@brainervirus/workit-core 0.6.0 → 0.7.0

package/src/core/branch.ts

@@ -3,22 +3,46 @@ import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { gitContext } from "./git";
 import { readConfig, resolveBranchPolicy } from "./config";
+import { resolveWorkspace } from "./workspaces";
+import { vcsConfig } from "./vcs-config";
 
-const policy = () => resolveBranchPolicy(readConfig());
-const allowedBranch = (name: string) => policy().allowed.some((r) => r.test(name));
-const isProtected = (name: string) => policy().protected.has(name.toLowerCase());
+/** CA-09: the one policy resolver every consumer calls. */
+export const resolveBranchPolicyFor = (workspaceRoot: string) =>
+  resolveBranchPolicy(readConfig(), resolveWorkspace(workspaceRoot));
+
+const policy = (root: string) => resolveBranchPolicyFor(root);
+const allowedBranch = (root: string, name: string) =>
+  policy(root).allowed.some((r) => r.test(name));
+const isProtected = (root: string, name: string) => policy(root).protected.has(name.toLowerCase());
+// RL-01: malformed vcs.json blocks branch resolution with an exact-path error.
+const baseBranch = (cwd: string): { base: string } | { error: string } => {
+  const resolved = vcsConfig("resolve", cwd);
+  if (resolved.ok === false) return { error: String(resolved.error) };
+  return { base: String(resolved.defaultTargetBranch ?? "develop") };
+};
 const DECLARE_RE = /^\s*\*+Branch:\*+\s*`?([^`\s|]+)`?\s*$/gim;
 const USE_CURRENT_RE = /^\s*\*+Branch:\*+\s*use-current\s*$/im;
 const readSafe = (p: string): string | null => {
-  try { return readFileSync(p, "utf8"); } catch { return null; }
+  try {
+    return readFileSync(p, "utf8");
+  } catch {
+    return null;
+  }
 };
 
-const normalizeBranch = (name: string): string | null => {
+const normalizeBranch = (root: string, name: string): string | null => {
   const n = name.trim().replace(/`/g, "").replace(/\.+$/, "");
-  if (isProtected(n)) return null;
-  if (!allowedBranch(n)) return null;
-  const parts = n.toLowerCase().split("/").map((p) =>
-    p.replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-"));
+  if (isProtected(root, n)) return null;
+  if (!allowedBranch(root, n)) return null;
+  const parts = n
+    .toLowerCase()
+    .split("/")
+    .map((p) =>
+      p
+        .replace(/[^\w.-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .replace(/-{2,}/g, "-"),
+    );
   if (parts.some((p) => !p)) return null;
   return parts.join("/");
 };
@@ -29,14 +53,21 @@ const deriveSlug = (planPath: string): string => {
   return dirName === "." || dirName === "/" || dirName === "" ? "" : dirName;
 };
 
-const deriveKind = (planPath: string, fallback: "feature" | "bugfix" = "feature"): "feature" | "bugfix" => {
+const deriveKind = (
+  planPath: string,
+  fallback: "feature" | "bugfix" = "feature",
+): "feature" | "bugfix" => {
   const slug = deriveSlug(planPath);
   const text = readSafe(planPath) ?? "";
   let kind = fallback;
   if (/\bbugfix\b/i.test(slug) || /^fix-/i.test(slug)) {
     kind = "bugfix";
   } else {
-    const goal = text.split("\n").find((line) => line.startsWith("**Goal:**"))?.toLowerCase() ?? "";
+    const goal =
+      text
+        .split("\n")
+        .find((line) => line.startsWith("**Goal:**"))
+        ?.toLowerCase() ?? "";
     if (/\b(bugfix|bug fix)\b/.test(goal) && !/\b(feat|feature|upgrade|add)\b/.test(goal)) {
       kind = "bugfix";
     }
@@ -49,7 +80,11 @@ export const resolveBranch = ({
   spec_path,
   plan_path,
   workspace_root,
-}: { spec_path: string; plan_path: string; workspace_root: string }) => {
+}: {
+  spec_path: string;
+  plan_path: string;
+  workspace_root: string;
+}) => {
   const cwd = path.resolve(workspace_root);
   const abs = (p: string) => (path.isAbsolute(p) ? p : path.join(cwd, p));
   const spec = abs(spec_path);
@@ -69,27 +104,30 @@ export const resolveBranch = ({
     const text = readSafe(file);
     if (!text) continue;
     if (USE_CURRENT_RE.test(text)) {
-      if (!current || !allowedBranch(current) || isProtected(current)) {
+      if (!current || !allowedBranch(cwd, current) || isProtected(cwd, current)) {
         return { error: `use-current but HEAD ${current} is not an allowed branch` };
       }
       return finish(current, "use-current");
     }
   }
 
-  if (current && allowedBranch(current) && !isProtected(current)) return finish(current, "keep-current");
+  if (current && allowedBranch(cwd, current) && !isProtected(cwd, current))
+    return finish(current, "keep-current");
 
   let declaredButInvalid: string | null = null;
   for (const file of [spec, plan]) {
     const text = readSafe(file);
     if (!text) continue;
     for (const match of text.matchAll(DECLARE_RE)) {
-      const normalized = normalizeBranch(match[1]);
+      const normalized = normalizeBranch(cwd, match[1]);
       if (normalized) return finish(normalized, file === spec ? "spec" : "plan");
       declaredButInvalid ??= match[1];
     }
   }
   if (declaredButInvalid) {
-    return { error: `declared branch ${JSON.stringify(declaredButInvalid)} is not allowed by the branch policy` };
+    return {
+      error: `declared branch ${JSON.stringify(declaredButInvalid)} is not allowed by the branch policy`,
+    };
   }
 
   const slug = deriveSlug(plan);
@@ -103,55 +141,103 @@ export const docsBranch = ({
   plan_path,
   kind,
   workspace_root,
-}: { plan_path?: string; kind?: string; workspace_root: string }) => {
+}: {
+  plan_path?: string;
+  kind?: string;
+  workspace_root: string;
+}) => {
   const cwd = path.resolve(workspace_root);
   const git = gitContext(cwd);
   const current = git.branch;
   const kindArg = (kind ?? "feature").toLowerCase();
+  const baseResolved = baseBranch(cwd);
+  if ("error" in baseResolved) return { error: baseResolved.error };
+  const base = baseResolved.base;
 
-  if (current && allowedBranch(current) && !isProtected(current)) {
-    return { branch: current, action: "keep", current_branch: current, base: "develop", dirty: Boolean(git.status_short.trim()) };
-  }
-  if (current === "main" || current === "master" || current === "develop") {
+  if (current === base || current === "main" || current === "master" || current === "develop") {
     let slug = "";
     if (plan_path) {
       const plan = path.isAbsolute(plan_path) ? plan_path : path.join(cwd, plan_path);
       slug = deriveSlug(plan);
     }
     if (!slug) {
-      return { error: "plan_path required to derive branch slug when not on feature/* or bugfix/*" };
+      return {
+        error: "plan_path required to derive branch slug when not on feature/* or bugfix/*",
+      };
     }
     const branchKind = kindArg === "bugfix" ? "bugfix" : "feature";
-    return { branch: `${branchKind}/${slug}`, action: "create_from_develop", current_branch: current, base: "develop", dirty: Boolean(git.status_short.trim()) };
+    return {
+      branch: `${branchKind}/${slug}`,
+      action: base === "develop" ? "create_from_develop" : "create_from_base",
+      current_branch: current,
+      base,
+      dirty: Boolean(git.status_short.trim()),
+    };
+  }
+  if (current && allowedBranch(cwd, current) && !isProtected(cwd, current)) {
+    return {
+      branch: current,
+      action: "keep",
+      current_branch: current,
+      base,
+      dirty: Boolean(git.status_short.trim()),
+    };
   }
   return { error: `cannot resolve docs branch from HEAD ${JSON.stringify(current)}` };
 };
 
 // Port of scripts/lib/ensure-develop-base.sh
-export const ensureDevelopBase = (cwd: string): { ok: boolean; error?: string } => {
+export const ensureBaseBranch = (cwd: string, base: string): { ok: boolean; error?: string } => {
   const git = gitContext(cwd);
-  if (!git.branch || git.branch === "unknown") return { ok: false, error: "not in a git repository" };
-  const run = (args: string[]) => execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
+  if (!git.branch || git.branch === "unknown")
+    return { ok: false, error: "not in a git repository" };
+  const run = (args: string[]) =>
+    execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
   try {
     try {
-      run(["fetch", "origin", "develop", "--prune"]);
+      run(["fetch", "origin", base, "--prune"]);
     } catch {
       run(["fetch", "origin", "--prune"]);
     }
-    let hasOriginDevelop = true;
-    try { execFileSync("git", ["show-ref", "--verify", "--quiet", "refs/remotes/origin/develop"], { cwd, stdio: "pipe" }); } catch { hasOriginDevelop = false; }
-    if (!hasOriginDevelop) return { ok: false, error: "origin/develop missing — push develop before creating feature/* or bugfix/* branches" };
-    let hasLocalDevelop = true;
-    try { execFileSync("git", ["show-ref", "--verify", "--quiet", "refs/heads/develop"], { cwd, stdio: "pipe" }); } catch { hasLocalDevelop = false; }
-    if (hasLocalDevelop) {
-      run(["checkout", "develop"]);
-      try { run(["merge", "--ff-only", "origin/develop"]); } catch { /* non-fast-forward: keep local */ }
+    let hasOriginBase = true;
+    try {
+      execFileSync("git", ["show-ref", "--verify", "--quiet", `refs/remotes/origin/${base}`], {
+        cwd,
+        stdio: "pipe",
+      });
+    } catch {
+      hasOriginBase = false;
+    }
+    if (!hasOriginBase)
+      return {
+        ok: false,
+        error: `origin/${base} missing — push ${base} before creating feature/* or bugfix/* branches`,
+      };
+    let hasLocalBase = true;
+    try {
+      execFileSync("git", ["show-ref", "--verify", "--quiet", `refs/heads/${base}`], {
+        cwd,
+        stdio: "pipe",
+      });
+    } catch {
+      hasLocalBase = false;
+    }
+    if (hasLocalBase) {
+      run(["checkout", base]);
+      try {
+        run(["merge", "--ff-only", `origin/${base}`]);
+      } catch {
+        /* non-fast-forward: keep local */
+      }
     } else {
-      run(["checkout", "-b", "develop", "--track", "origin/develop"]);
+      run(["checkout", "-b", base, "--track", `origin/${base}`]);
     }
     return { ok: true };
   } catch (error) {
-    return { ok: false, error: error instanceof Error ? error.message : "ensure-develop-base failed" };
+    return {
+      ok: false,
+      error: error instanceof Error ? error.message : "ensure-base-branch failed",
+    };
   }
 };
 
@@ -162,17 +248,29 @@ export const branchSetup = ({
   target_branch,
   stash,
   workspace_root,
-}: { action?: string; sdd_dir?: string; target_branch?: string; stash?: string; workspace_root: string }) => {
+}: {
+  action?: string;
+  sdd_dir?: string;
+  target_branch?: string;
+  stash?: string;
+  workspace_root: string;
+}) => {
   const cwd = path.resolve(workspace_root);
   const exec = (args: string[]): string =>
     execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
   const current = gitContext(cwd).branch;
   if (!current || current === "unknown") return { error: "not in a git repository" };
   const sdd = sdd_dir ?? "docs";
-  const manifestPath = path.isAbsolute(sdd) ? path.join(sdd, "manifest.json") : path.join(cwd, sdd, "manifest.json");
+  const manifestPath = path.isAbsolute(sdd)
+    ? path.join(sdd, "manifest.json")
+    : path.join(cwd, sdd, "manifest.json");
   mkdirSync(path.dirname(manifestPath), { recursive: true, mode: 0o755 });
   const readManifest = (): Record<string, unknown> => {
-    try { return JSON.parse(readFileSync(manifestPath, "utf8")); } catch { return {}; }
+    try {
+      return JSON.parse(readFileSync(manifestPath, "utf8"));
+    } catch {
+      return {};
+    }
   };
   const writeManifest = (data: Record<string, unknown>) =>
     writeFileSync(manifestPath, JSON.stringify(data, null, 2) + "\n", "utf8");
@@ -181,7 +279,9 @@ export const branchSetup = ({
     const manifest = readManifest();
     const ref = manifest.stash_ref;
     if (!ref) return { error: "no stash_ref in manifest" };
-    try { exec(["stash", "pop", String(ref)]); } catch (error) {
+    try {
+      exec(["stash", "pop", String(ref)]);
+    } catch (error) {
       return { error: error instanceof Error ? error.message : "stash pop failed" };
     }
     delete manifest.stash_ref;
@@ -192,15 +292,19 @@ export const branchSetup = ({
 
   const target = target_branch ?? "";
   if (!target) return { error: "target branch required" };
-  if (isProtected(target)) return { error: `protected branch ${target}` };
-  if (!allowedBranch(target)) return { error: `target branch ${target} is not allowed by the branch policy` };
+  if (isProtected(cwd, target)) return { error: `protected branch ${target}` };
+  if (!allowedBranch(cwd, target))
+    return { error: `target branch ${target} is not allowed by the branch policy` };
 
   let stash_ref: string | undefined;
   if (current !== target) {
     const dirty = Boolean(gitContext(cwd).status_short.trim());
     if (dirty) {
       if (stash !== "yes") {
-        return { error: "dirty working tree — ask with native question, then call workflow_branch_setup with stash=yes" };
+        return {
+          error:
+            "dirty working tree — ask with native question, then call workflow_branch_setup with stash=yes",
+        };
       }
       try {
         exec(["stash", "push", "-u", "-m", `workit: pre-checkout ${target}`, "--", ":!docs/*/sdd"]);
@@ -214,22 +318,20 @@ export const branchSetup = ({
     } catch (error) {
       const message = error instanceof Error ? error.message : "checkout failed";
       if (/worktree/i.test(message)) {
-        return { error: `branch ${target} is locked by an existing git worktree — remove it first (we do not use worktrees)` };
+        return {
+          error: `branch ${target} is locked by an existing git worktree — remove it first (we do not use worktrees)`,
+        };
       }
       try {
-        // Branch does not exist yet: base it on develop (never main/master).
-        const current = gitContext(cwd).branch;
-        if (current === "main" || current === "master") {
-          const baseResult = ensureDevelopBase(cwd);
-          if (!baseResult.ok) return { error: baseResult.error };
-        } else {
-          // Already on develop or another feature branch: still require origin/develop to exist.
-          const baseResult = ensureDevelopBase(cwd);
-          if (!baseResult.ok) return { error: baseResult.error };
-        }
+        const baseResolved = baseBranch(cwd);
+        if ("error" in baseResolved) return { error: baseResolved.error };
+        const baseResult = ensureBaseBranch(cwd, baseResolved.base);
+        if (!baseResult.ok) return { error: baseResult.error };
         exec(["checkout", "-b", target]);
       } catch (createError) {
-        return { error: createError instanceof Error ? createError.message : "branch create failed" };
+        return {
+          error: createError instanceof Error ? createError.message : "branch create failed",
+        };
       }
     }
   }
@@ -242,5 +344,12 @@ export const branchSetup = ({
     manifest.stash_created_at = new Date().toISOString();
   }
   writeManifest(manifest);
-  return { action: "setup", ok: true, branch: target, previous_branch: current, stash_ref: stash_ref ?? null, manifest: manifestPath };
+  return {
+    action: "setup",
+    ok: true,
+    branch: target,
+    previous_branch: current,
+    stash_ref: stash_ref ?? null,
+    manifest: manifestPath,
+  };
 };

package/src/core/changelog.ts

@@ -2,14 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { resolveWorkspaceRoot } from "./scripts";
 
-const CATEGORIES = [
-  "Added",
-  "Changed",
-  "Deprecated",
-  "Removed",
-  "Fixed",
-  "Security",
-];
+const CATEGORIES = ["Added", "Changed", "Deprecated", "Removed", "Fixed", "Security"];
 
 // Port of scripts/changelog/apply-unreleased.py — merge Keep a Changelog
 // entries into ## [Unreleased] without duplicating ### headings.
@@ -73,10 +66,21 @@ function splitUnreleased(text: string): [string, string, string] {
 function canonicalCategory(heading: string): string | null {
   const match = CAT_RE.exec(heading.replace(/\r?\n$/, ""));
   if (!match) return null;
-  return CATEGORIES.find((c) => c.toLowerCase() === match[0].replace(/^###\s+/, "").trim().toLowerCase()) ?? null;
+  return (
+    CATEGORIES.find(
+      (c) =>
+        c.toLowerCase() ===
+        match[0]
+          .replace(/^###\s+/, "")
+          .trim()
+          .toLowerCase(),
+    ) ?? null
+  );
 }
 
-function splitSections(body: string): [string[], Array<{ heading: string; category: string | null; body: string[] }>] {
+function splitSections(
+  body: string,
+): [string[], Array<{ heading: string; category: string | null; body: string[] }>] {
   const preamble: string[] = [];
   const sections: Array<{ heading: string; category: string | null; body: string[] }> = [];
   let current: { heading: string; category: string | null; body: string[] } | null = null;
@@ -207,7 +211,8 @@ function applyChangelog(
         break;
       }
     }
-    text = lines.slice(0, insertAt).join("") + "## [Unreleased]\n\n" + lines.slice(insertAt).join("");
+    text =
+      lines.slice(0, insertAt).join("") + "## [Unreleased]\n\n" + lines.slice(insertAt).join("");
   }
 
   const [before, body, after] = splitUnreleased(text);
@@ -290,9 +295,7 @@ export function changelogApply({
 
 export function changelogUnreleasedStats(workspace_root: string, changelogPath = "CHANGELOG.md") {
   const cwd = resolveWorkspaceRoot(workspace_root);
-  const abs = path.isAbsolute(changelogPath)
-    ? changelogPath
-    : path.join(cwd, changelogPath);
+  const abs = path.isAbsolute(changelogPath) ? changelogPath : path.join(cwd, changelogPath);
   if (!fs.existsSync(abs)) return { exists: false };
   const text = fs.readFileSync(abs, "utf8");
   const m = text.match(/##\s+\[Unreleased\]([\s\S]*?)(?=\n##\s+\[|$)/i);

package/src/core/config-guard.ts

@@ -1,13 +1,20 @@
 import { initStatus } from "./init";
 
-export const ALL_ITEM_IDS = ["youtrack_json", "youtrack_token", "vcs_json", "gitlab_token", "github_token"];
+export const ALL_ITEM_IDS = [
+  "youtrack_json",
+  "youtrack_token",
+  "vcs_json",
+  "gitlab_token",
+  "github_token",
+];
 export const CONFIG_GAP_MARKER = "workflow config missing";
 
 export function describeConfigGaps(scope?: string[]): { missing: string[]; ok: boolean } {
   const all = scope ?? ALL_ITEM_IDS;
   try {
     const status: unknown = initStatus();
-    if (!status || typeof status !== "object" || (status as Record<string, unknown>).error) return { missing: all, ok: false };
+    if (!status || typeof status !== "object" || (status as Record<string, unknown>).error)
+      return { missing: all, ok: false };
     const items = (status as Record<string, unknown>).items;
     if (!Array.isArray(items) || items.length === 0) return { missing: all, ok: false };
     const known = all;