@applitools/core 4.65.1 → 4.66.0

package/dist/utils/extract-git-info.js

@@ -26,18 +26,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractBranchLookupFallbackList = exports.isISODate = exports.extractBranchingTimestamp = exports.extractBuildIdFromCI = exports.extractCIBranchName = exports.extractGitRepo = exports.extractGitBranch = exports.extractLatestCommitInfo = exports.getPrimaryRemoteName = exports.cacheKey = void 0;
+exports.extractBranchLookupFallbackList = exports.getBranchAncestryByLocalBranches = exports.getBranchAncestryByCommits = exports.isISODate = exports.extractBranchingTimestamp = exports.extractBuildIdFromCI = exports.extractCIBranchName = exports.extractGitRepo = exports.extractGitBranch = exports.extractLatestCommitInfo = exports.extractDefaultBranch = exports.checkGitEnvironment = exports.resolveBranchToLocalRef = exports.getPrimaryRemoteName = exports.cacheKey = void 0;
 const utils = __importStar(require("@applitools/utils"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const shell_quote_1 = require("shell-quote");
 const logger_1 = require("@applitools/logger");
-// Check if debug mode is enabled for verbose git info logging
+/** Verbose diagnostic-logging gate; on when RUNNER_DEBUG=1. */
 const isDebugMode = () => process.env.RUNNER_DEBUG === '1';
 exports.cacheKey = 'default';
-/**
- * Get the primary remote name (cached for performance)
- * Prefers 'origin' if it exists, otherwise uses the first available remote
- */
+/** Primary remote name (cached). Prefers `origin`, else the first remote. */
 exports.getPrimaryRemoteName = utils.general.cachify(async function ({ execOptions, logger = (0, logger_1.makeLogger)() }) {
     const result = await executeWithLog('git remote show', { execOptions, logger });
     if (result.stderr) {
@@ -54,14 +52,316 @@ exports.getPrimaryRemoteName = utils.general.cachify(async function ({ execOptio
         cwd: (_a = args[0].execOptions) === null || _a === void 0 ? void 0 : _a.cwd,
     });
 });
-exports.extractLatestCommitInfo = utils.general.cachify(async function ({ execOptions, logger = (0, logger_1.makeLogger)(), }) {
-    let result;
+/**
+ * Resolve `branchName` to a local bare ref so later `git merge-base`/`rev-parse`
+ * calls don't fatal in single-branch/shallow clones where the branch lives only
+ * on the remote.
+ *
+ * Resolution order (cheap → expensive):
+ *   1. `refs/heads/<name>` — already a local branch.
+ *   2. `refs/remotes/<remote>/<name>` — remote-tracking ref; alias it locally
+ *      via `git branch <name> <remote>/<name>`.
+ *   3. `git ls-remote --heads <remote> <name>` — remote-only; fetch it in as
+ *      a local-branch ref.
+ *   4. `undefined` — unknown branch.
+ *
+ * Never throws. NOT cachified — it has filesystem side-effects.
+ */
+async function resolveBranchToLocalRef({ branchName, remoteName, execOptions, logger = (0, logger_1.makeLogger)(), }) {
+    // 1+2. Probe local and remote-tracking refs in parallel — independent reads;
+    //      saves a sequential round-trip in the common CI miss case.
+    const [local, tracking] = await Promise.all([
+        executeWithLog((0, shell_quote_1.quote)(['git', 'rev-parse', '--verify', '--quiet', `refs/heads/${branchName}`]), {
+            execOptions,
+            logger,
+        }),
+        executeWithLog((0, shell_quote_1.quote)(['git', 'rev-parse', '--verify', '--quiet', `refs/remotes/${remoteName}/${branchName}`]), {
+            execOptions,
+            logger,
+        }),
+    ]);
+    // 1. Local branch already exists.
+    if (local.code === 0 && local.stdout.trim()) {
+        return branchName;
+    }
+    // 2. Remote-tracking ref exists — create the local-branch alias.
+    if (tracking.code === 0 && tracking.stdout.trim()) {
+        const create = await executeWithLog((0, shell_quote_1.quote)(['git', 'branch', branchName, `${remoteName}/${branchName}`]), {
+            execOptions,
+            logger,
+        });
+        if (create.code === 0) {
+            logger.log(`resolveBranchToLocalRef: created local ref refs/heads/${branchName} from ${remoteName}/${branchName}`);
+            return branchName;
+        }
+        // Race or already-exists — recheck local ref before giving up.
+        const recheck = await executeWithLog((0, shell_quote_1.quote)(['git', 'rev-parse', '--verify', '--quiet', `refs/heads/${branchName}`]), {
+            execOptions,
+            logger,
+        });
+        if (recheck.code === 0 && recheck.stdout.trim())
+            return branchName;
+    }
+    // 3. Branch lives only on the remote — fetch into a local-branch ref.
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (env.remoteAccessible) {
+        const lsR = await executeWithLog((0, shell_quote_1.quote)(['git', 'ls-remote', '--heads', remoteName, branchName]), {
+            execOptions,
+            logger,
+        });
+        if (lsR.code === 0 && lsR.stdout.trim()) {
+            const fetched = await executeWithLog((0, shell_quote_1.quote)(['git', 'fetch', remoteName, `${branchName}:${branchName}`, '--filter=tree:0']), { execOptions, logger });
+            if (fetched.code === 0) {
+                logger.log(`resolveBranchToLocalRef: fetched ${branchName} from ${remoteName} into refs/heads/${branchName}`);
+                return branchName;
+            }
+        }
+    }
+    return undefined;
+}
+exports.resolveBranchToLocalRef = resolveBranchToLocalRef;
+/**
+ * One-shot, cached probe of the git environment, staged cheap → expensive:
+ *   1. git installed?                 (`git --version`)
+ *   2. inside a work tree?            (`git rev-parse --is-inside-work-tree`)
+ *   3. remote configured?            (`git remote`)
+ *   4. remote reachable?             (`git ls-remote <r> HEAD`)
+ *
+ * Outermost guard for any path that shells out to git; each step short-circuits
+ * the rest. Callers consult `ok` for local-only features, `remoteAccessible`
+ * for network ops. Cached per `cwd`; first call emits a grep-friendly
+ * `APPLITOOLS GIT ENVIRONMENT CHECK` banner, later calls return silently.
+ */
+exports.checkGitEnvironment = utils.general.cachify(async function ({ execOptions, logger = (0, logger_1.makeLogger)(), }) {
+    // INVARIANT: MUST NOT reject. Cachified — a rejected promise would be
+    // memoized and re-thrown by every downstream caller. Every path returns via
+    // `finalize()` (can't throw) or is caught by the outer safety net below.
+    var _a, _b, _c, _d, _e, _f;
+    let gitInstalled = false;
+    let insideRepo = false;
+    let remoteAccessible = false;
+    let remoteName;
+    const reasons = [];
+    const finalize = (extraReason) => {
+        if (extraReason)
+            reasons.push(extraReason);
+        const result = {
+            gitInstalled,
+            insideRepo,
+            remoteAccessible,
+            ok: gitInstalled && insideRepo,
+            reason: reasons.length ? reasons.join('; ') : 'ok',
+            remoteName,
+        };
+        try {
+            logGitEnvironmentBanner(logger, result);
+        }
+        catch {
+            // Logger failures must NEVER make the env check itself fail.
+        }
+        return result;
+    };
     try {
-        const githubPullRequestLastCommitSha = await extractGithubPullRequestLastCommitSha();
-        result = await executeWithLog(`git log ${githubPullRequestLastCommitSha !== null && githubPullRequestLastCommitSha !== void 0 ? githubPullRequestLastCommitSha : ''} -1 --format="%aI %H"`, {
+        try {
+            // 1. git installed? Non-fatal — failures finalize with a clean result.
+            const versionResult = await executeWithLog('git --version', { execOptions, logger });
+            if (versionResult.code !== 0) {
+                return finalize(`git binary: ${((_a = versionResult.stderr) === null || _a === void 0 ? void 0 : _a.trim()) || `exit ${versionResult.code} (command not found?)`}`);
+            }
+            gitInstalled = true;
+            // 2. Inside a work tree?
+            const repoResult = await executeWithLog('git rev-parse --is-inside-work-tree', { execOptions, logger });
+            if (repoResult.code !== 0 || repoResult.stdout.trim() !== 'true') {
+                return finalize(`repo: ${((_b = repoResult.stderr) === null || _b === void 0 ? void 0 : _b.trim()) || 'not inside a git work tree'}`);
+            }
+            insideRepo = true;
+            // 3. Remote configured?
+            const remotesResult = await executeWithLog('git remote', { execOptions, logger });
+            const remotesText = remotesResult.stdout.trim();
+            if (remotesResult.code !== 0 || !remotesText) {
+                return finalize(`remote: ${((_c = remotesResult.stderr) === null || _c === void 0 ? void 0 : _c.trim()) || 'no remote configured'}`);
+            }
+            // Non-empty text → split+filter yields ≥1 element.
+            const remotes = remotesText.split(/\s+/).filter(Boolean);
+            remoteName = remotes.includes('origin') ? 'origin' : remotes[0];
+            // 4. Remote reachable?
+            const probe = await executeWithLog((0, shell_quote_1.quote)(['git', 'ls-remote', remoteName, 'HEAD']), { execOptions, logger });
+            if (probe.code !== 0) {
+                return finalize(`remote: ${((_d = probe.stderr) === null || _d === void 0 ? void 0 : _d.trim()) || `ls-remote exit ${probe.code}`}`);
+            }
+            remoteAccessible = true;
+            return finalize();
+        }
+        catch (err) {
+            // Catches `executeWithLog` rejections (e.g. spawn ENOENT for a missing
+            // git binary). Falls through to a clean finalize.
+            return finalize(`probe threw: ${(_e = err === null || err === void 0 ? void 0 : err.message) !== null && _e !== void 0 ? _e : err}`);
+        }
+    }
+    catch (catastrophic) {
+        // Last-resort safety net — `finalize` shouldn't throw, but if anything
+        // truly unexpected happens, return an "all-failed" result, never reject.
+        return {
+            gitInstalled: false,
+            insideRepo: false,
+            remoteAccessible: false,
+            ok: false,
+            reason: `checkGitEnvironment catastrophic failure: ${(_f = catastrophic === null || catastrophic === void 0 ? void 0 : catastrophic.message) !== null && _f !== void 0 ? _f : catastrophic}`,
+            remoteName: undefined,
+        };
+    }
+}, args => { var _a, _b; return ({ cwd: (_b = (_a = args[0]) === null || _a === void 0 ? void 0 : _a.execOptions) === null || _b === void 0 ? void 0 : _b.cwd }); });
+/**
+ * Grep-friendly env banner. The `APPLITOOLS GIT ENVIRONMENT CHECK` prefix is
+ * unique to this codepath, so support can find the full verdict in one line.
+ */
+function logGitEnvironmentBanner(logger, r) {
+    const sep = '============================================================';
+    const allGood = r.gitInstalled && r.insideRepo && r.remoteAccessible;
+    // Header — names the first failed sub-check (or "all ok").
+    logger.log(sep);
+    if (allGood) {
+        logger.log('APPLITOOLS GIT ENVIRONMENT CHECK ✓ all ok');
+    }
+    else if (!r.gitInstalled) {
+        logger.log('APPLITOOLS GIT ENVIRONMENT CHECK ✗ GIT NOT INSTALLED');
+    }
+    else if (!r.insideRepo) {
+        logger.log('APPLITOOLS GIT ENVIRONMENT CHECK ✗ NOT IN A GIT REPOSITORY');
+    }
+    else if (!r.remoteAccessible) {
+        logger.log('APPLITOOLS GIT ENVIRONMENT CHECK ✗ REMOTE NOT ACCESSIBLE');
+    }
+    // Per-condition status lines — show every sub-check that was reached.
+    logger.log(`  git binary:  ${r.gitInstalled ? '✓ installed' : '✗ NOT FOUND'}`);
+    if (r.gitInstalled) {
+        logger.log(`  repo:        ${r.insideRepo ? '✓ inside work tree' : '✗ NOT INSIDE A WORK TREE'}`);
+    }
+    if (r.gitInstalled && r.insideRepo) {
+        const remoteLine = r.remoteAccessible
+            ? `✓ accessible (${r.remoteName})`
+            : r.remoteName
+                ? `✗ NOT ACCESSIBLE (${r.remoteName})`
+                : '✗ NONE CONFIGURED';
+        logger.log(`  remote:      ${remoteLine}`);
+    }
+    // Reason + remediation hints for the triggered failure mode.
+    if (!allGood) {
+        logger.log(`  reason:      ${r.reason}`);
+        if (!r.gitInstalled) {
+            logger.log('  → All git-based SCM features will be SKIPPED.');
+            logger.log('  → Install git or add it to PATH to enable branch detection and baseline inheritance.');
+        }
+        else if (!r.insideRepo) {
+            logger.log('  → All git-based SCM features will be SKIPPED.');
+            logger.log('  → Run this from inside a git working tree to enable branch detection.');
+        }
+        else if (!r.remoteAccessible) {
+            logger.log('  → All remote-dependent fallbacks will be SKIPPED.');
+            logger.log('  → Branch lookup may be incomplete. Verify network / credentials / remote config.');
+        }
+    }
+    logger.log(sep);
+}
+/**
+ * Detect the repo's default branch. Fallback chain (short-circuits on success;
+ * never throws):
+ *   1. `APPLITOOLS_DEFAULT_BRANCH` — explicit override.
+ *   2. `git symbolic-ref --short refs/remotes/<remote>/HEAD` — authoritative
+ *      once fetched; `<remote>/` prefix stripped.
+ *   3. `git ls-remote --symref <remote> HEAD` — works when the local symref was
+ *      never set up (single-branch clones, older CI git).
+ *   4. `git config --get init.defaultBranch` — user-global preference.
+ *   5. Literal `'main'` — last resort.
+ *
+ * Steps 2-3 catch non-standard defaults (e.g. `team/.../v1.x-rc`).
+ * Cached per `cwd`.
+ */
+exports.extractDefaultBranch = utils.general.cachify(async function ({ execOptions, logger = (0, logger_1.makeLogger)() }) {
+    var _a;
+    logger = logger.extend({ tags: [`extract-default-branch-${utils.general.shortid()}`] });
+    // 1. Explicit override — works even without git / outside a repo.
+    const envOverride = (_a = process.env.APPLITOOLS_DEFAULT_BRANCH) === null || _a === void 0 ? void 0 : _a.trim();
+    if (envOverride) {
+        logger.log(`extractDefaultBranch: using APPLITOOLS_DEFAULT_BRANCH="${envOverride}"`);
+        return envOverride;
+    }
+    // Env gate. Steps 2-4 shell out to git; without it, skip to 'main'.
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.ok) {
+        logger.log("extractDefaultBranch: git environment not ok, falling back to 'main'");
+        return 'main';
+    }
+    const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
+    // 2. git symbolic-ref --short refs/remotes/<remote>/HEAD
+    try {
+        const r = await executeWithLog((0, shell_quote_1.quote)(['git', 'symbolic-ref', '--short', `refs/remotes/${remoteName}/HEAD`]), {
             execOptions,
             logger,
         });
+        if (!r.stderr && r.stdout.trim()) {
+            const out = r.stdout.trim();
+            const normalized = out.replace(new RegExp(`^${remoteName}/`), '');
+            if (normalized) {
+                logger.log(`extractDefaultBranch: resolved via symbolic-ref -> "${normalized}"`);
+                return normalized;
+            }
+        }
+    }
+    catch (err) {
+        // Expected when the symref isn't set up (fresh single-branch clone).
+        if (isDebugMode())
+            logger.log('extractDefaultBranch: symbolic-ref step failed, continuing', err);
+    }
+    // 3. git ls-remote --symref <remote> HEAD
+    try {
+        const r = await executeWithLog((0, shell_quote_1.quote)(['git', 'ls-remote', '--symref', remoteName, 'HEAD']), { execOptions, logger });
+        if (!r.stderr && r.stdout) {
+            // Output line: "ref: refs/heads/<name>\tHEAD"
+            const match = r.stdout.match(/^ref:\s+refs\/heads\/([^\s]+)\s+HEAD/m);
+            if (match && match[1]) {
+                logger.log(`extractDefaultBranch: resolved via ls-remote --symref -> "${match[1]}"`);
+                return match[1];
+            }
+        }
+    }
+    catch (err) {
+        // Expected without remote access.
+        if (isDebugMode())
+            logger.log('extractDefaultBranch: ls-remote --symref step failed, continuing', err);
+    }
+    // 4. git config --get init.defaultBranch (user-global preference)
+    try {
+        const r = await executeWithLog('git config --get init.defaultBranch', { execOptions, logger });
+        if (!r.stderr && r.stdout.trim()) {
+            logger.log(`extractDefaultBranch: resolved via init.defaultBranch -> "${r.stdout.trim()}"`);
+            return r.stdout.trim();
+        }
+    }
+    catch (err) {
+        // No user-global preference — normal.
+        if (isDebugMode())
+            logger.log('extractDefaultBranch: init.defaultBranch step failed, continuing', err);
+    }
+    // 5. Last resort
+    logger.log('extractDefaultBranch: falling back to literal "main"');
+    return 'main';
+}, args => { var _a, _b; return ({ cwd: (_b = (_a = args[0]) === null || _a === void 0 ? void 0 : _a.execOptions) === null || _b === void 0 ? void 0 : _b.cwd }); });
+exports.extractLatestCommitInfo = utils.general.cachify(async function ({ execOptions, logger = (0, logger_1.makeLogger)(), }) {
+    // Function-entry env gate. Without git or a repo, there is no commit to extract.
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.ok) {
+        logger.log('extractLatestCommitInfo: git environment not ok, skipping');
+        return undefined;
+    }
+    let result;
+    try {
+        const githubPullRequestLastCommitSha = await extractGithubPullRequestLastCommitSha();
+        const logArgs = ['git', 'log'];
+        if (githubPullRequestLastCommitSha)
+            logArgs.push(githubPullRequestLastCommitSha);
+        logArgs.push('-1', '--format=%aI %H');
+        result = await executeWithLog((0, shell_quote_1.quote)(logArgs), { execOptions, logger });
         if (result.stderr) {
             logger.log(`Error during extracting commit information from git`, result.stderr);
         }
@@ -82,7 +382,7 @@ exports.extractLatestCommitInfo = utils.general.cachify(async function ({ execOp
         var _a, _b, _c;
         if (((_a = process.env.GITHUB_EVENT_NAME) === null || _a === void 0 ? void 0 : _a.startsWith('pull_request')) && process.env.GITHUB_EVENT_PATH) {
             const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
-            await executeWithLog(`git fetch ${remoteName} --depth=2`, { execOptions, logger });
+            await executeWithLog((0, shell_quote_1.quote)(['git', 'fetch', remoteName, '--depth=2']), { execOptions, logger });
             const event = await fs_1.default.promises.readFile(process.env.GITHUB_EVENT_PATH, 'utf-8').then(JSON.parse);
             return (_c = (_b = event === null || event === void 0 ? void 0 : event.pull_request) === null || _b === void 0 ? void 0 : _b.head) === null || _c === void 0 ? void 0 : _c.sha;
         }
@@ -90,11 +390,18 @@ exports.extractLatestCommitInfo = utils.general.cachify(async function ({ execOp
 }, () => exports.cacheKey);
 exports.extractGitBranch = utils.general.cachify(async function ({ execOptions, logger = (0, logger_1.makeLogger)() }) {
     // 1. Try CI environment variables first (fast, no subprocess, handles detached HEAD in CI)
+    //    This step works even without git installed / outside a repo.
     const ciBranch = extractCIBranchName();
     if (ciBranch) {
         logger.log(`Extracted branch name from CI environment: "${ciBranch}"`);
         return ciBranch;
     }
+    // Function-entry env gate for the git-using fallback path below.
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.ok) {
+        logger.log('extractGitBranch: git environment not ok, no branch name available');
+        return undefined;
+    }
     // 2. Fall back to git command (works when on an actual branch locally)
     const result = await executeWithLog('git branch --show-current', { execOptions, logger });
     if (result.stderr) {
@@ -110,10 +417,16 @@ exports.extractGitBranch = utils.general.cachify(async function ({ execOptions,
     }
 }, args => { var _a, _b, _c; return ({ cwd: (_b = (_a = args[0]) === null || _a === void 0 ? void 0 : _a.execOptions) === null || _b === void 0 ? void 0 : _b.cwd, ignoreGitBranching: (_c = args[0]) === null || _c === void 0 ? void 0 : _c.ignoreGitBranching }); });
 exports.extractGitRepo = utils.general.cachify(async function ({ execOptions, logger = (0, logger_1.makeLogger)() }) {
+    // Function-entry env gate. Without git or a repo, we can't extract a remote URL.
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.ok) {
+        logger.log('extractGitRepo: git environment not ok, returning empty repo info');
+        return {};
+    }
     const remotes = await extractRemotes();
     logger.log(`Extracted remotes from git: ${remotes}`);
     const remote = remotes.includes('origin') ? 'origin' : remotes[0];
-    const result = await executeWithLog(`git remote get-url ${remote}`, { execOptions, logger });
+    const result = await executeWithLog((0, shell_quote_1.quote)(['git', 'remote', 'get-url', remote]), { execOptions, logger });
     if (result.stderr) {
         logger.log(`Error during extracting remote url from git`, result.stderr);
         return {};
@@ -160,67 +473,114 @@ async function extractBuildIdFromCI() {
     );
 }
 exports.extractBuildIdFromCI = extractBuildIdFromCI;
+/**
+ * Extract the ISO-8601 timestamp at which `branchName` branched off
+ * `parentBranchName`. Steps short-circuit on success; returns `undefined` on
+ * total failure — never throws.
+ *   1. Shallow clone → unshallow so topology is visible to `git merge-base`.
+ *   2. `git merge-base <remote>/<branch> <remote>/<parent>` — remote refs first
+ *      (CI usually only has these).
+ *   3. Local refs fallback (`git merge-base <branch> <parent>`).
+ *   4. Still none → if the parent is on the remote, fetch it by name and retry;
+ *      else give up (branch exists nowhere).
+ *   5. Resolve the hash's date via `git show -s --format=%aI`.
+ *
+ * Cached per (branchName, parentBranchName, cwd).
+ */
 exports.extractBranchingTimestamp = utils.general.cachify(async function ({ branchName, parentBranchName, execOptions, logger = (0, logger_1.makeLogger)(), }) {
-    var _a;
     logger = logger.extend({ tags: [`extract-branching-timestamp-${utils.general.shortid()}`] });
-    // Get the primary remote name (cached)
-    const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
-    const shallowCheckResult = await executeWithLog('git rev-parse --is-shallow-repository', {
-        execOptions,
-        logger,
-    });
-    const isShallow = shallowCheckResult.stdout.trim() === 'true';
-    if (isShallow) {
-        logger.log('extractBranchingTimestamp - Repository is a shallow clone, attempting to unshallow');
-        await executeFetchStrategy(isShallow, execOptions, logger);
-    }
-    // Step 1: Try with remote refs first (fast path - uses already-fetched remote data)
-    const command = `HASH=$(git merge-base ${branchName} ${parentBranchName}) && git show -q --format=%aI $HASH`;
-    let result = await executeWithLog(command, { execOptions, logger });
-    // Step 2: If remote refs failed, try local refs
-    if (result.stderr) {
-        const commandWithRemoteRefs = `HASH=$(git merge-base ${remoteName}/${branchName} ${remoteName}/${parentBranchName}) && git show -q --format=%aI $HASH`;
-        result = await executeWithLog(commandWithRemoteRefs, { execOptions, logger });
-    }
-    // Step 3: Handle missing branches with smart fetch (check remote existence first)
-    // Fetch remote branches list once if there's an error (cached call - virtually free)
-    if (result.stderr) {
-        const remoteBranches = await getAllRemoteBranches({ execOptions, logger });
-        // Both parent and current branches could be missing, iterate up to twice
-        for (let i = 0; i < 2; i++) {
-            if (result.stderr) {
-                const [, missingBranch] = (_a = result.stderr.match(/Not a valid object name ([^\s]+)/)) !== null && _a !== void 0 ? _a : [];
-                if (missingBranch) {
-                    // Normalize branch name by removing remote prefix
-                    const normalizedBranchName = missingBranch.replace(new RegExp(`^${remoteName}/`), '');
-                    if (!remoteBranches.has(normalizedBranchName)) {
-                        logger.log(`Branch ${missingBranch} not found on remote, skipping fetch`);
-                        return undefined; // Exit early - no point in fetching non-existent branch
-                    }
-                    // Branch exists on remote, proceed with fetch
-                    logger.log(`Fetching missing branch ${missingBranch} from remote`);
-                    const command = `HASH=$(git merge-base ${branchName} ${parentBranchName}) && git show -q --format=%aI $HASH`;
-                    /*
-                    // --filter=tree:0 creates a treeless clone.
-                    // These clones download all reachable commits while fetching trees and blobs on-demand.
-                    // These clones are best for build environments where the repository will be deleted
-                    // after a single build, but you still need access to commit history.
-                    */
-                    result = await executeWithLog(`git fetch ${remoteName} ${normalizedBranchName}:${normalizedBranchName} --filter=tree:0 && ${command}`, {
-                        execOptions,
-                        logger,
-                    });
-                }
+    try {
+        // Env gate. Without git or a repo, merge-base is impossible.
+        const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+        if (!env.ok) {
+            logger.log('extractBranchingTimestamp: git environment not ok, skipping');
+            return undefined;
+        }
+        const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
+        // Step 1: shallow clones lack the history merge-base needs — unshallow.
+        const shallowCheckResult = await executeWithLog('git rev-parse --is-shallow-repository', {
+            execOptions,
+            logger,
+        });
+        const isShallow = shallowCheckResult.stdout.trim() === 'true';
+        if (isShallow) {
+            logger.log('extractBranchingTimestamp - Repository is a shallow clone, attempting to unshallow');
+            await executeFetchStrategy(isShallow, execOptions, logger);
+        }
+        // Common-ancestor SHA between two refs, or null on git failure. `null` is
+        // expected during the fallback chain, so the log line is verbose-only.
+        async function getMergeBase(ref1, ref2) {
+            const { stdout, stderr } = await executeWithLog((0, shell_quote_1.quote)(['git', 'merge-base', ref1, ref2]), { execOptions, logger });
+            if (stderr) {
+                if (isDebugMode())
+                    logger.log(`getMergeBase failed for ${ref1} and ${ref2}: ${stderr}`);
+                return null;
             }
+            return stdout.trim();
+        }
+        // Resolve a commit hash to its author-date (`%aI`, strict ISO-8601), or
+        // undefined on failure.
+        async function getTimestampForHash(hash) {
+            if (!hash)
+                return undefined;
+            const { stdout, stderr } = await executeWithLog((0, shell_quote_1.quote)(['git', 'show', '-s', '--format=%aI', hash]), {
+                execOptions,
+                logger,
+            });
+            const timestamp = stdout.trim();
+            if (stderr || !isISODate(timestamp)) {
+                logger.log(`Error extracting timestamp for hash ${hash}: stderr: ${stderr}, stdout: ${stdout}`);
+                return undefined;
+            }
+            return timestamp;
+        }
+        // Steps 2–4: resolve the merge-base, escalating from remote → local → fetch.
+        let mergeBaseHash = null;
+        // Step 2: remote refs (preferred — CI typically has these populated).
+        mergeBaseHash = await getMergeBase(`${remoteName}/${branchName}`, `${remoteName}/${parentBranchName}`);
+        // Step 3: local refs fallback.
+        if (!mergeBaseHash) {
+            mergeBaseHash = await getMergeBase(branchName, parentBranchName);
+        }
+        // Step 4: still no merge-base — fetch the missing side(s) by name and
+        // retry. Narrowed refspecs (single-branch/shallow) mean a plain
+        // `fetch origin` won't pick them up, so fetch each name explicitly when
+        // it's on the remote (idempotent). `getAllRemoteBranches` returns an
+        // empty set when the remote is unreachable, so `.has(...)` falls through.
+        if (!mergeBaseHash) {
+            const remoteBranches = await getAllRemoteBranches({ execOptions, logger });
+            if (!remoteBranches.has(parentBranchName)) {
+                logger.log(`Parent branch ${parentBranchName} not found on remote, cannot determine branching point.`);
+                return undefined;
+            }
+            const branchesToFetch = [parentBranchName];
+            if (branchName !== parentBranchName && remoteBranches.has(branchName)) {
+                branchesToFetch.push(branchName);
+            }
+            logger.log(`Fetching missing branches [${branchesToFetch.join(', ')}] from remote and retrying merge-base`);
+            for (const branch of branchesToFetch) {
+                await executeWithLog((0, shell_quote_1.quote)(['git', 'fetch', remoteName, `${branch}:${branch}`, '--filter=tree:0']), {
+                    execOptions,
+                    logger,
+                });
+            }
+            mergeBaseHash = await getMergeBase(branchName, parentBranchName);
+        }
+        if (!mergeBaseHash) {
+            logger.log(`Could not find a merge-base for ${branchName} and ${parentBranchName}.`);
+            return undefined;
+        }
+        // Step 5: hash → ISO timestamp. The merge-base IS the divergence moment;
+        // its timestamp is what the server's baseline-inheritance cutoff wants.
+        const timestamp = await getTimestampForHash(mergeBaseHash);
+        if (timestamp) {
+            logger.log(`git branching timestamp for parent '${parentBranchName}' successfully extracted: ${timestamp}`);
+            return timestamp;
         }
     }
-    const timestamp = result.stdout.replace(/\s/g, '');
-    if (isISODate(timestamp)) {
-        logger.log('git branching timestamp successfully extracted', timestamp);
-        return timestamp;
-    }
-    else {
-        logger.log(`Error during extracting merge timestamp: git branching timestamp is an invalid ISO date string: ${timestamp}. stderr: ${result.stderr}, stdout: ${result.stdout}`);
+    catch (err) {
+        logger.log('extractBranchingTimestamp: unexpected error, returning undefined', err);
+        return undefined;
     }
 }, args => {
     var _a;
@@ -245,13 +605,71 @@ function isISODate(str) {
     return /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\+\d{2}:\d{2})?/.test(str);
 }
 exports.isISODate = isISODate;
+const GIT_PREDICATE_MAX_ATTEMPTS = 3;
+/**
+ * Classify one git boolean-predicate execution into ancestor / not-ancestor /
+ * error. `code === 0` with no stderr is the clean positive; `code === 1` with
+ * empty stderr is the clean negative; everything else (other code, `null` from
+ * a timeout-kill, a string spawn-error code, or any non-empty stderr) is a
+ * transient error that callers must not treat as a definitive negative.
+ *
+ * `code` is typed `number` by the process wrapper, but at runtime `exec` may
+ * surface `null`/string/undefined — hence the loose comparisons here.
+ */
+function classifyGitPredicate(result) {
+    const code = result.code;
+    const hasStderr = Boolean(result.stderr && result.stderr.trim());
+    if (code === 0 && !hasStderr)
+        return true;
+    if (code === 1 && !hasStderr)
+        return false;
+    return 'error';
+}
 /**
- * Execute operations in parallel with a concurrency limit to avoid overwhelming system resources
- * @param items - Array of items to process
- * @param concurrency - Maximum number of concurrent operations
- * @param fn - Async function to execute for each item
- * @returns Array of results in the same order as input items
+ * Run a git boolean predicate with bounded retry. Returns true/false on a clean
+ * result, or `'error'` only after the error persists across all attempts. The
+ * no-error path runs exactly once (zero added latency); retries fire solely on
+ * a transient classification, with exponential backoff + small jitter.
  */
+async function runGitPredicateWithRetry(command, { execOptions, logger }) {
+    let outcome = 'error';
+    for (let attempt = 0; attempt < GIT_PREDICATE_MAX_ATTEMPTS; attempt++) {
+        const result = await executeWithLog(command, { execOptions, logger });
+        outcome = classifyGitPredicate(result);
+        if (outcome !== 'error')
+            return outcome;
+        if (attempt < GIT_PREDICATE_MAX_ATTEMPTS - 1) {
+            await gitRetryBackoff(attempt, command, logger);
+        }
+    }
+    return outcome;
+}
+/** Exponential backoff with small jitter between predicate retries. */
+async function gitRetryBackoff(attempt, command, logger) {
+    const backoff = 50 * 2 ** attempt + Math.floor(Math.random() * 10);
+    if (isDebugMode()) {
+        logger.log(`git transient error (attempt ${attempt + 1}), retrying in ${backoff}ms: ${command}`);
+    }
+    await new Promise(resolve => setTimeout(resolve, backoff));
+}
+/**
+ * Run a git `--contains`-style listing with the same transient-error retry as
+ * the boolean predicates, but distinguishing empty-output (clean, no matching
+ * branches) from a stderr/operational error. Returns stdout (possibly empty) on
+ * a clean result; returns `null` only when the error persists across attempts.
+ */
+async function runGitContainsWithRetry(command, { execOptions, logger }) {
+    for (let attempt = 0; attempt < GIT_PREDICATE_MAX_ATTEMPTS; attempt++) {
+        const result = await executeWithLog(command, { execOptions, logger });
+        if (!(result.stderr && result.stderr.trim()))
+            return result.stdout;
+        if (attempt < GIT_PREDICATE_MAX_ATTEMPTS - 1) {
+            await gitRetryBackoff(attempt, command, logger);
+        }
+    }
+    return '';
+}
+/** Run `fn` over `items` in batches of `concurrency`, preserving order. */
 async function parallelWithLimit(items, concurrency, fn) {
     const results = [];
     for (let i = 0; i < items.length; i += concurrency) {
@@ -262,9 +680,394 @@ async function parallelWithLimit(items, concurrency, fn) {
     return results;
 }
 /**
- * Get all remote branches from the primary remote (cached for performance)
- * Uses git ls-remote which is fast and doesn't require fetching data
- * Cache TTL: 5 minutes (remote branches don't change frequently during a test run)
+ * Enumerate ancestor branches in MERGE_BASE..gitBranchName by walking each
+ * commit in the window and unioning the branches that contain it. Returns a
+ * sorted, deduped list (no `refs/` prefix). Never throws — `[]` on git failure.
+ *
+ * Inclusion contract (fork-depth — shares semantics with
+ * {@link getBranchAncestryByLocalBranches}):
+ * - `gitBranchName` is **always excluded** by the self check.
+ * - `defaultBranch` is **always kept** as the base: it defines the floor
+ *   (`merge-base(HEAD, defaultBranch)`), so its own merge-base with HEAD equals
+ *   the floor and would fail the strict fork-depth test by construction.
+ * - Descendants of HEAD are dropped (built on top of us; cannot be baselines).
+ * - A candidate `C` is kept iff it forked from HEAD's history **strictly later**
+ *   than the default branch did — i.e. some `merge-base(HEAD, C)` is a strict
+ *   descendant of the floor. Cousins that share only the floor (diverged no
+ *   later than the default branch) are dropped. This prunes the over-inclusive
+ *   candidate seed (the per-commit `--contains` walk pulls in cousins via
+ *   criss-cross/ghost merges).
+ *
+ * Use {@link getBranchAncestryByLocalBranches} if you need both refs pinned.
+ */
+async function getBranchAncestryByCommits({ gitBranchName, defaultBranch, execOptions, logger = (0, logger_1.makeLogger)(), }) {
+    logger = logger.extend({ tags: [`get-branch-ancestry-by-commits-${utils.general.shortid()}`] });
+    if (isDebugMode()) {
+        logger.log(`[byCommits] Start: gitBranchName=${gitBranchName}, defaultBranch=${defaultBranch}`);
+    }
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.ok) {
+        logger.log('[byCommits] git environment not ok, returning []');
+        return [];
+    }
+    try {
+        // Step 1: MERGE_BASE(HEAD, defaultBranch) anchors the ancestry window —
+        // commits after it are uniquely ours.
+        let mergeBaseResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'merge-base', gitBranchName, defaultBranch]), {
+            execOptions,
+            logger,
+        });
+        if (mergeBaseResult.stderr || !mergeBaseResult.stdout.trim()) {
+            // Direct callers may pass a defaultBranch that lives only on the remote.
+            // Resolve it to a local ref and retry once before giving up.
+            const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
+            const resolved = await resolveBranchToLocalRef({ branchName: defaultBranch, remoteName, execOptions, logger });
+            if (resolved) {
+                mergeBaseResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'merge-base', gitBranchName, defaultBranch]), {
+                    execOptions,
+                    logger,
+                });
+            }
+            if (mergeBaseResult.stderr || !mergeBaseResult.stdout.trim()) {
+                logger.log(`[byCommits] ✗ merge-base ${gitBranchName} ${defaultBranch} failed (stderr="${mergeBaseResult.stderr}"), returning []`);
+                return [];
+            }
+        }
+        const mergeBase = mergeBaseResult.stdout.trim();
+        if (isDebugMode())
+            logger.log(`[byCommits] Merge-base resolved: ${mergeBase}`);
+        // Step 2: enumerate every commit in the window MERGE_BASE..HEAD.
+        const logResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'log', '--format=%H', `${mergeBase}..${gitBranchName}`]), {
+            execOptions,
+            logger,
+        });
+        if (logResult.stderr) {
+            logger.log(`[byCommits] ✗ git log ${mergeBase}..${gitBranchName} failed (stderr="${logResult.stderr}"), returning []`);
+            return [];
+        }
+        const commits = logResult.stdout.trim().split('\n').filter(Boolean);
+        if (isDebugMode())
+            logger.log(`[byCommits] Walking ${commits.length} commit(s) in window ${mergeBase}..${gitBranchName}`);
+        // Step 3: union the branches containing each commit → parent candidates.
+        const candidates = new Set([defaultBranch, gitBranchName]);
+        const containResults = await parallelWithLimit(commits, 10, async (hash) => {
+            // Retry on transient error so a hiccup under parallel load doesn't silently
+            // drop the branches a commit belongs to; empty output is a clean negative.
+            const r = await runGitContainsWithRetry((0, shell_quote_1.quote)(['git', 'branch', '-a', '--contains', hash, '--format=%(refname:short)']), { execOptions, logger });
+            return r
+                .split('\n')
+                .map(line => line.trim())
+                .filter(b => b && b !== 'HEAD');
+        });
+        // Verbose: full per-commit dump (can be hundreds of entries).
+        if (isDebugMode()) {
+            logger.log(`[byCommits] Branches containing commits in ${mergeBase}..${gitBranchName}:`, containResults);
+        }
+        for (const list of containResults)
+            for (const b of list)
+                candidates.add(b);
+        // Branches whose tip sits exactly at the merge-base are not inside the
+        // exclusive MERGE_BASE..HEAD window, so the per-commit walk never sees them.
+        // Seed them explicitly; the fork-depth filter below prunes the ones that are
+        // mere cousins (sharing only the floor) and keeps genuine lineage points.
+        const atMergeBase = await runGitContainsWithRetry((0, shell_quote_1.quote)(['git', 'branch', '-a', '--contains', mergeBase, '--format=%(refname:short)']), { execOptions, logger });
+        for (const b of atMergeBase
+            .split('\n')
+            .map(l => l.trim())
+            .filter(b => b && b !== 'HEAD')) {
+            candidates.add(b);
+        }
+        if (isDebugMode()) {
+            logger.log(`[byCommits] Unioned candidates before descendant filter (${candidates.size}): ${Array.from(candidates).join(', ')}`);
+        }
+        // Step 4: fork-depth filter. `mergeBase` is the floor — the point where HEAD
+        // and the default branch diverged. A candidate is a coherent lineage point
+        // iff it forked from HEAD's history STRICTLY LATER than the default branch
+        // did. Concretely, per candidate C:
+        //   (a) self     — drop C if it normalizes to HEAD.
+        //   default base — always keep the default branch: it defines the floor, so
+        //                  its own merge-base with HEAD equals the floor and fails
+        //                  the strict-descendant test (c) by construction; it is the
+        //                  base and is always kept.
+        //   (b) descendant — drop C if HEAD is its ancestor (built on top of us).
+        //   (c) fork-depth — keep C iff some merge-base(HEAD, C) is a STRICT
+        //                  descendant of the floor. Cousins that share only the floor
+        //                  (diverged no later than the default branch) are dropped.
+        // Criss-cross robustness: `git merge-base` without `--all` returns one
+        // unspecified base, which would make (c) nondeterministic in criss-cross
+        // topologies (e.g. ghost merges). Use `--all` and keep if ANY base is a
+        // strict descendant of the floor.
+        // Error policy throughout: an operational/transient git error → KEEP. A
+        // false-drop loses a real baseline forever; a false-keep is recoverable
+        // downstream.
+        const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
+        let droppedSelf = 0;
+        let droppedDescendants = 0;
+        let droppedCousins = 0;
+        const finalCandidates = await parallelWithLimit(Array.from(candidates), 10, async (branch) => {
+            // `branch` may be local (`staging`) or remote-tracking (`origin/staging`).
+            // Use the as-is form for git ops (git resolves both); strip only for the
+            // self-comparison and the return value. In single-branch clones,
+            // intermediate ancestors exist ONLY as remote-tracking refs.
+            const normalizedBranch = branch.replace(new RegExp(`^${remoteName}/`), '');
+            if (normalizedBranch === gitBranchName) {
+                droppedSelf++;
+                return null; // self
+            }
+            // Default branch always kept (see (c)-by-construction note above). Name
+            // compare rather than a first-parent check: the default branch is the base.
+            if (normalizedBranch === defaultBranch) {
+                if (isDebugMode())
+                    logger.log(`[byCommits] KEEP base (default branch): ${normalizedBranch}`);
+                return normalizedBranch;
+            }
+            // (b) `git merge-base --is-ancestor HEAD <candidate>` asks "is HEAD an
+            // ancestor of the candidate?" → the candidate is a DESCENDANT of HEAD.
+            // Clean-true → drop. Clean-false / error → fall through to (c).
+            const isDescendant = await runGitPredicateWithRetry((0, shell_quote_1.quote)(['git', 'merge-base', '--is-ancestor', gitBranchName, branch]), { execOptions, logger });
+            if (isDescendant === true) {
+                droppedDescendants++;
+                if (isDebugMode())
+                    logger.log(`[byCommits] DROP descendant: ${normalizedBranch}`);
+                return null;
+            }
+            // (c) fork-depth. Compute ALL merge bases of HEAD and the candidate.
+            // Empty/operational error → KEEP conservatively.
+            const mbAllResult = await runGitContainsWithRetry((0, shell_quote_1.quote)(['git', 'merge-base', '--all', gitBranchName, branch]), {
+                execOptions,
+                logger,
+            });
+            const mbCs = mbAllResult
+                .split('\n')
+                .map(line => line.trim())
+                .filter(Boolean);
+            if (mbCs.length === 0) {
+                if (isDebugMode())
+                    logger.log(`[byCommits] KEEP (no merge-base resolved, conservative): ${normalizedBranch}`);
+                return normalizedBranch;
+            }
+            // Keep iff ANY base is a STRICT descendant of the floor: base != floor AND
+            // floor is an ancestor of base. A base == floor (or below it) means C
+            // diverged no later than the default branch → cousin for that base. On a
+            // transient error probing a base → treat as strict (conservative keep).
+            let anyStrictlyAboveFloor = false;
+            for (const mbC of mbCs) {
+                if (mbC === mergeBase)
+                    continue; // base == floor → cousin via this base
+                const floorIsAncestorOfMbC = await runGitPredicateWithRetry((0, shell_quote_1.quote)(['git', 'merge-base', '--is-ancestor', mergeBase, mbC]), { execOptions, logger });
+                if (floorIsAncestorOfMbC === true || floorIsAncestorOfMbC === 'error') {
+                    anyStrictlyAboveFloor = true;
+                    break;
+                }
+                // clean-false → mbC is strictly BELOW the floor (older) → not a fork point
+                // via this base; keep checking the remaining bases.
+            }
+            if (!anyStrictlyAboveFloor) {
+                droppedCousins++;
+                if (isDebugMode())
+                    logger.log(`[byCommits] DROP cousin (shares only the floor): ${normalizedBranch}`);
+                return null;
+            }
+            if (isDebugMode())
+                logger.log(`[byCommits] KEEP lineage point: ${normalizedBranch}`);
+            return normalizedBranch;
+        });
+        const finalCleanBranches = finalCandidates.filter((b) => b !== null);
+        const result = Array.from(new Set(finalCleanBranches)).sort();
+        if (isDebugMode()) {
+            logger.log(`[byCommits] Done. dropped(self=${droppedSelf}, descendants=${droppedDescendants}, cousins=${droppedCousins}) → ${result.length} lineage point(s): ${result.join(', ')}`);
+        }
+        return result;
+    }
+    catch (err) {
+        logger.log('[byCommits] ✗ ERROR', err);
+        return [];
+    }
+}
+exports.getBranchAncestryByCommits = getBranchAncestryByCommits;
+/**
+ * Enumerate ancestor branches by iterating every branch ref and applying
+ * Rule 1 (fork-depth: candidate must have forked from HEAD strictly later than
+ * the default branch did — some merge-base with HEAD is a strict descendant of
+ * the primary MERGE_BASE) and Rule 2 (HEAD must not be an ancestor of the
+ * candidate). Rule 1 shares the fork-depth semantics of
+ * {@link getBranchAncestryByCommits}: cousins sharing only the floor are dropped
+ * in BOTH strategies, while the default branch and genuine lineage points are
+ * kept in both.
+ *
+ * Walks `refs/heads/` AND `refs/remotes/<remote>/` (stripping the prefix), since
+ * CI typically has one local branch and dozens of remote refs.
+ *
+ * Returns a sorted, deduped list. Never throws — `[]` on git failure. Always
+ * includes `defaultBranch` and `gitBranchName`.
+ */
+async function getBranchAncestryByLocalBranches({ gitBranchName, defaultBranch, execOptions, logger = (0, logger_1.makeLogger)(), }) {
+    logger = logger.extend({ tags: [`get-branch-ancestry-by-local-branches-${utils.general.shortid()}`] });
+    if (isDebugMode()) {
+        logger.log(`[byLocalBranches] Start: gitBranchName=${gitBranchName}, defaultBranch=${defaultBranch}`);
+    }
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.ok) {
+        logger.log('[byLocalBranches] git environment not ok, returning []');
+        return [];
+    }
+    // Per-rule counters for the final summary.
+    let droppedNoMb = 0;
+    let droppedRule1 = 0;
+    let droppedRule2 = 0;
+    let pinned = 0;
+    try {
+        // 1. Primary MERGE_BASE of CURRENT and DEFAULT (used by Rule 1).
+        let mergeBaseResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'merge-base', gitBranchName, defaultBranch]), {
+            execOptions,
+            logger,
+        });
+        if (mergeBaseResult.stderr || !mergeBaseResult.stdout.trim()) {
+            // Direct callers may pass a defaultBranch that lives only on the remote.
+            // Resolve it to a local ref and retry once before giving up.
+            const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
+            const resolved = await resolveBranchToLocalRef({ branchName: defaultBranch, remoteName, execOptions, logger });
+            if (resolved) {
+                mergeBaseResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'merge-base', gitBranchName, defaultBranch]), {
+                    execOptions,
+                    logger,
+                });
+            }
+            if (mergeBaseResult.stderr || !mergeBaseResult.stdout.trim()) {
+                logger.log(`[byLocalBranches] ✗ merge-base ${gitBranchName} ${defaultBranch} failed (stderr="${mergeBaseResult.stderr}"), returning []`);
+                return [];
+            }
+        }
+        const mergeBase = mergeBaseResult.stdout.trim();
+        if (isDebugMode())
+            logger.log(`[byLocalBranches] Primary merge-base: ${mergeBase}`);
+        // 2. Enumerate candidate branches from BOTH local AND remote refs.
+        const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
+        const refsResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'for-each-ref', '--format=%(refname:short)', 'refs/heads/', `refs/remotes/${remoteName}/`]), { execOptions, logger });
+        if (refsResult.stderr) {
+            logger.log(`[byLocalBranches] ✗ for-each-ref failed (stderr="${refsResult.stderr}"), returning []`);
+            return [];
+        }
+        // Map: normalized name → as-is ref git can resolve. In single-branch clones
+        // intermediate ancestors exist ONLY as remote-tracking refs, so the stripped
+        // form would fatal merge-base. Prefer local form when both exist (for-each-ref
+        // emits refs/heads/ first).
+        const candidateBranches = new Map();
+        candidateBranches.set(defaultBranch, defaultBranch);
+        candidateBranches.set(gitBranchName, gitBranchName);
+        for (const raw of refsResult.stdout.split('\n')) {
+            const trimmed = raw.trim();
+            if (!trimmed)
+                continue;
+            const normalized = trimmed.replace(new RegExp(`^${remoteName}/`), '');
+            if (!normalized || normalized === 'HEAD')
+                continue;
+            if (!candidateBranches.has(normalized)) {
+                candidateBranches.set(normalized, trimmed);
+            }
+        }
+        if (isDebugMode()) {
+            logger.log(`[byLocalBranches] Enumerated ${candidateBranches.size} candidate(s): ${Array.from(candidateBranches.keys()).join(', ')}`);
+        }
+        // 3. Apply Rule 1 & 2 to every non-pinned candidate (defaultBranch and
+        //    gitBranchName always pass through). Entry is [normalized, refForGitOps].
+        const results = await parallelWithLimit(Array.from(candidateBranches.entries()), 10, async ([branch, refToUse]) => {
+            if (branch === defaultBranch || branch === gitBranchName) {
+                pinned++;
+                if (isDebugMode())
+                    logger.log(`[byLocalBranches] KEEP pinned:     ${branch}`);
+                return branch;
+            }
+            // Rule 1 (fork-depth — shares semantics with getBranchAncestryByCommits):
+            //         keep a branch only if it forked from HEAD's history STRICTLY
+            //         LATER than the default branch did — i.e. some merge-base(HEAD, C)
+            //         is a STRICT descendant of the primary MERGE_BASE (the floor).
+            //         A branch sharing ONLY the floor is a cousin and is dropped; both
+            //         strategies now prune cousins identically AND share the same
+            //         error→KEEP policy on the floor-ancestor probe (a transient error
+            //         keeps conservatively). `git merge-base --all` (vs the single best
+            //         base) gives criss-cross robustness: keep if ANY base is strictly
+            //         above the floor.
+            const branchMbR = await runGitContainsWithRetry((0, shell_quote_1.quote)(['git', 'merge-base', '--all', refToUse, gitBranchName]), {
+                execOptions,
+                logger,
+            });
+            const branchMbs = branchMbR
+                .split('\n')
+                .map(line => line.trim())
+                .filter(Boolean);
+            if (branchMbs.length === 0) {
+                droppedNoMb++;
+                if (isDebugMode()) {
+                    logger.log(`[byLocalBranches] DROP no-merge-base: ${branch}`);
+                }
+                return null;
+            }
+            // Keep iff ANY base is a STRICT descendant of the floor. A transient error
+            // probing a base counts as strictly-above-floor (conservative KEEP) — the
+            // same error→KEEP policy as getBranchAncestryByCommits; a false-drop loses a
+            // real baseline while a false-keep is recoverable downstream.
+            let anyStrictlyAboveFloor = false;
+            for (const branchMb of branchMbs) {
+                if (branchMb === mergeBase)
+                    continue; // base == floor → cousin via this base
+                const r1 = await runGitPredicateWithRetry((0, shell_quote_1.quote)(['git', 'merge-base', '--is-ancestor', mergeBase, branchMb]), {
+                    execOptions,
+                    logger,
+                });
+                if (r1 === true || r1 === 'error') {
+                    anyStrictlyAboveFloor = true;
+                    break;
+                }
+                // clean-false → base strictly BELOW the floor (diverged before our
+                // window); keep checking the remaining bases.
+            }
+            if (!anyStrictlyAboveFloor) {
+                droppedRule1++;
+                if (isDebugMode()) {
+                    logger.log(`[byLocalBranches] DROP Rule 1 (cousin — shares only the floor ${mergeBase}): ${branch} — bases=${branchMbs.join(',')}`);
+                }
+                return null;
+            }
+            const branchMb = branchMbs[0];
+            // Rule 2: skip branches ahead of CURRENT (HEAD is their ancestor —
+            //         descendants, not parents).
+            const r2 = await runGitPredicateWithRetry((0, shell_quote_1.quote)(['git', 'merge-base', '--is-ancestor', gitBranchName, refToUse]), {
+                execOptions,
+                logger,
+            });
+            if (r2 === true) {
+                droppedRule2++;
+                if (isDebugMode()) {
+                    logger.log(`[byLocalBranches] DROP Rule 2 (descendant): ${branch} — ${gitBranchName} is its ancestor`);
+                }
+                return null;
+            }
+            if (r2 === 'error') {
+                droppedRule2++;
+                if (isDebugMode())
+                    logger.log(`[byLocalBranches] DROP Rule 2 (transient error): ${branch}`);
+                return null;
+            }
+            if (isDebugMode())
+                logger.log(`[byLocalBranches] KEEP ancestor:   ${branch} (mb=${branchMb})`);
+            return branch;
+        });
+        const result = Array.from(new Set(results.filter((b) => b !== null))).sort();
+        if (isDebugMode()) {
+            logger.log(`[byLocalBranches] Done. pinned=${pinned}, dropped(no-mb=${droppedNoMb}, rule1=${droppedRule1}, rule2=${droppedRule2}) → ${result.length} ancestor(s): ${result.join(', ')}`);
+        }
+        return result;
+    }
+    catch (err) {
+        logger.log('[byLocalBranches] ✗ ERROR', err);
+        return [];
+    }
+}
+exports.getBranchAncestryByLocalBranches = getBranchAncestryByLocalBranches;
+/**
+ * All branches on the primary remote via `git ls-remote` (fast, no fetch).
+ * Cached with a 5-minute TTL.
  */
 const getAllRemoteBranches = utils.general.cachify(async function ({ execOptions, logger }) {
     var _a;
@@ -272,11 +1075,16 @@ const getAllRemoteBranches = utils.general.cachify(async function ({ execOptions
         logger.log('[getAllRemoteBranches] Starting git ls-remote to fetch all remote branches...');
         logger.log('[getAllRemoteBranches] execOptions.cwd:', (execOptions === null || execOptions === void 0 ? void 0 : execOptions.cwd) || 'undefined');
     }
+    // Short-circuit when the remote isn't reachable — ls-remote would fail.
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.remoteAccessible) {
+        logger.log('[getAllRemoteBranches] Skipping ls-remote (remote not accessible), returning empty set');
+        return new Set();
+    }
     try {
-        // Get the primary remote name (cached)
         const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
         const startTime = Date.now();
-        const result = await executeWithLog(`git ls-remote --heads ${remoteName}`, {
+        const result = await executeWithLog((0, shell_quote_1.quote)(['git', 'ls-remote', '--heads', remoteName]), {
             execOptions,
             logger,
         });
@@ -299,7 +1107,6 @@ const getAllRemoteBranches = utils.general.cachify(async function ({ execOptions
                     const branchName = match[1];
                     branches.add(branchName);
                     if (isDebugMode() && index < 5) {
-                        // Log first 5 branches for debugging
                         logger.log(`[getAllRemoteBranches] Found branch: ${branchName}`);
                     }
                 }
@@ -329,26 +1136,32 @@ const getAllRemoteBranches = utils.general.cachify(async function ({ execOptions
         return new Set();
     }
 }, 
-// Custom cache key generator - only cache by cwd, not by logger instance
+// Cache by cwd only, not by logger instance.
 args => { var _a; return ({ cwd: (_a = args[0].execOptions) === null || _a === void 0 ? void 0 : _a.cwd }); }, 5 * 60 * 1000);
 /**
- * Determine fetch strategy and execute appropriate fetch operation
+ * Determine fetch strategy and execute appropriate fetch operation.
+ * No-op when the remote isn't reachable.
  */
 async function executeFetchStrategy(isShallow, execOptions, logger) {
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.remoteAccessible) {
+        logger.log('executeFetchStrategy: skipping fetch (remote not accessible)');
+        return;
+    }
     const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
     if (isShallow) {
-        // Shallow clone needs full unshallow for initial topology discovery
+        // Shallow clone → unshallow for topology discovery.
         logger.log(`Shallow repository detected, unshallowing to enable topology discovery...`);
-        await executeWithLog(`git fetch ${remoteName} --unshallow --filter=blob:none`, {
+        await executeWithLog((0, shell_quote_1.quote)(['git', 'fetch', remoteName, '--unshallow', '--filter=blob:none']), {
             execOptions,
             logger,
         });
         logger.log(`Repository unshallowed successfully`);
     }
     else {
-        // Non-shallow clone (e.g., single-branch clone) needs to fetch all remote branches for topology discovery
+        // Single-branch clone → fetch all remote branches for topology discovery.
         logger.log(`Non-shallow clone detected, fetching all remote branches for topology discovery...`);
-        await executeWithLog(`git fetch ${remoteName} --filter=tree:0`, {
+        await executeWithLog((0, shell_quote_1.quote)(['git', 'fetch', remoteName, '--filter=tree:0']), {
             execOptions,
             logger,
         });
@@ -356,21 +1169,20 @@ async function executeFetchStrategy(isShallow, execOptions, logger) {
     }
 }
 /**
- * Helper function to check if we're dealing with a remote branch scenario
- * and fetch specific remote branches if needed for complete ancestor checking
- *
- * @param branchName - The current branch being analyzed
- * @param branchesToFetch - Array of ancestor branch names that need to be fetched (empty = fetch all)
- * @param isShallow - Whether the repository is a shallow clone
- * @param execOptions - Git execution options
- * @param logger - Logger instance
+ * If the current branch tracks a remote, fetch all remote branches so ancestor
+ * checks have the full topology, and populate `refs/remotes/<remote>/HEAD`.
  */
 async function ensureRemoteBranchesAvailable(branchName, isShallow, execOptions, logger) {
+    // Skip when the remote is unreachable — nothing here would do useful work.
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.remoteAccessible) {
+        logger.log('ensureRemoteBranchesAvailable: skipping (remote not accessible)');
+        return;
+    }
     try {
-        // Get the primary remote name (cached)
         const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
-        // Check if current branch tracks a remote branch
-        const symbolicResult = await executeWithLog(`git rev-parse --abbrev-ref ${branchName}@{upstream} `, {
+        // Does the current branch track a remote branch?
+        const symbolicResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'rev-parse', '--abbrev-ref', `${branchName}@{upstream}`]), {
             execOptions,
             logger,
         });
@@ -379,91 +1191,112 @@ async function ensureRemoteBranchesAvailable(branchName, isShallow, execOptions,
             return;
         }
         logger.log(`Detected remote branch scenario, fetching ancestor branches...`);
-        // Configure fetch to get all remote branches
-        await executeWithLog(`git config remote.${remoteName}.fetch "+refs/heads/*:refs/remotes/${remoteName}/*"`, {
-            execOptions,
-            logger,
-        });
-        // Execute appropriate fetch strategy
+        // Widen the refspec to fetch all remote branches, then fetch.
+        await executeWithLog((0, shell_quote_1.quote)(['git', 'config', `remote.${remoteName}.fetch`, `+refs/heads/*:refs/remotes/${remoteName}/*`]), { execOptions, logger });
         await executeFetchStrategy(isShallow, execOptions, logger);
         logger.log(`Remote branches fetched successfully for complete ancestor check`);
+        // Single-branch clones / actions/checkout@v4 never write
+        // refs/remotes/<remote>/HEAD. Populate it so extractDefaultBranch step 2
+        // (symbolic-ref) succeeds. Non-fatal — steps 3-5 still cover us.
+        try {
+            await executeWithLog((0, shell_quote_1.quote)(['git', 'remote', 'set-head', remoteName, '-a']), { execOptions, logger });
+        }
+        catch (err) {
+            logger.log('ensureRemoteBranchesAvailable: remote set-head -a failed (continuing)', err);
+        }
     }
     catch (err) {
         logger.log('Note: Could not determine if branch is remote, continuing with topology discovery', err);
     }
 }
 /**
- * Extracts a list of ancestor branches for the given branch, ordered by most recent commit timestamp.
+ * List ancestor branches for `gitBranchName`, ordered by most-recent timestamp.
  *
- * Algorithm:
- * 1. Check if shallow clone and should skip (via APPLITOOLS_SKIP_BRANCH_LOOKUP_IN_SHALLOW_CLONE)
- * 2. Ensure remote branches are available (fetch if needed for single-branch/shallow clones)
- * 3. Use git topology to discover ancestor branches efficiently (O(log N) via --first-parent --simplify-by-decoration)
- * 4. For each discovered branch, extract the branching timestamp (latest viable commit where branch existed)
- * 5. Sort results by timestamp descending (most recent first)
- * 6. Return cached results (5-minute TTL) to avoid redundant git operations
+ * 1. Shallow-clone gate (skip via `enableShallowClone`, from server account-info).
+ * 2. Fetch remote branches if needed (single-branch/shallow clones).
+ * 3. Detect the actual default branch (`extractDefaultBranch` — non-standard names).
+ * 4. Discover ancestors via `APPLITOOLS_BRANCH_ANCESTRY_STRATEGY`:
+ *    `commits` (default, walks MERGE_BASE..HEAD) | `local` (iterates refs).
+ * 5. Extract each branch's branching timestamp.
+ * 6. Sort by timestamp desc, tie-break by name.
+ * 7. Root-branch safety net: fall back to the detected default branch.
  *
- * @param gitBranchName - The branch to analyze
- * @param execOptions - Git execution options (e.g., cwd)
- * @param logger - Logger instance for debugging
- * @returns Array of ancestor branches with timestamps, or undefined if skipped
+ * @returns ancestor branches with timestamps, or undefined if skipped.
  */
 exports.extractBranchLookupFallbackList = utils.general.cachify(async function ({ gitBranchName, execOptions, logger = (0, logger_1.makeLogger)(), enableShallowClone = true, }) {
     const functionStartTime = Date.now();
     logger = logger.extend({ tags: [`extract-branch-fallback-list-${utils.general.shortid()}`] });
-    logger.log(`[PERF] extractBranchLookupFallbackList started for branch: ${gitBranchName}`);
+    if (isDebugMode())
+        logger.log(`[PERF] extractBranchLookupFallbackList started for branch: ${gitBranchName}`);
+    // Env gate. Everything downstream shells out to git.
+    const env = await (0, exports.checkGitEnvironment)({ execOptions, logger });
+    if (!env.ok) {
+        logger.log('extractBranchLookupFallbackList: git environment not ok, skipping');
+        return undefined;
+    }
     try {
-        // 1. Check if this is a shallow clone and if we should skip based on env var
-        // add this to control of the user
+        // 1. Shallow-clone gate: when the caller opted out AND the clone is
+        //    shallow, skip the expensive unshallow + topology discovery.
         const shallowCheckStartTime = Date.now();
         const shallowCheckResult = await executeWithLog('git rev-parse --is-shallow-repository', {
             execOptions,
             logger,
         });
-        logger.log(`[PERF] Shallow check took ${Date.now() - shallowCheckStartTime}ms`);
+        if (isDebugMode())
+            logger.log(`[PERF] Shallow check took ${Date.now() - shallowCheckStartTime}ms`);
         const isShallow = shallowCheckResult.stdout.trim() === 'true';
         if (!enableShallowClone && isShallow) {
-            logger.log('Shallow clone detected and APPLITOOLS_SKIP_BRANCH_LOOKUP_IN_SHALLOW_CLONE is enabled, skipping branch lookup');
+            logger.log('Shallow clone detected and enableShallowClone=false, skipping branch lookup');
             return undefined;
         }
-        // 2. Ensure remote branches are available BEFORE topology discovery
-        // This is necessary for single-branch clones and shallow clones where branches don't exist locally
+        // 2. Fetch the other branches' refs so subsequent merge-base calls work
+        //    (single-branch/shallow clones don't have them locally).
         const ensureRemoteStartTime = Date.now();
         await ensureRemoteBranchesAvailable(gitBranchName, isShallow, execOptions, logger);
-        logger.log(`[PERF] ensureRemoteBranchesAvailable took ${Date.now() - ensureRemoteStartTime}ms`);
-        // 3. OPTIMIZATION: Use git topology to discover only ancestor branches (O(log N) instead of O(N))
-        // Instead of listing all remote branches and checking each one, we walk the git graph
-        // only along the current branch's history using --first-parent and --simplify-by-decoration
-        const topologyStartTime = Date.now();
-        logger.log(`Discovering ancestor branches using git topology for ${gitBranchName}...`);
-        // Get the primary remote name (cached)
+        if (isDebugMode())
+            logger.log(`[PERF] ensureRemoteBranchesAvailable took ${Date.now() - ensureRemoteStartTime}ms`);
         const remoteName = await (0, exports.getPrimaryRemoteName)({ execOptions, logger });
-        const logResult = await executeWithLog(`git log --first-parent --simplify-by-decoration --format="%D" ${gitBranchName}`, { execOptions, logger });
-        const foundBranches = new Set();
-        if (!logResult.stderr && logResult.stdout.trim()) {
-            const rawLines = logResult.stdout.split('\n');
-            for (const line of rawLines) {
-                // Parse refs like: "HEAD -> feat, origin/feat, tag: v1, origin/main"
-                const refs = line.split(',').map(r => r.trim());
-                for (const ref of refs) {
-                    if (ref.includes('tag:'))
-                        continue; // Ignore tags
-                    const cleanRef = ref.replace('HEAD -> ', '').replace(new RegExp(`^${remoteName}/`), ''); // Normalize
-                    if (cleanRef && cleanRef !== gitBranchName && cleanRef !== 'HEAD')
-                        foundBranches.add(cleanRef);
-                }
-            }
+        // 3. Detect the repo's actual default branch (non-standard names).
+        const defaultBranch = await (0, exports.extractDefaultBranch)({ execOptions, logger });
+        logger.log(`Default branch detected: ${defaultBranch}`);
+        // 3a. Ensure it resolves as a local ref — extractDefaultBranch may return
+        //     a remote-only name or the literal `'main'`, and without a local ref
+        //     `git merge-base <feature> <defaultBranch>` fatals (empty ancestry).
+        const resolvedDefaultBranch = await resolveBranchToLocalRef({
+            branchName: defaultBranch,
+            remoteName,
+            execOptions,
+            logger,
+        });
+        if (!resolvedDefaultBranch) {
+            logger.log(`extractBranchLookupFallbackList: default branch "${defaultBranch}" not resolvable locally or on remote, skipping ancestry`);
+            return undefined;
+        }
+        // 4. Discover ancestors: APPLITOOLS_BRANCH_ANCESTRY_STRATEGY=commits|local.
+        const ancestryStrategy = (process.env.APPLITOOLS_BRANCH_ANCESTRY_STRATEGY || 'commits').trim().toLowerCase();
+        const ancestryDriver = ancestryStrategy === 'local' ? getBranchAncestryByLocalBranches : getBranchAncestryByCommits;
+        const ancestryStartTime = Date.now();
+        logger.log(`Discovering ancestor branches via "${ancestryStrategy}" strategy for ${gitBranchName} (default=${defaultBranch})...`);
+        const ancestry = await ancestryDriver({ gitBranchName, defaultBranch, execOptions, logger });
+        if (isDebugMode())
+            logger.log(`[PERF] Ancestry discovery took ${Date.now() - ancestryStartTime}ms`);
+        if (isDebugMode()) {
+            logger.log(`Ancestry discovery found ${ancestry.length} candidate branches: ${ancestry.join(', ')}`);
+        }
+        else {
+            logger.log(`Ancestry discovery found ${ancestry.length} candidate branches`);
         }
-        let allBranches = Array.from(foundBranches);
-        logger.log(`[PERF] Topology discovery took ${Date.now() - topologyStartTime}ms`);
+        // Strip the current branch (caller adds it back via timestamp logic).
+        let allBranches = ancestry.filter(b => b !== gitBranchName);
         if (isDebugMode()) {
-            logger.log(`Topology discovered ${allBranches.length} potential ancestor branches: ${allBranches.join(', ')}`);
+            logger.log(`Ancestry discovered ${allBranches.length} potential ancestor branches: ${allBranches.join(', ')}`);
         }
         else {
-            logger.log(`Topology discovered ${allBranches.length} potential ancestor branches`);
+            logger.log(`Ancestry discovered ${allBranches.length} potential ancestor branches`);
         }
-        // 3. Filter out branches that don't exist on remote (if we can determine remote branches)
-        // This prevents unnecessary ancestor checks and fetch attempts for missing branches
+        // 4b. Drop branches found locally but absent on the remote — working
+        //     against them wastes time and surfaces confusing errors. Cheap
+        //     (`getAllRemoteBranches` is cached).
         const remoteBranchesStartTime = Date.now();
         if (isDebugMode()) {
             logger.log('[Remote Filtering] ========================================');
@@ -486,7 +1319,6 @@ exports.extractBranchLookupFallbackList = utils.general.cachify(async function (
                 const beforeFilter = allBranches.length;
                 if (isDebugMode()) {
                     logger.log('[Remote Filtering] Filtering branches against remote...');
-                    // Log each branch check only in debug mode
                     allBranches.forEach(branch => {
                         const exists = remoteBranches.has(branch);
                         logger.log(`[Remote Filtering] Branch "${branch}": ${exists ? '✓ EXISTS' : '✗ MISSING'} on remote`);
@@ -516,76 +1348,60 @@ exports.extractBranchLookupFallbackList = utils.general.cachify(async function (
                 logger.log('[Remote Filtering] Continuing with all discovered branches');
             }
         }
-        logger.log(`[Remote Filtering] [PERF] Remote branch filtering took ${Date.now() - remoteBranchesStartTime}ms`);
         if (isDebugMode()) {
+            logger.log(`[Remote Filtering] [PERF] Remote branch filtering took ${Date.now() - remoteBranchesStartTime}ms`);
             logger.log('[Remote Filtering] ========================================');
         }
-        // 4. Filter out sibling branches - keep only TRUE ancestors
-        // A branch is a true ancestor if it's in the ancestry path of the current branch
-        // Use git merge-base --is-ancestor to check if candidate is an ancestor of current branch
-        const filteringStartTime = Date.now();
-        logger.log(`Filtering out sibling branches to keep only true ancestors...`);
-        // PERFORMANCE: Check ancestors in parallel with concurrency limit to avoid overwhelming git
-        const ANCESTOR_CHECK_CONCURRENCY = 10;
-        const ancestorChecks = await parallelWithLimit(allBranches, ANCESTOR_CHECK_CONCURRENCY, async (candidateBranch) => {
-            try {
-                // Check if candidate branch is an ancestor of current branch
-                // git merge-base --is-ancestor <commit> <commit> exits with status 0 if true, 1 if false
-                const isAncestorResult = await executeWithLog(`git merge-base --is-ancestor ${candidateBranch} ${gitBranchName}`, {
-                    execOptions,
-                    logger,
-                });
-                // Exit code 0 means it's an ancestor, exit code 1 means it's not
-                if (isAncestorResult.code === 0) {
-                    logger.log(`✓ ${candidateBranch} is a true ancestor`);
-                    return { branch: candidateBranch, isAncestor: true };
-                }
-                else if (isAncestorResult.code === 1) {
-                    logger.log(`✗ ${candidateBranch} is a sibling, not an ancestor`);
-                    return { branch: candidateBranch, isAncestor: false };
-                }
-                else {
-                    logger.log(`⚠ Could not determine if ${candidateBranch} is an ancestor (exit code: ${isAncestorResult.code}), including it to be safe`);
-                    return { branch: candidateBranch, isAncestor: true };
-                }
-            }
-            catch (err) {
-                logger.log(`Error checking if ${candidateBranch} is a true ancestor:`, err);
-                // If we can't determine, include it to be safe (better to have false positives than miss ancestors)
-                return { branch: candidateBranch, isAncestor: true };
-            }
-        });
-        const trueAncestors = ancestorChecks.filter(result => result.isAncestor).map(result => result.branch);
-        logger.log(`[PERF] Sibling filtering took ${Date.now() - filteringStartTime}ms`);
-        logger.log(`Filtered to ${trueAncestors.length} true ancestors: ${trueAncestors.join(', ')}`);
-        // 5. For each true ancestor branch, calculate the branching timestamp
+        // 5. Compute each surviving ancestor's branching timestamp in parallel.
         const timestampStartTime = Date.now();
-        const branchesWithTimestamps = await Promise.all(trueAncestors.map(async (ancestorBranch) => {
-            const timestamp = await (0, exports.extractBranchingTimestamp)({
+        const branchesWithTimestamps = await Promise.all(allBranches.map(async (ancestorBranch) => {
+            let timestamp = await (0, exports.extractBranchingTimestamp)({
                 branchName: gitBranchName,
                 parentBranchName: ancestorBranch,
                 execOptions,
                 logger,
             });
+            // These branches are already confirmed ancestors. A missing timestamp
+            // here is almost always a transient git hiccup under parallel load, so
+            // retry once before considering a fallback.
+            if (!timestamp) {
+                timestamp = await (0, exports.extractBranchingTimestamp)({
+                    branchName: gitBranchName,
+                    parentBranchName: ancestorBranch,
+                    execOptions,
+                    logger,
+                });
+            }
+            // Still no merge-base timestamp: keep the confirmed ancestor rather
+            // than silently dropping it, falling back to the ancestor tip's
+            // commit date so the server still receives it in the lookup list.
+            if (!timestamp) {
+                const tip = await executeWithLog((0, shell_quote_1.quote)(['git', 'show', '-s', '--format=%aI', ancestorBranch]), {
+                    execOptions,
+                    logger,
+                });
+                const tipTimestamp = tip.stdout.trim();
+                if (!tip.stderr && isISODate(tipTimestamp)) {
+                    logger.log(`No branching timestamp for confirmed ancestor '${ancestorBranch}', using tip commit date ${tipTimestamp}`);
+                    timestamp = tipTimestamp;
+                }
+            }
             return timestamp ? { branchName: ancestorBranch, latestViableTimestamp: timestamp } : null;
         }));
-        logger.log(`[PERF] Timestamp extraction took ${Date.now() - timestampStartTime}ms`);
-        // 6. Filter out null results and sort by timestamp (most recent first), then by branch name
+        if (isDebugMode())
+            logger.log(`[PERF] Timestamp extraction took ${Date.now() - timestampStartTime}ms`);
+        // 6. Drop nulls; sort by timestamp desc, tie-break by branch name.
         const validBranches = branchesWithTimestamps
             .filter((item) => item !== null)
             .sort((a, b) => {
-            // Sort descending by timestamp (newest first)
             const timeDiff = new Date(b.latestViableTimestamp).getTime() - new Date(a.latestViableTimestamp).getTime();
-            // If timestamps are equal, sort alphabetically by branch name
             if (timeDiff === 0) {
                 return a.branchName.localeCompare(b.branchName);
             }
             return timeDiff;
         });
-        // 7. Root branch fallback (safety net if no branches were found)
-        // The root branch is the branch that contains the first commit in the repository
+        // 7. Root-branch safety net (branch containing the repo's first commit).
         try {
-            // Find the first commit (root commit)
             const firstCommitResult = await executeWithLog('git rev-list --max-parents=0 HEAD', {
                 execOptions,
                 logger,
@@ -593,45 +1409,29 @@ exports.extractBranchLookupFallbackList = utils.general.cachify(async function (
             if (firstCommitResult.stdout.trim()) {
                 const firstCommitHash = firstCommitResult.stdout.trim().split('\n')[0];
                 logger.log(`Found root commit: ${firstCommitHash}`);
-                // Find which branches contain this root commit
-                // Try remote branches first, then fall back to local branches
-                let branchesContainingRootResult = await executeWithLog(`git branch -r --contains ${firstCommitHash}`, {
-                    execOptions,
-                    logger,
-                });
-                // If no remote branches found, try local branches
+                // Which branches contain the root commit? Remote refs first, local next.
+                let branchesContainingRootResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'branch', '-r', '--contains', firstCommitHash]), { execOptions, logger });
                 if (!branchesContainingRootResult.stdout.trim()) {
                     logger.log('No remote branches contain root commit, trying local branches');
-                    branchesContainingRootResult = await executeWithLog(`git branch --contains ${firstCommitHash}`, {
-                        execOptions,
-                        logger,
-                    });
+                    branchesContainingRootResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'branch', '--contains', firstCommitHash]), { execOptions, logger });
                 }
                 if (branchesContainingRootResult.stdout.trim()) {
                     const branchesContainingRoot = branchesContainingRootResult.stdout
                         .split('\n')
                         .map(line => line.trim())
                         .filter(line => line && !line.includes('->') && !line.includes('HEAD'))
-                        .map(line => line.replace(new RegExp(`^${remoteName}/`), '').replace(/^\* /, '')); // Remove remote prefix and '* ' prefix
-                    // Try common root branch names first: main, master, develop
-                    const commonRootNames = ['main', 'master', 'develop', 'trunk'];
+                        .map(line => line.replace(new RegExp(`^${remoteName}/`), '').replace(/^\* /, '')); // strip remote + '* ' prefixes
+                    // Prefer the detected default branch over a heuristic.
                     let rootBranch = null;
-                    for (const commonName of commonRootNames) {
-                        if (branchesContainingRoot.includes(commonName)) {
-                            rootBranch = commonName;
-                            logger.log(`Found root branch using common name: ${rootBranch}`);
-                            break;
-                        }
+                    if (branchesContainingRoot.includes(defaultBranch)) {
+                        rootBranch = defaultBranch;
+                        logger.log(`Found root branch via detected defaultBranch: ${rootBranch}`);
                     }
-                    // If no common name found, use the oldest branch (most likely the root)
+                    // Otherwise fall back to the oldest root-containing branch.
                     if (!rootBranch && branchesContainingRoot.length > 0) {
-                        // Find the branch with the oldest creation timestamp among those containing root commit
                         const branchTimestamps = await Promise.all(branchesContainingRoot.slice(0, 10).map(async (branch) => {
                             try {
-                                const branchTimestampResult = await executeWithLog(`git log -1 --format=%aI ${branch}`, {
-                                    execOptions,
-                                    logger,
-                                });
+                                const branchTimestampResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'log', '-1', '--format=%aI', branch]), { execOptions, logger });
                                 return {
                                     branch,
                                     timestamp: branchTimestampResult.stdout.trim(),
@@ -649,20 +1449,28 @@ exports.extractBranchLookupFallbackList = utils.general.cachify(async function (
                             logger.log(`Found root branch by oldest timestamp: ${rootBranch}`);
                         }
                     }
-                    // Add root branch if found and not already in the list
+                    // Add the root branch if found and not already present.
                     if (rootBranch && rootBranch !== gitBranchName) {
                         const alreadyIncluded = validBranches.some(b => b.branchName === rootBranch);
                         if (!alreadyIncluded) {
-                            // Verify that root branch is actually an ancestor before adding it
-                            // This prevents adding sibling branches that happen to contain the root commit
+                            // Verify it's a true ancestor — guards against sibling branches
+                            // that merely contain the root commit. The pinned base is the
+                            // exception: it can advance past the branch point (no longer a
+                            // strict ancestor), so accept it when it shares history with HEAD.
                             try {
-                                const isAncestorResult = await executeWithLog(`git merge-base --is-ancestor ${rootBranch} ${gitBranchName}`, {
-                                    execOptions,
-                                    logger,
-                                });
-                                if (isAncestorResult.code === 0) {
-                                    logger.log(`Root branch ${rootBranch} is a true ancestor, adding it as final fallback`);
-                                    // Get the timestamp of the root commit (merge-base between current branch and root branch)
+                                const isAncestorResult = await executeWithLog((0, shell_quote_1.quote)(['git', 'merge-base', '--is-ancestor', rootBranch, gitBranchName]), { execOptions, logger });
+                                let accepted = isAncestorResult.code === 0;
+                                if (!accepted && rootBranch === defaultBranch) {
+                                    const sharedHistory = await executeWithLog((0, shell_quote_1.quote)(['git', 'merge-base', rootBranch, gitBranchName]), { execOptions, logger });
+                                    if (!sharedHistory.stderr && sharedHistory.stdout.trim()) {
+                                        accepted = true;
+                                        logger.log(`Root branch ${rootBranch} is the advanced base, adding it as final fallback`);
+                                    }
+                                }
+                                if (accepted) {
+                                    if (isAncestorResult.code === 0) {
+                                        logger.log(`Root branch ${rootBranch} is a true ancestor, adding it as final fallback`);
+                                    }
                                     const rootTimestamp = await (0, exports.extractBranchingTimestamp)({
                                         branchName: gitBranchName,
                                         parentBranchName: rootBranch,
@@ -682,8 +1490,8 @@ exports.extractBranchLookupFallbackList = utils.general.cachify(async function (
                                 }
                             }
                             catch (err) {
+                                // Can't determine → don't add it (conservative).
                                 logger.log(`Error checking if root branch ${rootBranch} is an ancestor:`, err);
-                                // If we can't determine, don't add it (better to be conservative)
                             }
                         }
                         else {
@@ -696,7 +1504,9 @@ exports.extractBranchLookupFallbackList = utils.general.cachify(async function (
         catch (err) {
             logger.log('Failed to detect and add root branch, continuing without it', err);
         }
-        logger.log(`[PERF] extractBranchLookupFallbackList completed in ${Date.now() - functionStartTime}ms total`);
+        if (isDebugMode()) {
+            logger.log(`[PERF] extractBranchLookupFallbackList completed in ${Date.now() - functionStartTime}ms total`);
+        }
         logger.log('Successfully extracted branch lookup fallback list', JSON.stringify(validBranches));
         return validBranches.length > 0 ? validBranches : undefined;
     }