@brainervirus/workit-codex 7.0.0 → 7.2.0

package/dist/launch-mcp.js

@@ -6625,7 +6625,7 @@ import { existsSync as existsSync9, realpathSync as realpathSync7, statSync as s
 import path21 from "node:path";
 
 // packages/workit-core/src/core.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
 import path19 from "node:path";
 
@@ -18884,6 +18884,11 @@ function worktreeSignal(cwd, options = {}) {
   }
   return `sig:${hash.digest("hex")}`;
 }
+function mergeBase(cwd, a, b) {
+  if (!safeArg(a) || !safeArg(b))
+    return null;
+  return line(git2(cwd, ["merge-base", a, b]));
+}
 function patchId(cwd, base, head) {
   if (!safeArg(base) || !safeArg(head))
     return null;
@@ -18907,9 +18912,33 @@ function patchId(cwd, base, head) {
   const id = git2(cwd, ["patch-id", "--stable"], { input: diff.stdout });
   return line(id)?.split(/\s+/u)[0] ?? null;
 }
+function remoteNames(cwd) {
+  return (git2(cwd, ["remote"]).stdout ?? "").split(/\r?\n/u).map((value) => value.trim()).filter(Boolean);
+}
+function resolveRef(cwd, ref) {
+  if (!safeArg(ref))
+    return null;
+  return line(git2(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]));
+}
+var config2 = (cwd, key) => line(git2(cwd, ["config", "--get", key]));
 function currentBranch(cwd) {
   return line(git2(cwd, ["symbolic-ref", "--short", "-q", "HEAD"]));
 }
+function pushRemoteName(cwd, branch) {
+  const name = branch ?? currentBranch(cwd);
+  const remotes = remoteNames(cwd);
+  const candidates = [
+    name ? config2(cwd, `branch.${name}.pushRemote`) : null,
+    config2(cwd, "remote.pushDefault"),
+    name ? config2(cwd, `branch.${name}.remote`) : null
+  ];
+  for (const candidate of candidates)
+    if (candidate && candidate !== "." && remotes.includes(candidate))
+      return candidate;
+  if (remotes.includes("origin"))
+    return "origin";
+  return remotes.length === 1 ? remotes[0] : null;
+}
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync3 } from "node:fs";
@@ -20523,6 +20552,8 @@ var readConfig = () => {
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
 };
+var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path12.join(configDir(), "vcs.json");
+var branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i");
 var resolveBranchPolicy = (config, workspace) => {
   const wp = workspace?.branchPolicy ?? {};
   const preset = Object.hasOwn(PRESETS, wp.preset) ? wp.preset : config.branchPolicy?.preset ?? "gitflow";
@@ -20530,7 +20561,7 @@ var resolveBranchPolicy = (config, workspace) => {
     allowed: wp.allowed,
     protectedNames: wp.protected
   }, config);
-  const allowed = merged.allowed.map((p) => new RegExp(`^${p.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"));
+  const allowed = merged.allowed.map(branchGlobPattern);
   return {
     preset,
     allowed,
@@ -20547,16 +20578,6 @@ var COMMIT_PRESETS = [
   "custom",
   "auto"
 ];
-var resolveCommitPolicy = (config, workspace) => {
-  const wp = workspace?.commitPolicy ?? {};
-  if (COMMIT_PRESETS.includes(String(wp.preset ?? ""))) {
-    return {
-      preset: wp.preset,
-      ...typeof wp.pattern === "string" ? { pattern: wp.pattern } : {}
-    };
-  }
-  return config.commitPolicy ?? { preset: "conventional" };
-};
 
 // packages/workit-core/src/core/workspaces.ts
 import { createHash as createHash8 } from "node:crypto";
@@ -20595,26 +20616,31 @@ var versionSourceSchema = discriminatedUnion("kind", [
   object({ kind: literal("manual") }).strict()
 ]);
 var releaseTrackSchema = object({
-  strategy: branchPreset,
+  strategy: branchPreset.optional(),
   productionBranch: nonBlank,
   integrationBranch: nonBlank,
-  naming: object({ feature: nonBlank, release: nonBlank, hotfix: nonBlank }).strict(),
-  baseBranch: nonBlank,
-  mergeBackBranches: array(nonBlank),
-  pullRequestTarget: nonBlank,
-  tagNamespace: string2(),
-  versionSource: versionSourceSchema,
-  requiredChecks: array(nonBlank)
-}).strict().superRefine((track, context) => {
+  naming: object({
+    feature: nonBlank.optional(),
+    release: nonBlank.optional(),
+    hotfix: nonBlank.optional()
+  }).passthrough().optional(),
+  baseBranch: nonBlank.optional(),
+  mergeBackBranches: array(nonBlank).optional(),
+  pullRequestTarget: nonBlank.optional(),
+  tagNamespace: string2().optional(),
+  versionSource: versionSourceSchema.optional(),
+  requiredChecks: array(nonBlank).optional(),
+  critical: array(nonBlank).optional()
+}).passthrough().superRefine((track, context) => {
   for (const [field, values] of [
-    ["mergeBackBranches", track.mergeBackBranches],
-    ["requiredChecks", track.requiredChecks]
+    ["mergeBackBranches", track.mergeBackBranches ?? []],
+    ["requiredChecks", track.requiredChecks ?? []]
   ]) {
     if (new Set(values).size !== values.length) {
       context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
     }
   }
-  if (track.versionSource.kind === "package-json" && (path13.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+  if (track.versionSource?.kind === "package-json" && (path13.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
     context.addIssue({
       code: "custom",
       path: ["versionSource", "path"],
@@ -20632,7 +20658,7 @@ var workspaceConfigSchema = object({
     account: nonBlank.optional()
   }).passthrough().optional(),
   autoApprove: union([boolean2(), array(nonBlank)]).optional(),
-  defaultEndpoint: _enum(["commit", "pr"]).optional(),
+  defaultEndpoint: unknown().optional(),
   verification: _enum(["self", "independent"]).optional(),
   autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
     kind,
@@ -20882,7 +20908,7 @@ var resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd,
 var runtimeWorkspaceIndexSchema = object({
   workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
 }).passthrough();
-var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+var matchRuntimeWorkspace = (cwd) => {
   const file = path13.join(configDir(), "workspaces.json");
   let raw;
   try {
@@ -20917,8 +20943,17 @@ var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   });
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  if (!selected)
+  return selected ? { file, selected } : null;
+};
+var resolveRuntimeReleaseTracks = (cwd) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+};
+var resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
+  const matched = matchRuntimeWorkspace(cwd);
+  if (!matched)
     return null;
+  const { file, selected } = matched;
   const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
   if (!policy.success) {
     const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
@@ -20944,15 +20979,410 @@ var resolveRuntimeWorkspacePolicy = (cwd, kind, requestedProfile) => {
     source: profilePolicy ? `profile:${profileName}` : workspacePolicy ? `workspace:${candidate.name}` : "user-default"
   };
 };
+function workspaceDefaultTarget(cwd, globalDefault) {
+  const ws = resolveRuntimeWorkspaceVcs(cwd);
+  const wp = ws?.branchPolicy ?? {};
+  const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
+  const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined);
+  const policyDefault = resolveBranchPolicy(readConfig(), selected.policy ? { branchPolicy: selected.policy } : null).defaultTargetBranch;
+  return String(ws?.vcs?.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : globalDefault ?? policyDefault) ?? "develop");
+}
 
 // packages/workit-core/src/core/vcs-config.ts
 import fs12 from "node:fs";
 import path14 from "node:path";
+import { spawnSync as spawnSync8 } from "node:child_process";
+
+// packages/workit-core/src/core/release-tracks.ts
+import { createHash as createHash9 } from "node:crypto";
 import { spawnSync as spawnSync7 } from "node:child_process";
-var vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path14.join(configDir(), "vcs.json");
+var KNOWN_FIELDS = new Set([
+  "strategy",
+  "productionBranch",
+  "integrationBranch",
+  "naming",
+  "baseBranch",
+  "mergeBackBranches",
+  "pullRequestTarget",
+  "tagNamespace",
+  "versionSource",
+  "requiredChecks",
+  "critical"
+]);
+var BRANCH_FIELDS = ["productionBranch", "integrationBranch", "baseBranch", "pullRequestTarget"];
+var PLACEHOLDER = /\{[^}]*\}/gu;
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var branchName = (value) => typeof value === "string" && value.trim() && !value.trim().startsWith("-") ? value.trim() : null;
+var namedBranches = (entry) => [
+  ...BRANCH_FIELDS.map((field) => branchName(entry[field])),
+  ...Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : []
+].filter((name) => name !== null);
+var literalOf = (template) => template.replace(PLACEHOLDER, "").replace(/[*/]/gu, "").trim();
+function readReleaseTracks(raw) {
+  const out = { tracks: [], issues: [], error: null, protectedBranches: [] };
+  if (raw === undefined || raw === null)
+    return out;
+  if (!isRecord3(raw)) {
+    out.issues.push("releaseTracks is not an object; ignored");
+    return out;
+  }
+  const fatal = [];
+  const protectedNames = new Set;
+  for (const [name, entry] of Object.entries(raw).toSorted(([a], [b]) => a < b ? -1 : 1)) {
+    const label = `release track ${JSON.stringify(name)}`;
+    if (!isRecord3(entry)) {
+      out.issues.push(`${label} is not an object; ignored`);
+      continue;
+    }
+    for (const branch of namedBranches(entry))
+      protectedNames.add(branch);
+    if (!name.trim()) {
+      out.issues.push("a release track with a blank name was ignored");
+      continue;
+    }
+    let critical = [];
+    if (Array.isArray(entry.critical))
+      critical = entry.critical.filter((item) => typeof item === "string");
+    else if (entry.critical !== undefined)
+      out.issues.push(`${label} critical: must be a list of field names; ignored`);
+    const isCritical = (field) => critical.some((item) => field === item || field.startsWith(`${item}.`));
+    const problem = (field, message) => {
+      if (isCritical(field))
+        fatal.push(`${label} ${field}: ${message}`);
+      else
+        out.issues.push(`${label} ${field}: ${message}`);
+    };
+    for (const key of Object.keys(entry))
+      if (!KNOWN_FIELDS.has(key))
+        problem(key, "unknown field, ignored");
+    const productionBranch = branchName(entry.productionBranch);
+    const integrationBranch = branchName(entry.integrationBranch);
+    if (!productionBranch)
+      problem("productionBranch", "missing or not a branch name");
+    if (!integrationBranch)
+      problem("integrationBranch", "missing or not a branch name");
+    const optionalBranch = (field) => {
+      if (entry[field] === undefined)
+        return null;
+      const value = branchName(entry[field]);
+      if (!value)
+        problem(field, "not a branch name; using the integration branch");
+      return value;
+    };
+    const baseBranch = optionalBranch("baseBranch");
+    const pullRequestTarget = optionalBranch("pullRequestTarget");
+    let mergeBackBranches = [];
+    if (entry.mergeBackBranches !== undefined) {
+      const list = Array.isArray(entry.mergeBackBranches) ? entry.mergeBackBranches.map(branchName) : [null];
+      if (list.some((item) => item === null))
+        problem("mergeBackBranches", "must be a list of branch names; ignored");
+      else
+        mergeBackBranches = [...new Set(list)];
+    }
+    const naming = {};
+    if (entry.naming !== undefined) {
+      if (!isRecord3(entry.naming))
+        problem("naming", "not an object; ignored");
+      else
+        for (const kind of ["feature", "release", "hotfix"]) {
+          const template = entry.naming[kind];
+          if (template === undefined)
+            continue;
+          if (typeof template !== "string" || !template.trim())
+            problem(`naming.${kind}`, "not a template string; ignored");
+          else if (!literalOf(template))
+            problem(`naming.${kind}`, "needs literal text besides placeholders; ignored");
+          else
+            naming[kind] = template.trim();
+        }
+    }
+    if (!productionBranch || !integrationBranch) {
+      out.issues.push(`${label} was skipped: it needs a productionBranch and integrationBranch`);
+      continue;
+    }
+    out.tracks.push({
+      name,
+      productionBranch,
+      integrationBranch,
+      baseBranch: baseBranch ?? integrationBranch,
+      pullRequestTarget: pullRequestTarget ?? integrationBranch,
+      mergeBackBranches,
+      naming
+    });
+  }
+  out.protectedBranches = [...protectedNames];
+  if (fatal.length)
+    out.error = `workspace releaseTracks cannot be read by this Workit (${fatal.join("; ")}); upgrade Workit or fix the track`;
+  return out;
+}
+var IMPLICIT = "";
+var ownedBy = (tracks, branch) => tracks.filter((track) => [track.integrationBranch, track.productionBranch, track.baseBranch].includes(branch));
+var shortRef = (ref, remotes) => {
+  const bare = ref.replace(/^refs\/heads\//u, "").replace(/^refs\/remotes\/[^/]+\//u, "");
+  const remote = remotes.find((name) => bare.startsWith(`${name}/`));
+  return remote ? bare.slice(remote.length + 1) : bare;
+};
+var MAX_RECORDED_HOPS = 10;
+function resolveReleaseTrack(input) {
+  const tracks = [...input.tracks];
+  const issues = [...input.issues ?? []];
+  const requested = input.requested?.trim();
+  if (tracks.length === 0) {
+    if (requested)
+      return {
+        status: "invalid",
+        error: `no release tracks configured for this workspace; --track ${requested} cannot apply`,
+        issues
+      };
+    return { status: "none", issues };
+  }
+  const names = tracks.map((track) => track.name).join(", ");
+  let envProblem = null;
+  const done = (track, source, detail, warnings = [], ambiguous = null) => ({
+    status: "resolved",
+    track: track && track.name !== IMPLICIT ? track : null,
+    source,
+    detail,
+    warnings: [...issues, ...envProblem ? [envProblem] : [], ...warnings],
+    tracks,
+    blocking: envProblem ?? ambiguous
+  });
+  if (requested) {
+    const named = tracks.find((track) => track.name === requested);
+    if (!named)
+      return {
+        status: "invalid",
+        error: `no release track ${JSON.stringify(requested)}; configured: ${names}`,
+        issues
+      };
+    return done(named, "flag", `track ${named.name} was requested explicitly`);
+  }
+  const owned = (branch) => branch !== null && tracks.some((track) => [
+    track.integrationBranch,
+    track.productionBranch,
+    track.baseBranch,
+    track.pullRequestTarget
+  ].includes(branch));
+  const implicit = input.defaultBranch && !owned(input.defaultBranch) ? {
+    name: IMPLICIT,
+    productionBranch: input.defaultBranch,
+    integrationBranch: input.defaultBranch,
+    baseBranch: input.defaultBranch,
+    pullRequestTarget: input.defaultBranch,
+    mergeBackBranches: [],
+    naming: {}
+  } : null;
+  const candidates = implicit ? [...tracks, implicit] : tracks;
+  const label = (track) => track.name === IMPLICIT ? `the workspace default line (${track.integrationBranch})` : `track ${track.name}`;
+  const fallback = (why) => {
+    const byDefault = input.defaultBranch ? tracks.filter((track) => track.integrationBranch === input.defaultBranch || track.pullRequestTarget === input.defaultBranch) : [];
+    const track = byDefault.length === 1 ? byDefault[0] : null;
+    const target = track ? `track ${track.name}` : `default target ${input.defaultBranch ?? "(none)"}`;
+    const ambiguous = candidates.length >= 2 ? `can't tell which release line ${input.branch ?? "HEAD"} is on (${why}); pass --track <name> (${names}) or --base <branch>` : null;
+    return done(track, "default", `${why}; using the workspace ${target}`, [
+      `release track not determined: ${why}; using the workspace ${target} (pass --track <name> to choose)`
+    ], ambiguous);
+  };
+  const branch = input.branch;
+  if (branch) {
+    const owners = ownedBy(candidates, branch);
+    if (owners.length === 1)
+      return done(owners[0], "branch", `${branch} is a branch of ${label(owners[0])}`);
+    if (owners.length > 1)
+      return fallback(`${branch} belongs to more than one track (${owners.map((track) => track.name).join(", ")})`);
+  }
+  const env = input.envRequested?.trim();
+  if (env) {
+    const named = tracks.find((track) => track.name === env);
+    if (named)
+      return done(named, "env", `WORKFLOW_RELEASE_TRACK selects track ${named.name}`);
+    envProblem = `WORKFLOW_RELEASE_TRACK=${env} names no release track of this workspace (${names}); ignored`;
+  }
+  if (!branch)
+    return fallback("HEAD is detached");
+  if (tracks.length === 1 && !implicit)
+    return done(tracks[0], "only-track", `${tracks[0].name} is the only track`);
+  let remotes = null;
+  const short = (ref) => shortRef(ref, remotes ??= input.probe.remotes());
+  const ownerOf = (ref) => {
+    const owner = ownedBy(candidates, short(ref));
+    return owner.length === 1 ? owner[0] : null;
+  };
+  const followRecorded = (start) => {
+    let cursor = start;
+    const seen = new Set([start]);
+    for (let hop = 0;hop < MAX_RECORDED_HOPS; hop += 1) {
+      const recorded = input.probe.recordedBase(cursor);
+      if (!recorded)
+        return null;
+      const base = short(recorded);
+      const owner = ownerOf(base);
+      if (owner)
+        return owner;
+      if (ownedBy(candidates, base).length > 1 || seen.has(base))
+        return null;
+      seen.add(base);
+      cursor = base;
+    }
+    return null;
+  };
+  const recordedOwner = followRecorded(branch);
+  if (recordedOwner)
+    return done(recordedOwner, "recorded-base", `${branch} was created on ${label(recordedOwner)}'s line (recorded base)`);
+  for (const source of ["reflog", "checkout"]) {
+    const ref = source === "reflog" ? input.probe.createdFrom(branch) : input.probe.checkedOutFrom(branch);
+    if (!ref)
+      continue;
+    const owner = ownerOf(ref) ?? followRecorded(short(ref));
+    if (owner)
+      return done(owner, source, `${branch} was created from ${short(ref)} (${source === "reflog" ? "branch reflog" : "HEAD reflog"})`);
+  }
+  const forks = [];
+  for (const track of candidates)
+    for (const ref of new Set([track.integrationBranch, track.baseBranch])) {
+      const sha = input.probe.mergeBase(branch, ref);
+      if (sha)
+        forks.push({ track, ref, sha });
+    }
+  if (forks.length === 0)
+    return fallback(`no track branch could be compared with ${branch} (fetch the track branches)`);
+  const ancestry = new Map;
+  const descends = (older, newer) => {
+    if (older === newer)
+      return false;
+    const key = `${older}>${newer}`;
+    if (!ancestry.has(key))
+      ancestry.set(key, input.probe.isAncestor(older, newer));
+    return ancestry.get(key);
+  };
+  const winners = forks.filter((fork) => forks.every((other) => other.track === fork.track || descends(other.sha, fork.sha)));
+  const winningTracks = [...new Set(winners.map((fork) => fork.track))];
+  if (winningTracks.length === 1 && forks.some((fork) => fork.track !== winningTracks[0])) {
+    const win = winners[0];
+    return done(win.track, "ancestry", `${branch} forked from ${win.ref} at ${win.sha.slice(0, 12)}, after every other line's fork point`);
+  }
+  if (winningTracks.length === 1)
+    return fallback(`only ${label(winningTracks[0])} could be compared with ${branch}`);
+  const newest = forks.filter((fork) => !forks.some((other) => descends(fork.sha, other.sha)));
+  return fallback(`${branch} has the same or unrelated fork points with ${[...new Set(newest.map((fork) => `${fork.ref} (${fork.track.name === IMPLICIT ? "workspace default" : fork.track.name})`))].join(" and ")}`);
+}
+var git4 = (cwd, args) => {
+  const run = spawnSync7("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 20000,
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  return run.status === 0 ? (run.stdout ?? "").trim() : null;
+};
+var recordedBaseKey = (branch) => `branch.${branch}.workitBase`;
+var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+var reflog = (cwd, ref) => (git4(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
+`).map((line) => {
+  const [sha = "", selector = "", ...subject] = line.split("\t");
+  return {
+    sha,
+    time: Number(/@\{(\d+)\}$/u.exec(selector)?.[1] ?? Number.NaN),
+    subject: subject.join("\t")
+  };
+}).filter((entry) => entry.sha && Number.isFinite(entry.time));
+function gitTrackProbe(cwd) {
+  let remote;
+  let remotes;
+  const tip = (branch) => {
+    remote ??= pushRemoteName(cwd) ?? "origin";
+    return resolveRef(cwd, `refs/remotes/${remote}/${branch}`) ?? resolveRef(cwd, `refs/heads/${branch}`);
+  };
+  return {
+    remotes: () => remotes ??= remoteNames(cwd),
+    recordedBase: (branch) => git4(cwd, ["config", "--get", recordedBaseKey(branch)]) || null,
+    createdFrom: (branch) => {
+      const log = git4(cwd, ["reflog", "show", "--format=%gs", `refs/heads/${branch}`, "--"]);
+      const oldest = log?.split(`
+`).findLast(Boolean) ?? "";
+      const match = /^branch: Created from (\S+)$/u.exec(oldest);
+      return match && match[1] !== "HEAD" ? match[1] : null;
+    },
+    checkedOutFrom: (branch) => {
+      const own = reflog(cwd, `refs/heads/${branch}`);
+      const created = own.at(-1);
+      if (!created || created.subject !== "branch: Created from HEAD")
+        return null;
+      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp(branch)}$`, "u");
+      const entry = reflog(cwd, "HEAD").findLast((item) => item.time >= created.time && item.sha === created.sha && pattern.test(item.subject));
+      return entry ? pattern.exec(entry.subject)?.[1] ?? null : null;
+    },
+    mergeBase: (branch, trackBranch) => {
+      const base = tip(trackBranch);
+      return base && resolveRef(cwd, `refs/heads/${branch}`) ? mergeBase(cwd, base, `refs/heads/${branch}`) : null;
+    },
+    isAncestor: (ancestor, descendant) => git4(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]) !== null
+  };
+}
+function workspaceReleaseTracks(cwd) {
+  const raw = resolveRuntimeReleaseTracks(cwd);
+  return { workspace: raw?.workspace ?? null, ...readReleaseTracks(raw?.releaseTracks) };
+}
+var memo3 = new Map;
+var MEMO_LIMIT = 64;
+function resolveTrackFor(cwd, options) {
+  const read = workspaceReleaseTracks(cwd);
+  if (read.error)
+    return { status: "invalid", error: read.error, issues: read.issues };
+  if (read.tracks.length === 0 && !options.track?.trim())
+    return { status: "none", issues: read.issues };
+  const branch = options.branch === undefined ? currentBranch(cwd) : options.branch;
+  const envRequested = process.env.WORKFLOW_RELEASE_TRACK?.trim() || null;
+  const input = {
+    tracks: read.tracks,
+    requested: options.track ?? null,
+    envRequested,
+    branch,
+    defaultBranch: options.defaultBranch,
+    issues: read.issues
+  };
+  let key = null;
+  if (!options.probe) {
+    const refs = git4(cwd, [
+      "for-each-ref",
+      "--format=%(refname) %(objectname)",
+      "refs/heads",
+      "refs/remotes"
+    ]) ?? "";
+    const head = git4(cwd, ["reflog", "show", "-n", "1", "--format=%H %gs", "HEAD", "--"]) ?? "";
+    const own = branch ? [
+      git4(cwd, [
+        "log",
+        "-g",
+        "-n",
+        "1",
+        "--date=unix",
+        "--format=%H %gd %gs",
+        `refs/heads/${branch}`,
+        "--"
+      ]) ?? "",
+      git4(cwd, ["config", "--get", recordedBaseKey(branch)]) ?? ""
+    ] : [];
+    key = createHash9("sha256").update(JSON.stringify({ cwd, input, refs, head, own })).digest("hex");
+    const hit = memo3.get(key);
+    if (hit)
+      return hit;
+  }
+  const resolution = resolveReleaseTrack({ ...input, probe: options.probe ?? gitTrackProbe(cwd) });
+  if (key) {
+    if (memo3.size >= MEMO_LIMIT)
+      memo3.delete(memo3.keys().next().value);
+    memo3.set(key, resolution);
+  }
+  return resolution;
+}
+
+// packages/workit-core/src/core/vcs-config.ts
+var workspacesPath = () => path14.join(configDir(), "workspaces.json");
 var vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd();
 var remoteProvider = (cwd) => {
-  const r = spawnSync7("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  const r = spawnSync8("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
   if (r.status !== 0)
     return null;
   const url = (r.stdout ?? "").trim();
@@ -20989,7 +21419,7 @@ var remoteEndpoint = (remote) => {
 var configuredSshEndpoint = (host) => {
   if (host.startsWith("-"))
     return null;
-  const resolved = spawnSync7("ssh", ["-G", host], {
+  const resolved = spawnSync8("ssh", ["-G", host], {
     encoding: "utf8",
     timeout: 5000,
     maxBuffer: 1024 * 1024,
@@ -21054,7 +21484,16 @@ var readVcsConfig = () => {
   }
   return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
 };
-function vcsConfig(mode, cwd) {
+var trackSummary = (resolution) => resolution.status === "resolved" ? {
+  name: resolution.track?.name ?? null,
+  source: resolution.source,
+  detail: resolution.detail,
+  warnings: resolution.warnings,
+  track: resolution.track,
+  tracks: resolution.tracks,
+  blocking: resolution.blocking
+} : null;
+function vcsConfig(mode, cwd, options = {}) {
   const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
   const wsVcs = ws?.vcs ?? {};
   const wsYt = ws?.youtrack ?? {};
@@ -21064,10 +21503,7 @@ function vcsConfig(mode, cwd) {
   const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
   const rawProvider = wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? null;
   const provider = rawProvider === null || rawProvider === undefined ? null : String(rawProvider).toLowerCase() || null;
-  const wp = ws?.branchPolicy ?? {};
-  const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
-  const policyDefault = resolveBranchPolicyFor(root).defaultTargetBranch;
-  const defaultTarget = String(wsVcs.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : cfg.defaultTargetBranch ?? policyDefault) ?? "develop");
+  const workspaceDefault = workspaceDefaultTarget(root, cfg.defaultTargetBranch);
   const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
   const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   let issuesProvider = null;
@@ -21079,11 +21515,24 @@ function vcsConfig(mode, cwd) {
   if (mode === "resolve") {
     if (cfgStatus === "malformed")
       return { ok: false, error: cfgError, configPath: cfgPath };
+    const trackResolution = resolveTrackFor(root, {
+      track: options.track,
+      ...options.branch !== undefined ? { branch: options.branch } : {},
+      defaultBranch: workspaceDefault
+    });
+    if (trackResolution.status === "invalid")
+      return { ok: false, error: trackResolution.error, configPath: workspacesPath() };
+    const releaseTrack = trackSummary(trackResolution);
+    const defaultTarget = releaseTrack?.track?.pullRequestTarget ?? workspaceDefault;
+    const baseBranch = releaseTrack?.track?.baseBranch ?? defaultTarget;
     return {
       ok: true,
       workspace_name: ws?.name ?? null,
       provider,
       defaultTargetBranch: defaultTarget,
+      workspaceDefaultTargetBranch: workspaceDefault,
+      baseBranch,
+      releaseTrack,
       link_issues: linkIssues,
       youtrack_base_url: youtrackBaseUrl,
       issues_provider: issuesProvider,
@@ -21107,7 +21556,7 @@ function vcsConfig(mode, cwd) {
     ok: true,
     configPath: path14.resolve(cfgPath),
     provider,
-    defaultTargetBranch: defaultTarget,
+    defaultTargetBranch: workspaceDefault,
     pr: cfg.pr ?? {},
     workspace_name: ws?.name ?? null,
     link_issues: linkIssues,
@@ -21143,7 +21592,7 @@ function mergedPrStyle(limit = 6, cwd) {
 `).filter((l) => l.startsWith("## ")).map((l) => l.trim()),
     descriptionPreview: desc.slice(0, 600)
   });
-  const remoteResult = spawnSync7("git", ["remote", "get-url", "--push", "--all", "origin"], {
+  const remoteResult = spawnSync8("git", ["remote", "get-url", "--push", "--all", "origin"], {
     cwd,
     encoding: "utf8"
   });
@@ -21159,7 +21608,7 @@ function mergedPrStyle(limit = 6, cwd) {
   if (!hostingApiHostMatches(remote, host))
     return { ok: false, error: "PR style target does not match the provider host" };
   if (provider === "gitlab") {
-    const run = (args) => spawnSync7("glab", ["api", ...args], {
+    const run = (args) => spawnSync8("glab", ["api", ...args], {
       cwd,
       encoding: "utf8",
       env
@@ -21179,7 +21628,7 @@ function mergedPrStyle(limit = 6, cwd) {
       });
     }
   } else if (provider === "github") {
-    const r = spawnSync7("gh", [
+    const r = spawnSync8("gh", [
       "pr",
       "list",
       "--repo",
@@ -21210,20 +21659,6 @@ function mergedPrStyle(limit = 6, cwd) {
     examples
   };
 }
-
-// packages/workit-core/src/core/branch.ts
-function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
-  const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
-  const config = readConfig();
-  return kind === "branch" ? {
-    branchPolicy: resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null),
-    provenance: { branchPolicy: selected.source }
-  } : {
-    commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
-    provenance: { commitPolicy: selected.source }
-  };
-}
-var resolveBranchPolicyFor = (workspaceRoot, profileName) => effectiveWorkspacePolicy(workspaceRoot, "branch", profileName).branchPolicy;
 // packages/workit-core/src/core/task-engine.ts
 import { realpathSync as realpathSync4 } from "node:fs";
 
@@ -21431,10 +21866,51 @@ var DEFAULT_GRANTS = Object.freeze({
   release: false,
   rerun: true
 });
+var DEFAULT_ENDPOINTS = ["commit", "pr", "green", "merged"];
 var DEFAULT_ENDPOINT = "commit";
+var isDefaultEndpoint = (value) => typeof value === "string" && DEFAULT_ENDPOINTS.includes(value);
+function endpointOf(entry) {
+  const raw = entry?.defaultEndpoint;
+  if (raw === undefined)
+    return { raw, endpoint: DEFAULT_ENDPOINT };
+  if (isDefaultEndpoint(raw))
+    return { raw, endpoint: raw };
+  return {
+    raw,
+    endpoint: DEFAULT_ENDPOINT,
+    issue: `defaultEndpoint ${JSON.stringify(raw)} is not one of ${DEFAULT_ENDPOINTS.join(", ")}; using ${DEFAULT_ENDPOINT}`
+  };
+}
+function effectiveEndpoint(endpoint, context) {
+  if (endpoint === "commit")
+    return { endpoint };
+  const missing = (kind) => `${kind} grant missing; ${grantHint(context.workspace, kind)}`;
+  if (context.grants.push === false)
+    return { endpoint: "commit", reason: missing("push") };
+  if (context.grants.pr === false)
+    return { endpoint: "commit", reason: missing("pr") };
+  if (context.configured.length > 0 && !context.accountConfigured)
+    return {
+      endpoint: "commit",
+      reason: `vcs.account missing; set vcs.account for workspace "${context.workspace ?? "?"}" in ~/.config/workit/workspaces.json`
+    };
+  if (endpoint === "merged" && context.grants.merge === false)
+    return { endpoint: "green", reason: missing("merge") };
+  return { endpoint };
+}
+function endpointView(entry, context) {
+  const { raw, endpoint, issue } = endpointOf(entry);
+  const effective = effectiveEndpoint(endpoint, context);
+  return {
+    defaultEndpoint: endpoint,
+    configuredEndpoint: raw ?? null,
+    effectiveEndpoint: effective.endpoint,
+    ...effective.reason ? { endpointReason: effective.reason } : {},
+    ...issue ? { endpointIssue: issue } : {}
+  };
+}
 var DEFAULT_VERIFICATION = "self";
 var verificationOf = (entry) => entry?.verification === "independent" ? "independent" : "self";
-var endpointOf = (entry) => entry?.defaultEndpoint === "pr" ? "pr" : "commit";
 var isGrantValue = (value) => value === true || value === false || value === "verified";
 var normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value;
 var fromAutoApprove = (value) => {
@@ -21475,21 +21951,33 @@ function resolveAutonomy(cwd) {
       source: "default",
       accountConfigured: false,
       defaultEndpoint: DEFAULT_ENDPOINT,
+      configuredEndpoint: null,
+      effectiveEndpoint: DEFAULT_ENDPOINT,
       verification: DEFAULT_VERIFICATION,
       note: override
     };
   const workspace = resolveWorkspaceFrom(cwd, grantsDir(), process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
   const { grants, source } = configuredGrants(workspace);
+  const full = { ...DEFAULT_GRANTS, ...grants };
+  const configured = GRANT_KINDS.filter((kind) => grants[kind] !== undefined);
+  const accountConfigured = Boolean(workspace?.vcs?.account);
   return {
     workspace: workspace?.name ?? null,
-    grants: { ...DEFAULT_GRANTS, ...grants },
-    configured: GRANT_KINDS.filter((kind) => grants[kind] !== undefined),
+    grants: full,
+    configured,
     source,
-    accountConfigured: Boolean(workspace?.vcs?.account),
-    defaultEndpoint: endpointOf(workspace),
+    accountConfigured,
+    ...endpointView(workspace, {
+      workspace: workspace?.name ?? null,
+      grants: full,
+      configured,
+      accountConfigured
+    }),
     verification: verificationOf(workspace)
   };
 }
+var suggested = (kind) => kind === "merge" ? "verified" : "true";
+var grantHint = (workspace, kind) => `ask the user to run, in their own terminal: workit grant set ${workspace ?? "<workspace>"} ${kind}=${suggested(kind)}`;
 
 // packages/workit-core/src/core/task-engine.ts
 var workspaceVerification = (root) => {
@@ -23077,7 +23565,7 @@ class WorkitCore {
   }
 }
 // packages/workit-core/src/core/repo-context.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "node:fs";
 import path16 from "node:path";
 var isSafeContextRange = (value) => value.length <= 4096 && (() => {
@@ -23106,7 +23594,7 @@ var invalidRange = (cwd) => ({
   cwd
 });
 var runGit = (cwd, args) => {
-  const result = spawnSync8("git", args, { cwd, encoding: "utf8" });
+  const result = spawnSync9("git", args, { cwd, encoding: "utf8" });
   return {
     stdout: (result.stdout ?? "").trimEnd(),
     stderr: (result.stderr ?? "").trimEnd(),
@@ -23547,12 +24035,12 @@ function releaseNotesContext(root, rangeOrTag) {
 }
 
 // packages/workit-core/src/core/tracker-issues.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 
 // packages/workit-core/src/core/pr-create.ts
 import fs13 from "node:fs";
 import path17 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 // packages/workit-core/src/forge/pr-body.ts
 function parseGhIssue(value) {
   const m = /issues\/(\d+)/.exec(value);
@@ -23577,7 +24065,7 @@ function whichOnPath(tool) {
 }
 var hostingCliAvailable = (provider) => whichOnPath(provider === "gitlab" ? "glab" : "gh") !== null;
 var pushRemote = (cwd) => {
-  const result = spawnSync9("git", ["remote", "get-url", "--push", "--all", "origin"], {
+  const result = spawnSync10("git", ["remote", "get-url", "--push", "--all", "origin"], {
     cwd,
     encoding: "utf8"
   });
@@ -23608,7 +24096,7 @@ var defaultCli = (bin, available) => {
   if (!available)
     return null;
   return (args, root) => {
-    const out = spawnSync10(bin, args, {
+    const out = spawnSync11(bin, args, {
       cwd: root,
       encoding: "utf8",
       env: { ...process.env, PATH: process.env.PATH ?? "" }
@@ -24126,7 +24614,7 @@ function resolveInside(root, candidate) {
 }
 function run2(root, executable, args, env = {}) {
   const cwd = realpathSync5(root);
-  const result = spawnSync11(executable, args, {
+  const result = spawnSync12(executable, args, {
     cwd,
     encoding: "utf8",
     env: { ...process.env, ...env }
@@ -26572,8 +27060,8 @@ var SENSITIVE_WORDS = new Set([
   "query"
 ]);
 var STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
-var escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-var homePattern = new RegExp(`${escapeRegExp(os4.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
+var escapeRegExp2 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var homePattern = new RegExp(`${escapeRegExp2(os4.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
 var applyPatterns = (value) => {
   let out = value;
   out = out.replace(SECRET_VALUE, REDACTED);