@hominis/fireforge 0.50.0 → 0.51.0

package/dist/src/commands/test-verdict.d.ts

@@ -13,7 +13,7 @@ import type { HarnessRunVerdict } from '../core/test-harness-crash.js';
  */
 export type FireforgeVerdictReason = 'crash' | 'harness-arguments' | 'no-tests' | 'test-failures' | 'preflight' | 'inconclusive' | 'lock-timeout' | 'killed';
 /** Additive keys a run can stamp on its verdict line. */
-export type VerdictRunAttributeKey = 'shuffle' | 'orphans-reaped' | 'host-load' | 'host-cpu-warning' | 'power-source' | 'power-changed' | 'furnace-applied' | 'furnace-apply';
+export type VerdictRunAttributeKey = 'shuffle' | 'orphans-reaped' | 'host-load' | 'host-cpu-warning' | 'power-source' | 'power-changed' | 'furnace-applied' | 'furnace-apply' | 'furnace-skipped' | 'control-build' | 'drift-tolerated' | 'lock' | 'jobs' | 'results';
 /** Records an additive attribute for this run's verdict line. */
 export declare function setVerdictRunAttribute(key: VerdictRunAttributeKey, value: string): void;
 /**
@@ -46,6 +46,7 @@ export declare function emitAggregateVerdict(body: string): void;
 export declare function emitHarnessVerdict(verdict: HarnessRunVerdict, shards?: {
     passed: number;
     total: number;
+    failed?: readonly string[];
 }): void;
 /** Emits the pathless `--doctor` PASS verdict. */
 export declare function emitPassVerdict(): void;

package/dist/src/commands/test.d.ts

@@ -19,4 +19,4 @@ import type { TestOptions } from '../types/commands/index.js';
  * @param options - Test options
  * @param underLock - Runs the rest of the command under the engine session lock
  */
-export declare function testCommand(projectRoot: string, testPaths: string[], options?: TestOptions, underLock?: (body: () => Promise<void>) => Promise<void>): Promise<void>;
+export declare function testCommand(projectRoot: string, testPaths: string[], options?: TestOptions, underLock?: (body: () => Promise<void>, mode?: 'exclusive' | 'shared') => Promise<void>): Promise<void>;

package/dist/src/commands/test.js

@@ -1,8 +1,7 @@
 // SPDX-License-Identifier: EUPL-1.2
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { assertEngineExists } from '../core/engine-precondition.js';
-import { assertEngineGenerationUnchanged, snapshotEngineGeneration, } from '../core/engine-session-lock.js';
 import { hasBuildArtifacts } from '../core/mach.js';
 import { assertBuildArtifacts } from '../core/mach-build-artifacts.js';
 import { ensureLaunchableBrowserNotRunning } from '../core/marionette-port.js';
@@ -13,23 +12,22 @@ import { analyzeTestPathScopes, formatScopeNotice, } from '../core/test-path-sco
 import { cleanupProfileFiles, stageProfileFiles, } from '../core/test-profile-files.js';
 import { assertObjdirMatchesTreeMarker } from '../core/tree-store.js';
 import { FireForgeError, GeneralError, LockContentionError, PreflightRefusalError, } from '../errors/base.js';
-import { BuildError } from '../errors/build.js';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
-import { info, intro, notice, warn } from '../utils/logger.js';
+import { info, intro, warn } from '../utils/logger.js';
 import { resolveWaitLockSeconds } from '../utils/options.js';
 import { stripEnginePrefix } from '../utils/paths.js';
 import { appendMarionetteForwardingArgs, ensureTestBrowserEnvironment, runDoctorPreflight, } from './test-browser-preflight.js';
 import { runTestBuildPhase } from './test-build-phase.js';
-import { diagnoseShardOutcome, finalizeSingleRunOutcome } from './test-diagnose.js';
-import { buildPerfSampleEnv, mergeHarnessEnv, resolveShuffleSeed, shuffleTestGroups, } from './test-harness-env.js';
+import { assertParallelTestUsage, dispatchTests } from './test-dispatch.js';
+import { buildPerfSampleEnv, mergeHarnessEnv, resolveShuffleSeed } from './test-harness-env.js';
 import { removePgidFile, setActivePgidFile } from './test-harness-teardown.js';
-import { assertPathlessTestMode, assertTestModeCombinations, canaryTimeoutSeconds, classifyBeforeDispatch, reportCanaryOutcome, resolveCanaryPath, restartBetweenTestsArgs, } from './test-modes.js';
+import { assertPathlessTestMode, assertTestModeCombinations, canaryTimeoutSeconds, classifyBeforeDispatch, resolveCanaryPath, restartBetweenTestsArgs, } from './test-modes.js';
 import { orchestrateTestRuns } from './test-orchestrate.js';
-import { perfGenerationTolerance } from './test-perf-scope.js';
 import { resolveLaunchablePathForTests, runTestPreLockPreflight, TEST_BUILD_PREFLIGHT, } from './test-prelock.js';
-import { DEFAULT_HARNESS_RETRIES, finalizeShardedOutcome, runShardedTests, runTestsWithRetries, } from './test-run.js';
-import { emitFailVerdict, resetVerdictEmission, verdictEmitted } from './test-verdict.js';
+import { resetTestResults, withRawLogDir, writeTestResults } from './test-results.js';
+import { DEFAULT_HARNESS_RETRIES } from './test-run.js';
+import { emitFailVerdict, resetVerdictEmission, setVerdictRunAttribute, verdictEmitted, } from './test-verdict.js';
 async function assertTestPathsExist(engineDir, testPaths) {
     const missingPaths = [];
     for (const testPath of testPaths) {
@@ -126,12 +124,33 @@ export async function testCommand(projectRoot, testPaths, options = {}, underLoc
             staged = await stageProfileFiles(projectRoot, options.profileFile);
             options = { ...options, machArg: [...(options.machArg ?? []), ...staged.args] };
         }
+        assertParallelTestUsage(testPaths, options);
         const lockedOptions = await runTestPreLockPreflight(projectRoot, testPaths, options);
         const profileEnv = staged?.env;
-        await underLock(() => orchestrateTestRuns(projectRoot, testPaths, lockedOptions, (paths, runOptions, hooks) => runTestCommandBody(projectRoot, paths, runOptions, profileEnv, hooks), (error) => {
+        // The pre-lock pass resolved `sharedLock` against config and the run's shape.
+        const lockMode = lockedOptions.sharedLock === true ? 'shared' : 'exclusive';
+        if (lockMode === 'shared')
+            setVerdictRunAttribute('lock', 'shared');
+        resetTestResults();
+        if (options.results !== undefined) {
+            setVerdictRunAttribute('results', resolve(projectRoot, options.results));
+        }
+        const orchestrate = (rawLogDir) => orchestrateTestRuns(projectRoot, testPaths, lockedOptions, (paths, runOptions, hooks) => runTestCommandBody(projectRoot, paths, runOptions, profileEnv, {
+            ...hooks,
+            ...(rawLogDir === undefined ? {} : { rawLogDir }),
+        }), (error) => {
             renderPreflightRefusal(error);
             emitFailVerdict('preflight', refusalNote(error));
-        }));
+        });
+        const collectsResults = options.results !== undefined || options.shardSize !== undefined;
+        try {
+            await underLock(() => (collectsResults ? withRawLogDir((dir) => orchestrate(dir)) : orchestrate()), lockMode);
+        }
+        finally {
+            if (options.results !== undefined) {
+                await writeResultsFile(resolve(projectRoot, options.results));
+            }
+        }
     }
     catch (error) {
         if (!verdictEmitted()) {
@@ -164,6 +183,15 @@ export async function testCommand(projectRoot, testPaths, options = {}, underLoc
         }
     }
 }
+/** Writes `--results`; a failure warns, since the run's verdict is already out. */
+async function writeResultsFile(path) {
+    try {
+        await writeTestResults(path);
+    }
+    catch (error) {
+        warn(`Could not write --results ${path}: ${toError(error).message}`);
+    }
+}
 /** The refusal class a preflight gate named, when it named one. */
 function refusalNote(error) {
     return error instanceof PreflightRefusalError ? error.note : undefined;
@@ -198,26 +226,6 @@ function renderPreflightRefusal(error) {
     process.stdout.write(block);
     writeToActiveRunLog(block);
 }
-/**
- * Verifies `engine/` did not change under the run before any PASS verdict
- * may print. On failure the run's verdict is `FAIL reason=inconclusive`,
- * because the harness result exists but cannot be trusted (`preflight` would
- * misdescribe a run whose harness already executed). It is emitted here so the
- * guard's throw can never leave a stale or missing verdict line behind.
- */
-async function verifyEngineGenerationOrEmitInconclusive(engineDir, before, powerChanged = false, perfSamples) {
-    try {
-        await (perfSamples === undefined
-            ? assertEngineGenerationUnchanged(engineDir, before)
-            : assertEngineGenerationUnchanged(engineDir, before, perfGenerationTolerance(engineDir)));
-        if (powerChanged)
-            throw new GeneralError('Perf power source changed during the run; repeat this sitting on a stable power source.');
-    }
-    catch (error) {
-        emitFailVerdict('inconclusive');
-        throw error;
-    }
-}
 async function guardBuildBrowser(engineDir, launchablePath, options) {
     if ((options.build || options.buildOnly) && launchablePath) {
         await waitForPreflight(() => ensureLaunchableBrowserNotRunning(join(engineDir, launchablePath), {
@@ -254,7 +262,12 @@ function prepareDispatchArguments(classification, options, canaryPath, projectCo
         ? filterRedundantXpcshellFlavorArgs(options.machArg, classification)
         : [];
     const extraArgs = prepareExtraMachArgs(options, shuffleSeed, canaryPath, projectConfig, forwardedMachArgs);
-    extraArgs.push(...restartBetweenTestsArgs(options, suite, forwardedMachArgs));
+    // A `--shard-size` chunk runs several files in one browser; mochitest
+    // restarts it between them so a chunk judges each file as a shard would.
+    const restart = options.shardSize !== undefined && suite === 'mochitest'
+        ? { ...options, restartBetweenTests: true }
+        : options;
+    extraArgs.push(...restartBetweenTestsArgs(restart, suite, forwardedMachArgs));
     return { suite, shuffleSeed, extraArgs };
 }
 /**
@@ -327,6 +340,9 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}, profileE
     // documented `--mach-arg --marionette-port=NNNN` route still hits the
     // wrapper preflight refusing on 2828 before the forwarded arg reaches
     // mach.
+    // A negative control on compiled source goes in here, so the build
+    // compiles it (see negative-control-compiled.ts).
+    await hooks.beforeBuild?.();
     if (await runTestBuildPhase(projectRoot, paths, projectConfig, harnessRetries, options, {
         classification,
         normalizedPaths: hooks.coveragePaths ?? normalizedPaths,
@@ -364,6 +380,8 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}, profileE
         ...(options.fullOutput === true ? { fullOutput: true } : {}),
         ...(harnessEnv ? { env: harnessEnv } : {}),
         pgidFile: options.pgidFile,
+        ...(hooks.rawLogDir === undefined ? {} : { rawLogDir: hooks.rawLogDir }),
+        ...(hooks.repetition === undefined ? {} : { repetition: hooks.repetition }),
     };
     const postRebuildContext = options.build
         ? createPostRebuildFailureContext('fireforge test --build', normalizedPaths)
@@ -376,46 +394,18 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}, profileE
     // into later files. Sharding is per path argument: a directory argument
     // keeps its enumerated files together in one invocation, preserving the
     // one-browser-instance semantics of a directory run. `--no-shard` restores
-    // the combined invocation. The default must not be silent: a cross-file
-    // pollution repro otherwise "passes" because the comparison run was
-    // sharded without saying so, misattributing a suite-context bug upstream.
-    // Hence the one-line notice stating what sharding does and does not
-    // exercise.
-    if (canaryPath === undefined && dispatchGroups.length > 1 && options.shard !== false) {
-        notice(`Sharding: running ${dispatchGroups.length} test path arguments in isolated browser instances ` +
-            '(one mach invocation per argument; a directory argument keeps its files in one instance). ' +
-            'Cross-argument state is NOT exercised — pass --no-shard for a combined single-instance run.');
-        const generationBefore = await snapshotEngineGeneration(paths.engine);
-        let summary;
-        try {
-            const orderedGroups = shuffleSeed === undefined ? dispatchGroups : shuffleTestGroups(dispatchGroups, shuffleSeed);
-            summary = await runShardedTests(runCtx, orderedGroups, (outcome, label) => diagnoseShardOutcome(outcome, label, projectConfig.binaryName, postRebuildContext));
-        }
-        finally {
-            // Runs before the aggregate verdict below: a mutated engine/ emits
-            // `FAIL reason=inconclusive` and throws, so an invalidated run can
-            // never print `PASS shards=N/N` first. (A throw here masks an
-            // in-flight shard error, as the plain assert always did.)
-            await verifyEngineGenerationOrEmitInconclusive(paths.engine, generationBefore, runCtx.powerChanged, options.perfSamples);
-        }
-        finalizeShardedOutcome(summary);
-        return;
-    }
-    const combinedDispatchPaths = dispatchGroups.flatMap((group) => group.paths);
-    let outcome;
-    const generationBefore = await snapshotEngineGeneration(paths.engine);
-    try {
-        outcome = await runTestsWithRetries(runCtx, combinedDispatchPaths);
-    }
-    catch (error) {
-        throw new BuildError('Test process failed to start', 'mach test', error instanceof Error ? error : undefined);
-    }
-    finally {
-        await verifyEngineGenerationOrEmitInconclusive(paths.engine, generationBefore, runCtx.powerChanged, options.perfSamples);
-    }
-    if (canaryPath !== undefined) {
-        reportCanaryOutcome(outcome);
-        return;
-    }
-    finalizeSingleRunOutcome(outcome, normalizedPaths, projectConfig.binaryName, postRebuildContext, options.headless === true);
+    // the combined invocation; `--shard-size` and `--jobs` reshape it (see
+    // test-dispatch.ts).
+    await dispatchTests({
+        engineDir: paths.engine,
+        runCtx,
+        dispatchGroups,
+        options,
+        projectConfig,
+        canaryPath,
+        shuffleSeed,
+        normalizedPaths,
+        xpcshellOnly,
+        postRebuildContext,
+    });
 }

package/dist/src/commands/token-lint.js

@@ -8,15 +8,18 @@
 import { join } from 'node:path';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { furnaceConfigExists, loadFurnaceConfig } from '../core/furnace-config.js';
+import { buildPatchQueueContext } from '../core/patch-lint.js';
+import { buildJarTargetIndex } from '../core/patch-lint-forward-registration-extended.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { collectDeclaredTokenNames, lintTokenLockstep, lintUndeclaredTokenReferences, } from '../core/token-lint.js';
 import { getTokensCssPath } from '../core/token-manager.js';
+import { buildSiblingSheetMap } from '../core/token-sibling-sheets.js';
 import { GeneralError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
 import { pathExists, readText } from '../utils/fs.js';
 import { info, intro, outro, setMachineOutputMode, setStdoutSealed, success, warn, } from '../utils/logger.js';
 import { emitMachineError, MACHINE_OUTPUT_SCHEMA_VERSION } from '../utils/machine-output.js';
-/** Token prefix and exempt names from furnace.json, with the init default. */
+/** Token prefix, exempt names and sibling sheets from furnace.json, with the init default. */
 async function loadTokenSettings(projectRoot, binaryName) {
     const fallback = { tokenPrefix: `--${binaryName}-`, exempt: new Set() };
     if (!(await furnaceConfigExists(projectRoot)))
@@ -26,6 +29,7 @@ async function loadTokenSettings(projectRoot, binaryName) {
         return {
             tokenPrefix: furnace.tokenPrefix ?? fallback.tokenPrefix,
             exempt: new Set([...(furnace.tokenAllowlist ?? []), ...(furnace.runtimeVariables ?? [])]),
+            siblingSheets: furnace.tokenSiblingSheets,
         };
     }
     catch (error) {
@@ -41,7 +45,7 @@ async function collectTokenLint(projectRoot) {
     if (!(await pathExists(tokensFile))) {
         throw new GeneralError(`Token CSS file not found: ${tokensCssPath}. Run "fireforge furnace init" to seed it.`);
     }
-    const { tokenPrefix, exempt } = await loadTokenSettings(projectRoot, config.binaryName);
+    const { tokenPrefix, exempt, siblingSheets } = await loadTokenSettings(projectRoot, config.binaryName);
     const tokensCss = await readText(tokensFile);
     const lines = tokensCss.split('\n');
     const declared = collectDeclaredTokenNames(lines);
@@ -52,19 +56,55 @@ async function collectTokenLint(projectRoot) {
     // Every CSS file the patch queue touches: the fork's own stylesheets and
     // the upstream ones it edits.
     const manifest = await loadPatchesManifest(paths.patches);
-    const cssFiles = [
-        ...new Set((manifest?.patches ?? []).flatMap((patch) => patch.filesAffected.filter((file) => file.endsWith('.css') && file !== tokensCssPath))),
-    ].sort();
+    const touched = [...new Set((manifest?.patches ?? []).flatMap((patch) => patch.filesAffected))];
+    const cssFiles = touched.filter((file) => file.endsWith('.css') && file !== tokensCssPath).sort();
+    const contents = await readEngineFiles(paths.engine, touched.filter((file) => LINKING_FILE.test(file)));
+    const siblings = buildSiblingSheetMap({
+        documents: contents,
+        jarTargets: buildJarTargetIndex((await buildPatchQueueContext(paths.patches)).entries),
+        sheets: cssFiles,
+        explicit: siblingSheets,
+    });
     let filesScanned = 1;
     for (const file of cssFiles) {
-        const absolute = join(paths.engine, file);
-        if (!(await pathExists(absolute)))
+        const css = contents.get(file);
+        if (css === undefined)
             continue;
         filesScanned++;
-        findings.push(...lintUndeclaredTokenReferences(file, await readText(absolute), tokenPrefix, declared, exempt));
+        findings.push(...lintUndeclaredTokenReferences(file, css, tokenPrefix, await withSiblingDeclarations(paths.engine, declared, siblings.get(file), contents), exempt));
     }
     return { tokensCssPath, tokenPrefix, filesScanned, findings };
 }
+/** Files whose content can link a stylesheet: markup, scripts, and sheets (`@import`). */
+const LINKING_FILE = /\.(?:css|xhtml|html|xml|mjs|js)$/;
+/** Reads the engine files that exist, keyed by engine-relative path. */
+async function readEngineFiles(engineDir, files) {
+    const contents = new Map();
+    for (const file of files) {
+        const absolute = join(engineDir, file);
+        if (await pathExists(absolute))
+            contents.set(file, await readText(absolute));
+    }
+    return contents;
+}
+/** The tokens CSS declarations plus every declaration of a sheet's siblings. */
+async function withSiblingDeclarations(engineDir, declared, siblings, contents) {
+    if (siblings === undefined || siblings.size === 0)
+        return declared;
+    const merged = new Set(declared);
+    for (const sibling of siblings) {
+        if (!contents.has(sibling)) {
+            const absolute = join(engineDir, sibling);
+            if (!(await pathExists(absolute)))
+                continue;
+            contents.set(sibling, await readText(absolute));
+        }
+        const css = contents.get(sibling) ?? '';
+        for (const name of collectDeclaredTokenNames(css.split('\n')))
+            merged.add(name);
+    }
+    return merged;
+}
 function failureMessage(count) {
     return `token lint found ${String(count)} finding(s).`;
 }

package/dist/src/commands/verify.js

@@ -21,7 +21,7 @@ import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { isGitRepository } from '../core/git.js';
 import { withPrivateGitIndex } from '../core/git-readonly-index.js';
 import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from '../core/git-status.js';
-import { findUnresolvedSystemModuleImports, formatUnresolvedSystemModuleImports, } from '../core/module-resolution-preflight.js';
+import { collectWorktreeModuleFiles, findUnresolvedSystemModuleImports, formatUnresolvedSystemModuleImports, } from '../core/module-resolution-preflight.js';
 import { buildPatchQueueContext, formatPatchLintIssue, lintPatchQueue, } from '../core/patch-lint.js';
 import { loadPatchesManifest, validatePatchesManifestConsistency } from '../core/patch-manifest.js';
 import { evaluatePatchPolicy } from '../core/patch-policy.js';
@@ -206,8 +206,15 @@ export async function collectPatchQueueHealth(projectRoot, scope) {
         // CREATES. This asks the same question of the engine, so an import ADDED
         // to an existing module is named as text instead of surfacing later as a
         // bare `xpcshell return code: -11` with zero output.
+        // Unscoped, the engine worktree joins in: an unexported chrome script
+        // importing an unexported, unregistered module crashes every objdir
+        // start before either file is in the queue. A scoped run never judges
+        // unmanaged files.
         if (await pathExists(paths.engine)) {
-            const unresolved = await findUnresolvedSystemModuleImports(paths.engine, scopePatches(manifest.patches, scope).flatMap((patch) => patch.filesAffected));
+            const worktree = scope === undefined && (await isGitRepository(paths.engine))
+                ? await collectWorktreeModuleFiles(paths.engine)
+                : undefined;
+            const unresolved = await findUnresolvedSystemModuleImports(paths.engine, scopePatches(manifest.patches, scope).flatMap((patch) => patch.filesAffected), worktree);
             if (unresolved.length > 0) {
                 groups.push({
                     title: `Unresolvable system-module imports (${unresolved.length})`,

package/dist/src/core/build-prepare.d.ts

@@ -42,6 +42,12 @@ export interface PrepareBuildOptions {
      * (`fireforge test --build --no-furnace-apply`).
      */
     skipFurnaceApply?: boolean | undefined;
+    /**
+     * Apply only these components (`fireforge test --build --furnace-apply
+     * reached`). Undefined applies every component with undeployed edits; an
+     * empty list applies none.
+     */
+    furnaceComponents?: readonly string[] | undefined;
 }
 /**
  * Describes an exit code in the shell's 128+N signal convention. Truncated

package/dist/src/core/build-prepare.js

@@ -170,14 +170,35 @@ async function reportUnexportedDriftBeforeOverwrite(projectRoot, config, options
     }
     notice(message);
 }
+/**
+ * Applies the named components one at a time, each under its own Furnace
+ * mutation (one rollback journal per apply), and merges the results.
+ */
+async function applySelectedComponents(projectRoot, names) {
+    const merged = {
+        applied: [],
+        skipped: [],
+        errors: [],
+        warnings: [],
+    };
+    for (const componentName of names) {
+        const result = await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx, componentName }));
+        merged.applied.push(...result.applied);
+        merged.skipped.push(...result.skipped);
+        merged.errors.push(...result.errors);
+        merged.warnings.push(...(result.warnings ?? []));
+    }
+    return merged;
+}
 /**
  * Applies Furnace components before the build when `furnace.json` exists.
  * Prints every warning the apply computed, then the loud sync banner.
  *
  * @param projectRoot - Project root
+ * @param only - Apply just these components; every component when undefined
  * @returns Names of the components written to engine/
  */
-async function applyFurnaceBeforeBuild(projectRoot) {
+async function applyFurnaceBeforeBuild(projectRoot, only) {
     if (!(await furnaceConfigExists(projectRoot)))
         return [];
     const furnaceConfig = await loadFurnaceConfig(projectRoot);
@@ -187,7 +208,10 @@ async function applyFurnaceBeforeBuild(projectRoot) {
     const furnaceSpinner = spinner('Applying Furnace components...');
     let result;
     try {
-        result = await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx }));
+        result =
+            only === undefined
+                ? await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx }))
+                : await applySelectedComponents(projectRoot, only);
     }
     catch (error) {
         furnaceSpinner.error('Failed to apply Furnace components');
@@ -349,7 +373,9 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
             throw error;
         }
     }
-    const furnaceAppliedNames = options.skipFurnaceApply === true ? [] : await applyFurnaceBeforeBuild(projectRoot);
+    const furnaceAppliedNames = options.skipFurnaceApply === true || options.furnaceComponents?.length === 0
+        ? []
+        : await applyFurnaceBeforeBuild(projectRoot, options.furnaceComponents);
     // Generate mozconfig
     const mozconfigSpinner = spinner('Generating mozconfig...');
     let mozconfigWritten;

package/dist/src/core/config-paths.d.ts

@@ -7,7 +7,7 @@ export declare const FIREFORGE_DIR = ".fireforge";
 /** Supported top-level fireforge.json keys backed by the current schema. */
 export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "buildAudit", "test", "history", "externalToolchains", "license", "wire", "patchLint", "patchPolicy", "typecheck", "markerComment", "check"];
 /** Supported config paths that can be read or set without --force. */
-export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "test.mochitestPorts", "history", "history.path", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchLint.forwardRegistration", "patchLint.fileSizeMetric", "patchLint.patchSizeMetric", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment", "check"];
+export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "test.mochitestPorts", "test.lockMode", "test.furnaceApply", "history", "history.path", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchLint.forwardRegistration", "patchLint.fileSizeMetric", "patchLint.patchSizeMetric", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment", "check"];
 /**
  * Gets all project paths based on a root directory.
  * @param root - Root directory of the project

package/dist/src/core/config-paths.js

@@ -57,6 +57,8 @@ export const SUPPORTED_CONFIG_PATHS = [
     'test.canaryTimeoutSeconds',
     'test.reapOrphans',
     'test.mochitestPorts',
+    'test.lockMode',
+    'test.furnaceApply',
     'history',
     'history.path',
     'externalToolchains',

package/dist/src/core/config-validate-check.js

@@ -78,7 +78,7 @@ function parseExtraStep(raw, field) {
     if (!isObject(raw)) {
         throw new ConfigError(`Config field "${field}" must be a plain object with "name" and "command"`);
     }
-    assertKnownKeys(raw, field, ['name', 'command', 'cwd', 'timeout']);
+    assertKnownKeys(raw, field, ['name', 'command', 'cwd', 'timeout', 'after']);
     const name = raw['name'];
     if (typeof name !== 'string' || !STEP_NAME_PATTERN.test(name)) {
         throw new ConfigError(`Config field "${field}.name" must be lowercase letters, digits and dashes (e.g. "policy-audit")`);
@@ -99,14 +99,63 @@ function parseExtraStep(raw, field) {
         step.cwd = cwd;
     }
     if (raw['timeout'] !== undefined) {
-        const timeout = parseNonNegativeInteger(raw['timeout'], `${field}.timeout`);
-        if (timeout === 0) {
-            throw new ConfigError(`Config field "${field}.timeout" must be a positive number of seconds`);
-        }
-        step.timeout = timeout;
+        step.timeout = parsePositiveSeconds(raw['timeout'], `${field}.timeout`);
     }
+    if (raw['after'] !== undefined)
+        step.after = parseStringList(raw['after'], `${field}.after`);
     return step;
 }
+function parsePositiveSeconds(raw, field) {
+    const seconds = parseNonNegativeInteger(raw, field);
+    if (seconds === 0) {
+        throw new ConfigError(`Config field "${field}" must be a positive number of seconds`);
+    }
+    return seconds;
+}
+/**
+ * Checks every `after` names a known step and the extra steps' ordering
+ * has no cycle: a cycle would leave its steps waiting forever.
+ */
+function assertExtraStepOrdering(steps) {
+    const extras = new Map(steps.map((step) => [step.name, step]));
+    for (const [index, step] of steps.entries()) {
+        for (const dependency of step.after ?? []) {
+            if (dependency === step.name) {
+                throw new ConfigError(`Config field "check.extraSteps[${String(index)}].after" names the step itself`);
+            }
+            if (!isBuiltinStep(dependency) && !extras.has(dependency)) {
+                throw new ConfigError(`Config field "check.extraSteps[${String(index)}].after" names unknown step "${dependency}"`);
+            }
+        }
+    }
+    const state = new Map();
+    const visit = (name, path) => {
+        if (state.get(name) === 'done')
+            return;
+        if (state.get(name) === 'visiting') {
+            throw new ConfigError(`Config field "check.extraSteps" orders its steps in a cycle: ${[...path, name].join(' -> ')}`);
+        }
+        state.set(name, 'visiting');
+        for (const dependency of extras.get(name)?.after ?? []) {
+            if (extras.has(dependency))
+                visit(dependency, [...path, name]);
+        }
+        state.set(name, 'done');
+    };
+    for (const step of steps)
+        visit(step.name, []);
+}
+function parseTimeouts(raw) {
+    if (!isObject(raw))
+        throw new ConfigError('Config field "check.timeouts" must be a plain object');
+    assertKnownKeys(raw, 'check.timeouts', [...CHECK_BUILTIN_STEPS]);
+    const out = {};
+    for (const [name, value] of Object.entries(raw)) {
+        if (isBuiltinStep(name))
+            out[name] = parsePositiveSeconds(value, `check.timeouts.${name}`);
+    }
+    return out;
+}
 function parseExtraSteps(raw) {
     if (!Array.isArray(raw))
         throw new ConfigError('Config field "check.extraSteps" must be an array');
@@ -118,6 +167,7 @@ function parseExtraSteps(raw) {
         }
         seen.add(step.name);
     }
+    assertExtraStepOrdering(steps);
     return steps;
 }
 /**
@@ -129,7 +179,16 @@ function parseExtraSteps(raw) {
 export function parseCheckConfig(raw) {
     if (!isObject(raw))
         throw new ConfigError('Config field "check" must be a plain object');
-    assertKnownKeys(raw, 'check', ['skip', 'status', 'maxWarnings', 'extraSteps']);
+    assertKnownKeys(raw, 'check', [
+        'skip',
+        'status',
+        'maxWarnings',
+        'extraSteps',
+        'timeout',
+        'timeouts',
+        'failOnSkipped',
+        'lintReport',
+    ]);
     const out = {};
     if (raw['skip'] !== undefined)
         out.skip = parseSkip(raw['skip']);
@@ -139,5 +198,22 @@ export function parseCheckConfig(raw) {
         out.maxWarnings = parseMaxWarnings(raw['maxWarnings']);
     if (raw['extraSteps'] !== undefined)
         out.extraSteps = parseExtraSteps(raw['extraSteps']);
+    if (raw['timeout'] !== undefined)
+        out.timeout = parsePositiveSeconds(raw['timeout'], 'check.timeout');
+    if (raw['timeouts'] !== undefined)
+        out.timeouts = parseTimeouts(raw['timeouts']);
+    if (raw['failOnSkipped'] !== undefined) {
+        if (typeof raw['failOnSkipped'] !== 'boolean') {
+            throw new ConfigError('Config field "check.failOnSkipped" must be a boolean');
+        }
+        out.failOnSkipped = raw['failOnSkipped'];
+    }
+    if (raw['lintReport'] !== undefined) {
+        const path = raw['lintReport'];
+        if (typeof path !== 'string' || path.trim() === '' || !isContainedRelativePath(path)) {
+            throw new ConfigError('Config field "check.lintReport" must be a project-relative path');
+        }
+        out.lintReport = path;
+    }
     return out;
 }

package/dist/src/core/config-validate-test-toolchains.js

@@ -59,6 +59,20 @@ export function parseTestBlock(rec, config) {
         }
         out.mochitestPorts = mochitestPorts;
     }
+    const lockMode = testRec.raw('lockMode');
+    if (lockMode !== undefined) {
+        if (lockMode !== 'exclusive' && lockMode !== 'shared') {
+            throw new ConfigError('Config field "test.lockMode" must be "exclusive" or "shared"');
+        }
+        out.lockMode = lockMode;
+    }
+    const furnaceApply = testRec.raw('furnaceApply');
+    if (furnaceApply !== undefined) {
+        if (furnaceApply !== 'all' && furnaceApply !== 'reached' && furnaceApply !== 'none') {
+            throw new ConfigError('Config field "test.furnaceApply" must be "all", "reached" or "none"');
+        }
+        out.furnaceApply = furnaceApply;
+    }
     config.test = out;
 }
 /** Parses optional project-specific external toolchain doctor probes. */

package/dist/src/core/config-validate-token-scales.d.ts

@@ -1,5 +1,8 @@
 /**
  * Validation for `fireforge.json#patchLint.tokenScales`.
+ *
+ * Unknown keys are refused: a misspelt `allowInCalc` or `minFiles` would
+ * otherwise loosen or drop a scale without a word.
  */
 import type { PatchLintTokenScale } from '../types/config.js';
 /** Parses and validates `patchLint.tokenScales`. */