32,14 +32,18 @@ export function collectTokenInventory(lines) {
     if (bounds === undefined || bounds.close === -1)
         return [];
     const masked = maskCommentLines(lines);
+    const sections = parseTokenCategorySections(lines);
+    const headers = new Map(sections.map((section) => [section.categoryLine, section]));
     const groups = [];
     let current;
+    let sectionEnd = bounds.close;
     for (let i = bounds.open + 1; i < bounds.close; i++) {
-        // Banners are read from the raw lines: `maskCommentLines` blanks comment
-        // bodies, which is exactly what a banner is.
-        const banner = categoryBannerNameAt(lines, i);
-        if (banner !== undefined) {
-            current = { category: banner, tokens: [] };
+        if (i >= sectionEnd)
+            current = undefined;
+        const section = headers.get(i);
+        if (section !== undefined) {
+            current = { category: section.name, tokens: [] };
+            sectionEnd = section.sectionEnd;
             groups.push(current);
             continue;
         }
@@ -48,6 +52,7 @@ export function collectTokenInventory(lines) {
             continue;
         if (current === undefined) {
             current = { category: null, tokens: [] };
+            sectionEnd = bounds.close;
             groups.push(current);
         }
         current.tokens.push({ name: match[1], line: i + 1, value: (match[2] ?? '').trim() });

package/dist/src/core/typecheck.js

@@ -26,6 +26,7 @@ import { sha256Hex } from '../utils/hash.js';
 import { verbose } from '../utils/logger.js';
 import { getPackageVersion } from '../utils/package-root.js';
 import { normalizePathSlashes } from '../utils/paths.js';
+import { withGeckoDomTypes } from './gecko-dom-types.js';
 import { composeShimSource, SHIM_FILENAME, SUPPRESSED_DIAGNOSTIC_CODES, UNDEFINED_IDENTIFIER_CODES, UNDEFINED_IDENTIFIER_HINT, } from './typecheck-shim.js';
 /**
  * Sentinel string surfaced as a `TypecheckIssue.message` when the
@@ -252,7 +253,7 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
     // filtered out below, so the pass reports failures that do not exist.
     const shimPath = normalizePathSlashes(resolve(projectDir, `.fireforge-${SHIM_FILENAME}`));
     const rootFiles = [...parsed.fileNames, shimPath];
-    const defaultHost = ts.createCompilerHost(options);
+    const defaultHost = withGeckoDomTypes(ts, ts.createCompilerHost(options));
     const host = {
         ...defaultHost,
         getSourceFile(fileName, languageVersion, onError, shouldCreate) {
@@ -293,11 +294,10 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
         program = ts.createProgram(rootFiles, options, host);
     }
     else {
-        const builder = ts.createIncrementalProgram({
-            rootNames: rootFiles,
-            options: { ...options, incremental: true, tsBuildInfoFile: buildInfoFile },
-            host: withSourceFileVersions(host),
-        });
+        // Always check the entire project in root order. Restoring TypeScript's
+        // per-file semantic cache makes checkJs inference depend on the first
+        // invalidated importer and can both invent and hide diagnostics.
+        const builder = ts.createEmitAndSemanticDiagnosticsBuilderProgram(rootFiles, { ...options, incremental: true, tsBuildInfoFile: buildInfoFile }, withSourceFileVersions(host));
         program = builder;
         // Under noEmit, emit() writes the build info and nothing else.
         writeBuildInfo = () => {

package/dist/src/types/commands/options.d.ts

@@ -109,6 +109,8 @@ export interface SourceSetOptions {
  * Options for the build command.
  */
 export interface BuildOptions extends EngineLockWaitable {
+    /** Wait for the objdir browser before deploying/building. */
+    waitBrowser?: number | boolean;
     /** Fast UI-only rebuild */
     ui?: boolean;
     /** Number of parallel jobs */
@@ -368,6 +370,8 @@ export interface ReExportOptions extends EngineLockWaitable {
      * rather than hidden.
      */
     expectUnmanaged?: string[];
+    /** Explicitly retire named absent patch-created files in a scan-less export. */
+    expectRemoved?: string[];
 }
 /**
  * Options for the `fireforge patch tier` subcommand. Sets or clears the
@@ -551,6 +555,12 @@ export interface RunOptions {
  * Options for the test command.
  */
 export interface TestOptions extends EngineLockWaitable {
+    /** Queue behind a browser using this objdir; bare flag means 60 seconds. */
+    waitBrowser?: number | boolean;
+    /** Queue behind the mochitest/Marionette port holder. */
+    waitPort?: number | boolean;
+    /** Copy a file into the profile at a relative destination (repeatable source=destination). */
+    profileFile?: string[];
     /** Run tests in headless mode */
     headless?: boolean;
     /**
@@ -675,9 +685,10 @@ export interface TestOptions extends EngineLockWaitable {
      */
     perfSamples?: string;
     /**
-     * Seeded file-order shuffle for mochitest runs. `true` draws a fresh seed;
-     * a number replays one. Forwarded as mach `--shuffle` with the seed
-     * exported as `FIREFORGE_SHUFFLE_SEED` and stamped on the verdict line.
+     * Seeded isolated path-argument order for mochitest runs. `true` draws a
+     * fresh seed; a number replays the shard permutation. Native mach
+     * `--shuffle` within a shard remains unseeded. Also exported as
+     * `FIREFORGE_SHUFFLE_SEED` for custom task code and recorded on the verdict.
      */
     shuffle?: number | boolean;
 }

package/dist/src/utils/assert.js

@@ -11,13 +11,8 @@
  * says the opposite: nothing the operator could have done would have
  * prevented it.
  *
- * Every check routes through a helper here rather than being open-coded
- * as `if (!condition) throw`. An inline throw adds a
- * permanently-uncovered branch to every function it appears in, and the
- * per-module coverage floors in `scripts/check-coverage-thresholds.mjs`
- * would pay for it in ~40 places. Routed through a call, the branch lives
- * here once and is covered here once, and the `complexity` ceiling in
- * `eslint.config.js` does not see it at all.
+ * Shared helpers provide consistent classification and TypeScript narrowing,
+ * and keep expensive failure descriptions lazy on successful paths.
  *
  * This module is a leaf: it imports the error class and nothing else, per
  * the dependency-direction note in `src/utils/errors.ts`.

package/dist/src/utils/child-env.d.ts

@@ -1,8 +1,5 @@
 /**
  * Environment construction for spawned children.
- *
- * Its own module rather than a helper inside `process.ts` only because that
- * file sits on a 500-line budget. The logic belongs to the exec layer.
  */
 /** The `env` / `envUnset` slice of exec options this module needs. */
 interface ChildEnvOptions {

package/dist/src/utils/child-env.js

@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
  * Environment construction for spawned children.
- *
- * Its own module rather than a helper inside `process.ts` only because that
- * file sits on a 500-line budget. The logic belongs to the exec layer.
  */
 /**
  * The child's environment: `process.env`, with `env` merged over it, then

package/dist/src/utils/concurrency.d.ts

@@ -1,8 +1,8 @@
 /**
  * Bounded-concurrency helpers shared by commands that fan out per-file IO
  * (status classification, import's unmanaged-dirty guard, re-export scans,
- * the dry-run purity guard). Kept tiny: one order-preserving mapper, no
- * queues, no cancellation.
+ * the dry-run purity guard). On failure, stop scheduling new items and await
+ * every started operation before rejecting, so callers can safely clean up.
  */
 /** Maps items with at most `limit` in-flight promises. Preserves order. */
 export declare function mapWithConcurrency<T, R>(items: readonly T[], limit: number, fn: (item: T, index: number) => Promise<R>): Promise<R[]>;

package/dist/src/utils/concurrency.js

@@ -1,21 +1,32 @@
 /**
  * Bounded-concurrency helpers shared by commands that fan out per-file IO
  * (status classification, import's unmanaged-dirty guard, re-export scans,
- * the dry-run purity guard). Kept tiny: one order-preserving mapper, no
- * queues, no cancellation.
+ * the dry-run purity guard). On failure, stop scheduling new items and await
+ * every started operation before rejecting, so callers can safely clean up.
  */
 /** Maps items with at most `limit` in-flight promises. Preserves order. */
 export async function mapWithConcurrency(items, limit, fn) {
+    if (!Number.isSafeInteger(limit) || limit < 1) {
+        throw new RangeError('Concurrency limit must be a positive integer');
+    }
     const results = new Array(items.length);
     let next = 0;
+    const state = {};
     const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
-        for (;;) {
+        while (!state.failure) {
             const index = next++;
             if (index >= items.length)
                 return;
-            results[index] = await fn(items[index], index);
+            try {
+                results[index] = await fn(items[index], index);
+            }
+            catch (error) {
+                state.failure ??= { error };
+            }
         }
     });
     await Promise.all(workers);
+    if (state.failure)
+        throw state.failure.error;
     return results;
 }

package/dist/src/utils/fs.js

@@ -99,7 +99,17 @@ export async function isSymlink(path) {
  */
 export async function copyFile(src, dest) {
     await ensureParentDir(dest);
-    await fsCopyFile(src, dest);
+    // Never follow a destination symlink or truncate a shared hardlink:
+    // build/deploy copies must not write through into components/ or a peer.
+    const tempPath = createAtomicTempPath(dest);
+    try {
+        await fsCopyFile(src, tempPath);
+        await renameWithRetries(tempPath, dest);
+        await syncParentDir(dest);
+    }
+    finally {
+        await rm(tempPath, { force: true });
+    }
 }
 /**
  * Reads a JSON file and parses it.

package/dist/src/utils/options.d.ts

@@ -89,7 +89,22 @@ export declare function resolveWaitLockSeconds(value: string | number | boolean
  */
 export declare function sessionWaitLockMs(): number | undefined;
 /**
- * Recursively gives every command in the tree a `--wait-lock` flag: the
+ * Registers `--wait-lock [seconds]` on a command that takes no lock, so a
+ * scripted sequence can blanket-append the flag without hitting a usage
+ * error. A command that rejects it with "unknown option" kills the whole
+ * sequence with a usage error instead of a lock message.
+ *
+ * The flag is accepted and ignored here, never silently repurposed, and
+ * the help text says so, so nobody reads its presence as evidence that this
+ * command waits for anything.
+ *
+ * The value is parsed and validated exactly as the honoring variant does:
+ * `--wait-lock nonsense` must still be a usage error everywhere, or the
+ * uniformity would be a lie.
+ */
+export declare function addAcceptedWaitLockOption(command: Command): Command;
+/**
+ * Recursively gives every leaf command in the tree a `--wait-lock` flag: the
  * honoring registration where one already exists, the accept-and-ignore
  * one everywhere else.
  */

package/dist/src/utils/options.js

@@ -182,7 +182,7 @@ export function sessionWaitLockMs() {
  * `--wait-lock nonsense` must still be a usage error everywhere, or the
  * uniformity would be a lie.
  */
-function addAcceptedWaitLockOption(command) {
+export function addAcceptedWaitLockOption(command) {
     return command.option('--wait-lock [seconds]', 'Accepted for scripting uniformity and ignored: this command takes no FireForge lock', commanderArgParser((raw) => resolveWaitLockSeconds(raw)));
 }
 /**
@@ -194,13 +194,15 @@ function hasWaitLockOption(command) {
     return command.options.some((option) => option.long === '--wait-lock');
 }
 /**
- * Recursively gives every command in the tree a `--wait-lock` flag: the
+ * Recursively gives every leaf command in the tree a `--wait-lock` flag: the
  * honoring registration where one already exists, the accept-and-ignore
  * one everywhere else.
  */
 export function ensureWaitLockOptionEverywhere(command) {
     for (const sub of command.commands) {
-        if (!hasWaitLockOption(sub))
+        // Commander groups otherwise capture a trailing leaf option before the
+        // action can see it. Register the uniform flag only on actionable leaves.
+        if (sub.commands.length === 0 && !hasWaitLockOption(sub))
             addAcceptedWaitLockOption(sub);
         ensureWaitLockOptionEverywhere(sub);
     }

package/dist/src/utils/paths.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: EUPL-1.2
-import { isAbsolute, relative, resolve } from 'node:path';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
 const WINDOWS_ABSOLUTE_PATH = /^[a-zA-Z]:[\\/]/;
 const RELATIVE_PATH_ROOT = resolve('/__fireforge_path_root__');
 /**
@@ -55,7 +55,8 @@ export function isPathInsideRoot(root, candidate) {
         : resolve(resolvedRoot, candidate);
     const relativePath = relative(resolvedRoot, resolvedCandidate);
     return (relativePath === '' ||
-        (!relativePath.startsWith('..') &&
+        (relativePath !== '..' &&
+            !relativePath.startsWith(`..${sep}`) &&
             !isAbsolute(relativePath) &&
             !WINDOWS_ABSOLUTE_PATH.test(relativePath)));
 }

package/dist/src/utils/process-group.d.ts

@@ -1,6 +1,5 @@
 /**
- * Process-group kill and post-run sweep helpers for the exec layer. Split
- * out of `process.ts` to keep that file within the per-file line budget.
+ * Process-group kill and post-run sweep helpers for the exec layer.
  * Spawn-based rather than `exec`-based so the two modules do not import
  * each other cyclically.
  */

package/dist/src/utils/process-group.js

@@ -1,7 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * Process-group kill and post-run sweep helpers for the exec layer. Split
- * out of `process.ts` to keep that file within the per-file line budget.
+ * Process-group kill and post-run sweep helpers for the exec layer.
  * Spawn-based rather than `exec`-based so the two modules do not import
  * each other cyclically.
  */

package/dist/src/utils/process-input.js

@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
  * Stdin-fed command execution with byte-exact stdout.
- *
- * Its own module rather than a function in `process.ts` only because that
- * file sits on a 500-line budget. The logic belongs to the exec layer.
  */
 import { spawn } from 'node:child_process';
 import { buildChildEnv } from './child-env.js';

package/dist/src/utils/process.d.ts

@@ -150,8 +150,9 @@ export declare function execStream(command: string, args: string[], options?: St
  * Registers a child whose shutdown {@link waitForActiveChildShutdown} must
  * wait for, and returns the handle that deregisters it.
  *
- * @returns `settle()`. Call from both the child's `close` and `error`
- *   handlers so a dead child never holds the shutdown wait open
+ * @returns `settle()`. Call after child closure and required teardown finish.
+ *   An abort's `error` event does not prove closure; do not settle there.
+ *   A failed start may settle when no live child or teardown remains.
  */
 export declare function trackChildClosure(): {
     settle: () => void;