@brainervirus/workit-cli 8.34.0 → 8.35.2

package/dist/index.js

@@ -6401,9 +6401,16 @@ function workspaceDefaultTarget(cwd, globalDefault) {
 }
 var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspaceCommitPolicySchema, workspaceProfileSchema, versionSourceSchema, releaseTrackSchema, workspaceConfigSchema, workspacesFileSchema, workspacesRevision = (contents) => createHash("sha256").update(contents ?? "<missing>").digest("hex"), validateWorkspacesDocument = (parsed, file) => {
   if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+    return {
+      status: "malformed",
+      path: file,
+      entries: [],
+      error: `${file} is not a JSON object`
+    };
   }
-  const validated = workspacesFileSchema.safeParse(parsed, { reportInput: true });
+  const validated = workspacesFileSchema.safeParse(parsed, {
+    reportInput: true
+  });
   if (!validated.success) {
     const detail = validated.error.issues.map((issue) => {
       const field = String(issue.path[issue.path.length - 1] ?? "");
@@ -6442,7 +6449,12 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     raw = readFileSync2(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
-      return { status: "missing", path: file, entries: [], revision: workspacesRevision(null) };
+      return {
+        status: "missing",
+        path: file,
+        entries: [],
+        revision: workspacesRevision(null)
+      };
     return {
       status: "malformed",
       path: file,
@@ -6462,7 +6474,10 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
       error: `${file} is not valid JSON`
     };
   }
-  return { ...validateWorkspacesDocument(parsed, file), revision: workspacesRevision(raw) };
+  return {
+    ...validateWorkspacesDocument(parsed, file),
+    revision: workspacesRevision(raw)
+  };
 }, loadWorkspacesFrom = (dir) => readWorkspacesResult(dir).entries, globToRegExp = (glob) => {
   let out = "";
   for (let i = 0;i < glob.length; i++) {
@@ -6591,7 +6606,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     for (const b of entries.slice(i + 1)) {
       const aInB = matchWorkspace(b.glob, globRoot(a.glob));
       const bInA = matchWorkspace(a.glob, globRoot(b.glob));
-      if (!aInB && !bInA)
+      if (!aInB && !bInA && !globsMayOverlap(a.glob, b.glob))
         continue;
       const [inner, outer] = aInB && !bInA ? [a, b] : bInA && !aInB ? [b, a] : globSpecificity(a.glob) >= globSpecificity(b.glob) ? [a, b] : [b, a];
       const si = globSpecificity(inner.glob);
@@ -6681,7 +6696,10 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   return selected ? { file, selected, matches } : null;
 }, resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
-  return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+  return matched ? {
+    workspace: matched.selected.name,
+    releaseTracks: matched.selected.releaseTracks
+  } : null;
 }, inheritedSetting = (cwd, dir, has) => {
   let matched;
   try {
@@ -6693,7 +6711,10 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     return null;
   const { selected, matches } = matched;
   const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
-  return { workspace: selected.name, source: [selected, ...enclosing].find(has) ?? null };
+  return {
+    workspace: selected.name,
+    source: [selected, ...enclosing].find(has) ?? null
+  };
 }, workspaceDeleteBranch = (cwd, dir) => inheritedSetting(cwd, dir, (entry) => typeof entry.deleteBranch === "boolean")?.source?.deleteBranch !== false, workspaceTrailers = (cwd, dir) => {
   const found = inheritedSetting(cwd, dir, (entry) => typeof entry.trailers === "boolean");
   return {
@@ -6821,7 +6842,10 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     status: "resolved",
     profileName: null,
     workspace: null,
-    provenance: { branchPolicy: "user-default", commitPolicy: "user-default" }
+    provenance: {
+      branchPolicy: "user-default",
+      commitPolicy: "user-default"
+    }
   };
   if (selected.status === "invalid")
     return selected;
@@ -6892,7 +6916,11 @@ var init_workspaces = __esm(() => {
       ["requiredChecks", track.requiredChecks ?? []]
     ]) {
       if (new Set(values).size !== values.length) {
-        context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
+        context.addIssue({
+          code: "custom",
+          path: [field],
+          message: "entries must be unique"
+        });
       }
     }
     if (track.versionSource?.kind === "package-json" && (path2.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
@@ -6925,7 +6953,10 @@ var init_workspaces = __esm(() => {
       kind,
       union([boolean2(), literal("verified")]).optional()
     ]))).passthrough().optional(),
-    youtrack: object({ baseUrl: nonBlank.optional(), link_issues: boolean2().optional() }).passthrough().optional(),
+    youtrack: object({
+      baseUrl: nonBlank.optional(),
+      link_issues: boolean2().optional()
+    }).passthrough().optional(),
     issues: object({
       provider: _enum(["github", "gitlab", "youtrack"]).optional(),
       link: boolean2().optional(),
@@ -9286,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.34.0",
+    version: "8.35.2",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9324,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.34.0",
+      "@brainervirus/workit-cursor": "^8.35.2",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.34.0"
+      "@brainervirus/workit-core": "^8.35.2"
     },
     engines: {
       node: ">=24"
@@ -14889,7 +14920,12 @@ function readLedger(cwd, options = {}) {
     });
   return {
     ok: true,
-    value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
+    value: {
+      path: file.value,
+      rows,
+      skipped,
+      integrity: options.integrity ? integrity : null
+    }
   };
 }
 function ledgerTampering(cwd) {
@@ -15014,7 +15050,10 @@ function branchScope(cwd, branch) {
     return at >= since && at <= until;
   };
 }
-function authorSessions(cwd, rows, branch, range = { base: null, head: null }, scope = branchScope(cwd, branch)) {
+function authorSessions(cwd, rows, branch, range = {
+  base: null,
+  head: null
+}, scope = branchScope(cwd, branch)) {
   const sessions = new Set;
   for (const row of rows) {
     if (!scope(row) || row.type !== "commit.recorded" && row.type !== "task.opened")
@@ -15089,12 +15128,13 @@ function restackCarries(exactIn, rows, branch, from, to) {
     const cwd = exactIn;
     let known = restackExact.get(row);
     if (known === undefined) {
-      known = typeof row.fromBase === "string" && typeof row.toBase === "string" && sameOwnChange(cwd, {
+      const range = typeof row.fromBase === "string" && typeof row.toBase === "string" ? {
         from: fromHead,
         to: head,
         fromBase: row.fromBase,
         toBase: row.toBase
-      });
+      } : null;
+      known = range !== null && (sameOwnChange(cwd, range) || cleanRebase(cwd, range));
       restackExact.set(row, known);
     }
     return known;
@@ -15129,7 +15169,10 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     const cacheKey = `${base}\x00${at}`;
     let key = keyCache.get(cacheKey);
     if (!key) {
-      key = { patchId: patchId(cwd, base, at), diffHash: diffHash(cwd, base, at) };
+      key = {
+        patchId: patchId(cwd, base, at),
+        diffHash: diffHash(cwd, base, at)
+      };
       keyCache.set(cacheKey, key);
     }
     return key;
@@ -15169,7 +15212,10 @@ function checkVerdicts(cwd, branch, ledgerRows) {
   };
   const exactCarry = (row) => FAILING.has(String(row.result)) || exactMatch(row) !== null;
   const keyBasis = (row) => {
-    const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
+    const basis = verdictBasis(row, {
+      head,
+      ...keyFor(row.base ?? fallbackBase)
+    });
     return basis === "carried" && !exactCarry(row) ? "stale" : basis;
   };
   const rebaseNote = (row) => row.head && head && row.head !== head && !FAILING.has(String(row.result)) && keyBasis(row) === "carried" && exactMatch(row) === "rebase" ? { rule: "rebase", since: row.head, files: [] } : null;
@@ -15274,7 +15320,11 @@ function checkVerdicts(cwd, branch, ledgerRows) {
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? {
+    accepted: false,
+    verdict: null,
+    reasons: ["ledger_tampered"]
+  } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
@@ -15292,7 +15342,10 @@ function checkVerdicts(cwd, branch, ledgerRows) {
     selfVerdict: accepted.accepted ? null : selfEntry?.verdict ?? null,
     base: newestCurrent?.verdict.base ?? fallbackBase,
     patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
-    current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
+    current: {
+      basis: newestCurrent?.basis ?? "none",
+      verdict: newestCurrent?.verdict ?? null
+    },
     carry: carryEntry?.carry ?? null,
     reverify,
     accepted,
@@ -15531,10 +15584,18 @@ function recordVerdict(context, input) {
 }
 function untrackedField(cwd) {
   const files = untrackedFiles2(cwd);
-  return files.length ? { untracked: files.slice(0, MAX_UNTRACKED_LISTED), untrackedCount: files.length } : {};
+  return files.length ? {
+    untracked: files.slice(0, MAX_UNTRACKED_LISTED),
+    untrackedCount: files.length
+  } : {};
 }
 function recordHandoff(context, input) {
-  return appendRow(context.cwd, { ...common(context, noteKey(context)), type: "handoff", note: input.note, next: input.next }, { now: context.now });
+  return appendRow(context.cwd, {
+    ...common(context, noteKey(context)),
+    type: "handoff",
+    note: input.note,
+    next: input.next
+  }, { now: context.now });
 }
 function rowLabels(row) {
   const labels = [];
@@ -15689,7 +15750,11 @@ function buildHandoff(cwd, options = {}) {
   }));
   const lastHandoffRow = mine.findLast((row) => row.type === "handoff");
   const partial = {
-    store: { root: store.value.root, shared: store.value.shared, ledger: ledger.path },
+    store: {
+      root: store.value.root,
+      shared: store.value.shared,
+      ledger: ledger.path
+    },
     branch,
     head,
     subject: head ? git4(cwd, ["log", "-1", "--format=%s", head]) : null,
@@ -15722,7 +15787,11 @@ function buildHandoff(cwd, options = {}) {
   const nextCommand = nextCommandFor(partial);
   return {
     ok: true,
-    value: { ...partial, nextCommand, next: options.next?.trim() || nextCommand }
+    value: {
+      ...partial,
+      nextCommand,
+      next: options.next?.trim() || nextCommand
+    }
   };
 }
 var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, VERDICT_RESULTS, PASSING, FAILING, STRONG_RESULTS, VERDICT_KINDS, VERDICT_SURFACES, PR_ROW_TYPES, err = (code, error, unblock) => ({
@@ -15887,7 +15956,11 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
     if (entry[0] === "R" || entry[0] === "C")
       index += 1;
   }
-  return { dirty: paths.length > 0, files: paths.length, paths: paths.slice(0, MAX_DIRTY_PATHS) };
+  return {
+    dirty: paths.length > 0,
+    files: paths.length,
+    paths: paths.slice(0, MAX_DIRTY_PATHS)
+  };
 }, nextCommandFor = (brief) => {
   const branchFlag = brief.branch ? ` --branch ${brief.branch}` : "";
   const verify = `workit ledger verdict verified${branchFlag} --how "<method and evidence>"  (from a session that did not author the branch, with WORKIT_SESSION_ID set)`;
@@ -80235,6 +80308,22 @@ function implicitDeleteSkip(cwd, resolved, doc, branch) {
     return `open PR ${children.data.map((n) => `#${n}`).join(", ")} targets ${branch} (a stack)`;
   return null;
 }
+function baseCiState(cwd, resolved, base) {
+  if (!isProtectedTarget(cwd, base))
+    return { ok: true, note: null };
+  const read = resolved.forge.branchChecks(base);
+  if (!read.ok)
+    return { ok: true, note: `base ${base} CI not read (${read.error}); merging anyway` };
+  const { requiredKnown } = read.data;
+  const failing = read.data.checks.filter((check) => check.state === "failing" && (requiredKnown ? check.required === true : check.required !== false && check.conclusion === "failure"));
+  if (failing.length)
+    return { ok: false, failing, sha: read.data.sha, requiredKnown };
+  const pending = read.data.checks.filter((check) => check.state === "pending");
+  return {
+    ok: true,
+    note: pending.length ? `base ${base} CI is still running (${pending.map((check) => check.name).join(", ")}); merging without waiting` : null
+  };
+}
 async function mergePullRequest(cwd, resolved, input, sleep) {
   const grant = requireGrant(cwd, "merge");
   if (!grant.allowed)
@@ -80244,6 +80333,9 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     return failure3("invalid_input", "--unverified needs --reason <why the user asked for it>");
   if (bypass && !grant.allowUnverified)
     return refuse(`unverified_refused: workspace ${grant.workspace ? `"${grant.workspace}"` : "(none)"} grants merge: "verified", which never merges without an accepted independent verdict`, "a non-author session verifies the head (workit-review), then merge without --unverified", { reason: "unverified_refused" });
+  const baseRed = input.baseRedOk ?? null;
+  if (baseRed && !baseRed.reason.trim())
+    return failure3("invalid_input", "--base-red-ok needs --reason <why merging onto a red base is fine>");
   const number = selectPr(cwd, resolved, { pr: input.pr });
   if (!number.ok)
     return number;
@@ -80328,6 +80420,15 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     const lane = gate.verification === "proportional" ? `, ${laneLabel(gate)}` : "";
     return refuse(gate.need === "self" ? `NEEDS_VERDICT: ${label} has no verdict for ${head.slice(0, 12)}${lane}: the author's own --self verdict is enough (${check.accepted.reasons.join(", ")})` : `NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)}${lane} (${check.accepted.reasons.join(", ")})`, gate.need === "self" ? `after an observed passing \`workit check test\`, the author runs: workit ledger verdict tests-verified --self --how "<what you ran>" --branch ${branch} (or a verifier records one)${bypassHint}` : `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}${bypassHint}`, { reason: "needs_verdict", verdict: summary });
   }
+  const baseCi = baseCiState(cwd, resolved, doc.base);
+  let baseRedOverride = null;
+  if (!baseCi.ok) {
+    const names = baseCi.failing.map((failed) => failed.name).join(", ");
+    const url = baseCi.failing.find((failed) => failed.url)?.url ?? null;
+    if (!baseRed)
+      return refuse(`base_red: ${doc.base} at ${baseCi.sha?.slice(0, 12) ?? "its head"} has failing CI (${names}${baseCi.requiredKnown ? "" : "; the required checks could not be read, so every failed check counts"})${url ? `: ${url}` : ""}; merging ${label} onto it would land on a red base`, `fix ${doc.base} first, or, if the user accepts it: workit pr merge${input.pr ? ` --pr ${doc.number}` : ""} --base-red-ok --reason "<why>"`, { reason: "base_red", blockers: baseCi.failing.map((failed) => failed.name) });
+    baseRedOverride = baseRed;
+  }
   const squashMessage = squashMessageFor(cwd, resolved, input, doc);
   if (squashMessage && !squashMessage.ok)
     return squashMessage;
@@ -80343,6 +80444,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     review: verdict.review,
     lane: verdict.lane,
     ...unverified ? { unverified: unverified.recorded } : {},
+    ...baseRedOverride ? { baseRedOk: baseRedOverride.reason } : {},
     grant: grant.source
   });
   if (!intent.ok)
@@ -80371,6 +80473,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     review: verdict.review,
     lane: verdict.lane,
     ...unverified ? { unverified: unverified.recorded } : {},
+    ...baseRedOverride ? { baseRedOk: baseRedOverride.reason } : {},
     grant: grant.source,
     intent: intentId,
     verified: false
@@ -80427,6 +80530,10 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
       mergeSha: merged.data.mergeSha,
       verdict,
       unverified,
+      baseCi: {
+        note: baseRedOverride ? `base ${doc.base} CI is red; merged anyway (--base-red-ok: ${baseRedOverride.reason})` : baseCi.ok ? baseCi.note : null,
+        override: baseRedOverride
+      },
       grant: { source: grant.source },
       deletedBranch,
       recorded,
@@ -80535,12 +80642,22 @@ function gitRestack(cwd, input) {
   if (!dir) {
     const scratch = scratchDir(cwd);
     if (!scratch)
-      return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
+      return {
+        ok: false,
+        conflict: false,
+        worktree: cwd,
+        error: "no store root"
+      };
     fs28.mkdirSync(scratch, { recursive: true });
     dir = path56.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
-      return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
+      return {
+        ok: false,
+        conflict: false,
+        worktree: cwd,
+        error: firstLine(added)
+      };
   }
   const run = gitRun3(dir, [
     "-c",
@@ -80563,7 +80680,12 @@ function gitRestack(cwd, input) {
         error: `git rebase did not finish within ${stackDeps.rebaseTimeoutMs} ms`
       };
     if (rebaseInProgress(dir))
-      return { ok: false, conflict: true, worktree: dir, error: firstLine(run) };
+      return {
+        ok: false,
+        conflict: true,
+        worktree: dir,
+        error: firstLine(run)
+      };
     if (!owner)
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
     return { ok: false, conflict: false, worktree: dir, error: firstLine(run) };
@@ -80571,7 +80693,12 @@ function gitRestack(cwd, input) {
   if (!owner)
     gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   const head = branchTip(cwd, input.branch);
-  return head ? { ok: true, head } : { ok: false, conflict: false, worktree: dir, error: `${input.branch} vanished` };
+  return head ? { ok: true, head } : {
+    ok: false,
+    conflict: false,
+    worktree: dir,
+    error: `${input.branch} vanished`
+  };
 }
 function pruneScratch(cwd) {
   const scratch = scratchDir(cwd);
@@ -80696,7 +80823,10 @@ function listStacks(cwd) {
     if (parsed && fileFor(parsed.name) === name)
       out.push(parsed);
   }
-  return { ok: true, data: out.toSorted((a, b) => a.name.localeCompare(b.name)) };
+  return {
+    ok: true,
+    data: out.toSorted((a, b) => a.name.localeCompare(b.name))
+  };
 }
 function selectStack(cwd, name) {
   if (name !== null && !validName(name))
@@ -81041,7 +81171,10 @@ function statusDoc(ctx, pr) {
   const status = ctx.resolved.forge.prStatus(pr);
   if (!status.ok)
     return status;
-  return buildStatusDoc(ctx.cwd, ctx.resolved, status.data, { logLines: 0, behind: false });
+  return buildStatusDoc(ctx.cwd, ctx.resolved, status.data, {
+    logLines: 0,
+    behind: false
+  });
 }
 function prBinding(ctx, entry, doc) {
   const label = noun2(ctx.resolved, entry.pr);
@@ -81061,7 +81194,10 @@ function prBinding(ctx, entry, doc) {
 function repoMismatch(ctx, stack) {
   const { kind, repo } = ctx.resolved.forge;
   if (stack.repo && stack.repo !== repo || stack.forge && stack.forge !== kind)
-    return stackFail("blocked", `repo_mismatch: stack ${stack.name} was planned on ${stack.forge ?? "?"} ${stack.repo ?? "?"}, but this checkout resolves to ${kind} ${repo}`, `workit stack plan --name ${stack.name} <branch…>  # re-plan it here, or run from the right checkout`, { planned: { forge: stack.forge, repo: stack.repo }, resolved: { forge: kind, repo } });
+    return stackFail("blocked", `repo_mismatch: stack ${stack.name} was planned on ${stack.forge ?? "?"} ${stack.repo ?? "?"}, but this checkout resolves to ${kind} ${repo}`, `workit stack plan --name ${stack.name} <branch…>  # re-plan it here, or run from the right checkout`, {
+      planned: { forge: stack.forge, repo: stack.repo },
+      resolved: { forge: kind, repo }
+    });
   return null;
 }
 function qualify(ctx, stack, entry, doc, verdict, grant, binding = null, bypass = false) {
@@ -81202,7 +81338,11 @@ function detectMerged(ctx, cwd, stack, trunkSha, state) {
       merged = tip !== null && hasOwnCommits(cwd, tip, entry.lastParentHead) && isAncestor2(cwd, tip, trunkSha);
     }
     if (merged) {
-      entry.merged = { pr: entry.pr, mergeSha: null, at: new Date().toISOString() };
+      entry.merged = {
+        pr: entry.pr,
+        mergeSha: null,
+        at: new Date().toISOString()
+      };
       newly.push({ branch: entry.branch, pr: entry.pr });
     }
   }
@@ -81216,18 +81356,31 @@ function pushBranch(cwd, actor, branch, priorTip) {
   if (!remote.ok)
     return stackFail(remote.code, remote.error);
   if (remote.sha === plan.data.sha)
-    return { ok: true, data: { pushed: false, forced: false, sha: plan.data.sha } };
+    return {
+      ok: true,
+      data: { pushed: false, forced: false, sha: plan.data.sha }
+    };
   const grant = requireGrant(cwd, "push", { forge: !plan.data.local });
   if (!grant.allowed)
-    return stackFail("blocked", grant.error, grant.unblock, { reason: grant.reason });
+    return stackFail("blocked", grant.error, grant.unblock, {
+      reason: grant.reason
+    });
   const force = remote.sha !== null && !isAncestor2(cwd, remote.sha, plan.data.sha);
   const expect = !force ? null : remote.sha === priorTip ? priorTip : recordedRemoteTip(cwd, plan.data) ?? null;
-  const pushed = executePush(cwd, plan.data, { forceWithLease: force, expect, actor });
+  const pushed = executePush(cwd, plan.data, {
+    forceWithLease: force,
+    expect,
+    actor
+  });
   if (!pushed.ok)
     return { ...fromForge(pushed), data: { branch } };
   return {
     ok: true,
-    data: { pushed: pushed.data.pushed, forced: pushed.data.forced, sha: plan.data.sha }
+    data: {
+      pushed: pushed.data.pushed,
+      forced: pushed.data.forced,
+      sha: plan.data.sha
+    }
   };
 }
 function syncStack(cwd, ctx, stack, options, actor) {
@@ -81337,7 +81490,11 @@ function syncStack(cwd, ctx, stack, options, actor) {
               worktree: rebased.worktree,
               progress: outcome
             });
-          return rebased.conflict ? stackFail("blocked", `conflict restacking ${entry.branch} onto ${parent.name}: ${rebased.error}`, `resolve the conflicts in ${rebased.worktree}, git rebase --continue, then workit stack sync  # or git rebase --abort`, { conflict: entry.branch, worktree: rebased.worktree, progress: outcome }) : stackFail("failed", `restacking ${entry.branch} failed: ${rebased.error}`, undefined, {
+          return rebased.conflict ? stackFail("blocked", `conflict restacking ${entry.branch} onto ${parent.name}: ${rebased.error}`, `resolve the conflicts in ${rebased.worktree}, git rebase --continue, then workit stack sync  # or git rebase --abort`, {
+            conflict: entry.branch,
+            worktree: rebased.worktree,
+            progress: outcome
+          }) : stackFail("failed", `restacking ${entry.branch} failed: ${rebased.error}`, undefined, {
             branch: entry.branch,
             progress: outcome
           });
@@ -81397,8 +81554,16 @@ function syncStack(cwd, ctx, stack, options, actor) {
           p: patchId(cwd, fromBase, fromHead),
           d: diffHash(cwd, fromBase, fromHead)
         };
-        const after = { p: patchId(cwd, parentTip, newTip), d: diffHash(cwd, parentTip, newTip) };
-        const equal = before.d !== null && before.d === after.d && before.p !== null && before.p === after.p && sameOwnChange(cwd, { from: fromHead, to: newTip, fromBase, toBase: parentTip });
+        const after = {
+          p: patchId(cwd, parentTip, newTip),
+          d: diffHash(cwd, parentTip, newTip)
+        };
+        const equal = before.d !== null && before.d === after.d && before.p !== null && before.p === after.p && sameOwnChange(cwd, {
+          from: fromHead,
+          to: newTip,
+          fromBase,
+          toBase: parentTip
+        });
         appendObserved(cwd, {
           type: "stack.restacked",
           actor,
@@ -81416,7 +81581,12 @@ function syncStack(cwd, ctx, stack, options, actor) {
         if (step.restack)
           step.restack.carried = equal;
         else
-          step.restack = { from: fromBase, onto: parentTip, head: newTip, carried: equal };
+          step.restack = {
+            from: fromBase,
+            onto: parentTip,
+            head: newTip,
+            carried: equal
+          };
       }
       if (options.publish) {
         touchStackLock();
@@ -81445,7 +81615,10 @@ function syncStack(cwd, ctx, stack, options, actor) {
             });
           const updated = ctx.resolved.forge.updateBase(entry.pr, parent.name);
           if (!updated.ok)
-            return { ...fromForge(updated), data: { branch: entry.branch, progress: outcome } };
+            return {
+              ...fromForge(updated),
+              data: { branch: entry.branch, progress: outcome }
+            };
           appendObserved(cwd, {
             type: "pr.retargeted",
             actor,
@@ -81520,7 +81693,9 @@ async function landStack(ctx, stack, options) {
   if (bypass) {
     const grant = requireGrant(ctx.cwd, "merge");
     if (!grant.allowed)
-      return failWith(stackFail("blocked", grant.error, grant.unblock, { reason: "grant_required" }));
+      return failWith(stackFail("blocked", grant.error, grant.unblock, {
+        reason: "grant_required"
+      }));
     if (!grant.allowUnverified)
       return failWith(stackFail("blocked", `unverified_refused: workspace ${grant.workspace ? `"${grant.workspace}"` : "(none)"} grants merge: "verified", which never lands without an accepted independent verdict`, "a non-author session verifies each head (workit-review), then land without --unverified", { reason: "unverified_refused" }));
   }
@@ -81593,7 +81768,8 @@ async function landStack(ctx, stack, options) {
       deleteBranch: false,
       actor: ctx.actor,
       expect: { base: stack.trunk, branch: entry.branch },
-      ...bypass && !verdict.satisfied ? { unverified: bypass } : {}
+      ...bypass && !verdict.satisfied ? { unverified: bypass } : {},
+      ...options.baseRedOk ? { baseRedOk: options.baseRedOk } : {}
     }, ctx.sleep);
     if (!merged.ok) {
       if (merged.code === "blocked" && "refusal" in merged && merged.refusal) {
@@ -81615,7 +81791,11 @@ async function landStack(ctx, stack, options) {
       mergeSha: merged.data.mergeSha,
       unverified: merged.data.unverified?.recorded ?? null
     });
-    entry.merged = { pr, mergeSha: merged.data.mergeSha, at: new Date().toISOString() };
+    entry.merged = {
+      pr,
+      mergeSha: merged.data.mergeSha,
+      at: new Date().toISOString()
+    };
     const written = writeStack(ctx.cwd, stack);
     if (!written.ok)
       return failWith(written);
@@ -82982,6 +83162,30 @@ function createGitHubForge(options) {
       };
       return success2(status);
     },
+    branchChecks(branch) {
+      const contexts = [];
+      let sha = null;
+      let cursor = null;
+      for (let page = 1;page <= maxPages; page += 1) {
+        const data = graphql(BRANCH_CHECKS_QUERY, { owner, name, ref: `refs/heads/${branch}`, contexts: cursor }, `checks on ${branch}`);
+        if (!data.ok)
+          return data;
+        const commit = data.data.repository?.object ?? null;
+        if (!commit)
+          return failure3("not_found", `branch ${branch} was not found`);
+        sha = commit.oid ?? sha;
+        const rollup = commit.statusCheckRollup;
+        if (!rollup)
+          break;
+        contexts.push(...rollup.contexts.nodes);
+        if (!rollup.contexts.pageInfo.hasNextPage)
+          break;
+        cursor = rollup.contexts.pageInfo.endCursor;
+      }
+      const required = requiredContexts(branch);
+      const checks = latestPerName(contexts.map(checkFromContext).filter((check) => check !== null)).map((check) => required ? { ...check, required: required.includes(check.context) } : check);
+      return success2({ sha, checks, requiredKnown: required !== null });
+    },
     jobLogTail(job, lines) {
       const text = apiText(runner, "gh", apiHost, ["api", `repos/${repo}/actions/jobs/${job.jobId}/logs`], `job ${job.jobId} log`, FORGE_TIMEOUTS.log);
       return text.ok ? success2(logTail(text.data, lines)) : text;
@@ -83179,7 +83383,7 @@ function createGitHubForge(options) {
     }
   };
 }
-var GITHUB_MAX_PAGES = 10, PR_FIELDS = `number url state isDraft isInMergeQueue mergeable mergeStateStatus baseRefName baseRefOid baseRef { target { oid } } headRefName headRefOid reviewDecision`, THREADS = `reviewThreads(first: 100, after: $threads) { pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 1) { nodes { author { login __typename } body url } } } }`, CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId isRequired(pullRequestNumber: $number) checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl isRequired(pullRequestNumber: $number) } } }`, PR_STATUS_QUERY, FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state baseRefName headRefName headRefOid headRepositoryOwner { login } } } } }`, READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, REPLY_MUTATION = `mutation($thread: ID!, $body: String!) { addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $thread, body: $body }) { comment { url } } }`, RESOLVE_MUTATION = `mutation($thread: ID!) { resolveReviewThread(input: { threadId: $thread }) { thread { isResolved } } }`, THREAD_QUERY = `query($thread: ID!) { node(id: $thread) { ... on PullRequestReviewThread { isResolved pullRequest { number } } } }`, prState = (value) => value === "MERGED" ? "merged" : value === "CLOSED" ? "closed" : "open", FAILING2, safeUrl = (value) => value ? redactText(value) : null, encodeRef = (ref) => ref.split("/").map(encodeURIComponent).join("/");
+var GITHUB_MAX_PAGES = 10, PR_FIELDS = `number url state isDraft isInMergeQueue mergeable mergeStateStatus baseRefName baseRefOid baseRef { target { oid } } headRefName headRefOid reviewDecision`, THREADS = `reviewThreads(first: 100, after: $threads) { pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 1) { nodes { author { login __typename } body url } } } }`, CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId isRequired(pullRequestNumber: $number) checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl isRequired(pullRequestNumber: $number) } } }`, PR_STATUS_QUERY, FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state baseRefName headRefName headRefOid headRepositoryOwner { login } } } } }`, BRANCH_CHECKS_QUERY = `query($owner: String!, $name: String!, $ref: String!, $contexts: String) { repository(owner: $owner, name: $name) { object(expression: $ref) { ... on Commit { oid statusCheckRollup { contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl } } } } } } } }`, READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, REPLY_MUTATION = `mutation($thread: ID!, $body: String!) { addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $thread, body: $body }) { comment { url } } }`, RESOLVE_MUTATION = `mutation($thread: ID!) { resolveReviewThread(input: { threadId: $thread }) { thread { isResolved } } }`, THREAD_QUERY = `query($thread: ID!) { node(id: $thread) { ... on PullRequestReviewThread { isResolved pullRequest { number } } } }`, prState = (value) => value === "MERGED" ? "merged" : value === "CLOSED" ? "closed" : "open", FAILING2, safeUrl = (value) => value ? redactText(value) : null, encodeRef = (ref) => ref.split("/").map(encodeURIComponent).join("/");
 var init_github = __esm(() => {
   init_exec();
   init_redact();
@@ -83380,6 +83584,35 @@ function createGitLabForge(options) {
       };
       return success2(status);
     },
+    branchChecks(branch) {
+      const tip = baseTip(branch);
+      if (!tip)
+        return failure3("not_found", `branch ${branch} was not found`);
+      const latest = apiJson(runner, "glab", apiHost, api(`${project}/pipelines?ref=${encodeURIComponent(branch)}&sha=${tip}&order_by=id&sort=desc&per_page=1`), `pipelines on ${branch}`);
+      if (!latest.ok)
+        return latest;
+      const pipeline = Array.isArray(latest.data) ? latest.data[0] : undefined;
+      if (!pipeline)
+        return success2({ sha: tip, checks: [], requiredKnown: true });
+      const scope = String(pipeline.project_id ?? encodeURIComponent(repo));
+      const jobs = pages(`projects/${scope}/pipelines/${pipeline.id}/jobs`, `pipeline ${pipeline.id} jobs`);
+      if (!jobs.ok)
+        return jobs;
+      const bridges = pages(`projects/${scope}/pipelines/${pipeline.id}/bridges`, `pipeline ${pipeline.id} bridges`);
+      if (!bridges.ok)
+        return bridges;
+      const checks = [
+        ...jobs.data.items.map((job) => checkFromJob(job, pipeline.id, scope)),
+        ...bridges.data.items.map((bridge) => checkFromBridge(bridge, pipeline.id, scope))
+      ];
+      if (stateOf(pipeline.status, false) === "failing" && !checks.some((check) => check.state === "failing"))
+        checks.push(pipelineCheck("failing", pipeline.status, {
+          id: pipeline.id,
+          project_id: pipeline.project_id ?? 0,
+          web_url: pipeline.web_url
+        }));
+      return success2({ sha: tip, checks, requiredKnown: true });
+    },
     jobLogTail(job, lines) {
       const scope = job.scope ?? encodeURIComponent(repo);
       const text = apiText(runner, "glab", apiHost, ["api", `projects/${scope}/jobs/${job.jobId}/trace`], `job ${job.jobId} trace`, FORGE_TIMEOUTS.log);
@@ -85487,6 +85720,7 @@ async function merge3(argv, io) {
     "delete-branch": "boolean",
     "keep-branch": "boolean",
     unverified: "boolean",
+    "base-red-ok": "boolean",
     reason: "value",
     subject: "value",
     body: "value",
@@ -85494,7 +85728,11 @@ async function merge3(argv, io) {
   });
   if (typeof flags === "string")
     return usage4(io, flags, MERGE_USAGE);
-  const unverified = unverifiedFlag(flags);
+  const baseRedOk = flags.booleans.has("base-red-ok");
+  const baseRedReason = flags.values.reason?.trim();
+  if (baseRedOk && !baseRedReason)
+    return usage4(io, "--base-red-ok needs --reason <why merging onto a red base is fine>", MERGE_USAGE);
+  const unverified = baseRedOk && !flags.booleans.has("unverified") ? null : unverifiedFlag(flags);
   if (typeof unverified === "string")
     return usage4(io, unverified, MERGE_USAGE);
   if (flags.positionals.length)
@@ -85536,6 +85774,7 @@ async function merge3(argv, io) {
     implicitDelete: !flags.booleans.has("keep-branch") && workspaceDeleteBranch(io.cwd),
     actor: actorFromEnv(io.env),
     ...unverified ? { unverified } : {},
+    ...baseRedOk && baseRedReason ? { baseRedOk: { reason: baseRedReason } } : {},
     ...subject !== undefined ? { subject } : {},
     ...body !== undefined ? { body } : {}
   }, forgeDeps.sleep);
@@ -85548,6 +85787,7 @@ async function merge3(argv, io) {
   return emit(io, ok2({ ...result.data, localCleanup: cleanup }), (data) => [
     `merged ${connected.data.forge.kind === "github" ? "PR #" : "MR !"}${data.number} (${data.method}) at head ${data.head.slice(0, 12)}${data.mergeSha ? ` -> ${data.mergeSha.slice(0, 12)}` : ""}`,
     data.unverified ? `UNVERIFIED: merged without a verdict (--unverified: ${data.unverified.reason}); ledger ${data.unverified.recorded}` : `verdict ${data.verdict.verdictId ?? "?"} accepted for that head${data.verdict.cover ? ` (stack verdict on ${data.verdict.cover.branch} @ ${data.verdict.cover.head.slice(0, 12)})` : data.verdict.carry ? ` (${carryLabel(data.verdict.carry)})` : ""}`,
+    ...data.baseCi.note ? [data.baseCi.note] : [],
     ...data.mergeBack.length ? [
       `merge back: ${data.base} is the ${data.mergeBackTrack} production branch; bring it into ${data.mergeBack.join(", ")}`
     ] : [],
@@ -85714,7 +85954,7 @@ async function run15(argv, io) {
     return reply(rest, io);
   return usage4(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE8);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE8 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE8 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
 var init_pr = __esm(() => {
   init_autonomy();
   init_issue_link();
@@ -87317,7 +87557,11 @@ __export(exports_stack, {
   run: () => run20
 });
 async function plan(argv, io) {
-  const flags = parseFlags(argv, { name: "value", trunk: "value", track: "value" });
+  const flags = parseFlags(argv, {
+    name: "value",
+    trunk: "value",
+    track: "value"
+  });
   if (typeof flags === "string")
     return usage4(io, flags, PLAN_USAGE);
   const name = flags.values.name ?? null;
@@ -87378,7 +87622,12 @@ async function status3(argv, io) {
   const connected = connect(io, selected.data.branches[0]?.branch ?? null);
   if (!connected.ok)
     return forgeFail(io, connected);
-  const result = stackStatus({ cwd: io.cwd, resolved: connected.data, actor: actorFromEnv(io.env), sleep: forgeDeps.sleep }, selected.data);
+  const result = stackStatus({
+    cwd: io.cwd,
+    resolved: connected.data,
+    actor: actorFromEnv(io.env),
+    sleep: forgeDeps.sleep
+  }, selected.data);
   if (!result.ok)
     return stackFailed(io, result);
   return emit(io, ok2(result.data), (data) => [
@@ -87442,11 +87691,16 @@ async function land(argv, io) {
     timeout: "value",
     interval: "value",
     unverified: "boolean",
+    "base-red-ok": "boolean",
     reason: "value"
   });
   if (typeof flags === "string")
     return usage4(io, flags, LAND_USAGE);
-  const unverified = unverifiedFlag(flags);
+  const baseRedOk = flags.booleans.has("base-red-ok");
+  const baseRedReason = flags.values.reason?.trim();
+  if (baseRedOk && !baseRedReason)
+    return usage4(io, "--base-red-ok needs --reason <why merging onto a red base is fine>", LAND_USAGE);
+  const unverified = baseRedOk && !flags.booleans.has("unverified") ? null : unverifiedFlag(flags);
   if (typeof unverified === "string")
     return usage4(io, unverified, LAND_USAGE);
   if (flags.positionals.length)
@@ -87479,7 +87733,15 @@ async function land(argv, io) {
       resolved: connected.data,
       actor: actorFromEnv(io.env),
       sleep: forgeDeps.sleep
-    }, fresh.data ?? selected.data, { dryRun: flags.booleans.has("dry-run"), max, method, timeoutMs, intervalMs, unverified });
+    }, fresh.data ?? selected.data, {
+      dryRun: flags.booleans.has("dry-run"),
+      max,
+      method,
+      timeoutMs,
+      intervalMs,
+      unverified,
+      baseRedOk: baseRedOk && baseRedReason ? { reason: baseRedReason } : null
+    });
   });
   if (!result.ok)
     return stackFailed(io, result);
@@ -87508,7 +87770,10 @@ async function run20(argv, io) {
     return land(rest, io);
   return usage4(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE12);
 }
-var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE12 = "workit stack plan|status|sync|land ... (workit help stack)", short5 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail2(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), label3 = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
+var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE12 = "workit stack plan|status|sync|land ... (workit help stack)", short5 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail2(result.code, result.error, {
+  unblock: result.unblock,
+  data: result.data ?? {}
+})), label3 = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
   `${data.dryRun ? "would sync" : "synced"} stack ${data.name}${data.merged.length ? `; merged: ${data.merged.map((item) => item.branch).join(", ")}` : ""}`,
   ...data.steps.map((step) => [
     `  ${step.branch} on ${step.parent}:`,
@@ -105920,19 +106185,22 @@ function bounded(brief, cwd) {
       file = path73.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
       fs37.writeFileSync(file, `${[...body, ...tail].join(`
 `)}
-`, { mode: 384 });
+`, {
+        mode: 384
+      });
     } catch {
       file = null;
     }
   const pointer = `… cut to ${MAX_BRIEF_BYTES} bytes; full brief: ${file ?? "not written (workit handoff --json has it all)"}`;
+  const cappedTail = tail.map(capLine);
   const kept = [];
   for (const line of body) {
     const cut = line.length > 400 ? `${line.slice(0, 400)}…` : line;
-    if (bytes([...kept, cut, pointer, ...tail]) > MAX_BRIEF_BYTES)
+    if (bytes([...kept, cut, pointer, ...cappedTail]) > MAX_BRIEF_BYTES)
       break;
     kept.push(cut);
   }
-  return [...kept, pointer, ...tail];
+  return [...kept, pointer, ...cappedTail];
 }
 async function resumeBrief(argv, io) {
   let values;
@@ -105954,7 +106222,9 @@ async function resumeBrief(argv, io) {
   }
   const last = values.last === undefined ? 10 : Number(values.last);
   if (!Number.isInteger(last) || last < 1)
-    return emit(io, fail2("invalid_input", "--last must be a positive integer", { unblock: USAGE19 }));
+    return emit(io, fail2("invalid_input", "--last must be a positive integer", {
+      unblock: USAGE19
+    }));
   const built = buildHandoff(io.cwd, {
     last,
     note: values.note ?? null,
@@ -105980,7 +106250,7 @@ async function run27(argv, io) {
 }
 var USAGE19 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", MAX_BRIEF_BYTES = 4096, short7 = (sha) => sha ? sha.slice(0, 12) : "no commit", bytes = (lines) => Buffer.byteLength(`${lines.join(`
 `)}
-`);
+`), TAIL_LINE_BYTES = 480, capLine = (line) => Buffer.byteLength(line) <= TAIL_LINE_BYTES ? line : `${Buffer.from(line).subarray(0, TAIL_LINE_BYTES).toString().replace(/\uFFFD$/u, "")}… (cut)`;
 var init_handoff = __esm(() => {
   init_ledger();
   init_output();
@@ -106020,13 +106290,19 @@ var FAMILY_ACTIONS = {
   },
   evidence: { record: "Record evidence against a task's requirements" },
   finding: { record: "Record a finding", resolve: "Resolve a finding" },
-  decision: { record: "Record a task decision", revoke: "Revoke a task decision" },
+  decision: {
+    record: "Record a task decision",
+    revoke: "Revoke a task decision"
+  },
   worker: {
     assign: "Assign a worker to a task",
     report: "Report a worker's result",
     cancel: "Cancel a worker assignment"
   },
-  state: { export: "Export a task's state (v1)", import: "Import an exported task state" }
+  state: {
+    export: "Export a task's state (v1)",
+    import: "Import an exported task state"
+  }
 };
 var POLICY_JUDGE = "--judge risk=trivial|normal|high behavior=yes|no product-choice=yes|no plan=yes|no [--ref <path>]… [--why <reason>]";
 var TASK_IMPLICIT = [
@@ -106317,7 +106593,7 @@ var VERBS = [
       },
       {
         name: "merge",
-        usage: "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>]",
+        usage: "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>]",
         summary: "Merge when READY, verified by a non-author and granted; --subject/--body set the squash message"
       }
     ],
@@ -106460,7 +106736,7 @@ var VERBS = [
       },
       {
         name: "land",
-        usage: "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--timeout 20m] [--interval 30s]",
+        usage: "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--timeout 20m] [--interval 30s]",
         summary: "Merge the stack root first, restacking the rest as each lands"
       }
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.34.0",
+  "version": "8.35.2",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,13 +38,13 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-cursor": "^8.34.0",
+    "@brainervirus/workit-cursor": "^8.35.2",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.34.0"
+    "@brainervirus/workit-core": "^8.35.2"
   },
   "engines": {
     "node": ">=24"