@brainervirus/workit-cli 8.10.0 → 8.11.0

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.10.0",
+    version: "8.11.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.10.0",
-      "@brainervirus/workit-cursor": "^8.10.0",
-      "@brainervirus/workit-opencode": "^8.10.0",
+      "@brainervirus/workit-core": "^8.11.0",
+      "@brainervirus/workit-cursor": "^8.11.0",
+      "@brainervirus/workit-opencode": "^8.11.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -13404,7 +13404,7 @@ var PREFIXES, branchNames = (workspaceRoot) => {
     return new Set;
   return new Set((r.stdout ?? "").split(`
 `).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
-}, detectBranchPolicy = (workspaceRoot) => {
+}, productionBranchOf = (names) => names.has("main") ? "main" : names.has("master") ? "master" : "main", detectBranchPolicy = (workspaceRoot) => {
   const names = branchNames(workspaceRoot);
   const develop = names.has("develop");
   const main = names.has("main");
@@ -16808,10 +16808,35 @@ var withReleaseTracks = (workspaceRoot, policy) => {
       ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
     ])
   };
-}, validateBranchNamePolicy = (name, policy, source) => {
+}, KIND_SYNONYMS, allowedKinds = (allowed) => [
+  ...new Set(allowed.map((pattern) => /^\^([\w.-]+)\\?\/\.\*\$$/u.exec(pattern.source)?.[1]?.toLowerCase()).filter((kind) => Boolean(kind)))
+], editDistance = (a, b) => {
+  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (let i = 1;i <= a.length; i++) {
+    let previous = row[0];
+    row[0] = i;
+    for (let j = 1;j <= b.length; j++) {
+      const saved = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+      previous = saved;
+    }
+  }
+  return row[b.length];
+}, suggestBranchName = (name, kinds) => {
+  if (!kinds.length)
+    return null;
+  const slash = name.indexOf("/");
+  const prefix = slash > 0 ? name.slice(0, slash).toLowerCase() : "";
+  const rest = (slash > 0 ? name.slice(slash + 1) : name) || "name";
+  const synonym = KIND_SYNONYMS[prefix];
+  const near = kinds.map((kind) => ({ kind, distance: editDistance(prefix, kind) })).filter((entry) => prefix && entry.distance <= 2).toSorted((a, b) => a.distance - b.distance)[0]?.kind;
+  const kind = (synonym && kinds.includes(synonym) ? synonym : null) ?? near ?? (kinds.includes("feature") ? "feature" : kinds[0]);
+  return `${kind}/${rest}`;
+}, kindList = (kinds) => kinds.map((kind) => `${kind}/`).join(", "), validateBranchNamePolicy = (name, policy, source) => {
   const allowed = policy.allowed.map((pattern) => `/${pattern.source}/${pattern.flags}`);
+  const kinds = allowedKinds(policy.allowed);
   if (policy.protected.has(name.toLowerCase())) {
-    const correction = `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
+    const correction = kinds.length ? `choose a non-protected branch of an allowed kind (${kindList(kinds)}), e.g. ${kinds[0]}/<slug>: workit git branch --kind ${kinds[0]} --slug <slug>` : `choose a non-protected branch matching one of: ${allowed.join(", ")}`;
     return {
       ok: false,
       rule: "protected_ref",
@@ -16822,7 +16847,8 @@ var withReleaseTracks = (workspaceRoot, policy) => {
     };
   }
   if (!policy.allowed.some((pattern) => pattern.test(name))) {
-    const correction = `choose a branch matching one of: ${allowed.join(", ")}`;
+    const suggestion = suggestBranchName(name, kinds);
+    const correction = suggestion && policy.allowed.some((pattern) => pattern.test(suggestion)) ? `use ${JSON.stringify(suggestion)}; the allowed kinds are ${kindList(kinds)} (workit git branch ${suggestion})` : `choose a branch matching one of: ${allowed.join(", ")}`;
     return {
       ok: false,
       rule: "allowed_pattern",
@@ -16898,7 +16924,45 @@ var withReleaseTracks = (workspaceRoot, policy) => {
       error: `policy_unavailable: cannot validate commit subject ${JSON.stringify(attempted)} because ${error instanceof Error ? error.message : String(error)}; ${correction}`
     };
   }
-}, resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy, resolveCommitPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "commit", profileName).commitPolicy, policy = (root) => resolveBranchPolicyFor(root), isProtected = (root, name) => policy(root).protected.has(name.toLowerCase()), isProtectedTarget = (root, name) => {
+}, resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy, resolveCommitPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "commit", profileName).commitPolicy, BRANCH_KINDS, branchKindOf = (name) => {
+  const prefix = name?.split("/", 1)[0]?.toLowerCase() ?? "";
+  return name?.includes("/") && BRANCH_KINDS.includes(prefix) ? prefix : null;
+}, gitFlowOf = (root, integration) => {
+  try {
+    if (resolveBranchPolicyFor(root).preset !== "gitflow")
+      return null;
+    const selected = resolveRuntimeWorkspacePolicy(root, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined).policy;
+    const names = branchNames(root);
+    const production = productionBranchOf(names);
+    const develop = selected?.developBranch?.trim() || (integration && integration.toLowerCase() !== production ? integration : "develop");
+    return { develop, production, developExists: names.has(develop) };
+  } catch {
+    return null;
+  }
+}, flowRoute = (flow, kind) => kind === "hotfix" ? { kind, base: flow.production, target: flow.production, mergeBack: flow.develop } : kind === "release" ? { kind, base: flow.develop, target: flow.production, mergeBack: flow.develop } : { kind, base: flow.develop, target: flow.develop, mergeBack: null }, releaseBranchesOf = (cwd) => {
+  try {
+    const resolved = resolveBranchPolicyFor(cwd);
+    const flow = resolved.preset === "gitflow" ? gitFlowOf(cwd) : null;
+    return {
+      preset: resolved.preset,
+      branches: flow ? [flow.production, flow.develop] : [],
+      production: flow ? flow.production : resolved.defaultTargetBranch
+    };
+  } catch {
+    return { preset: "unknown", branches: [], production: null };
+  }
+}, releaseBranch = (cwd, branch) => releaseBranchesOf(cwd).branches.some((name) => name.toLowerCase() === branch.toLowerCase()), shortBranch = (ref) => ref.replace(/^refs\/heads\//u, "").replace(/^(?:refs\/remotes\/)?origin\//u, ""), flowMismatch = (flow, kind, ref, role) => {
+  if (!flow || !kind || !flow.developExists)
+    return null;
+  const route = flowRoute(flow, kind);
+  const expected = role === "base" ? route.base : route.target;
+  const given = shortBranch(ref).toLowerCase();
+  const longLived = [flow.develop, flow.production].map((name) => name.toLowerCase());
+  const backMerge = role === "target" && route.mergeBack?.toLowerCase() === given;
+  if (!longLived.includes(given) || given === expected.toLowerCase() || backMerge)
+    return null;
+  return role === "base" ? `gitflow_base: git-flow starts ${kind}/* from ${expected}, not ${shortBranch(ref)}` : `gitflow_target: git-flow lands ${kind}/* on ${expected}, not ${shortBranch(ref)}`;
+}, policy = (root) => resolveBranchPolicyFor(root), isProtected = (root, name) => policy(root).protected.has(name.toLowerCase()), isProtectedTarget = (root, name) => {
   try {
     return isProtected(root, name);
   } catch {
@@ -16942,11 +17006,116 @@ var init_branch = __esm(() => {
   init_workspaces();
   init_vcs_config();
   init_release_tracks();
+  KIND_SYNONYMS = {
+    fix: "bugfix",
+    fixes: "bugfix",
+    bug: "bugfix",
+    bugs: "bugfix",
+    bugfixes: "bugfix",
+    feat: "feature",
+    features: "feature",
+    chore: "feature",
+    docs: "feature",
+    doc: "feature",
+    refactor: "feature",
+    test: "feature",
+    tests: "feature",
+    ci: "feature",
+    build: "feature",
+    perf: "feature",
+    style: "feature",
+    deps: "feature",
+    task: "feature",
+    enhancement: "feature",
+    hot: "hotfix",
+    hotfixes: "hotfix",
+    releases: "release",
+    rel: "release"
+  };
+  BRANCH_KINDS = ["feature", "bugfix", "release", "hotfix"];
+});
+
+// packages/workit-core/src/hooks/session-marker.ts
+var init_session_marker = __esm(() => {
+  init_paths();
+});
+// packages/workit-core/src/hooks/raw-git.ts
+var SHELLS, PREFIXES2, CD, PUSHD, POPD, GIT_VALUE_OPTIONS, LAUNCHERS, PUSH_VALUE_OPTIONS, VALUE_OPTIONS;
+var init_raw_git = __esm(() => {
+  init_branch();
+  init_workspaces();
+  init_rev();
+  init_ledger();
+  init_paths();
+  init_session_marker();
+  SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+  PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "nice", "&"]);
+  CD = new Set(["cd", "chdir", "set-location", "sl"]);
+  PUSHD = new Set(["pushd", "push-location"]);
+  POPD = new Set(["popd", "pop-location"]);
+  GIT_VALUE_OPTIONS = new Set([
+    "-c",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "--exec-path",
+    "--config-env",
+    "--super-prefix"
+  ]);
+  LAUNCHERS = new Set([
+    "npx",
+    "bunx",
+    "pnpx",
+    "-y",
+    "--yes",
+    "pnpm",
+    "dlx",
+    "exec",
+    "env",
+    "sudo",
+    "command"
+  ]);
+  PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
+  VALUE_OPTIONS = {
+    git: new Set([
+      "-m",
+      "--message",
+      "-F",
+      "--file",
+      "-C",
+      "-c",
+      "--reuse-message",
+      "--reedit-message",
+      "--author",
+      "--date",
+      "--trailer",
+      "-t",
+      "--template",
+      "--cleanup",
+      "--fixup",
+      "--squash",
+      "-o",
+      "--push-option",
+      "--repo",
+      "--receive-pack",
+      "--exec"
+    ]),
+    gh: new Set(["-b", "--body", "-F", "--body-file", "-t", "--title", "--subject", "-A", "--author-email"].concat(["-B", "--base", "-H", "--head", "-l", "--label", "-a", "--assignee"]).concat(["-r", "--reviewer", "-m", "--milestone", "-p", "--project", "-T", "--template"]).concat(["--match-head-commit", "-R", "--repo"])),
+    glab: new Set(["-m", "--message", "--squash-message", "--sha", "-t", "--title", "-d", "--description"].concat(["-b", "--target-branch", "-s", "--source-branch", "-l", "--label"]).concat(["-a", "--assignee", "--reviewer", "-R", "--repo"]))
+  };
 });
 
 // packages/workit-core/src/core/route-intent.ts
+var SWITCH_CREATE, CHECKOUT_CREATE, WORKTREE_CREATE, BRANCH_NO_CREATE, BRANCH_RENAME, WORKTREE_VALUES;
 var init_route_intent = __esm(() => {
+  init_raw_git();
   init_branch();
+  SWITCH_CREATE = new Set(["-c", "--create", "-C", "--force-create", "--orphan"]);
+  CHECKOUT_CREATE = new Set(["-b", "-B", "--orphan"]);
+  WORKTREE_CREATE = new Set(["-b", "-B"]);
+  BRANCH_NO_CREATE = new Set(["-d", "-D", "--delete", "-l", "--list", "-a", "--all", "-r", "--remotes", "--show-current"].concat(["-v", "-vv", "--verbose", "--contains", "--no-contains", "--merged", "--no-merged"]).concat(["--points-at", "--sort", "--format", "--column", "--no-column", "-u"]).concat(["--set-upstream-to", "--unset-upstream", "--edit-description", "-i", "--ignore-case"]));
+  BRANCH_RENAME = new Set(["-m", "-M", "--move", "-c", "-C", "--copy"]);
+  WORKTREE_VALUES = new Set(["--reason"]);
 });
 
 // packages/workit-core/src/core/runtime-identity.ts
@@ -72715,7 +72884,7 @@ async function runGrant(argv, io, deps = defaultDeps) {
   return usage2(io, `unknown subcommand "${sub}"`);
 }
 var USAGE2 = "workit grant show [<workspace>] [--all] | grant set <workspace> <kind>=<true|false|verified>… [defaultEndpoint=commit|pr|green|merged] [verification=self|independent] | grant unset <workspace> <kind>…  (kinds: push, pr, merge, release, rerun, defaultEndpoint, verification)", AGENT_ENV, agentMarker = (env) => AGENT_ENV.find((name) => env[name]) ?? Object.keys(env).find((name) => name.startsWith("CODEX_") && env[name]), defaultDeps, parseValue = (raw) => raw === "true" || raw === "yes" || raw === "on" ? true : raw === "false" || raw === "no" || raw === "off" ? false : raw === "verified" ? "verified" : null, STOPS_AT, endpointLabel = (view) => view.effectiveEndpoint === view.defaultEndpoint ? view.defaultEndpoint : `${view.defaultEndpoint} (effective: ${view.effectiveEndpoint}${view.endpointReason ? `, ${view.endpointReason}` : ""})`, describe2 = (grants, configured, endpoint, verification) => [
-  ...GRANT_KINDS.map((kind) => `  ${kind.padEnd(8)}${String(grants[kind]).padEnd(10)}${configured.includes(kind) ? "configured" : "default"}${kind === "release" ? " (no consumer yet: reserved, not enforced)" : ""}`),
+  ...GRANT_KINDS.map((kind) => `  ${kind.padEnd(8)}${String(grants[kind]).padEnd(10)}${configured.includes(kind) ? "configured" : "default"}${kind === "release" ? " (workit git push --release: git-flow main and develop, landed v* tags)" : ""}`),
   `  default endpoint: ${endpointLabel(endpoint)} (an unnamed request stops at ${STOPS_AT[endpoint.effectiveEndpoint]})`,
   ...endpoint.endpointIssue ? [`  note: ${endpoint.endpointIssue}`] : [],
   `  verification: ${verification} (${verification === "independent" ? "a normal-risk behavior change needs a non-author verdict" : "a normal-risk behavior change needs a passing check and the author's --self verdict, shown as self-reviewed"})`
@@ -73161,6 +73330,12 @@ function gitBranch(cwd, input) {
     return failure3("blocked", policy.error, policy.correction);
   if (resolveRef(cwd, `refs/heads/${name}`))
     return failure3("failed", `branch_exists: ${name} already exists`, `git switch ${name}`);
+  const kind = input.kind ?? branchKindOf(name);
+  const flow = resolved.ok !== false && !releaseTrack?.track ? gitFlowOf(cwd, String(resolved.defaultTargetBranch ?? "") || null) : null;
+  const route = flow && kind ? flowRoute(flow, kind) : null;
+  const mismatch = explicitBase ? flowMismatch(flow, kind, explicitBase, "base") : null;
+  if (mismatch && route)
+    return failure3("blocked", mismatch, `workit git branch ${input.kind ? `--kind ${kind} --slug ${input.slug}` : name}  # without --base it starts from ${route.base}`);
   let base = explicitBase;
   let defaultTarget = null;
   let defaultBase = null;
@@ -73170,12 +73345,14 @@ function gitBranch(cwd, input) {
     defaultTarget = String(resolved.defaultTargetBranch ?? "") || null;
     defaultBase = String(resolved.baseBranch ?? "") || defaultTarget;
   }
-  base ??= defaultBase;
+  base ??= route?.base ?? defaultBase;
   if (!base)
     return failure3("invalid_input", "no default target branch is configured; pass --base <branch>");
   if (base.startsWith("-"))
     return failure3("invalid_input", "--base must not start with -");
   const notes = [...releaseTrack?.warnings ?? []];
+  if (route?.mergeBack)
+    notes.push(`git-flow: ${route.kind}/* lands on ${route.target} (workit pr create targets it), then ${route.target} merges back into ${route.mergeBack}`);
   const remotes = remoteNames(cwd);
   const remote = remotes.includes("origin") ? "origin" : pushRemoteName(cwd);
   const localTip = resolveRef(cwd, `refs/heads/${base}`);
@@ -73218,7 +73395,8 @@ function gitBranch(cwd, input) {
     baseSha,
     carried: dirt !== "clean",
     notes,
-    releaseTrack
+    releaseTrack,
+    flow: route
   });
 }
 function lintCommitMessage(cwd, message) {
@@ -73439,7 +73617,7 @@ function pushPreflight(cwd, options = {}) {
   if (!branch)
     return failure3("invalid_input", "HEAD is detached; push a branch");
   if (isProtectedTarget(cwd, branch))
-    return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit never pushes to it`, "workit git branch <feature/name>  # push a feature branch and open a PR");
+    return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit git push never pushes to it`, releaseBranch(cwd, branch) ? `workit git push --release ${branch}  # finishing a release or hotfix; needs the release grant` : "workit git branch <feature/name>  # push a feature branch and open a PR");
   const sha = resolveRef(cwd, `refs/heads/${branch}`);
   if (!sha)
     return failure3("not_found", `branch ${branch} has no commit to push`);
@@ -73606,6 +73784,125 @@ ${gitOutput(run)}`);
     recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
   });
 }
+function releasePushPreflight(cwd, names) {
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "push");
+  const wanted = [...new Set(names)];
+  if (!wanted.length)
+    return failure3("invalid_input", "name the release refs to push");
+  const { preset, branches, production } = releaseBranchesOf(cwd);
+  const refs = [];
+  for (const raw of wanted) {
+    if (raw.startsWith("-") || raw.includes(":"))
+      return failure3("invalid_input", `${raw} is not a ref name (refspecs are not accepted)`);
+    const tagName = raw.replace(/^refs\/tags\//u, "");
+    const branchName = raw.replace(/^refs\/heads\//u, "");
+    const tag = raw.startsWith("refs/heads/") ? null : resolveRef(cwd, `refs/tags/${tagName}`);
+    const branch = raw.startsWith("refs/tags/") ? null : resolveRef(cwd, `refs/heads/${branchName}`);
+    if (tag && branch)
+      return failure3("invalid_input", `${raw} names both a branch and a tag`, `workit git push --release refs/heads/${raw}  # or refs/tags/${raw}`);
+    if (tag) {
+      if (!RELEASE_TAG.test(tagName))
+        return failure3("blocked", `release_push_refused: tag ${tagName} is not a release tag (v<version>)`, "git tag -a v<version> -m <message>  # then: workit git push --release v<version>");
+      refs.push({ kind: "tag", name: tagName, ref: `refs/tags/${tagName}`, sha: tag });
+      continue;
+    }
+    if (!branch)
+      return failure3("not_found", `${raw} is not a local branch or tag`);
+    if (!branches.some((name) => name.toLowerCase() === branchName.toLowerCase()))
+      return failure3("blocked", branches.length ? `release_push_refused: ${branchName} is not a git-flow release branch (${branches.join(", ")})` : `release_push_refused: the ${preset} policy lands ${branchName} only through a reviewed PR; workit git push --release pushes v<version> tags there, not branches`, branches.length ? "workit git push  # a feature, bugfix, release or hotfix branch, then: workit pr create" : `workit pr create --base ${branchName}  # then tag the merged commit and: workit git push --release v<version>`);
+    refs.push({ kind: "branch", name: branchName, ref: `refs/heads/${branchName}`, sha: branch });
+  }
+  const remote = pushRemoteName(cwd, refs.find((ref) => ref.kind === "branch")?.name ?? null);
+  if (!remote)
+    return failure3("not_found", "no push remote is configured for this repository", "git remote add origin <url>");
+  const raw = pushUrl(cwd, remote);
+  if (!raw)
+    return failure3("blocked", `remote "${remote}" has no single push URL`, `git remote get-url --push --all ${remote}  # keep exactly one push URL`);
+  const local = parseRemoteUrl(raw)?.protocol === "file";
+  if (!local && !pushTargetIsStable(cwd, raw))
+    return failure3("blocked", `push_target_rewritten: the push URL of "${remote}" is rewritten by a url.*.insteadOf rule, so the destination is not the one checked`, "git config --get-regexp '^url\\.'  # remove the rewrite for this remote");
+  return success2({ refs, remote, url: redactRemote(raw), rawUrl: raw, local, production });
+}
+function executeReleasePush(cwd, plan, input) {
+  const previous = new Map;
+  for (const ref of plan.refs) {
+    const before = remoteRefTip(cwd, plan.rawUrl, ref.ref);
+    if (!before.ok)
+      return failure3(before.code, before.error);
+    previous.set(ref.ref, before.sha);
+    if (before.sha === null || before.sha === ref.sha)
+      continue;
+    if (ref.kind === "tag")
+      return failure3("blocked", `tag_exists: ${plan.remote} already has ${ref.name} at ${before.sha.slice(0, 12)}, not ${ref.sha.slice(0, 12)}; a release tag never moves`, `git tag -d ${ref.name}  # tag the next version instead`);
+    if (!git5(cwd, ["merge-base", "--is-ancestor", before.sha, ref.sha]).ok)
+      return failure3("failed", `non_fast_forward: ${plan.remote}/${ref.name} (${before.sha.slice(0, 12)}) is not part of local ${ref.name}; a release push never rewrites it`, `git fetch ${plan.remote} ${ref.name} && git switch ${ref.name} && git merge --ff-only ${plan.remote}/${ref.name}  # then: workit git push --release ${ref.name}`);
+  }
+  const tags = plan.refs.filter((ref) => ref.kind === "tag");
+  if (tags.length) {
+    let productionTip = null;
+    if (plan.production) {
+      const tip = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${plan.production}`);
+      if (!tip.ok)
+        return failure3(tip.code, tip.error);
+      productionTip = tip.sha;
+    }
+    const contains = (tip, sha) => git5(cwd, ["merge-base", "--is-ancestor", sha, tip]).ok;
+    for (const tag of tags) {
+      const released = productionTip !== null && contains(productionTip, tag.sha) || plan.refs.some((ref) => ref.kind === "branch" && contains(ref.sha, tag.sha));
+      if (!released)
+        return failure3("blocked", `tag_unreleased: ${tag.name} (${tag.sha.slice(0, 12)}) is not on ${plan.remote}/${plan.production ?? "the production branch"}${plan.refs.some((ref) => ref.kind === "branch") ? " or a branch in this push" : ""}; a release tag marks a commit that already landed`, `land it through a PR first (workit pr create), git fetch ${plan.remote}, then tag the merged commit`);
+    }
+  }
+  const pending = plan.refs.filter((ref) => previous.get(ref.ref) !== ref.sha);
+  if (pending.length) {
+    const run = gitNetwork(cwd, [
+      "push",
+      "--porcelain",
+      "--atomic",
+      "--no-follow-tags",
+      "--recurse-submodules=no",
+      plan.remote,
+      ...pending.map((ref) => ref.kind === "tag" ? `${ref.ref}:${ref.ref}` : `${ref.sha}:${ref.ref}`)
+    ], input.timeoutMs ?? PUSH_TIMEOUT_MS);
+    if (!run.ok)
+      return run.timedOut ? failure3("unavailable", `git push to ${plan.url} timed out`) : failure3("failed", `git push to ${plan.url} failed:
+${gitOutput(run)}`);
+  }
+  for (const ref of plan.refs) {
+    const after = remoteRefTip(cwd, plan.rawUrl, ref.ref);
+    if (!after.ok)
+      return failure3(after.code, `push sent but not verified: ${after.error}`);
+    if (after.sha !== ref.sha)
+      return failure3("failed", `push_unverified: ${plan.remote} ${ref.ref} is at ${after.sha?.slice(0, 12) ?? "(absent)"}, not ${ref.sha.slice(0, 12)}`);
+  }
+  const refs = plan.refs.map((ref) => ({
+    ...ref,
+    previous: previous.get(ref.ref) ?? null,
+    pushed: pending.includes(ref)
+  }));
+  const row = appendObserved(cwd, {
+    type: "release.pushed",
+    actor: input.actor,
+    remote: plan.remote,
+    url: plan.url,
+    refs: refs.map(({ ref, sha, previous: before, pushed }) => ({
+      ref,
+      sha,
+      previous: before,
+      pushed
+    })),
+    grant: input.grant,
+    ...input.identity ? { identity: input.identity } : {}
+  });
+  return success2({
+    remote: plan.remote,
+    url: plan.url,
+    refs,
+    recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
+  });
+}
 function deleteRemoteBranch(cwd, target, branch, expectedTip, options = {}) {
   if (target.startsWith("-") || branch.startsWith("-") || !SHA.test(expectedTip))
     return { ok: false, lease: false, error: "invalid branch deletion target" };
@@ -73670,7 +73967,7 @@ ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((va
     ...lines.slice(-half)
   ].join(`
 `);
-}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX;
+}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX, RELEASE_TAG;
 var init_ops = __esm(() => {
   init_branch();
   init_commit_flavors();
@@ -73685,6 +73982,7 @@ var init_ops = __esm(() => {
   TRAILER_CONFIG = ["-c", "trailer.separators=:", "-c", "trailer.where=end"];
   SHA = /^[0-9a-f]{40,64}$/u;
   SHA_PREFIX = /^[0-9a-f]{7,39}$/u;
+  RELEASE_TAG = /^v\d/u;
 });
 
 // packages/workit-core/src/forge/reruns.ts
@@ -74224,7 +74522,7 @@ function boundSource(cwd, resolved) {
     return failure3("blocked", remote.sha === null ? `not_pushed: ${branch} is not on ${resolved.remote}` : `not_pushed: ${resolved.remote}/${branch} is at ${remote.sha.slice(0, 12)}, local ${branch} is at ${sha.slice(0, 12)}`, "workit git push");
   return success2({ branch, sha });
 }
-async function verifiedHead(resolved, branch, sha, first, sleep) {
+async function verifiedHead(resolved, branch, sha, first, sleep, base) {
   let ref = first;
   for (const delay of [0, ...VERIFY_DELAYS_MS]) {
     if (ref.headSha === sha)
@@ -74234,7 +74532,8 @@ async function verifiedHead(resolved, branch, sha, first, sleep) {
     const found = resolved.forge.findPr(branch, {
       owner: resolved.headRepo.split("/")[0] ?? null,
       projectId: resolved.headProjectId,
-      sha
+      sha,
+      base
     });
     if (!found.ok)
       return found;
@@ -74259,7 +74558,8 @@ async function createPullRequest(cwd, resolved, input, sleep) {
   const existing = resolved.forge.findPr(branch, {
     owner: resolved.headRepo.split("/")[0] ?? null,
     projectId: resolved.headProjectId,
-    sha
+    sha,
+    base: input.base
   });
   if (!existing.ok)
     return existing;
@@ -74282,7 +74582,7 @@ async function createPullRequest(cwd, resolved, input, sleep) {
     ref = made.data;
     created = true;
   }
-  const verified = await verifiedHead(resolved, branch, sha, ref, sleep);
+  const verified = await verifiedHead(resolved, branch, sha, ref, sleep, input.base);
   if (!verified.ok)
     return verified;
   const row = appendObserved(cwd, {
@@ -74449,7 +74749,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     const gone = !deleted.ok && remoteRefTip(cwd, resolved.remote, `refs/heads/${branch}`);
     deletedBranch = deleted.ok || gone && gone.ok && gone.sha === null ? true : { error: deleted.error };
   }
-  const mergeBack = mergeBackFor(cwd, doc.base);
+  const mergeBack = mergeBackFor(cwd, doc.base, branch);
   const row = appendObserved(cwd, {
     type: "pr.merged",
     actor: input.actor,
@@ -74488,9 +74788,16 @@ var VERIFY_DELAYS_MS, noun = (resolved) => resolved.forge.kind === "github" ? "p
   return `a non-author verifies the head (workit-review); the endpoint is ${endpoint}, so ${AFTER_REVIEW[endpoint]}`;
 }, SESSION_TRAILER, indent = (text) => text.split(`
 `).map((line) => line ? `  ${line}` : line).join(`
-`), mergeBackFor = (cwd, base) => {
+`), mergeBackFor = (cwd, base, head) => {
   try {
-    const owners = workspaceReleaseTracks(cwd).tracks.filter((track) => track.productionBranch === base);
+    const read = workspaceReleaseTracks(cwd);
+    if (!read.tracks.length) {
+      const flow = gitFlowOf(cwd);
+      const kind = branchKindOf(head);
+      const route = flow && kind ? flowRoute(flow, kind) : null;
+      return route?.mergeBack && route.target === base ? { track: "git-flow", branches: [route.mergeBack] } : { track: null, branches: [] };
+    }
+    const owners = read.tracks.filter((track) => track.productionBranch === base);
     if (owners.length !== 1)
       return { track: null, branches: [] };
     return {
@@ -76238,8 +76545,11 @@ function createGitHubForge(options) {
       if (!data.ok)
         return data;
       const nodes = data.data.repository?.pullRequests.nodes ?? [];
-      const ours = nodes.filter((node) => node.headRefName === head && (match.owner !== null && node.headRepositoryOwner?.login.toLowerCase() === match.owner.toLowerCase() || match.sha !== null && node.headRefOid === match.sha));
-      const pick = ours.find((node) => node.state === "OPEN") ?? ours[0];
+      const ours = nodes.filter((node) => node.headRefName === head && (!match.base || node.baseRefName === undefined || node.baseRefName === match.base) && (match.owner !== null && node.headRepositoryOwner?.login.toLowerCase() === match.owner.toLowerCase() || match.sha !== null && node.headRefOid === match.sha));
+      const open = ours.filter((node) => node.state === "OPEN");
+      if (!match.base && new Set(open.map((node) => node.baseRefName)).size > 1)
+        return failure3("blocked", `ambiguous_pr: ${head} has open pull requests ${open.map((node) => `#${node.number} -> ${node.baseRefName}`).join(", ")}`, `pass --pr <n>, e.g. --pr ${open[0].number}`);
+      const pick = open[0] ?? ours[0];
       if (!pick)
         return success2(null);
       const ref = {
@@ -76459,7 +76769,7 @@ function createGitHubForge(options) {
     }
   };
 }
-var GITHUB_MAX_PAGES = 10, PR_FIELDS = `number url state isDraft isInMergeQueue mergeable mergeStateStatus baseRefName baseRefOid baseRef { target { oid } } headRefName headRefOid reviewDecision`, THREADS = `reviewThreads(first: 100, after: $threads) { pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 1) { nodes { author { login __typename } body url } } } }`, CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId isRequired(pullRequestNumber: $number) checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl isRequired(pullRequestNumber: $number) } } }`, PR_STATUS_QUERY, FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state headRefName headRefOid headRepositoryOwner { login } } } } }`, READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, REPLY_MUTATION = `mutation($thread: ID!, $body: String!) { addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $thread, body: $body }) { comment { url } } }`, RESOLVE_MUTATION = `mutation($thread: ID!) { resolveReviewThread(input: { threadId: $thread }) { thread { isResolved } } }`, THREAD_QUERY = `query($thread: ID!) { node(id: $thread) { ... on PullRequestReviewThread { isResolved pullRequest { number } } } }`, prState = (value) => value === "MERGED" ? "merged" : value === "CLOSED" ? "closed" : "open", FAILING2, safeUrl = (value) => value ? redactText(value) : null, encodeRef = (ref) => ref.split("/").map(encodeURIComponent).join("/");
+var GITHUB_MAX_PAGES = 10, PR_FIELDS = `number url state isDraft isInMergeQueue mergeable mergeStateStatus baseRefName baseRefOid baseRef { target { oid } } headRefName headRefOid reviewDecision`, THREADS = `reviewThreads(first: 100, after: $threads) { pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 1) { nodes { author { login __typename } body url } } } }`, CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId isRequired(pullRequestNumber: $number) checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl isRequired(pullRequestNumber: $number) } } }`, PR_STATUS_QUERY, FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state baseRefName headRefName headRefOid headRepositoryOwner { login } } } } }`, READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, REPLY_MUTATION = `mutation($thread: ID!, $body: String!) { addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $thread, body: $body }) { comment { url } } }`, RESOLVE_MUTATION = `mutation($thread: ID!) { resolveReviewThread(input: { threadId: $thread }) { thread { isResolved } } }`, THREAD_QUERY = `query($thread: ID!) { node(id: $thread) { ... on PullRequestReviewThread { isResolved pullRequest { number } } } }`, prState = (value) => value === "MERGED" ? "merged" : value === "CLOSED" ? "closed" : "open", FAILING2, safeUrl = (value) => value ? redactText(value) : null, encodeRef = (ref) => ref.split("/").map(encodeURIComponent).join("/");
 var init_github = __esm(() => {
   init_exec();
   init_redact();
@@ -76576,8 +76886,11 @@ function createGitLabForge(options) {
         return list;
       if (!Array.isArray(list.data))
         return failure3("failed", "merge request list is not a list");
-      const matches = list.data.filter((mr) => mr.source_branch === head && (match.projectId !== null && mr.source_project_id === match.projectId || match.sha !== null && mr.sha === match.sha));
-      const pick = matches.find((mr) => mr.state === "opened") ?? matches[0];
+      const matches = list.data.filter((mr) => mr.source_branch === head && (!match.base || mr.target_branch === undefined || mr.target_branch === match.base) && (match.projectId !== null && mr.source_project_id === match.projectId || match.sha !== null && mr.sha === match.sha));
+      const open = matches.filter((mr) => mr.state === "opened");
+      if (!match.base && new Set(open.map((mr) => mr.target_branch)).size > 1)
+        return failure3("blocked", `ambiguous_pr: ${head} has open merge requests ${open.map((mr) => `!${mr.iid} -> ${mr.target_branch}`).join(", ")}`, `pass --pr <n>, e.g. --pr ${open[0].iid}`);
+      const pick = open[0] ?? matches[0];
       return success2(pick ? {
         number: pick.iid,
         url: pick.web_url,
@@ -77388,8 +77701,18 @@ async function create4(argv, io) {
   if (flags.values.base !== undefined && flags.values.track !== undefined)
     return usage3(io, "pass --base or --track, not both (--track picks the base for you)", CREATE_USAGE);
   let base = flags.values.base ?? null;
+  const branch = currentBranch(io.cwd);
+  const kind = branchKindOf(branch);
   let releaseTrack = null;
-  if (!base) {
+  let route = null;
+  if (base) {
+    const flow = gitFlowOf(io.cwd);
+    const mismatch = flowMismatch(flow, kind, base, "target");
+    if (mismatch && flow && kind)
+      return emit(io, fail("blocked", mismatch, {
+        unblock: `workit pr create …  # without --base it targets ${flowRoute(flow, kind).target}`
+      }));
+  } else {
     const resolved = vcsConfig("resolve", io.cwd, { track: flags.values.track ?? null });
     if (resolved.ok === false)
       return emit(io, fail("blocked", String(resolved.error), {
@@ -77401,10 +77724,13 @@ async function create4(argv, io) {
         unblock: "workit pr create --track <name> …  # or --base <branch>"
       }));
     base = String(resolved.defaultTargetBranch ?? "") || null;
+    const flow = releaseTrack?.track ? null : gitFlowOf(io.cwd, base);
+    route = flow && kind ? flowRoute(flow, kind) : null;
+    if (route)
+      base = route.target;
   }
   if (!base)
     return usage3(io, "no default target branch is configured; pass --base <b>", CREATE_USAGE);
-  const branch = currentBranch(io.cwd);
   const connected = connect(io, branch);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -77431,11 +77757,18 @@ async function create4(argv, io) {
   }, forgeDeps.sleep);
   if (!result.ok)
     return forgeFail(io, result);
-  const created = releaseTrack ? { ...result.data, releaseTrack } : result.data;
+  const created = {
+    ...result.data,
+    ...releaseTrack ? { releaseTrack } : {},
+    ...route ? { flow: route } : {}
+  };
   return emit(io, ok(created), (data) => [
     `${data.created ? "opened" : "found open"} ${connected.data.forge.kind === "github" ? "PR #" : "MR !"}${data.number}${data.draft && data.created ? " (draft)" : ""}: ${data.branch} -> ${data.base}  ${data.url}`,
     ...data.releaseTrack?.name ? [`release track: ${data.releaseTrack.name} (${data.releaseTrack.detail})`] : [],
     ...(data.releaseTrack?.warnings ?? []).map((warning) => `note: ${warning}`),
+    ...route?.mergeBack ? [
+      `merge back: git-flow: once ${data.branch} lands on ${route.target}, bring ${route.target} into ${route.mergeBack} (workit pr create --base ${route.mergeBack} opens the back-merge PR from ${data.branch}, or merge locally and run workit git push --release ${route.mergeBack}); tag the release and push it with workit git push --release <tag>`
+    ] : [],
     `head ${data.head.slice(0, 12)} verified on the forge`,
     ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : [],
     `next: ${data.next}`
@@ -77641,6 +77974,7 @@ var init_pr = __esm(() => {
   init_pr_ops();
   init_report();
   init_rev();
+  init_branch();
   init_ledger();
   init_vcs_config();
   init_output();
@@ -77872,6 +78206,17 @@ __export(exports_git, {
 });
 import { readFileSync as readFileSync22 } from "node:fs";
 import path46 from "node:path";
+function kindHint(cwd, kind) {
+  let kinds = [...BRANCH_KINDS];
+  try {
+    kinds = allowedKinds(branchPolicySnapshotFor(cwd).namePolicy.allowed);
+  } catch {}
+  const spellable = kinds.filter((name) => BRANCH_KINDS.includes(name));
+  if (spellable.length)
+    return `did you mean --kind ${suggestBranchName(`${kind}/x`, spellable)?.split("/")[0]}?`;
+  const named = suggestBranchName(`${kind}/<slug>`, kinds);
+  return named ? `this workspace allows ${kinds.map((name) => `${name}/`).join(", ")}: pass a name, e.g. workit git branch ${named}` : `this workspace allows any non-protected name: pass one, e.g. workit git branch ${kind}/<slug>`;
+}
 async function branch(argv, io) {
   const flags = parseFlags(argv, {
     base: "value",
@@ -77887,8 +78232,8 @@ async function branch(argv, io) {
     return usage3(io, `unexpected argument ${flags.positionals[1]}`, BRANCH_USAGE);
   if (kind === undefined !== (slug === undefined))
     return usage3(io, "--kind and --slug go together", BRANCH_USAGE);
-  if (kind !== undefined && !["feature", "bugfix", "hotfix"].includes(kind))
-    return usage3(io, "--kind must be feature, bugfix or hotfix", BRANCH_USAGE);
+  if (kind !== undefined && !BRANCH_KINDS.includes(kind))
+    return usage3(io, `--kind must be ${BRANCH_KINDS.join(", ")}; ${kindHint(io.cwd, kind)}`, BRANCH_USAGE);
   if (kind !== undefined && flags.positionals.length)
     return usage3(io, "pass a name or --kind/--slug, not both", BRANCH_USAGE);
   if (kind === undefined && !flags.positionals[0])
@@ -78016,10 +78361,17 @@ async function push(argv, io) {
     "set-upstream": "boolean",
     "force-with-lease": "boolean",
     "overwrite-unintegrated": "boolean",
-    expect: "value"
+    expect: "value",
+    release: "list"
   });
   if (typeof flags === "string")
     return usage3(io, flags, PUSH_USAGE);
+  const release = flags.lists.release;
+  if (release) {
+    if (flags.booleans.size || flags.values.expect !== undefined || flags.positionals.length)
+      return usage3(io, "--release takes only ref names (repeat it: --release main --release v1.2.0)", PUSH_USAGE);
+    return releasePush(release, io);
+  }
   if (flags.positionals.length)
     return usage3(io, `unexpected argument ${flags.positionals[0]} (workit pushes the current branch)`, PUSH_USAGE);
   const expect = flags.values.expect ?? null;
@@ -78065,6 +78417,39 @@ async function push(argv, io) {
     ...data.upstream ? [`upstream: ${data.remote}/${data.branch}`] : []
   ]);
 }
+async function releasePush(names, io) {
+  const plan = releasePushPreflight(io.cwd, names);
+  if (!plan.ok)
+    return forgeFail(io, plan);
+  const release = requireGrant(io.cwd, "release");
+  if (!release.allowed)
+    return emit(io, fail("blocked", release.error, {
+      unblock: release.unblock,
+      data: { reason: release.reason }
+    }));
+  const firstBranch = plan.data.refs.find((ref) => ref.kind === "branch")?.name;
+  const identity = plan.data.local ? null : pushIdentity(io, firstBranch ?? plan.data.refs[0].name);
+  if (identity && !identity.ok)
+    return forgeFail(io, identity);
+  const checked = identity?.data ?? null;
+  const pushGrant = requireGrant(io.cwd, "push", { forge: checked?.forge != null });
+  if (!pushGrant.allowed)
+    return emit(io, fail("blocked", pushGrant.error, {
+      unblock: pushGrant.unblock,
+      data: { reason: pushGrant.reason }
+    }));
+  const result = executeReleasePush(io.cwd, plan.data, {
+    actor: actorFromEnv(io.env),
+    grant: release.source,
+    ...checked ? { identity: { ...checked } } : {}
+  });
+  if (!result.ok)
+    return forgeFail(io, result);
+  return emit(io, ok({ ...result.data, identity: checked }), (data) => [
+    ...data.refs.map((ref) => ref.pushed ? `pushed ${ref.name} ${short2(ref.previous)} -> ${short2(ref.sha)} to ${data.remote}; remote tip verified` : `${data.remote} ${ref.name} is already at ${short2(ref.sha)}; remote tip verified`),
+    ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : []
+  ]);
+}
 async function run13(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "branch")
@@ -78075,9 +78460,10 @@ async function run13(argv, io) {
     return push(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE5);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES;
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES;
 var init_git2 = __esm(() => {
   init_autonomy();
+  init_branch();
   init_ops();
   init_ledger();
   init_implicit_task();
@@ -98571,8 +98957,8 @@ var VERBS = [
     subcommands: [
       {
         name: "branch",
-        usage: "workit git branch <name> | git branch --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry]",
-        summary: "Create and switch to a branch from the trunk or a release track"
+        usage: "workit git branch <name> | git branch --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry]",
+        summary: "Create and switch to a branch from the trunk, the git-flow route of its kind or a release track"
       },
       {
         name: "commit",
@@ -98581,8 +98967,8 @@ var VERBS = [
       },
       {
         name: "push",
-        usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]]",
-        summary: "Push the current branch and verify the remote tip (never a blind --force)"
+        usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…]",
+        summary: "Push the current branch and verify the remote tip (never a blind --force); --release finishes a git-flow release"
       }
     ],
     examples: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.10.0",
+  "version": "8.11.0",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,9 +38,9 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-core": "^8.10.0",
-    "@brainervirus/workit-cursor": "^8.10.0",
-    "@brainervirus/workit-opencode": "^8.10.0",
+    "@brainervirus/workit-core": "^8.11.0",
+    "@brainervirus/workit-cursor": "^8.11.0",
+    "@brainervirus/workit-opencode": "^8.11.0",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"