@brainervirus/workit-core 0.6.1 → 0.7.1

package/src/core/vcs-config.ts

@@ -3,7 +3,7 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { configDir } from "./config";
 import { resolveWorkspace } from "./workspaces";
-
+import { resolveBranchPolicyFor } from "./branch";
 // Ports of scripts/vcs/config.sh + verify-token.sh + token-create-urls.sh + merged-style.sh.
 // Token never printed.
 
@@ -17,22 +17,52 @@ const workspacesPath = (): string => path.join(configDir(), "workspaces.json");
 const vcsCwd = (cwd?: string): string =>
   process.env.WORKFLOW_WORKSPACE_ROOT ?? cwd ?? process.cwd();
 
-function readVcsJson(): { config: Record<string, any>; path: string; ok: boolean } {
-  const cfgPath = vcsConfigPath();
-  let config: Record<string, any> = {};
-  let ok = false;
-  if (fs.existsSync(cfgPath)) {
-    try {
-      const parsed = JSON.parse(fs.readFileSync(cfgPath, "utf8")) as unknown;
-      if (parsed && typeof parsed === "object") {
-        config = parsed as Record<string, any>;
-        ok = true;
-      }
-    } catch {
-      /* missing or invalid */
-    }
+// RL-03b: the origin remote is the ground truth for PR creation. A stale global
+// provider (e.g. gitlab from another repo) must not drive glab on a
+// github.com-hosted checkout. Recognized hosts only — custom/self-hosted
+// remotes keep the configured provider, and a missing origin is untouched.
+const remoteProvider = (cwd: string): string | null => {
+  const r = spawnSync("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  if (r.status !== 0) return null;
+  const url = (r.stdout ?? "").trim();
+  if (/github\.com[:/]/.test(url)) return "github";
+  if (/gitlab\.com[:/]/.test(url)) return "gitlab";
+  return null;
+};
+
+// RL-01: typed vcs.json reader. Missing is a legitimate unconfigured state;
+// malformed (parse failure or a non-object) is reported with the exact path so
+// risky consumers stop instead of silently reading defaults.
+export type VcsConfigResult = {
+  status: "missing" | "valid" | "malformed";
+  path: string;
+  config: Record<string, any>;
+  error?: string;
+};
+
+export const readVcsConfig = (): VcsConfigResult => {
+  const file = vcsConfigPath();
+  let raw: string;
+  try {
+    raw = fs.readFileSync(file, "utf8");
+  } catch {
+    return { status: "missing", path: file, config: {} };
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "malformed", path: file, config: {}, error: `${file} is not valid JSON` };
   }
-  return { config, path: cfgPath, ok };
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    return { status: "valid", path: file, config: parsed as Record<string, any> };
+  }
+  return { status: "malformed", path: file, config: {}, error: `${file} is not a JSON object` };
+};
+
+function readVcsJson(): { config: Record<string, any>; path: string; ok: boolean } {
+  const { status, path: cfgPath, config } = readVcsConfig();
+  return { config, path: cfgPath, ok: status === "valid" };
 }
 
 /** Port of scripts/vcs/config.sh — mode: load | summary | resolve. */
@@ -41,10 +71,31 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
   const wsVcs = (ws?.vcs ?? {}) as Record<string, any>;
   const wsYt = (ws?.youtrack ?? {}) as Record<string, any>;
   const wsIssues = (ws?.issues ?? {}) as Record<string, any>;
-  const { config: cfg, path: cfgPath, ok: cfgOk } = readVcsJson();
+  const { status: cfgStatus, path: cfgPath, config: cfg, error: cfgError } = readVcsConfig();
 
-  const provider = String(wsVcs.provider ?? cfg.provider ?? "gitlab").toLowerCase();
-  const defaultTarget = String(wsVcs.defaultTargetBranch ?? cfg.defaultTargetBranch ?? "develop");
+  // Explicit workspace vcs.provider is the user's per-repo intent and wins;
+  // otherwise, with a determinate repo root (explicit cwd or host-provided
+  // WORKFLOW_WORKSPACE_ROOT), the origin remote is authoritative over the
+  // global default (RL-03b). Ambient process.cwd() callers keep the legacy
+  // config-only contract (CA-06 parity), so a stale global default cannot
+  // contaminate host-agnostic reads.
+  const root = vcsCwd(cwd);
+  const determinateRoot = cwd !== undefined || process.env.WORKFLOW_WORKSPACE_ROOT !== undefined;
+  const provider = String(
+    wsVcs.provider ?? (determinateRoot ? remoteProvider(root) : null) ?? cfg.provider ?? "gitlab",
+  ).toLowerCase();
+  // CA-05: workspace/global explicit target wins; when unset the resolved
+  // branch-policy preset supplies the default (gitflow->develop,
+  // github-flow->main, trunk-based->master, custom->develop). Shared by load
+  // and resolve so both surfaces stay consistent.
+  // CA-09: the one resolver wrapper — same policy resolution every consumer
+  // uses, so the tightened gate in branch-policy-resolver.test.ts stays green.
+  const defaultTarget = String(
+    wsVcs.defaultTargetBranch ??
+      cfg.defaultTargetBranch ??
+      resolveBranchPolicyFor(root).defaultTargetBranch ??
+      "develop",
+  );
   const linkIssues = typeof wsYt.link_issues === "boolean" ? wsYt.link_issues : null;
   const youtrackBaseUrl = typeof wsYt.baseUrl === "string" ? wsYt.baseUrl : null;
   // github issues path only when BOTH providers are github (mirrors WorkspaceConfig.issues).
@@ -60,6 +111,10 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
   }
 
   if (mode === "resolve") {
+    // RL-01: malformed vcs.json blocks resolution with an exact-path diagnostic
+    // instead of silently resolving defaults; a missing file is still a
+    // legitimate unconfigured state that falls back to defaults.
+    if (cfgStatus === "malformed") return { ok: false, error: cfgError, configPath: cfgPath };
     return {
       ok: true,
       workspace_name: ws?.name ?? null,
@@ -72,7 +127,12 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
     };
   }
 
-  if (!cfgOk) return { ok: false, error: "missing or invalid vcs.json" };
+  if (cfgStatus === "malformed") {
+    return { ok: false, error: cfgError, configPath: cfgPath };
+  }
+  if (cfgStatus === "missing") {
+    return { ok: false, error: `vcs.json is missing: ${cfgPath}`, configPath: cfgPath };
+  }
 
   const prov = (cfg[provider] ?? {}) as Record<string, any>;
   const tokenFile = String(prov.tokenFile ?? path.join(configDir(), `${provider}.token`));
@@ -113,7 +173,7 @@ export function vcsConfig(mode: "load" | "summary" | "resolve", cwd?: string): R
 }
 
 /** Port of scripts/vcs/verify-token.sh — soft-fail JSON out, always exit 0. */
-export function vcsVerifyToken(): Record<string, any> {
+export async function vcsVerifyToken(): Promise<Record<string, any>> {
   const cfg = vcsConfig("load");
   if (!cfg.ok) return { ok: false, error: cfg.error ?? "vcs config not ready" };
   const provider = cfg.provider as string;
@@ -133,23 +193,32 @@ export function vcsVerifyToken(): Record<string, any> {
       /\/+$/,
       "",
     );
-    const result = spawnSync("curl", ["-fsS", "-H", `PRIVATE-TOKEN: ${token}`, `${api}/user`], {
-      encoding: "utf8",
-    });
-    if (result.status !== 0) {
+    let user: Record<string, any>;
+    try {
+      const res = await fetch(`${api}/user`, {
+        headers: { "PRIVATE-TOKEN": token },
+      });
+      if (!res.ok) {
+        return {
+          ok: false,
+          provider,
+          error: "GitLab API rejected token",
+          detail: (await res.text()).slice(0, 200),
+        };
+      }
+      user = JSON.parse(await res.text()) as Record<string, any>;
+    } catch (err) {
+      if (err instanceof SyntaxError) {
+        return { ok: false, provider, error: "invalid JSON from GitLab /user" };
+      }
       return {
         ok: false,
         provider,
         error: "GitLab API rejected token",
-        detail: (result.stderr ?? result.stdout ?? "").slice(0, 200),
+        detail: (err instanceof Error ? err.message : "network error").slice(0, 200),
       };
     }
-    try {
-      const user = JSON.parse(result.stdout ?? "") as Record<string, any>;
-      return { ok: true, provider, username: user.username ?? user.login, name: user.name };
-    } catch {
-      return { ok: false, provider, error: "invalid JSON from GitLab /user" };
-    }
+    return { ok: true, provider, username: user.username ?? user.login, name: user.name };
   }
   if (provider === "github") {
     const result = spawnSync("gh", ["api", "user"], {
@@ -240,8 +309,8 @@ export function vcsTokenCreateUrls(): Record<string, any> {
 }
 
 /** Port of scripts/vcs/merged-style.sh — recent merged MR/PR bodies for style reference. */
-export function mergedPrStyle(limit = 6): Record<string, any> {
-  const cfg = vcsConfig("load");
+export function mergedPrStyle(limit = 6, cwd?: string): Record<string, any> {
+  const cfg = vcsConfig("load", cwd);
   if (!cfg.ok || !cfg.tokenReady) return { ok: false, error: "vcs not configured" };
   const provider = cfg.provider as string;
   const token = fs.readFileSync(cfg.tokenPath as string, "utf8").trim();
@@ -257,14 +326,15 @@ export function mergedPrStyle(limit = 6): Record<string, any> {
   });
 
   if (provider === "gitlab") {
-    const remote = spawnSync("git", ["remote", "get-url", "origin"], { encoding: "utf8" });
+    const remote = spawnSync("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
     if (remote.status !== 0) return { ok: false, error: "no origin remote" };
     const url = (remote.stdout ?? "").trim();
     const m = /gitlab\.com[:/](.+?)(?:\.git)?$/.exec(url);
     if (!m) return { ok: false, error: "not a gitlab.com origin" };
     const project = m[1];
     const env = { ...process.env, GITLAB_TOKEN: token };
-    const run = (args: string[]) => spawnSync("glab", ["api", ...args], { encoding: "utf8", env });
+    const run = (args: string[]) =>
+      spawnSync("glab", ["api", ...args], { cwd, encoding: "utf8", env });
     let r = run([
       `projects/${project.replaceAll("/", "%2F")}/merge_requests?state=merged&per_page=${limit}&order_by=updated_at&sort=desc`,
     ]);
@@ -285,7 +355,7 @@ export function mergedPrStyle(limit = 6): Record<string, any> {
     const r = spawnSync(
       "gh",
       ["pr", "list", "--state", "merged", "--limit", String(limit), "--json", "title,url,body"],
-      { encoding: "utf8", env: { ...process.env, GH_TOKEN: token } },
+      { cwd, encoding: "utf8", env: { ...process.env, GH_TOKEN: token } },
     );
     if (r.status !== 0) return { ok: false, error: "could not list pull requests" };
     for (const pr of JSON.parse(r.stdout ?? "[]") as Array<Record<string, any>>) {

package/src/core/verify-project.ts

@@ -0,0 +1,181 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { repoRoot } from "./repo-context";
+
+// Port of scripts/verify-project.sh — discover + run project verification checks
+// (npm/pnpm/yarn, cargo, pytest/ruff, CHANGELOG format). Output is parsed by
+// verify-parse.ts and keeps the same ## section text shape.
+
+export type VerifyResult = { stdout: string; stderr: string; exitCode: number; cwd: string };
+
+const commandOnPath = (name: string): boolean => {
+  const dirs = (process.env.PATH ?? "").split(path.delimiter);
+  // win32 executables carry an .exe suffix (pytest.exe), so probe both names.
+  const names = process.platform === "win32" ? [name, `${name}.exe`] : [name];
+  for (const dir of dirs) {
+    if (!dir) continue;
+    for (const candidateName of names) {
+      const candidate = path.join(dir, candidateName);
+      try {
+        statSync(candidate);
+        if (process.platform !== "win32") {
+          const mode = statSync(candidate).mode & 0o111;
+          if (mode === 0) continue;
+        }
+        return true;
+      } catch {
+        /* keep scanning */
+      }
+    }
+  }
+  return false;
+};
+
+const hasScript = (cwd: string, name: string): boolean => {
+  const pkgPath = path.join(cwd, "package.json");
+  if (!existsSync(pkgPath)) return false;
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as { scripts?: Record<string, string> };
+    return Boolean(pkg.scripts && typeof pkg.scripts[name] === "string");
+  } catch {
+    return false;
+  }
+};
+
+const packageRunner = (cwd: string): string => {
+  if (existsSync(path.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  const pkgPath = path.join(cwd, "package.json");
+  if (existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as { packageManager?: string };
+      if (typeof pkg.packageManager === "string" && pkg.packageManager.startsWith("pnpm")) {
+        return "pnpm";
+      }
+    } catch {
+      /* fall through */
+    }
+  }
+  if (existsSync(path.join(cwd, "yarn.lock"))) return "yarn";
+  return "npm";
+};
+
+export function runVerifyProject(root: string, dryRun = false): VerifyResult {
+  // Shell parity: verify-project.sh did `root=$(git rev-parse --show-toplevel || pwd); cd "$root"`,
+  // so a run from a repo subdirectory still checks the repo root.
+  const cwd = repoRoot(root);
+  let passed = 0;
+  let failed = 0;
+  let skipped = 0;
+  const lines: string[] = [];
+  const stderrParts: string[] = [];
+
+  const runCheck = (label: string, cmd: string, args: string[]) => {
+    lines.push(`\n## ${label}\n\n`);
+    lines.push(`command: ${[cmd, ...args].join(" ")}\n\n`);
+    if (dryRun) {
+      lines.push("status: skipped (dry run)\n");
+      skipped += 1;
+      return;
+    }
+    const r = spawnSync(cmd, args, { cwd, encoding: "utf8" });
+    const so = (r.stdout ?? "").trimEnd();
+    if (so) lines.push(so + "\n");
+    const se = (r.stderr ?? "").trimEnd();
+    if (se) stderrParts.push(se);
+    if (r.status === 0) {
+      lines.push("\nstatus: pass\n");
+      passed += 1;
+    } else {
+      lines.push(`\nstatus: fail (exit ${r.status})\n`);
+      failed += 1;
+    }
+  };
+
+  const skipCheck = (label: string, reason: string) => {
+    lines.push(`\n## ${label}\n\nstatus: skipped (${reason})\n`);
+    skipped += 1;
+  };
+
+  lines.push("# Verification Context\n");
+  lines.push(`\nroot: ${cwd}\n`);
+  lines.push(`dry_run: ${String(dryRun)}\n`);
+
+  const pkgPath = path.join(cwd, "package.json");
+  if (existsSync(pkgPath)) {
+    const runner = packageRunner(cwd);
+    for (const script of ["lint", "format:check", "test", "build"]) {
+      if (hasScript(cwd, script)) {
+        if (runner === "npm") runCheck(script, "npm", ["run", script]);
+        else runCheck(script, runner, [script]);
+      } else {
+        skipCheck(script, `package.json has no ${script} script`);
+      }
+    }
+  } else {
+    skipCheck("javascript", "package.json not found");
+  }
+
+  const cargoManifest = existsSync(path.join(cwd, "Cargo.toml"))
+    ? "Cargo.toml"
+    : existsSync(path.join(cwd, "src-tauri/Cargo.toml"))
+      ? "src-tauri/Cargo.toml"
+      : "";
+  if (cargoManifest) {
+    runCheck("cargo fmt", "cargo", ["fmt", "--manifest-path", cargoManifest, "--", "--check"]);
+    runCheck("cargo clippy", "cargo", [
+      "clippy",
+      "--manifest-path",
+      cargoManifest,
+      "--all-targets",
+      "--",
+      "-D",
+      "warnings",
+    ]);
+    runCheck("cargo test", "cargo", ["test", "--manifest-path", cargoManifest, "--all-targets"]);
+  } else {
+    skipCheck("rust", "Cargo.toml not found");
+  }
+
+  if (
+    existsSync(path.join(cwd, "pyproject.toml")) ||
+    existsSync(path.join(cwd, "pytest.ini")) ||
+    existsSync(path.join(cwd, "tests"))
+  ) {
+    if (commandOnPath("pytest")) runCheck("pytest", "pytest", []);
+    else skipCheck("pytest", "pytest not available");
+    if (commandOnPath("ruff")) runCheck("ruff check", "ruff", ["check", "."]);
+    else skipCheck("ruff check", "ruff not available");
+  }
+
+  lines.push("\n## CHANGELOG.md format\n\n");
+  lines.push('command: grep -qi "## [Unreleased]" CHANGELOG.md\n\n');
+  const changelogPath = path.join(cwd, "CHANGELOG.md");
+  if (dryRun) {
+    lines.push("status: skipped (dry run)\n");
+    skipped += 1;
+  } else if (existsSync(changelogPath)) {
+    if (/## \[Unreleased\]/i.test(readFileSync(changelogPath, "utf8"))) {
+      lines.push("status: pass\n");
+      passed += 1;
+    } else {
+      lines.push("status: fail (missing ## [Unreleased])\n");
+      failed += 1;
+    }
+  } else {
+    lines.push("status: fail (missing CHANGELOG.md)\n");
+    failed += 1;
+  }
+
+  lines.push("\n# Summary\n\n");
+  lines.push(`passed: ${passed}\n`);
+  lines.push(`failed: ${failed}\n`);
+  lines.push(`skipped: ${skipped}\n`);
+
+  return {
+    stdout: lines.join(""),
+    stderr: stderrParts.join("\n"),
+    exitCode: failed > 0 ? 1 : 0,
+    cwd,
+  };
+}

package/src/core/workspaces.ts

@@ -1,19 +1,70 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
-import { configDir } from "./config";
+import { configDir, isConfigObject, type BranchPreset } from "./config";
 
 export type VcsProvider = "gitlab" | "github";
 
+export type IntegrationMode = "pr" | "merge";
+
+export type WorkspaceBranchPolicy = {
+  preset: BranchPreset;
+  developBranch?: string;
+  prefixes?: { feature: string; bugfix: string; release: string; hotfix: string };
+  allowed?: string[];
+  protected?: string[];
+  integration: IntegrationMode;
+};
+
 export type WorkspaceConfig = {
   name: string;
   glob: string;
   vcs?: { provider: VcsProvider; defaultTargetBranch?: string };
   youtrack?: { baseUrl?: string; link_issues?: boolean };
   issues?: { provider?: "github"; link_on_pr?: boolean };
+  branchPolicy?: WorkspaceBranchPolicy;
 };
 
 export const workspacesPath = (): string => path.join(configDir(), "workspaces.json");
 
+// RL-01: typed workspaces reader. Missing is a legitimate unconfigured state
+// (empty list); malformed JSON is reported with the exact path so risky
+// consumers (wizard/installer/doctor) can block instead of silently resetting.
+export type WorkspacesResult = {
+  status: "missing" | "valid" | "malformed";
+  path: string;
+  entries: WorkspaceConfig[];
+  error?: string;
+};
+
+export const readWorkspacesResult = (dir: string = configDir()): WorkspacesResult => {
+  const file = path.join(dir, "workspaces.json");
+  let raw: string;
+  try {
+    raw = readFileSync(file, "utf8");
+  } catch {
+    return { status: "missing", path: file, entries: [] };
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { status: "malformed", path: file, entries: [], error: `${file} is not valid JSON` };
+  }
+  if (!isConfigObject(parsed)) {
+    return { status: "malformed", path: file, entries: [], error: `${file} is not a JSON object` };
+  }
+  const list = (parsed as { workspaces?: unknown }).workspaces;
+  return {
+    status: "valid",
+    path: file,
+    entries: Array.isArray(list) ? (list as WorkspaceConfig[]) : [],
+  };
+};
+
+/** Parse the workspaces.json list under an explicit config dir; [] when missing/malformed. */
+export const loadWorkspacesFrom = (dir: string): WorkspaceConfig[] =>
+  readWorkspacesResult(dir).entries;
+
 // ponytail: only globstar (`**`) is supported; if more minimatch parity is needed
 // (char classes, braces, `?`), swap this matcher for the minimatch dependency.
 const globToRegExp = (glob: string): RegExp => {
@@ -54,28 +105,96 @@ const globToRegExp = (glob: string): RegExp => {
   return new RegExp(`^${out}$`);
 };
 
-export const resolveWorkspace = (cwd: string): WorkspaceConfig | null => {
-  let raw: string;
-  try {
-    raw = readFileSync(workspacesPath(), "utf8");
-  } catch {
-    return null;
+/** Shared authoritative workspace matcher (WZ-12): the wizard's pattern
+ *  preview and resolveWorkspaceFrom both route through it. */
+export const matchWorkspace = (glob: string, target: string): boolean =>
+  globToRegExp(glob.replaceAll("\\", "/")).test(target.replaceAll("\\", "/"));
+
+// RL-08: the matcher above implements `*` and `**` only. Classic glob
+// metacharacters it would otherwise store as literals (char classes, `?`,
+// brace expansion) are rejected at write time so a saved pattern never
+// silently matches nothing (Task 15 advisory: unsupported patterns were
+// accepted and shown as "no match").
+const UNSUPPORTED_GLOB = /[?[\]{}]/;
+
+// B3: `!`-negation and extglob prefixes (@(...), +(...), *(...)) are the same
+// no-match trap — the matcher stores them as literals, so `!**` or `@(a|b)`
+// silently matches nothing. Reject them at write time too; the Task 15 match
+// preview still routes through matchWorkspace (literals -> no match) and is
+// unchanged.
+const UNSUPPORTED_EXTGLOB = /[@+*]\(|!/;
+
+export type GlobValidation = { ok: true } | { ok: false; error: string };
+
+export const validateWorkspaceGlob = (glob: string): GlobValidation => {
+  const trimmed = glob.trim();
+  if (!trimmed) return { ok: false, error: "workspace pattern is required" };
+  const m = UNSUPPORTED_GLOB.exec(trimmed);
+  if (m) {
+    return {
+      ok: false,
+      error: `unsupported glob character ${JSON.stringify(m[0])} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`,
+    };
   }
-  let parsed: unknown;
+  const ext = UNSUPPORTED_EXTGLOB.exec(trimmed);
+  if (ext) {
+    const token = ext[0];
+    const kind = token === "!" ? "negation (!)" : `extglob (${token})`;
+    return {
+      ok: false,
+      error: `unsupported glob ${kind} in workspace pattern ${JSON.stringify(glob)} — the matcher supports * and ** only (e.g. /work/**)`,
+    };
+  }
+  return { ok: true };
+};
+
+const realpathOf = (p: string): string => {
+  // realpathSync.native goes through libuv, which expands Windows 8.3 short
+  // names (C:\Users\RUNNER~1 -> C:\Users\runneradmin); the plain realpathSync
+  // keeps them, so a git-derived long path would miss a glob written with the
+  // short form (GitHub runner TMP uses the short name).
+  const real = realpathSync.native ?? realpathSync;
   try {
-    parsed = JSON.parse(raw);
+    return real(p);
   } catch {
-    return null;
+    return p;
   }
-  if (!parsed || typeof parsed !== "object") return null;
-  const list = (parsed as { workspaces?: unknown }).workspaces;
-  if (!Array.isArray(list)) return null;
-  const cwdPosix = cwd.replaceAll("\\", "/");
-  for (const entry of list) {
+};
+
+// Rebuild a glob with the realpath of its static prefix, so a config glob
+// written with the logical path also matches a canonical target (and vice
+// versa). The glob metacharacters themselves are left untouched.
+const canonicalGlob = (glob: string): string => {
+  const m = /[*?[\]{]/.exec(glob);
+  const prefix = m ? glob.slice(0, m.index) : glob;
+  const rest = m ? glob.slice(m.index) : "";
+  if (!prefix) return glob;
+  const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
+  return real + (prefix.endsWith("/") ? "/" : "") + rest;
+};
+
+/** Match a cwd against the workspaces.json under an explicit config dir. */
+export const resolveWorkspaceFrom = (cwd: string, dir: string): WorkspaceConfig | null => {
+  // macOS/Windows tmpdir symlinks (/var -> /private/var): git's
+  // --show-toplevel returns the realpath while config globs are usually
+  // written with the logical path, so a workspace would silently stop
+  // matching on macOS. Match both forms on each side — same class as the
+  // docs-migration escape-guard realpath comparison; on Linux both forms
+  // are identical so behavior is unchanged.
+  const targets = [cwd, realpathOf(cwd)].map((p) => p.replaceAll("\\", "/"));
+  for (const entry of loadWorkspacesFrom(dir)) {
     if (!entry || typeof entry !== "object") continue;
     const ws = entry as WorkspaceConfig;
     if (typeof ws.glob !== "string" || !ws.glob) continue;
-    if (globToRegExp(ws.glob.replaceAll("\\", "/")).test(cwdPosix)) return ws;
+    const glob = ws.glob.replaceAll("\\", "/");
+    const canonical = canonicalGlob(glob);
+    for (const target of targets) {
+      if (matchWorkspace(glob, target)) return ws;
+      if (canonical !== glob && matchWorkspace(canonical, target)) return ws;
+    }
   }
   return null;
 };
+
+export const resolveWorkspace = (cwd: string): WorkspaceConfig | null =>
+  resolveWorkspaceFrom(cwd, configDir());