@hominis/fireforge 0.50.0 → 0.52.0

package/dist/src/commands/verify.js

@@ -21,7 +21,7 @@ import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { isGitRepository } from '../core/git.js';
 import { withPrivateGitIndex } from '../core/git-readonly-index.js';
 import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from '../core/git-status.js';
-import { findUnresolvedSystemModuleImports, formatUnresolvedSystemModuleImports, } from '../core/module-resolution-preflight.js';
+import { collectWorktreeModuleFiles, findUnresolvedSystemModuleImports, formatUnresolvedSystemModuleImports, } from '../core/module-resolution-preflight.js';
 import { buildPatchQueueContext, formatPatchLintIssue, lintPatchQueue, } from '../core/patch-lint.js';
 import { loadPatchesManifest, validatePatchesManifestConsistency } from '../core/patch-manifest.js';
 import { evaluatePatchPolicy } from '../core/patch-policy.js';
@@ -206,8 +206,15 @@ export async function collectPatchQueueHealth(projectRoot, scope) {
         // CREATES. This asks the same question of the engine, so an import ADDED
         // to an existing module is named as text instead of surfacing later as a
         // bare `xpcshell return code: -11` with zero output.
+        // Unscoped, the engine worktree joins in: an unexported chrome script
+        // importing an unexported, unregistered module crashes every objdir
+        // start before either file is in the queue. A scoped run never judges
+        // unmanaged files.
         if (await pathExists(paths.engine)) {
-            const unresolved = await findUnresolvedSystemModuleImports(paths.engine, scopePatches(manifest.patches, scope).flatMap((patch) => patch.filesAffected));
+            const worktree = scope === undefined && (await isGitRepository(paths.engine))
+                ? await collectWorktreeModuleFiles(paths.engine)
+                : undefined;
+            const unresolved = await findUnresolvedSystemModuleImports(paths.engine, scopePatches(manifest.patches, scope).flatMap((patch) => patch.filesAffected), worktree);
             if (unresolved.length > 0) {
                 groups.push({
                     title: `Unresolvable system-module imports (${unresolved.length})`,

package/dist/src/core/build-baseline-types.d.ts

@@ -144,6 +144,19 @@ export interface BuildBaseline {
      * as "unknown" when absent.
      */
     recordedBy?: string;
+    /**
+     * The process that wrote this baseline: its pid, its invocation id (the
+     * one its history records carry) and the caller's `FIREFORGE_SESSION_ID`
+     * when set. A coverage refusal names it, so a run whose claim another
+     * session's scoped build replaced can tell whose build that was.
+     */
+    recorder?: BaselineRecorder;
+}
+/** See {@link BuildBaseline.recorder}. */
+export interface BaselineRecorder {
+    pid: number;
+    invocationId: string;
+    sessionId?: string;
 }
 /**
  * State of the engine at the last full build, as far as compiled-in XPCOM

package/dist/src/core/build-baseline-validate.js

@@ -32,6 +32,13 @@ function isCoverageRecordMap(value) {
             Array.isArray(record['inputs']) &&
             record['inputs'].every(isBaselinePath)));
 }
+/** A `recorder` stamp: an integer pid, an invocation id and an optional session id. */
+function isBaselineRecorder(value) {
+    return (isObject(value) &&
+        Number.isInteger(value['pid']) &&
+        typeof value['invocationId'] === 'string' &&
+        (value['sessionId'] === undefined || typeof value['sessionId'] === 'string'));
+}
 /** Validates persisted fields without converting malformed coverage into a full claim. */
 export function isBuildBaseline(value) {
     if (!isObject(value))
@@ -59,6 +66,8 @@ export function isBuildBaseline(value) {
         return false;
     if (value['recordedBy'] !== undefined && typeof value['recordedBy'] !== 'string')
         return false;
+    if (value['recorder'] !== undefined && !isBaselineRecorder(value['recorder']))
+        return false;
     if (value['testCoverageRecords'] !== undefined &&
         !isCoverageRecordMap(value['testCoverageRecords']))
         return false;

package/dist/src/core/build-baseline.js

@@ -32,6 +32,7 @@ import { hashEngineFile } from './coverage-extend.js';
 import { getHead, hasChanges, isMissingHeadError } from './git.js';
 import { git } from './git-base.js';
 import { getUntrackedFiles } from './git-status.js';
+import { historyRecordIdentity } from './history-log-file.js';
 /*
  * Keep the IO fan-out bounded: a patched Firefox checkout can carry hundreds
  * of dirty packageable paths and serial reads add directly to every build.
@@ -72,6 +73,11 @@ export async function readBuildBaseline(projectRoot, invalid = 'ignore') {
         return undefined;
     }
 }
+/** This process's {@link BuildBaseline.recorder} stamp. */
+function baselineRecorder() {
+    const { pid, invocationId, sessionId } = historyRecordIdentity();
+    return { pid, invocationId, ...(sessionId !== undefined ? { sessionId } : {}) };
+}
 /**
  * Records a successful build by writing a fresh baseline marker. Captures
  * engine HEAD SHA (or an empty string when the engine has no HEAD yet) and
@@ -121,6 +127,7 @@ export async function writeBuildBaseline(options) {
         ...(mozconfigHash !== undefined ? { mozconfigHash } : {}),
         ...(staticComponentsBaseline !== undefined ? { staticComponentsBaseline } : {}),
         ...(recordedBy !== undefined ? { recordedBy } : {}),
+        recorder: baselineRecorder(),
     };
     await writeJson(getBuildBaselinePath(projectRoot), baseline);
 }

package/dist/src/core/build-prepare.d.ts

@@ -42,6 +42,12 @@ export interface PrepareBuildOptions {
      * (`fireforge test --build --no-furnace-apply`).
      */
     skipFurnaceApply?: boolean | undefined;
+    /**
+     * Apply only these components (`fireforge test --build --furnace-apply
+     * reached`). Undefined applies every component with undeployed edits; an
+     * empty list applies none.
+     */
+    furnaceComponents?: readonly string[] | undefined;
 }
 /**
  * Describes an exit code in the shell's 128+N signal convention. Truncated

package/dist/src/core/build-prepare.js

@@ -170,14 +170,35 @@ async function reportUnexportedDriftBeforeOverwrite(projectRoot, config, options
     }
     notice(message);
 }
+/**
+ * Applies the named components one at a time, each under its own Furnace
+ * mutation (one rollback journal per apply), and merges the results.
+ */
+async function applySelectedComponents(projectRoot, names) {
+    const merged = {
+        applied: [],
+        skipped: [],
+        errors: [],
+        warnings: [],
+    };
+    for (const componentName of names) {
+        const result = await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx, componentName }));
+        merged.applied.push(...result.applied);
+        merged.skipped.push(...result.skipped);
+        merged.errors.push(...result.errors);
+        merged.warnings.push(...(result.warnings ?? []));
+    }
+    return merged;
+}
 /**
  * Applies Furnace components before the build when `furnace.json` exists.
  * Prints every warning the apply computed, then the loud sync banner.
  *
  * @param projectRoot - Project root
+ * @param only - Apply just these components; every component when undefined
  * @returns Names of the components written to engine/
  */
-async function applyFurnaceBeforeBuild(projectRoot) {
+async function applyFurnaceBeforeBuild(projectRoot, only) {
     if (!(await furnaceConfigExists(projectRoot)))
         return [];
     const furnaceConfig = await loadFurnaceConfig(projectRoot);
@@ -187,7 +208,10 @@ async function applyFurnaceBeforeBuild(projectRoot) {
     const furnaceSpinner = spinner('Applying Furnace components...');
     let result;
     try {
-        result = await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx }));
+        result =
+            only === undefined
+                ? await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx }))
+                : await applySelectedComponents(projectRoot, only);
     }
     catch (error) {
         furnaceSpinner.error('Failed to apply Furnace components');
@@ -349,7 +373,9 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
             throw error;
         }
     }
-    const furnaceAppliedNames = options.skipFurnaceApply === true ? [] : await applyFurnaceBeforeBuild(projectRoot);
+    const furnaceAppliedNames = options.skipFurnaceApply === true || options.furnaceComponents?.length === 0
+        ? []
+        : await applyFurnaceBeforeBuild(projectRoot, options.furnaceComponents);
     // Generate mozconfig
     const mozconfigSpinner = spinner('Generating mozconfig...');
     let mozconfigWritten;

package/dist/src/core/config-paths.d.ts

@@ -7,7 +7,7 @@ export declare const FIREFORGE_DIR = ".fireforge";
 /** Supported top-level fireforge.json keys backed by the current schema. */
 export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "buildAudit", "test", "history", "externalToolchains", "license", "wire", "patchLint", "patchPolicy", "typecheck", "markerComment", "check"];
 /** Supported config paths that can be read or set without --force. */
-export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "test.mochitestPorts", "history", "history.path", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchLint.forwardRegistration", "patchLint.fileSizeMetric", "patchLint.patchSizeMetric", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment", "check"];
+export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "test.mochitestPorts", "test.lockMode", "test.furnaceApply", "history", "history.path", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchLint.forwardRegistration", "patchLint.fileSizeMetric", "patchLint.patchSizeMetric", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment", "check"];
 /**
  * Gets all project paths based on a root directory.
  * @param root - Root directory of the project

package/dist/src/core/config-paths.js

@@ -57,6 +57,8 @@ export const SUPPORTED_CONFIG_PATHS = [
     'test.canaryTimeoutSeconds',
     'test.reapOrphans',
     'test.mochitestPorts',
+    'test.lockMode',
+    'test.furnaceApply',
     'history',
     'history.path',
     'externalToolchains',

package/dist/src/core/config-validate-check.js

@@ -78,7 +78,7 @@ function parseExtraStep(raw, field) {
     if (!isObject(raw)) {
         throw new ConfigError(`Config field "${field}" must be a plain object with "name" and "command"`);
     }
-    assertKnownKeys(raw, field, ['name', 'command', 'cwd', 'timeout']);
+    assertKnownKeys(raw, field, ['name', 'command', 'cwd', 'timeout', 'after']);
     const name = raw['name'];
     if (typeof name !== 'string' || !STEP_NAME_PATTERN.test(name)) {
         throw new ConfigError(`Config field "${field}.name" must be lowercase letters, digits and dashes (e.g. "policy-audit")`);
@@ -99,14 +99,63 @@ function parseExtraStep(raw, field) {
         step.cwd = cwd;
     }
     if (raw['timeout'] !== undefined) {
-        const timeout = parseNonNegativeInteger(raw['timeout'], `${field}.timeout`);
-        if (timeout === 0) {
-            throw new ConfigError(`Config field "${field}.timeout" must be a positive number of seconds`);
-        }
-        step.timeout = timeout;
+        step.timeout = parsePositiveSeconds(raw['timeout'], `${field}.timeout`);
     }
+    if (raw['after'] !== undefined)
+        step.after = parseStringList(raw['after'], `${field}.after`);
     return step;
 }
+function parsePositiveSeconds(raw, field) {
+    const seconds = parseNonNegativeInteger(raw, field);
+    if (seconds === 0) {
+        throw new ConfigError(`Config field "${field}" must be a positive number of seconds`);
+    }
+    return seconds;
+}
+/**
+ * Checks every `after` names a known step and the extra steps' ordering
+ * has no cycle: a cycle would leave its steps waiting forever.
+ */
+function assertExtraStepOrdering(steps) {
+    const extras = new Map(steps.map((step) => [step.name, step]));
+    for (const [index, step] of steps.entries()) {
+        for (const dependency of step.after ?? []) {
+            if (dependency === step.name) {
+                throw new ConfigError(`Config field "check.extraSteps[${String(index)}].after" names the step itself`);
+            }
+            if (!isBuiltinStep(dependency) && !extras.has(dependency)) {
+                throw new ConfigError(`Config field "check.extraSteps[${String(index)}].after" names unknown step "${dependency}"`);
+            }
+        }
+    }
+    const state = new Map();
+    const visit = (name, path) => {
+        if (state.get(name) === 'done')
+            return;
+        if (state.get(name) === 'visiting') {
+            throw new ConfigError(`Config field "check.extraSteps" orders its steps in a cycle: ${[...path, name].join(' -> ')}`);
+        }
+        state.set(name, 'visiting');
+        for (const dependency of extras.get(name)?.after ?? []) {
+            if (extras.has(dependency))
+                visit(dependency, [...path, name]);
+        }
+        state.set(name, 'done');
+    };
+    for (const step of steps)
+        visit(step.name, []);
+}
+function parseTimeouts(raw) {
+    if (!isObject(raw))
+        throw new ConfigError('Config field "check.timeouts" must be a plain object');
+    assertKnownKeys(raw, 'check.timeouts', [...CHECK_BUILTIN_STEPS]);
+    const out = {};
+    for (const [name, value] of Object.entries(raw)) {
+        if (isBuiltinStep(name))
+            out[name] = parsePositiveSeconds(value, `check.timeouts.${name}`);
+    }
+    return out;
+}
 function parseExtraSteps(raw) {
     if (!Array.isArray(raw))
         throw new ConfigError('Config field "check.extraSteps" must be an array');
@@ -118,6 +167,7 @@ function parseExtraSteps(raw) {
         }
         seen.add(step.name);
     }
+    assertExtraStepOrdering(steps);
     return steps;
 }
 /**
@@ -129,7 +179,16 @@ function parseExtraSteps(raw) {
 export function parseCheckConfig(raw) {
     if (!isObject(raw))
         throw new ConfigError('Config field "check" must be a plain object');
-    assertKnownKeys(raw, 'check', ['skip', 'status', 'maxWarnings', 'extraSteps']);
+    assertKnownKeys(raw, 'check', [
+        'skip',
+        'status',
+        'maxWarnings',
+        'extraSteps',
+        'timeout',
+        'timeouts',
+        'failOnSkipped',
+        'lintReport',
+    ]);
     const out = {};
     if (raw['skip'] !== undefined)
         out.skip = parseSkip(raw['skip']);
@@ -139,5 +198,22 @@ export function parseCheckConfig(raw) {
         out.maxWarnings = parseMaxWarnings(raw['maxWarnings']);
     if (raw['extraSteps'] !== undefined)
         out.extraSteps = parseExtraSteps(raw['extraSteps']);
+    if (raw['timeout'] !== undefined)
+        out.timeout = parsePositiveSeconds(raw['timeout'], 'check.timeout');
+    if (raw['timeouts'] !== undefined)
+        out.timeouts = parseTimeouts(raw['timeouts']);
+    if (raw['failOnSkipped'] !== undefined) {
+        if (typeof raw['failOnSkipped'] !== 'boolean') {
+            throw new ConfigError('Config field "check.failOnSkipped" must be a boolean');
+        }
+        out.failOnSkipped = raw['failOnSkipped'];
+    }
+    if (raw['lintReport'] !== undefined) {
+        const path = raw['lintReport'];
+        if (typeof path !== 'string' || path.trim() === '' || !isContainedRelativePath(path)) {
+            throw new ConfigError('Config field "check.lintReport" must be a project-relative path');
+        }
+        out.lintReport = path;
+    }
     return out;
 }

package/dist/src/core/config-validate-test-toolchains.js

@@ -59,6 +59,20 @@ export function parseTestBlock(rec, config) {
         }
         out.mochitestPorts = mochitestPorts;
     }
+    const lockMode = testRec.raw('lockMode');
+    if (lockMode !== undefined) {
+        if (lockMode !== 'exclusive' && lockMode !== 'shared') {
+            throw new ConfigError('Config field "test.lockMode" must be "exclusive" or "shared"');
+        }
+        out.lockMode = lockMode;
+    }
+    const furnaceApply = testRec.raw('furnaceApply');
+    if (furnaceApply !== undefined) {
+        if (furnaceApply !== 'all' && furnaceApply !== 'reached' && furnaceApply !== 'none') {
+            throw new ConfigError('Config field "test.furnaceApply" must be "all", "reached" or "none"');
+        }
+        out.furnaceApply = furnaceApply;
+    }
     config.test = out;
 }
 /** Parses optional project-specific external toolchain doctor probes. */

package/dist/src/core/config-validate-token-scales.d.ts

@@ -1,5 +1,8 @@
 /**
  * Validation for `fireforge.json#patchLint.tokenScales`.
+ *
+ * Unknown keys are refused: a misspelt `allowInCalc` or `minFiles` would
+ * otherwise loosen or drop a scale without a word.
  */
 import type { PatchLintTokenScale } from '../types/config.js';
 /** Parses and validates `patchLint.tokenScales`. */

package/dist/src/core/config-validate-token-scales.js

@@ -1,9 +1,23 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
  * Validation for `fireforge.json#patchLint.tokenScales`.
+ *
+ * Unknown keys are refused: a misspelt `allowInCalc` or `minFiles` would
+ * otherwise loosen or drop a scale without a word.
  */
 import { ConfigError } from '../errors/config.js';
 import { parseObject } from '../utils/parse.js';
+const SCALE_KEYS = [
+    'properties',
+    'prefix',
+    'allowLiterals',
+    'allow',
+    'allowInCalc',
+    'offsetCap',
+    'exclude',
+    'minFiles',
+];
+const PREFIX_PATTERN = /^--[\w-]+$/;
 function parseNames(raw, label, required) {
     if (raw === undefined && !required)
         return undefined;
@@ -14,6 +28,21 @@ function parseNames(raw, label, required) {
     }
     return raw;
 }
+function parsePrefix(raw, label) {
+    const prefixes = Array.isArray(raw) ? raw : [raw];
+    if (prefixes.length === 0 ||
+        prefixes.some((prefix) => typeof prefix !== 'string' || !PREFIX_PATTERN.test(prefix))) {
+        throw new ConfigError(`Config field "${label}.prefix" must be a custom-property prefix such as "--mybrowser-space-", or a non-empty list of them`);
+    }
+    return Array.isArray(raw) ? prefixes : raw;
+}
+function parseNumber(raw, label, integer) {
+    const valid = typeof raw === 'number' && Number.isFinite(raw) && (integer ? Number.isInteger(raw) : true);
+    if (!valid || raw < (integer ? 1 : 0)) {
+        throw new ConfigError(`Config field "${label}" must be ${integer ? 'a positive integer' : 'a non-negative number'}`);
+    }
+    return raw;
+}
 function parseTokenScale(raw, label) {
     let rec;
     try {
@@ -22,12 +51,13 @@ function parseTokenScale(raw, label) {
     catch {
         throw new ConfigError(`Config field "${label}" must be an object`);
     }
-    const properties = parseNames(rec.raw('properties'), `${label}.properties`, true) ?? [];
-    const prefix = rec.raw('prefix');
-    if (typeof prefix !== 'string' || !/^--[\w-]+$/.test(prefix)) {
-        throw new ConfigError(`Config field "${label}.prefix" must be a custom-property prefix such as "--mybrowser-space-"`);
+    for (const key of Object.keys(raw)) {
+        if (!SCALE_KEYS.includes(key)) {
+            throw new ConfigError(`Config field "${label}" has unknown key "${key}"`);
+        }
     }
-    const scale = { properties, prefix };
+    const properties = parseNames(rec.raw('properties'), `${label}.properties`, true) ?? [];
+    const scale = { properties, prefix: parsePrefix(rec.raw('prefix'), label) };
     const allowLiterals = parseNames(rec.raw('allowLiterals'), `${label}.allowLiterals`, false);
     if (allowLiterals !== undefined)
         scale.allowLiterals = allowLiterals;
@@ -39,6 +69,18 @@ function parseTokenScale(raw, label) {
         }
         scale.allow = allow;
     }
+    const allowInCalc = parseNames(rec.raw('allowInCalc'), `${label}.allowInCalc`, false);
+    if (allowInCalc !== undefined)
+        scale.allowInCalc = allowInCalc;
+    const offsetCap = rec.raw('offsetCap');
+    if (offsetCap !== undefined)
+        scale.offsetCap = parseNumber(offsetCap, `${label}.offsetCap`, false);
+    const exclude = parseNames(rec.raw('exclude'), `${label}.exclude`, false);
+    if (exclude !== undefined)
+        scale.exclude = exclude;
+    const minFiles = rec.raw('minFiles');
+    if (minFiles !== undefined)
+        scale.minFiles = parseNumber(minFiles, `${label}.minFiles`, true);
     return scale;
 }
 /** Parses and validates `patchLint.tokenScales`. */

package/dist/src/core/config-validate.js

@@ -471,6 +471,12 @@ function parseTypecheckBlock(rec) {
     if (undefinedIdentifiers !== undefined) {
         out.undefinedIdentifiers = undefinedIdentifiers;
     }
+    const litTypes = rec.raw('litTypes');
+    if (litTypes !== undefined && typeof litTypes !== 'boolean') {
+        throw new ConfigError('Config field "typecheck.litTypes" must be a boolean');
+    }
+    if (litTypes !== undefined)
+        out.litTypes = litTypes;
     return out;
 }
 /**

package/dist/src/core/coverage-extend.js

@@ -13,7 +13,7 @@
  */
 import { toError } from '../utils/errors.js';
 import { verbose } from '../utils/logger.js';
-import { collectStagingInputs, createCoverageRecord, findChangedInputs, hashEngineFile, isUnderPath, narrowAnchor, normalizeRequestPath, readEngineContentState, refreshAnchor, } from './coverage-records.js';
+import { collectStagingInputs, createCoverageRecord, findChangedInputs, hashEngineFile, isUnderPath, narrowAnchor, normalizeRequestPath, readEngineContentState, refreshAnchor, widenWithRestagedManifests, } from './coverage-records.js';
 export { hashEngineFile } from './coverage-records.js';
 /** Filename of the generated mozconfig, relative to the engine directory. */
 const MOZCONFIG_FILENAME = 'mozconfig';
@@ -96,7 +96,7 @@ export async function planCoverageRetention(engineDir, previous, requested) {
     if (previous === undefined)
         return emptyPlan();
     const coverage = previous.testPackagingCoverage ?? 'full';
-    const rebuilt = requested.map(normalizeRequestPath).filter((path) => path !== '');
+    const rebuilt = await widenWithRestagedManifests(engineDir, requested.map(normalizeRequestPath).filter((path) => path !== ''));
     let state;
     try {
         state = await readEngineContentState(engineDir);

package/dist/src/core/coverage-records.d.ts

@@ -67,6 +67,17 @@ export declare function findChangedInputs(state: EngineContentState, anchor: Cov
  * cannot be read or the anchor cannot be compared.
  */
 export declare function refreshAnchor<T extends CoverageAnchor>(state: EngineContentState, anchor: T, rebuilt: readonly string[]): Promise<T | undefined>;
+/**
+ * The request paths a scoped build restages, widened by the test manifests
+ * of every requested file: packaging one file of a manifest re-processes
+ * the manifest itself, so a manifest that gained an entry for that file is
+ * restaged too, and must not count as a changed input of the manifest's
+ * other files afterwards.
+ *
+ * @param engineDir - Path to the engine directory
+ * @param requested - Normalized request paths of the build
+ */
+export declare function widenWithRestagedManifests(engineDir: string, requested: readonly string[]): Promise<string[]>;
 /**
  * Engine-relative paths a manifest names outside its own directory. Bare
  * names stay inside it. `!/` and `/` prefixes are engine-root relative, as

package/dist/src/core/coverage-records.js

@@ -217,6 +217,40 @@ async function findManifestDirectory(engineDir, dir) {
             return undefined;
     }
 }
+/**
+ * The request paths a scoped build restages, widened by the test manifests
+ * of every requested file: packaging one file of a manifest re-processes
+ * the manifest itself, so a manifest that gained an entry for that file is
+ * restaged too, and must not count as a changed input of the manifest's
+ * other files afterwards.
+ *
+ * @param engineDir - Path to the engine directory
+ * @param requested - Normalized request paths of the build
+ */
+export async function widenWithRestagedManifests(engineDir, requested) {
+    const widened = new Set(requested);
+    for (const path of requested) {
+        if (!TEST_FILE_PATTERN.test(posix.basename(path)))
+            continue;
+        const dir = await findManifestDirectory(engineDir, posix.dirname(path));
+        if (dir === undefined)
+            continue;
+        let entries;
+        try {
+            entries = await readdir(join(engineDir, dir));
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (TEST_MANIFEST_BASENAMES.has(entry))
+                widened.add(dir === '' ? entry : `${dir}/${entry}`);
+        }
+    }
+    return [...widened];
+}
+/** A test implementation file (`browser_*.js`, `test_*.js`, …), not a directory. */
+const TEST_FILE_PATTERN = /^(?:browser|test)_.*\.m?js$/;
 /** Test manifests at or beneath `dir`, bounded by {@link MAX_WALK_ENTRIES}. */
 async function findManifestsBeneath(engineDir, dir) {
     const manifests = [];

package/dist/src/core/engine-session-lock.d.ts

@@ -1,3 +1,4 @@
+import type { LockMode } from './file-lock.js';
 import { type LockStatusSnapshot } from './file-lock.js';
 export interface EngineSessionLockOptions {
     /**
@@ -7,6 +8,11 @@ export interface EngineSessionLockOptions {
      * fail-fast behaviour.
      */
     waitLockSeconds?: number | undefined;
+    /**
+     * `shared` lets build-less test runs overlap each other; see
+     * `file-lock-shared.ts`. Every other caller holds the lock exclusively.
+     */
+    mode?: LockMode | undefined;
 }
 /**
  * Formats the notice printed when the wait budget is extended because the

package/dist/src/core/engine-session-lock.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { InconclusiveVerdictError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
 import { info, warn } from '../utils/logger.js';
+import { MAX_WAIT_LOCK_SECONDS } from '../utils/options.js';
 import { sleep } from '../utils/sleep.js';
 import { formatLockQueuePosition, readLockStatus, withFileLock, } from './file-lock.js';
 import { git } from './git-base.js';
@@ -14,7 +15,7 @@ const ENGINE_SESSION_LOCK_PATH = join('.fireforge', 'engine-session.lock');
  * never gets one longer than the largest wait they could have asked for.
  */
 const WAIT_EXTENSION_FACTOR = 4;
-const MAX_WAIT_LOCK_MS = 3600 * 1000;
+const MAX_WAIT_LOCK_MS = MAX_WAIT_LOCK_SECONDS * 1000;
 /**
  * Formats the periodic operator-facing waiting line printed while `--wait-lock`
  * polls a contended engine session lock. The holder identification comes from
@@ -66,6 +67,7 @@ export async function withEngineSessionLock(projectRoot, command, operation, opt
     }
     const { waitLockSeconds } = options;
     return withFileLock(join(projectRoot, ENGINE_SESSION_LOCK_PATH), operation, {
+        ...(options.mode === 'shared' ? { mode: 'shared' } : {}),
         timeoutMs: waitLockSeconds !== undefined ? waitLockSeconds * 1000 : 1000,
         ...(waitLockSeconds !== undefined
             ? {
@@ -121,8 +123,13 @@ export async function readEngineSessionLockStatus(projectRoot) {
  * Pure, so the wording is unit-testable without a lock on disk.
  */
 export function formatEngineSessionLockStatus(snapshot, holderCpuSeconds) {
+    const shared = snapshot.sharedHolders !== undefined && snapshot.sharedHolders > 0
+        ? `Shared holders: ${snapshot.sharedHolders} build-less test run(s) under a shared lock.`
+        : undefined;
     if (!snapshot.held) {
-        return ['Engine session lock: free (no FireForge engine-mutating command is running).'];
+        return shared === undefined
+            ? ['Engine session lock: free (no FireForge engine-mutating command is running).']
+            : ['Engine session lock: no exclusive holder.', shared];
     }
     const elapsed = snapshot.heldForMs === undefined
         ? 'unknown duration'
@@ -135,6 +142,7 @@ export function formatEngineSessionLockStatus(snapshot, holderCpuSeconds) {
     const lines = [
         `Engine session lock: ${identity}, for ${elapsed}.`,
         `Queue depth: ${snapshot.queueDepth} waiter(s).`,
+        ...(shared === undefined ? [] : [shared]),
     ];
     // Liveness answers "does the process exist". It does not answer "is it
     // getting anywhere". A holder alive for minutes having used a fraction of

package/dist/src/core/file-lock-shared.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Shared holds on a FireForge directory lock.
+ *
+ * Every lock used to be exclusive, so two build-less `fireforge test` runs
+ * on one objdir, each with its own profile and (under auto ports) its own
+ * ports, still waited for each other: the gate's browser tiers ran strictly
+ * serially on a 14-core host. A shared hold lets such runs overlap while
+ * anything that writes (a build, a re-export, a test run that builds)
+ * still holds the lock alone.
+ *
+ * The scheme reuses the exclusive lock as a turnstile, so arrival order and
+ * stale-holder reaping come from the machinery that already exists:
+ *
+ *  - A shared holder takes the exclusive lock in the ordinary way, records
+ *    itself under `<lock>.shared/<uuid>/` (an owner record like the lock's
+ *    own), and releases the exclusive lock at once.
+ *  - An exclusive holder takes the exclusive lock, then waits until no live
+ *    shared holder is left. While it waits it already holds the turnstile,
+ *    so no new shared holder can slip in ahead of it: a writer queued
+ *    behind readers is served once they finish, never starved by newcomers.
+ *
+ * A shared holder whose process died is reaped by the same PID-first
+ * liveness check the exclusive lock uses.
+ */
+/** How a caller holds a lock. */
+export type LockMode = 'exclusive' | 'shared';
+/** The directory holding a lock's shared-holder records. */
+export declare function sharedHoldersDir(lockPath: string): string;
+/**
+ * Counts the live shared holders of a lock, reaping any whose process is
+ * gone. A missing directory means none.
+ *
+ * @param lockPath - The lock directory
+ * @param options - `reap: false` only counts (status reads)
+ */
+export declare function countLiveSharedHolders(lockPath: string, options?: {
+    reap?: boolean;
+}): Promise<number>;
+/** A registered shared hold. */
+export interface SharedHold {
+    /** Removes the hold. Never throws. */
+    release(): Promise<void>;
+}
+/**
+ * Records a shared hold. Call while holding the lock's exclusive turnstile.
+ *
+ * @param lockPath - The lock directory
+ * @param metadata - Owner metadata lines (`command=…`)
+ */
+export declare function registerSharedHold(lockPath: string, metadata: readonly string[] | undefined): Promise<SharedHold>;
+/**
+ * Removes every shared hold this process registered, for the signal path.
+ * Never throws.
+ *
+ * @returns The holder paths removed
+ */
+export declare function releaseSharedHoldsForSignal(): Promise<string[]>;