@brainervirus/workit-codex 7.0.0 → 7.1.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "workit",
-  "version": "7.0.0",
+  "version": "7.1.0",
   "description": "Adaptive engineering workflow rails for Codex",
   "author": {
     "name": "BrainerVirus"

package/dist/launch-mcp.js

@@ -6625,7 +6625,7 @@ import { existsSync as existsSync9, realpathSync as realpathSync7, statSync as s
 import path21 from "node:path";
 
 // packages/workit-core/src/core.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
 import path19 from "node:path";
 
@@ -18884,6 +18884,11 @@ function worktreeSignal(cwd, options = {}) {
   }
   return `sig:${hash.digest("hex")}`;
 }
+function mergeBase(cwd, a, b) {
+  if (!safeArg(a) || !safeArg(b))
+    return null;
+  return line(git2(cwd, ["merge-base", a, b]));
+}
 function patchId(cwd, base, head) {
   if (!safeArg(base) || !safeArg(head))
     return null;
@@ -18907,9 +18912,33 @@ function patchId(cwd, base, head) {
   const id = git2(cwd, ["patch-id", "--stable"], { input: diff.stdout });
   return line(id)?.split(/\s+/u)[0] ?? null;
 }
+function remoteNames(cwd) {
+  return (git2(cwd, ["remote"]).stdout ?? "").split(/\r?\n/u).map((value) => value.trim()).filter(Boolean);
+}
+function resolveRef(cwd, ref) {
+  if (!safeArg(ref))
+    return null;
+  return line(git2(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]));
+}
+var config2 = (cwd, key) => line(git2(cwd, ["config", "--get", key]));
 function currentBranch(cwd) {
   return line(git2(cwd, ["symbolic-ref", "--short", "-q", "HEAD"]));
 }
+function pushRemoteName(cwd, branch) {
+  const name = branch ?? currentBranch(cwd);
+  const remotes = remoteNames(cwd);
+  const candidates = [
+    name ? config2(cwd, `branch.${name}.pushRemote`) : null,
+    config2(cwd, "remote.pushDefault"),
+    name ? config2(cwd, `branch.${name}.remote`) : null
+  ];
+  for (const candidate of candidates)
+    if (candidate && candidate !== "." && remotes.includes(candidate))
+      return candidate;
+  if (remotes.includes("origin"))
+    return "origin";
+  return remotes.length === 1 ? remotes[0] : null;
+}
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync3 } from "node:fs";
@@ -20523,6 +20552,8 @@ var readConfig = () => {
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
 };
+var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path12.join(configDir(), "vcs.json");
+var branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i");
 var resolveBranchPolicy = (config, workspace) => {
   const wp = workspace?.branchPolicy ?? {};
   const preset = Object.hasOwn(PRESETS, wp.preset) ? wp.preset : config.branchPolicy?.preset ?? "gitflow";
@@ -20530,7 +20561,7 @@ var resolveBranchPolicy = (config, workspace) => {
     allowed: wp.allowed,
     protectedNames: wp.protected
   }, config);
-  const allowed = merged.allowed.map((p) => new RegExp(`^${p.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"));
+  const allowed = merged.allowed.map(branchGlobPattern);
   return {
     preset,
     allowed,
@@ -20547,16 +20578,6 @@ var COMMIT_PRESETS = [
   "custom",
   "auto"
 ];
-var resolveCommitPolicy = (config, workspace) => {
-  const wp = workspace?.commitPolicy ?? {};
-  if (COMMIT_PRESETS.includes(String(wp.preset ?? ""))) {
-    return {
-      preset: wp.preset,
-      ...typeof wp.pattern === "string" ? { pattern: wp.pattern } : {}
-    };
-  }
-  return config.commitPolicy ?? { preset: "conventional" };
-};
 
 // packages/workit-core/src/core/workspaces.ts
 import { createHash as createHash8 } from "node:crypto";
@@ -20595,26 +20616,31 @@ var versionSourceSchema = discriminatedUnion("kind", [
   object({ kind: literal("manual") }).strict()
 ]);
 var releaseTrackSchema = object({
-  strategy: branchPreset,
+  strategy: branchPreset.optional(),
   productionBranch: nonBlank,
   integrationBranch: nonBlank,
-  naming: object({ feature: nonBlank, release: nonBlank, hotfix: nonBlank }).strict(),
-  baseBranch: nonBlank,
-  mergeBackBranches: array(nonBlank),
-  pullRequestTarget: nonBlank,
-  tagNamespace: string2(),
-  versionSource: versionSourceSchema,
-  requiredChecks: array(nonBlank)
-}).strict().superRefine((track, context) => {
+  naming: object({
+    feature: nonBlank.optional(),
+    release: nonBlank.optional(),
+    hotfix: nonBlank.optional()
+  }).passthrough().optional(),
+  baseBranch: nonBlank.optional(),
+  mergeBackBranches: array(nonBlank).optional(),
+  pullRequestTarget: nonBlank.optional(),
+  tagNamespace: string2().optional(),
+  versionSource: versionSourceSchema.optional(),
+  requiredChecks: array(nonBlank).optional(),
+  critical: array(nonBlank).optional()
+}).passthrough().superRefine((track, context) => {
   for (const [field, values] of [
-    ["mergeBackBranches", track.mergeBackBranches],
-    ["requiredChecks", track.requiredChecks]
+    ["mergeBackBranches", track.mergeBackBranches ?? []],
+    ["requiredChecks", track.requiredChecks ?? []]
   ]) {
     if (new Set(values).size !== values.length) {
       context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
     }
   }
-  if (track.versionSource.kind === "package-json" && (path13.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+  if (track.versionSource?.kind === "package-json" && (path13.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
     context.addIssue({
       code: "custom",
       path: ["versionSource", "path"],
@@ -20882,7 +20908,7 @@ var resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd,
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
-var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+var matchRuntimeWorkspace = (cwd) => {
   const file = path13.join(configDir(), "workspaces.json");
   let raw;
   try {
@@ -20917,8 +20943,17 @@ var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   });
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  if (!selected)
+  return selected ? { file, selected } : null;
+};
+var resolveRuntimeReleaseTracks = (cwd) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+};
+var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  if (!matched)
     return null;
+  const { file, selected } = matched;
   const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
   if (!policy.success) {
     const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
@@ -20944,15 +20979,410 @@ var resolveRuntimeWorkspacePolicy = (cwd, kind, requestedProfile) => {
     source: profilePolicy ? `profile:${profileName}` : workspacePolicy ? `workspace:${candidate.name}` : "user-default"
   };
 };
+function workspaceDefaultTarget(cwd, globalDefault) {
+  const ws = resolveRuntimeWorkspaceVcs(cwd);
+  const wp = ws?.branchPolicy ?? {};
+  const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
+  const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined);
+  const policyDefault = resolveBranchPolicy(readConfig(), selected.policy ? { branchPolicy: selected.policy } : null).defaultTargetBranch;
+  return String(ws?.vcs?.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : globalDefault ?? policyDefault) ?? "develop");
+}
 
 // packages/workit-core/src/core/vcs-config.ts
 import fs12 from "node:fs";
 import path14 from "node:path";
+import { spawnSync as spawnSync8 } from "node:child_process";
+
+// packages/workit-core/src/core/release-tracks.ts
+import { createHash as createHash9 } from "node:crypto";
 import { spawnSync as spawnSync7 } from "node:child_process";
-var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path14.join(configDir(), "vcs.json");
+var KNOWN_FIELDS = new Set([
+  "strategy",
+  "productionBranch",
+  "integrationBranch",
+  "naming",
+  "baseBranch",
+  "mergeBackBranches",
+  "pullRequestTarget",
+  "tagNamespace",
+  "versionSource",
+  "requiredChecks",
+  "critical"
+]);
+var BRANCH_FIELDS = ["productionBranch", "integrationBranch", "baseBranch", "pullRequestTarget"];
+var PLACEHOLDER = /\{[^}]*\}/gu;
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var branchName = (value) => typeof value === "string" && value.trim() && !value.trim().startsWith("-") ? value.trim() : null;
+var namedBranches = (entry) => [
+  ...BRANCH_FIELDS.map((field) => branchName(entry[field])),
+  ...Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : []
+].filter((name) => name !== null);
+var literalOf = (template) => template.replace(PLACEHOLDER, "").replace(/[*/]/gu, "").trim();
+function readReleaseTracks(raw) {
+  const out = { tracks: [], issues: [], error: null, protectedBranches: [] };
+  if (raw === undefined || raw === null)
+    return out;
+  if (!isRecord3(raw)) {
+    out.issues.push("releaseTracks is not an object; ignored");
+    return out;
+  }
+  const fatal = [];
+  const protectedNames = new Set;
+  for (const [name, entry] of Object.entries(raw).toSorted(([a], [b]) => a < b ? -1 : 1)) {
+    const label = `release track ${JSON.stringify(name)}`;
+    if (!isRecord3(entry)) {
+      out.issues.push(`${label} is not an object; ignored`);
+      continue;
+    }
+    for (const branch of namedBranches(entry))
+      protectedNames.add(branch);
+    if (!name.trim()) {
+      out.issues.push("a release track with a blank name was ignored");
+      continue;
+    }
+    let critical = [];
+    if (Array.isArray(entry.critical))
+      critical = entry.critical.filter((item) => typeof item === "string");
+    else if (entry.critical !== undefined)
+      out.issues.push(`${label} critical: must be a list of field names; ignored`);
+    const isCritical = (field) => critical.some((item) => field === item || field.startsWith(`${item}.`));
+    const problem = (field, message) => {
+      if (isCritical(field))
+        fatal.push(`${label} ${field}: ${message}`);
+      else
+        out.issues.push(`${label} ${field}: ${message}`);
+    };
+    for (const key of Object.keys(entry))
+      if (!KNOWN_FIELDS.has(key))
+        problem(key, "unknown field, ignored");
+    const productionBranch = branchName(entry.productionBranch);
+    const integrationBranch = branchName(entry.integrationBranch);
+    if (!productionBranch)
+      problem("productionBranch", "missing or not a branch name");
+    if (!integrationBranch)
+      problem("integrationBranch", "missing or not a branch name");
+    const optionalBranch = (field) => {
+      if (entry[field] === undefined)
+        return null;
+      const value = branchName(entry[field]);
+      if (!value)
+        problem(field, "not a branch name; using the integration branch");
+      return value;
+    };
+    const baseBranch = optionalBranch("baseBranch");
+    const pullRequestTarget = optionalBranch("pullRequestTarget");
+    let mergeBackBranches = [];
+    if (entry.mergeBackBranches !== undefined) {
+      const list = Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : [null];
+      if (list.some((item) => item === null))
+        problem("mergeBackBranches", "must be a list of branch names; ignored");
+      else
+        mergeBackBranches = [...new Set(list)];
+    }
+    const naming = {};
+    if (entry.naming !== undefined) {
+      if (!isRecord3(entry.naming))
+        problem("naming", "not an object; ignored");
+      else
+        for (const kind of ["feature", "release", "hotfix"]) {
+          const template = entry.naming[kind];
+          if (template === undefined)
+            continue;
+          if (typeof template !== "string" || !template.trim())
+            problem(`naming.${kind}`, "not a template string; ignored");
+          else if (!literalOf(template))
+            problem(`naming.${kind}`, "needs literal text besides placeholders; ignored");
+          else
+            naming[kind] = template.trim();
+        }
+    }
+    if (!productionBranch || !integrationBranch) {
+      out.issues.push(`${label} was skipped: it needs a productionBranch and integrationBranch`);
+      continue;
+    }
+    out.tracks.push({
+      name,
+      productionBranch,
+      integrationBranch,
+      baseBranch: baseBranch ?? integrationBranch,
+      pullRequestTarget: pullRequestTarget ?? integrationBranch,
+      mergeBackBranches,
+      naming
+    });
+  }
+  out.protectedBranches = [...protectedNames];
+  if (fatal.length)
+    out.error = `workspace releaseTracks cannot be read by this Workit (${fatal.join("; ")}); upgrade Workit or fix the track`;
+  return out;
+}
+var IMPLICIT = "";
+var ownedBy = (tracks, branch) => tracks.filter((track) => [track.integrationBranch, track.productionBranch, track.baseBranch].includes(branch));
+var shortRef = (ref, remotes) => {
+  const bare = ref.replace(/^refs\/heads\//u, "").replace(/^refs\/remotes\/[^/]+\//u, "");
+  const remote = remotes.find((name) => bare.startsWith(`${name}/`));
+  return remote ? bare.slice(remote.length + 1) : bare;
+};
+var MAX_RECORDED_HOPS = 10;
+function resolveReleaseTrack(input) {
+  const tracks = [...input.tracks];
+  const issues = [...input.issues ?? []];
+  const requested = input.requested?.trim();
+  if (tracks.length === 0) {
+    if (requested)
+      return {
+        status: "invalid",
+        error: `no release tracks configured for this workspace; --track ${requested} cannot apply`,
+        issues
+      };
+    return { status: "none", issues };
+  }
+  const names = tracks.map((track) => track.name).join(", ");
+  let envProblem = null;
+  const done = (track, source, detail, warnings = [], ambiguous = null) => ({
+    status: "resolved",
+    track: track && track.name !== IMPLICIT ? track : null,
+    source,
+    detail,
+    warnings: [...issues, ...envProblem ? [envProblem] : [], ...warnings],
+    tracks,
+    blocking: envProblem ?? ambiguous
+  });
+  if (requested) {
+    const named = tracks.find((track) => track.name === requested);
+    if (!named)
+      return {
+        status: "invalid",
+        error: `no release track ${JSON.stringify(requested)}; configured: ${names}`,
+        issues
+      };
+    return done(named, "flag", `track ${named.name} was requested explicitly`);
+  }
+  const owned = (branch) => branch !== null && tracks.some((track) => [
+    track.integrationBranch,
+    track.productionBranch,
+    track.baseBranch,
+    track.pullRequestTarget
+  ].includes(branch));
+  const implicit = input.defaultBranch && !owned(input.defaultBranch) ? {
+    name: IMPLICIT,
+    productionBranch: input.defaultBranch,
+    integrationBranch: input.defaultBranch,
+    baseBranch: input.defaultBranch,
+    pullRequestTarget: input.defaultBranch,
+    mergeBackBranches: [],
+    naming: {}
+  } : null;
+  const candidates = implicit ? [...tracks, implicit] : tracks;
+  const label = (track) => track.name === IMPLICIT ? `the workspace default line (${track.integrationBranch})` : `track ${track.name}`;
+  const fallback = (why) => {
+    const byDefault = input.defaultBranch ? tracks.filter((track) => track.integrationBranch === input.defaultBranch || track.pullRequestTarget === input.defaultBranch) : [];
+    const track = byDefault.length === 1 ? byDefault[0] : null;
+    const target = track ? `track ${track.name}` : `default target ${input.defaultBranch ?? "(none)"}`;
+    const ambiguous = candidates.length >= 2 ? `can't tell which release line ${input.branch ?? "HEAD"} is on (${why}); pass --track <name> (${names}) or --base <branch>` : null;
+    return done(track, "default", `${why}; using the workspace ${target}`, [
+      `release track not determined: ${why}; using the workspace ${target} (pass --track <name> to choose)`
+    ], ambiguous);
+  };
+  const branch = input.branch;
+  if (branch) {
+    const owners = ownedBy(candidates, branch);
+    if (owners.length === 1)
+      return done(owners[0], "branch", `${branch} is a branch of ${label(owners[0])}`);
+    if (owners.length > 1)
+      return fallback(`${branch} belongs to more than one track (${owners.map((track) => track.name).join(", ")})`);
+  }
+  const env = input.envRequested?.trim();
+  if (env) {
+    const named = tracks.find((track) => track.name === env);
+    if (named)
+      return done(named, "env", `WORKFLOW_RELEASE_TRACK selects track ${named.name}`);
+    envProblem = `WORKFLOW_RELEASE_TRACK=${env} names no release track of this workspace (${names}); ignored`;
+  }
+  if (!branch)
+    return fallback("HEAD is detached");
+  if (tracks.length === 1 && !implicit)
+    return done(tracks[0], "only-track", `${tracks[0].name} is the only track`);
+  let remotes = null;
+  const short = (ref) => shortRef(ref, remotes ??= input.probe.remotes());
+  const ownerOf = (ref) => {
+    const owner = ownedBy(candidates, short(ref));
+    return owner.length === 1 ? owner[0] : null;
+  };
+  const followRecorded = (start) => {
+    let cursor = start;
+    const seen = new Set([start]);
+    for (let hop = 0;hop < MAX_RECORDED_HOPS; hop += 1) {
+      const recorded = input.probe.recordedBase(cursor);
+      if (!recorded)
+        return null;
+      const base = short(recorded);
+      const owner = ownerOf(base);
+      if (owner)
+        return owner;
+      if (ownedBy(candidates, base).length > 1 || seen.has(base))
+        return null;
+      seen.add(base);
+      cursor = base;
+    }
+    return null;
+  };
+  const recordedOwner = followRecorded(branch);
+  if (recordedOwner)
+    return done(recordedOwner, "recorded-base", `${branch} was created on ${label(recordedOwner)}'s line (recorded base)`);
+  for (const source of ["reflog", "checkout"]) {
+    const ref = source === "reflog" ? input.probe.createdFrom(branch) : input.probe.checkedOutFrom(branch);
+    if (!ref)
+      continue;
+    const owner = ownerOf(ref) ?? followRecorded(short(ref));
+    if (owner)
+      return done(owner, source, `${branch} was created from ${short(ref)} (${source === "reflog" ? "branch reflog" : "HEAD reflog"})`);
+  }
+  const forks = [];
+  for (const track of candidates)
+    for (const ref of new Set([track.integrationBranch, track.baseBranch])) {
+      const sha = input.probe.mergeBase(branch, ref);
+      if (sha)
+        forks.push({ track, ref, sha });
+    }
+  if (forks.length === 0)
+    return fallback(`no track branch could be compared with ${branch} (fetch the track branches)`);
+  const ancestry = new Map;
+  const descends = (older, newer) => {
+    if (older === newer)
+      return false;
+    const key = `${older}>${newer}`;
+    if (!ancestry.has(key))
+      ancestry.set(key, input.probe.isAncestor(older, newer));
+    return ancestry.get(key);
+  };
+  const winners = forks.filter((fork) => forks.every((other) => other.track === fork.track || descends(other.sha, fork.sha)));
+  const winningTracks = [...new Set(winners.map((fork) => fork.track))];
+  if (winningTracks.length === 1 && forks.some((fork) => fork.track !== winningTracks[0])) {
+    const win = winners[0];
+    return done(win.track, "ancestry", `${branch} forked from ${win.ref} at ${win.sha.slice(0, 12)}, after every other line's fork point`);
+  }
+  if (winningTracks.length === 1)
+    return fallback(`only ${label(winningTracks[0])} could be compared with ${branch}`);
+  const newest = forks.filter((fork) => !forks.some((other) => descends(fork.sha, other.sha)));
+  return fallback(`${branch} has the same or unrelated fork points with ${[...new Set(newest.map((fork) => `${fork.ref} (${fork.track.name === IMPLICIT ? "workspace default" : fork.track.name})`))].join(" and ")}`);
+}
+var git4 = (cwd, args) => {
+  const run = spawnSync7("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  return run.status === 0 ? (run.stdout ?? "").trim() : null;
+};
+var recordedBaseKey = (branch) => `branch.${branch}.workitBase`;
+var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+var reflog = (cwd, ref) => (git4(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
+`).map((line) => {
+  const [sha = "", selector = "", ...subject] = line.split("\t");
+  return {
+    sha,
+    time: Number(/@\{(\d+)\}$/u.exec(selector)?.[1] ?? Number.NaN),
+    subject: subject.join("\t")
+  };
+}).filter((entry) => entry.sha && Number.isFinite(entry.time));
+function gitTrackProbe(cwd) {
+  let remote;
+  let remotes;
+  const tip = (branch) => {
+    remote ??= pushRemoteName(cwd) ?? "origin";
+    return resolveRef(cwd, `refs/remotes/${remote}/${branch}`) ?? resolveRef(cwd, `refs/heads/${branch}`);
+  };
+  return {
+    remotes: () => remotes ??= remoteNames(cwd),
+    recordedBase: (branch) => git4(cwd, ["config", "--get", recordedBaseKey(branch)]) || null,
+    createdFrom: (branch) => {
+      const log = git4(cwd, ["reflog", "show", "--format=%gs", `refs/heads/${branch}`, "--"]);
+      const oldest = log?.split(`
+`).findLast(Boolean) ?? "";
+      const match = /^branch: Created from (\S+)$/u.exec(oldest);
+      return match && match[1] !== "HEAD" ? match[1] : null;
+    },
+    checkedOutFrom: (branch) => {
+      const own = reflog(cwd, `refs/heads/${branch}`);
+      const created = own.at(-1);
+      if (!created || created.subject !== "branch: Created from HEAD")
+        return null;
+      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp(branch)}$`, "u");
+      const entry = reflog(cwd, "HEAD").findLast((item) => item.time >= created.time && item.sha === created.sha && pattern.test(item.subject));
+      return entry ? pattern.exec(entry.subject)?.[1] ?? null : null;
+    },
+    mergeBase: (branch, trackBranch) => {
+      const base = tip(trackBranch);
+      return base && resolveRef(cwd, `refs/heads/${branch}`) ? mergeBase(cwd, base, `refs/heads/${branch}`) : null;
+    },
+    isAncestor: (ancestor, descendant) => git4(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]) !== null
+  };
+}
+function workspaceReleaseTracks(cwd) {
+  const raw = resolveRuntimeReleaseTracks(cwd);
+  return { workspace: raw?.workspace ?? null, ...readReleaseTracks(raw?.releaseTracks) };
+}
+var memo3 = new Map;
+var MEMO_LIMIT = 64;
+function resolveTrackFor(cwd, options) {
+  const read = workspaceReleaseTracks(cwd);
+  if (read.error)
+    return { status: "invalid", error: read.error, issues: read.issues };
+  if (read.tracks.length === 0 && !options.track?.trim())
+    return { status: "none", issues: read.issues };
+  const branch = options.branch === undefined ? currentBranch(cwd) : options.branch;
+  const envRequested = process.env.WORKFLOW_RELEASE_TRACK?.trim() || null;
+  const input = {
+    tracks: read.tracks,
+    requested: options.track ?? null,
+    envRequested,
+    branch,
+    defaultBranch: options.defaultBranch,
+    issues: read.issues
+  };
+  let key = null;
+  if (!options.probe) {
+    const refs = git4(cwd, [
+      "for-each-ref",
+      "--format=%(refname) %(objectname)",
+      "refs/heads",
+      "refs/remotes"
+    ]) ?? "";
+    const head = git4(cwd, ["reflog", "show", "-n", "1", "--format=%H %gs", "HEAD", "--"]) ?? "";
+    const own = branch ? [
+      git4(cwd, [
+        "log",
+        "-g",
+        "-n",
+        "1",
+        "--date=unix",
+        "--format=%H %gd %gs",
+        `refs/heads/${branch}`,
+        "--"
+      ]) ?? "",
+      git4(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
+    ] : [];
+    key = createHash9("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
+    const hit = memo3.get(key);
+    if (hit)
+      return hit;
+  }
+  const resolution = resolveReleaseTrack({ ...input, probe: options.probe ?? gitTrackProbe(cwd) });
+  if (key) {
+    if (memo3.size >= MEMO_LIMIT)
+      memo3.delete(memo3.keys().next().value);
+    memo3.set(key, resolution);
+  }
+  return resolution;
+}
+
+// packages/workit-core/src/core/vcs-config.ts
+var workspacesPath = () => path14.join(configDir(), "workspaces.json");
 var vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
 var remoteProvider = (cwd) => {
-  const r = spawnSync7("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  const r = spawnSync8("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
   if (r.status !== 0)
     return null;
   const url = (r.stdout ?? "").trim();
@@ -20989,7 +21419,7 @@ var remoteEndpoint = (remote) => {
 var configuredSshEndpoint = (host) => {
   if (host.startsWith("-"))
     return null;
-  const resolved = spawnSync7("ssh", ["-G", host], {
+  const resolved = spawnSync8("ssh", ["-G", host], {
     encoding: "utf8",
     timeout: 5000,
     maxBuffer: 1024 * 1024,
@@ -21054,7 +21484,16 @@ var readVcsConfig = () => {
   }
   return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
 };
-function vcsConfig(mode, cwd) {
+var trackSummary = (resolution) => resolution.status === "resolved" ? {
+  name: resolution.track?.name ?? null,
+  source: resolution.source,
+  detail: resolution.detail,
+  warnings: resolution.warnings,
+  track: resolution.track,
+  tracks: resolution.tracks,
+  blocking: resolution.blocking
+} : null;
+function vcsConfig(mode, cwd, options = {}) {
   const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
   const wsVcs = ws?.vcs ?? {};
   const wsYt = ws?.youtrack ?? {};
@@ -21064,10 +21503,7 @@ function vcsConfig(mode, cwd) {
   const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
   const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
   const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
-  const wp = ws?.branchPolicy ?? {};
-  const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
-  const policyDefault = resolveBranchPolicyFor(root).defaultTargetBranch;
-  const defaultTarget = String(wsVcs.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : cfg.defaultTargetBranch ?? policyDefault) ?? "develop");
+  const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
   const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
   const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   let issuesProvider = null;
@@ -21079,11 +21515,24 @@ function vcsConfig(mode, cwd) {
   if (mode === "resolve") {
     if (cfgStatus === "malformed")
       return { ok: false, error: cfgError, configPath: cfgPath };
+    const trackResolution = resolveTrackFor(root, {
+      track: options.track,
+      ...options.branch !== undefined ? { branch: options.branch } : {},
+      defaultBranch: workspaceDefault
+    });
+    if (trackResolution.status === "invalid")
+      return { ok: false, error: trackResolution.error, configPath: workspacesPath() };
+    const releaseTrack = trackSummary(trackResolution);
+    const defaultTarget = releaseTrack?.track?.pullRequestTarget ?? workspaceDefault;
+    const baseBranch = releaseTrack?.track?.baseBranch ?? defaultTarget;
     return {
       ok: true,
       workspace_name: ws?.name ?? null,
       provider,
       defaultTargetBranch: defaultTarget,
+      workspaceDefaultTargetBranch: workspaceDefault,
+      baseBranch,
+      releaseTrack,
       link_issues: linkIssues,
       youtrack_base_url: youtrackBaseUrl,
       issues_provider: issuesProvider,
@@ -21107,7 +21556,7 @@ function vcsConfig(mode, cwd) {
     ok: true,
     configPath: path14.resolve(cfgPath),
     provider,
-    defaultTargetBranch: defaultTarget,
+    defaultTargetBranch: workspaceDefault,
     pr: cfg.pr ?? {},
     workspace_name: ws?.name ?? null,
     link_issues: linkIssues,
@@ -21143,7 +21592,7 @@ function mergedPrStyle(limit = 6, cwd) {
 `).filter((l) => l.startsWith("## ")).map((l) => l.trim()),
     descriptionPreview: desc.slice(0, 600)
   });
-  const remoteResult = spawnSync7("git", ["remote", "get-url", "--push", "--all", "origin"], {
+  const remoteResult = spawnSync8("git", ["remote", "get-url", "--push", "--all", "origin"], {
     cwd,
     encoding: "utf8"
   });
@@ -21159,7 +21608,7 @@ function mergedPrStyle(limit = 6, cwd) {
   if (!hostingApiHostMatches(remote, host))
     return { ok: false, error: "PR style target does not match the provider host" };
   if (provider === "gitlab") {
-    const run = (args) => spawnSync7("glab", ["api", ...args], {
+    const run = (args) => spawnSync8("glab", ["api", ...args], {
       cwd,
       encoding: "utf8",
       env
@@ -21179,7 +21628,7 @@ function mergedPrStyle(limit = 6, cwd) {
       });
     }
   } else if (provider === "github") {
-    const r = spawnSync7("gh", [
+    const r = spawnSync8("gh", [
       "pr",
       "list",
       "--repo",
@@ -21210,20 +21659,6 @@ function mergedPrStyle(limit = 6, cwd) {
     examples
   };
 }
-
-// packages/workit-core/src/core/branch.ts
-function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
-  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
-  const config = readConfig();
-  return kind === "branch" ? {
-    branchPolicy: resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null),
-    provenance: { branchPolicy: selected.source }
-  } : {
-    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
-    provenance: { commitPolicy: selected.source }
-  };
-}
-var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
 // packages/workit-core/src/core/task-engine.ts
 import { realpathSync as realpathSync4 } from "node:fs";
 
@@ -23077,7 +23512,7 @@ class WorkitCore {
   }
 }
 // packages/workit-core/src/core/repo-context.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "node:fs";
 import path16 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
@@ -23106,7 +23541,7 @@ var invalidRange = (cwd) => ({
   cwd
 });
 var runGit = (cwd, args) => {
-  const result = spawnSync8("git", args, { cwd, encoding: "utf8" });
+  const result = spawnSync9("git", args, { cwd, encoding: "utf8" });
   return {
     stdout: (result.stdout ?? "").trimEnd(),
     stderr: (result.stderr ?? "").trimEnd(),
@@ -23547,12 +23982,12 @@ function releaseNotesContext(root, rangeOrTag) {
 }
 
 // packages/workit-core/src/core/tracker-issues.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 
 // packages/workit-core/src/core/pr-create.ts
 import fs13 from "node:fs";
 import path17 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 // packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
   const m = /issues\/(\d+)/.exec(value);
@@ -23577,7 +24012,7 @@ function whichOnPath(tool) {
 }
 var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
 var pushRemote = (cwd) => {
-  const result = spawnSync9("git", ["remote", "get-url", "--push", "--all", "origin"], {
+  const result = spawnSync10("git", ["remote", "get-url", "--push", "--all", "origin"], {
     cwd,
     encoding: "utf8"
   });
@@ -23608,7 +24043,7 @@ var defaultCli = (bin, available) => {
   if (!available)
     return null;
   return (args, root) => {
-    const out = spawnSync10(bin, args, {
+    const out = spawnSync11(bin, args, {
       cwd: root,
       encoding: "utf8",
       env: { ...process.env, PATH: process.env.PATH ?? "" }
@@ -24126,7 +24561,7 @@ function resolveInside(root, candidate) {
 }
 function run2(root, executable, args, env = {}) {
   const cwd = realpathSync5(root);
-  const result = spawnSync11(executable, args, {
+  const result = spawnSync12(executable, args, {
     cwd,
     encoding: "utf8",
     env: { ...process.env, ...env }
@@ -26572,8 +27007,8 @@ var SENSITIVE_WORDS = new Set([
   "query"
 ]);
 var STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
-var escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-var homePattern = new RegExp(`${escapeRegExp(os4.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
+var escapeRegExp2 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var homePattern = new RegExp(`${escapeRegExp2(os4.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
 var applyPatterns = (value) => {
   let out = value;
   out = out.replace(SECRET_VALUE, REDACTED);

package/dist/workit-hook.js

@@ -13872,6 +13872,7 @@ var readConfig = () => {
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
 };
+var branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i");
 var resolveBranchPolicy = (config, workspace) => {
   const wp = workspace?.branchPolicy ?? {};
   const preset = Object.hasOwn(PRESETS, wp.preset) ? wp.preset : config.branchPolicy?.preset ?? "gitflow";
@@ -13879,7 +13880,7 @@ var resolveBranchPolicy = (config, workspace) => {
     allowed: wp.allowed,
     protectedNames: wp.protected
   }, config);
-  const allowed = merged.allowed.map((p) => new RegExp(`^${p.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"));
+  const allowed = merged.allowed.map(branchGlobPattern);
   return {
     preset,
     allowed,
@@ -13944,26 +13945,31 @@ var versionSourceSchema = discriminatedUnion("kind", [
   object({ kind: literal("manual") }).strict()
 ]);
 var releaseTrackSchema = object({
-  strategy: branchPreset,
+  strategy: branchPreset.optional(),
   productionBranch: nonBlank,
   integrationBranch: nonBlank,
-  naming: object({ feature: nonBlank, release: nonBlank, hotfix: nonBlank }).strict(),
-  baseBranch: nonBlank,
-  mergeBackBranches: array(nonBlank),
-  pullRequestTarget: nonBlank,
-  tagNamespace: string2(),
-  versionSource: versionSourceSchema,
-  requiredChecks: array(nonBlank)
-}).strict().superRefine((track, context) => {
+  naming: object({
+    feature: nonBlank.optional(),
+    release: nonBlank.optional(),
+    hotfix: nonBlank.optional()
+  }).passthrough().optional(),
+  baseBranch: nonBlank.optional(),
+  mergeBackBranches: array(nonBlank).optional(),
+  pullRequestTarget: nonBlank.optional(),
+  tagNamespace: string2().optional(),
+  versionSource: versionSourceSchema.optional(),
+  requiredChecks: array(nonBlank).optional(),
+  critical: array(nonBlank).optional()
+}).passthrough().superRefine((track, context) => {
   for (const [field, values] of [
-    ["mergeBackBranches", track.mergeBackBranches],
-    ["requiredChecks", track.requiredChecks]
+    ["mergeBackBranches", track.mergeBackBranches ?? []],
+    ["requiredChecks", track.requiredChecks ?? []]
   ]) {
     if (new Set(values).size !== values.length) {
       context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
     }
   }
-  if (track.versionSource.kind === "package-json" && (path13.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+  if (track.versionSource?.kind === "package-json" && (path13.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
     context.addIssue({
       code: "custom",
       path: ["versionSource", "path"],
@@ -14230,7 +14236,7 @@ var runtimeWorkspacePolicySchema = (kind) => {
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
-var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+var matchRuntimeWorkspace = (cwd) => {
   const file = path13.join(configDir(), "workspaces.json");
   let raw;
   try {
@@ -14265,8 +14271,17 @@ var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   });
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  if (!selected)
+  return selected ? { file, selected } : null;
+};
+var resolveRuntimeReleaseTracks = (cwd) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+};
+var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  if (!matched)
     return null;
+  const { file, selected } = matched;
   const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
   if (!policy.success) {
     const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
@@ -16230,11 +16245,176 @@ var turnContextText = (input, descriptor) => {
 };
 // packages/workit-core/src/core/branch.ts
 import { createHash as createHash9 } from "node:crypto";
+
+// packages/workit-core/src/core/release-tracks.ts
+class ReleaseTrackError extends Error {
+}
+var KNOWN_FIELDS = new Set([
+  "strategy",
+  "productionBranch",
+  "integrationBranch",
+  "naming",
+  "baseBranch",
+  "mergeBackBranches",
+  "pullRequestTarget",
+  "tagNamespace",
+  "versionSource",
+  "requiredChecks",
+  "critical"
+]);
+var BRANCH_FIELDS = ["productionBranch", "integrationBranch", "baseBranch", "pullRequestTarget"];
+var PLACEHOLDER = /\{[^}]*\}/gu;
+var HAS_PLACEHOLDER = /\{[^}]*\}/u;
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var branchName = (value) => typeof value === "string" && value.trim() && !value.trim().startsWith("-") ? value.trim() : null;
+var namedBranches = (entry) => [
+  ...BRANCH_FIELDS.map((field) => branchName(entry[field])),
+  ...Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : []
+].filter((name) => name !== null);
+var literalOf = (template) => template.replace(PLACEHOLDER, "").replace(/[*/]/gu, "").trim();
+function readReleaseTracks(raw) {
+  const out = { tracks: [], issues: [], error: null, protectedBranches: [] };
+  if (raw === undefined || raw === null)
+    return out;
+  if (!isRecord3(raw)) {
+    out.issues.push("releaseTracks is not an object; ignored");
+    return out;
+  }
+  const fatal = [];
+  const protectedNames = new Set;
+  for (const [name, entry] of Object.entries(raw).toSorted(([a], [b]) => a < b ? -1 : 1)) {
+    const label = `release track ${JSON.stringify(name)}`;
+    if (!isRecord3(entry)) {
+      out.issues.push(`${label} is not an object; ignored`);
+      continue;
+    }
+    for (const branch of namedBranches(entry))
+      protectedNames.add(branch);
+    if (!name.trim()) {
+      out.issues.push("a release track with a blank name was ignored");
+      continue;
+    }
+    let critical = [];
+    if (Array.isArray(entry.critical))
+      critical = entry.critical.filter((item) => typeof item === "string");
+    else if (entry.critical !== undefined)
+      out.issues.push(`${label} critical: must be a list of field names; ignored`);
+    const isCritical = (field) => critical.some((item) => field === item || field.startsWith(`${item}.`));
+    const problem = (field, message) => {
+      if (isCritical(field))
+        fatal.push(`${label} ${field}: ${message}`);
+      else
+        out.issues.push(`${label} ${field}: ${message}`);
+    };
+    for (const key of Object.keys(entry))
+      if (!KNOWN_FIELDS.has(key))
+        problem(key, "unknown field, ignored");
+    const productionBranch = branchName(entry.productionBranch);
+    const integrationBranch = branchName(entry.integrationBranch);
+    if (!productionBranch)
+      problem("productionBranch", "missing or not a branch name");
+    if (!integrationBranch)
+      problem("integrationBranch", "missing or not a branch name");
+    const optionalBranch = (field) => {
+      if (entry[field] === undefined)
+        return null;
+      const value = branchName(entry[field]);
+      if (!value)
+        problem(field, "not a branch name; using the integration branch");
+      return value;
+    };
+    const baseBranch = optionalBranch("baseBranch");
+    const pullRequestTarget = optionalBranch("pullRequestTarget");
+    let mergeBackBranches = [];
+    if (entry.mergeBackBranches !== undefined) {
+      const list = Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : [null];
+      if (list.some((item) => item === null))
+        problem("mergeBackBranches", "must be a list of branch names; ignored");
+      else
+        mergeBackBranches = [...new Set(list)];
+    }
+    const naming = {};
+    if (entry.naming !== undefined) {
+      if (!isRecord3(entry.naming))
+        problem("naming", "not an object; ignored");
+      else
+        for (const kind of ["feature", "release", "hotfix"]) {
+          const template = entry.naming[kind];
+          if (template === undefined)
+            continue;
+          if (typeof template !== "string" || !template.trim())
+            problem(`naming.${kind}`, "not a template string; ignored");
+          else if (!literalOf(template))
+            problem(`naming.${kind}`, "needs literal text besides placeholders; ignored");
+          else
+            naming[kind] = template.trim();
+        }
+    }
+    if (!productionBranch || !integrationBranch) {
+      out.issues.push(`${label} was skipped: it needs a productionBranch and integrationBranch`);
+      continue;
+    }
+    out.tracks.push({
+      name,
+      productionBranch,
+      integrationBranch,
+      baseBranch: baseBranch ?? integrationBranch,
+      pullRequestTarget: pullRequestTarget ?? integrationBranch,
+      mergeBackBranches,
+      naming
+    });
+  }
+  out.protectedBranches = [...protectedNames];
+  if (fatal.length)
+    out.error = `workspace releaseTracks cannot be read by this Workit (${fatal.join("; ")}); upgrade Workit or fix the track`;
+  return out;
+}
+var trackBranches = (tracks) => [
+  ...new Set(tracks.flatMap((track) => [
+    track.productionBranch,
+    track.integrationBranch,
+    track.baseBranch,
+    track.pullRequestTarget,
+    ...track.mergeBackBranches
+  ]))
+];
+var namingGlob = (template) => HAS_PLACEHOLDER.test(template) ? template.replace(PLACEHOLDER, "*") : `${template.replace(/\/?\*?$/u, "")}/*`;
+function workspaceReleaseTracks(cwd) {
+  const raw = resolveRuntimeReleaseTracks(cwd);
+  return { workspace: raw?.workspace ?? null, ...readReleaseTracks(raw?.releaseTracks) };
+}
+var memo3 = new Map;
+
+// packages/workit-core/src/core/branch.ts
+var withReleaseTracks = (workspaceRoot, policy) => {
+  const read = workspaceReleaseTracks(workspaceRoot);
+  if (read.error)
+    throw new ReleaseTrackError(read.error);
+  if (read.tracks.length === 0 && read.protectedBranches.length === 0)
+    return policy;
+  const known = new Set(policy.allowed.map((pattern) => pattern.source));
+  const allowed = [...policy.allowed];
+  for (const glob of read.tracks.flatMap((track) => Object.values(track.naming).map(namingGlob))) {
+    const pattern = branchGlobPattern(glob);
+    if (!known.has(pattern.source)) {
+      known.add(pattern.source);
+      allowed.push(pattern);
+    }
+  }
+  return {
+    ...policy,
+    allowed,
+    protected: new Set([
+      ...policy.protected,
+      ...[...trackBranches(read.tracks), ...read.protectedBranches].map((name) => name.toLowerCase())
+    ])
+  };
+};
 function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
   const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
   const config = readConfig();
   return kind === "branch" ? {
-    branchPolicy: resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null),
+    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null)),
     provenance: { branchPolicy: selected.source }
   } : {
     commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
@@ -16583,7 +16763,7 @@ function writeGate(cwd, paths) {
 // packages/workit-core/src/hooks/hosts/fields.ts
 import { existsSync as existsSync6, realpathSync as realpathSync6, statSync as statSync2 } from "node:fs";
 import path17 from "node:path";
-var isRecord3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var isRecord4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var nonEmpty2 = (value) => typeof value === "string" && value.trim() !== "";
 var optionalText = (value) => typeof value === "string" ? value : null;
 var existingDirectory = (value) => {
@@ -16639,7 +16819,7 @@ var WRITE_TOOLS = new Set([
 var isWriteTool = (name) => typeof name === "string" && WRITE_TOOLS.has(name.toLowerCase().replace(/[_-]/g, ""));
 var PATH_KEYS = ["file_path", "filePath", "notebook_path", "path", "target_file", "file"];
 var writePaths = (input) => {
-  if (!isRecord3(input))
+  if (!isRecord4(input))
     return [];
   const paths = PATH_KEYS.map((key) => input[key]).filter(nonEmpty2);
   for (const value of Object.values(input))
@@ -16843,7 +17023,7 @@ var EVENTS = {
 };
 var SOURCES = new Set(["startup", "resume", "clear", "compact", "fork"]);
 var SHELL_TOOLS = new Set(["Bash", "PowerShell"]);
-var toolCommand = (value) => isRecord3(value.tool_input) ? commandText(value.tool_input.command) : null;
+var toolCommand = (value) => isRecord4(value.tool_input) ? commandText(value.tool_input.command) : null;
 var eventOf = (name, value) => {
   const toolUseId = optionalText(value.tool_use_id);
   switch (name) {
@@ -16873,7 +17053,7 @@ var eventOf = (name, value) => {
       const command = toolCommand(value);
       if (!SHELL_TOOLS.has(String(value.tool_name)) || !command)
         return { ok: false, error: "only shell PostToolUse is mapped" };
-      const response = isRecord3(value.tool_response) ? value.tool_response : {};
+      const response = isRecord4(value.tool_response) ? value.tool_response : {};
       return {
         ok: true,
         event: {
@@ -16949,14 +17129,14 @@ var render = (decision, native) => {
 var claudeCodeAdapter = {
   descriptor: CLAUDE_CODE_DESCRIPTOR,
   parse(raw) {
-    const native = isRecord3(raw) && Object.hasOwn(EVENTS, String(raw.hook_event_name)) ? raw.hook_event_name : null;
+    const native = isRecord4(raw) && Object.hasOwn(EVENTS, String(raw.hook_event_name)) ? raw.hook_event_name : null;
     const fail = (error) => ({
       ok: false,
       error,
       native,
       event: native ? EVENTS[native] : null
     });
-    if (!isRecord3(raw) || !native)
+    if (!isRecord4(raw) || !native)
       return fail("hook_event_name is required");
     if (!nonEmpty2(raw.session_id))
       return fail("session_id is required");
@@ -17099,7 +17279,7 @@ var SHELL_TOOLS2 = new Set(["bash", "unified-exec"]);
 var isShellTool = (name) => SHELL_TOOLS2.has(String(name).toLowerCase());
 var SOURCES2 = new Set(["startup", "resume", "clear", "compact"]);
 var parseCodexHookInput = (value) => {
-  if (!isRecord3(value) || !Object.hasOwn(EVENTS2, String(value.hook_event_name)))
+  if (!isRecord4(value) || !Object.hasOwn(EVENTS2, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
   const event = value.hook_event_name;
   const cwd = existingDirectory(value.cwd);
@@ -17107,7 +17287,7 @@ var parseCodexHookInput = (value) => {
     return { ok: false, error: "cwd must be an existing absolute directory" };
   if (event === "PreToolUse" && !nonEmpty2(value.tool_name))
     return { ok: false, error: "tool_name is required" };
-  const command = isRecord3(value.tool_input) ? commandText(value.tool_input.command) : null;
+  const command = isRecord4(value.tool_input) ? commandText(value.tool_input.command) : null;
   if (event === "PreToolUse" && isShellTool(value.tool_name) && !command)
     return { ok: false, error: "tool_input.command is required for shell tools" };
   if (event === "SubagentStart" && !nonEmpty2(value.agent_id))
@@ -17190,7 +17370,7 @@ var codexAdapter = {
     const host = detectCodexSurface(env);
     const parsed = parseCodexHookInput(raw);
     if (!parsed.ok) {
-      const native = isRecord3(raw) && Object.hasOwn(EVENTS2, String(raw.hook_event_name)) ? raw.hook_event_name : null;
+      const native = isRecord4(raw) && Object.hasOwn(EVENTS2, String(raw.hook_event_name)) ? raw.hook_event_name : null;
       return { ok: false, error: parsed.error, native, event: native ? EVENTS2[native] : null };
     }
     const input = parsed.data;
@@ -17329,7 +17509,7 @@ var EVENTS3 = {
   preCompact: "compact.pre"
 };
 var parseCursorHookInput = (value) => {
-  if (!isRecord3(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
+  if (!isRecord4(value) || !Object.hasOwn(EVENTS3, String(value.hook_event_name)))
     return { ok: false, error: "hook_event_name is required" };
   const roots = value.workspace_roots;
   if (!Array.isArray(roots) || roots.length === 0 || !roots.every(nonEmpty2))
@@ -17435,7 +17615,7 @@ var cursorAdapter = {
   parse(raw) {
     const parsed = parseCursorHookInput(raw);
     if (!parsed.ok) {
-      const native = isRecord3(raw) && Object.hasOwn(EVENTS3, String(raw.hook_event_name)) ? raw.hook_event_name : null;
+      const native = isRecord4(raw) && Object.hasOwn(EVENTS3, String(raw.hook_event_name)) ? raw.hook_event_name : null;
       return { ok: false, error: parsed.error, native, event: native ? EVENTS3[native] : null };
     }
     const input = parsed.data;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-codex",
-  "version": "7.0.0",
+  "version": "7.1.0",
   "private": false,
   "description": "Workit Codex CLI/desktop plugin — shared MCP transport, hooks, and sixteen method skills",
   "keywords": [
@@ -38,8 +38,8 @@
     "build": "bun scripts/build.ts"
   },
   "dependencies": {
-    "@brainervirus/workit-core": "^7.0.0",
-    "@brainervirus/workit-mcp": "^7.0.0"
+    "@brainervirus/workit-core": "^7.1.0",
+    "@brainervirus/workit-mcp": "^7.1.0"
   },
   "engines": {
     "node": ">=24"