refacil-sdd-ai 4.5.7 → 5.0.0

package/README.md

@@ -29,6 +29,8 @@ refacil-sdd-ai init
 #    whose folder already exists. Use --all to install for all three without prompting.
 #    Copies skills and sub-agents to the selected IDEs, configures hooks,
 #    and creates/updates .claudeignore, .cursorignore and .opencodeignore.
+#    Also prompts for global branch config (baseBranch, protectedBranches) pre-filled
+#    from ~/.refacil-sdd-ai/config.yaml. Skipped with --yes or --defaults.
 
 # 3. Restart your IDE session
 #    (new skills are not detected until you restart)
@@ -100,6 +102,8 @@ Native CLI for **`refacil-sdd/`** (no separate OpenSpec skill layer). Used by sk
 | `refacil-sdd-ai sdd tasks-update <name>` | Mark a task done (`--task N --done`) |
 | `refacil-sdd-ai sdd archive <name>` | Move a regular change to `refacil-sdd/changes/archive/` |
 | `refacil-sdd-ai sdd validate-name <name>` | Validate change folder name (must start with a letter) |
+| `refacil-sdd-ai sdd config [--json]` | Show effective branch configuration (protectedBranches, baseBranch) after cascade: project `refacil-sdd/config.yaml` → global `~/.refacil-sdd-ai/config.yaml` → built-in defaults |
+| `refacil-sdd-ai sdd write-config [--global] [--base-branch <v>] [--protected-branches <csv>]` | Write or merge branch config into `refacil-sdd/config.yaml` (project) or `~/.refacil-sdd-ai/config.yaml` (`--global`). Performs a semantic no-op check — skips rewrite if values are already set. Directory is auto-created if absent. |
 
 Run **`refacil-sdd-ai help`** for the full list including `bus` and `compact` subcommands.
 
@@ -372,7 +376,7 @@ The SDD-AI methodology generates a lot of context (artifacts, specs, prompts). T
 Defined in `skills/prereqs/METHODOLOGY-CONTRACT.md`:
 
 - **Flow states**: `READY_FOR_APPLY` / `VERIFY` / `REVIEW` / `ARCHIVE` / `MERGE` — each transition validates prerequisites.
-- **Branch policy**: every new branch (`feature/*`, `fix/*`, etc.) is created from an up-to-date `develop`/`dev`. Integration to protected branches (`testing`, `develop`, `dev`, `main`, `master`, `qa`) always via PR. **Never** direct commits to `master`/`main`. Single exception: repos without `develop`/`dev`, where `main` or `master` may be used temporarily as a base.
+- **Branch policy**: every new branch (`feature/*`, `fix/*`, etc.) is created from the `baseBranch` returned by `refacil-sdd-ai sdd config --json`. Integration to protected branches (as listed by `sdd config --json`) always via PR — **never** direct commits to a protected branch. Branch rules are resolved via a two-level cascade: project (`refacil-sdd/config.yaml`) → global (`~/.refacil-sdd-ai/config.yaml`) → built-in defaults (`master`, `main`, `develop`, `dev`, `testing`, `qa`). Use `sdd write-config` to set project- or team-level overrides. The global config at `~/.refacil-sdd-ai/config.yaml` is preserved across package updates and can be used to set team-wide defaults without per-repo configuration.
 - **Multi-stack tests**: detects the real test command (does not hardcode `npm test`).
 - **`AGENTS.md` by profile** (`sdd` vs `agents`): the methodology respects both.
 - **Output mode**: concise by default, detailed on demand.

package/bin/cli.js

@@ -4,6 +4,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 const {
   syncCompactGuidance,
   removeCompactGuidance,
@@ -27,7 +28,7 @@ const {
 const { installHooks, uninstallHooks, cleanLegacySettingsHooks, installOpenCodePlugin, uninstallOpenCodePlugin } = require('../lib/hooks');
 const { handleCompact } = require('../lib/commands/compact');
 const { handleBus } = require('../lib/commands/bus');
-const { handleSdd, autoMigrateOpenspec, findProjectRoot } = require('../lib/commands/sdd');
+const { handleSdd, autoMigrateOpenspec, findProjectRoot, cmdWriteConfig } = require('../lib/commands/sdd');
 const { syncIgnoreFiles } = require('../lib/ignore-files');
 const { methodologyMigrationPending } = require('../lib/methodology-migration-pending');
 
@@ -396,6 +397,114 @@ function checkReview() {
   }
 }
 
+// --- Branch config prompt (used by init) ---
+
+/**
+ * Prompt the user for global branch configuration interactively.
+ * Skips if --yes or --defaults flag is present, or if stdout is not a TTY.
+ * Pre-fills from existing global config values.
+ * On confirmation, writes the global config via cmdWriteConfig.
+ */
+/** Normalize a comma-separated branch string into a trimmed, non-empty array. Falls back to `fallback` if empty. */
+function parseBranchList(raw, fallback) {
+  const parsed = raw.split(',').map((s) => s.trim()).filter(Boolean);
+  return parsed.length > 0 ? parsed : fallback;
+}
+
+async function promptBranchConfig() {
+  const skipFlags = ['--yes', '--defaults'];
+  if (skipFlags.some((f) => process.argv.includes(f))) return;
+  if (!process.stdout.isTTY) return;
+
+  const { readConfigFile, DEFAULT_PROTECTED_BRANCHES, DEFAULT_BASE_BRANCH } = require('../lib/config');
+  const globalConfigPath = path.join(os.homedir(), '.refacil-sdd-ai', 'config.yaml');
+  const globalConfig = readConfigFile(globalConfigPath) || {};
+  const currentBaseBranch = (typeof globalConfig.baseBranch === 'string' && globalConfig.baseBranch.trim()) ? globalConfig.baseBranch.trim() : DEFAULT_BASE_BRANCH;
+  const currentProtected = (Array.isArray(globalConfig.protectedBranches) && globalConfig.protectedBranches.length > 0) ? globalConfig.protectedBranches : DEFAULT_PROTECTED_BRANCHES;
+
+  console.log('\n  Branch configuration (global, stored in ~/.refacil-sdd-ai/config.yaml)');
+  console.log(`  Current base branch:        ${currentBaseBranch}`);
+  console.log(`  Current protected branches: ${currentProtected.join(', ')}`);
+  console.log('  Press Enter to keep current values, or type new ones.\n');
+
+  let baseBranch;
+  let protectedBranches;
+
+  try {
+    const clack = require('@clack/prompts');
+
+    const bbResult = await clack.text({
+      message: `Base branch (current: ${currentBaseBranch}):`,
+      placeholder: currentBaseBranch,
+      validate: () => undefined,
+    });
+    if (clack.isCancel(bbResult)) {
+      console.log('  Branch config prompt cancelled. Keeping existing values.\n');
+      return;
+    }
+    baseBranch = (bbResult && bbResult.trim()) ? bbResult.trim() : currentBaseBranch;
+
+    const pbResult = await clack.text({
+      message: `Protected branches, comma-separated (current: ${currentProtected.join(', ')}):`,
+      placeholder: currentProtected.join(', '),
+      validate: () => undefined,
+    });
+    if (clack.isCancel(pbResult)) {
+      console.log('  Branch config prompt cancelled. Keeping existing values.\n');
+      return;
+    }
+    protectedBranches = parseBranchList((pbResult && pbResult.trim()) ? pbResult.trim() : currentProtected.join(', '), currentProtected);
+
+    const confirm = await clack.confirm({
+      message: `Save global config — base: "${baseBranch}", protected: [${protectedBranches.join(', ')}]?`,
+      initialValue: true,
+    });
+    if (clack.isCancel(confirm) || !confirm) {
+      console.log('  Branch config not saved.\n');
+      return;
+    }
+  } catch (_) {
+    // @clack/prompts not available — use inline readline fallback
+    const readline = require('readline');
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
+
+    const bbAnswer = await ask(`  Base branch [${currentBaseBranch}]: `);
+    baseBranch = (bbAnswer && bbAnswer.trim()) ? bbAnswer.trim() : currentBaseBranch;
+
+    const pbAnswer = await ask(`  Protected branches [${currentProtected.join(', ')}]: `);
+    protectedBranches = parseBranchList((pbAnswer && pbAnswer.trim()) ? pbAnswer.trim() : currentProtected.join(', '), currentProtected);
+
+    const confirmAnswer = await ask(`  Save global config — base: "${baseBranch}", protected: [${protectedBranches.join(', ')}]? (Y/n): `);
+    rl.close();
+    if (confirmAnswer.trim().toLowerCase() === 'n') {
+      console.log('  Branch config not saved.\n');
+      return;
+    }
+  }
+
+  // Fix 2: pre-check to avoid process.exit(0) from cmdWriteConfig no-op path when called programmatically
+  const valuesUnchanged = baseBranch === currentBaseBranch &&
+    JSON.stringify(protectedBranches.slice().sort()) === JSON.stringify(currentProtected.slice().sort());
+  if (valuesUnchanged) {
+    console.log('  Branch config unchanged. Keeping existing values.\n');
+    return;
+  }
+
+  // Build argv-style array and call cmdWriteConfig directly
+  const writeArgv = [
+    '--global',
+    '--base-branch', baseBranch,
+    '--protected-branches', protectedBranches.join(','),
+  ];
+  try {
+    cmdWriteConfig(writeArgv, projectRoot);
+  } catch (err) {
+    console.error(`  Warning: could not write global branch config: ${err.message}`);
+  }
+  console.log('');
+}
+
 // --- High-level commands ---
 
 async function init() {
@@ -417,6 +526,9 @@ async function init() {
   // Select target IDEs (interactive selector or --all / non-TTY)
   const selectedIDEs = await selectIDEs();
 
+  // Prompt for global branch configuration (skipped with --yes/--defaults or non-TTY)
+  await promptBranchConfig();
+
   if (selectedIDEs.length === 0) {
     console.log('\n  No IDEs selected. Nothing installed.\n');
     console.log('  Re-run with: refacil-sdd-ai init --all   to install for all IDEs');
@@ -644,6 +756,7 @@ function help() {
   Commands:
     init          Install skills in .claude/, .cursor/ and/or .opencode/ (interactive IDE selector).
                   Use --all to install for all three IDEs without prompting.
+                  Use --yes or --defaults to skip interactive branch config prompts.
                   Creates CLAUDE.md, .cursorrules and .opencode/opencode.json as appropriate.
     update        Re-copy skills for all detected IDEs (.claude/, .cursor/, .opencode/)
     migration-pending  Same validation as hooks/notify-update: list migrations (exit 1 if any; --json)
@@ -680,6 +793,11 @@ function help() {
                     sdd mark-reviewed <name>       Write .review-passed (requires --verdict and --summary)
                     sdd tasks-update <name>        Mark task N as completed (--task N --done)
                     sdd validate-name <name>       Validate change name format
+                    sdd config [--json]            Show effective branch config (project > global > defaults)
+                    sdd write-config              Write branch config to project or global config file
+                      [--global]                    Write to ~/.refacil-sdd-ai/config.yaml (global level)
+                      [--base-branch <branch>]      Base branch for new changes
+                      [--protected-branches <csv>]  Protected branches (comma-separated)
     clean         Remove skills and SDD-AI hooks from all detected IDEs
                   (.claude/settings.json, .cursor/hooks.json, .opencode/plugins/)
     help          Show this help

package/lib/commands/sdd.js

@@ -2,6 +2,8 @@
 
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
+const { loadBranchConfigWithSources, parseYaml, readConfigFile } = require('../config');
 
 function findProjectRoot() {
   let dir = process.cwd();
@@ -62,6 +64,47 @@ function validateChangeName(name) {
   return { valid: true };
 }
 
+function resolveExistingChangeName(projectRoot, inputName) {
+  if (!inputName || typeof inputName !== 'string') {
+    return { ok: false, reason: 'El nombre del cambio no puede estar vacío.' };
+  }
+
+  const normalizedInput = inputName.trim();
+  const lowerInput = normalizedInput.toLowerCase();
+  const changesDir = path.join(projectRoot, 'refacil-sdd', 'changes');
+
+  // Keep backward-compatible behavior when directory doesn't exist yet.
+  if (!fs.existsSync(changesDir)) {
+    return { ok: true, name: lowerInput };
+  }
+
+  const entries = fs.readdirSync(changesDir, { withFileTypes: true })
+    .filter((e) => e.isDirectory() && e.name !== 'archive')
+    .map((e) => e.name);
+
+  if (entries.includes(normalizedInput)) {
+    return { ok: true, name: normalizedInput };
+  }
+
+  if (entries.includes(lowerInput)) {
+    return { ok: true, name: lowerInput };
+  }
+
+  const ciMatches = entries.filter((n) => n.toLowerCase() === lowerInput);
+  if (ciMatches.length === 1) {
+    return { ok: true, name: ciMatches[0] };
+  }
+
+  if (ciMatches.length > 1) {
+    return {
+      ok: false,
+      reason: `Nombre de cambio ambiguo: '${inputName}'. Coincidencias: ${ciMatches.join(', ')}`,
+    };
+  }
+
+  return { ok: true, name: lowerInput };
+}
+
 function autoMigrateOpenspec(root) {
   const oldDir = path.join(root, 'openspec');
   const newDir = path.join(root, 'refacil-sdd');
@@ -77,49 +120,7 @@ function autoMigrateOpenspec(root) {
   // Si ambos existen o ninguno existe → no hacer nada
 }
 
-// --- Minimal YAML parser/serializer for memory.yaml ---
-// Supports: string values and string-array values only.
-
-function parseMemoryYaml(content) {
-  const result = {};
-  const lines = content.split('\n');
-  let currentKey = null;
-  let currentList = null;
-
-  for (const line of lines) {
-    if (!line.trim() || line.trim().startsWith('#')) continue;
-
-    // List item: "  - value"
-    if (/^\s{2,}- /.test(line)) {
-      const value = line.replace(/^\s*- /, '').trim();
-      if (currentKey && currentList !== null) {
-        currentList.push(value);
-      }
-      continue;
-    }
-
-    // Key-value: "key: value" or "key:" (empty/start of list)
-    const kvMatch = line.match(/^([a-zA-Z][a-zA-Z0-9_-]*):\s*(.*)/);
-    if (kvMatch) {
-      currentKey = kvMatch[1];
-      const val = kvMatch[2].trim();
-      if (val === '') {
-        // Could be a list
-        currentList = [];
-        result[currentKey] = currentList;
-      } else {
-        currentList = null;
-        result[currentKey] = val;
-      }
-      continue;
-    }
-
-    currentKey = null;
-    currentList = null;
-  }
-
-  return result;
-}
+// parseYaml is imported from lib/config.js (shared parser, no duplication)
 
 function serializeMemoryYaml(obj) {
   const lines = [];
@@ -180,7 +181,15 @@ function cmdNewChange(argv, projectRoot) {
 
 function cmdArchive(argv, projectRoot) {
   const args = parseArgs(argv);
-  const name = args._positional[0];
+  const rawName = args._positional[0];
+
+  autoMigrateOpenspec(projectRoot);
+  const resolved = resolveExistingChangeName(projectRoot, rawName);
+  if (!resolved.ok) {
+    console.error(resolved.reason);
+    process.exit(1);
+  }
+  const name = resolved.name;
 
   const validation = validateChangeName(name);
   if (!validation.valid) {
@@ -188,8 +197,6 @@ function cmdArchive(argv, projectRoot) {
     process.exit(1);
   }
 
-  autoMigrateOpenspec(projectRoot);
-
   const sourceDir = path.join(projectRoot, 'refacil-sdd', 'changes', name);
   if (!fs.existsSync(sourceDir)) {
     console.error(`No existe el cambio '${name}' en refacil-sdd/changes/${name}/`);
@@ -222,14 +229,21 @@ function cmdArchive(argv, projectRoot) {
 
 function cmdSetMemory(argv, projectRoot) {
   const args = parseArgs(argv);
-  const name = args._positional[0];
+  const rawName = args._positional[0];
 
-  if (!name) {
+  if (!rawName) {
     console.error('Uso: refacil-sdd-ai sdd set-memory <nombre-cambio> [--last-step <value>] [--stack-detected <value>] [--touched-files <csv>] [--commands-run <value>] [--criteria-run <csv>]');
     process.exit(1);
   }
 
   const root = projectRoot;
+  autoMigrateOpenspec(root);
+  const resolved = resolveExistingChangeName(root, rawName);
+  if (!resolved.ok) {
+    console.error(resolved.reason);
+    process.exit(1);
+  }
+  const name = resolved.name;
 
   // Guard: ensure the change directory exists before any file operation
   const changeDir = path.join(root, 'refacil-sdd', 'changes', name);
@@ -251,7 +265,7 @@ function cmdSetMemory(argv, projectRoot) {
   let existing = {};
   if (fs.existsSync(memoryPath)) {
     try {
-      existing = parseMemoryYaml(fs.readFileSync(memoryPath, 'utf8'));
+      existing = parseYaml(fs.readFileSync(memoryPath, 'utf8'));
     } catch (_) {
       existing = {};
     }
@@ -274,15 +288,22 @@ function cmdSetMemory(argv, projectRoot) {
 
 function cmdGetMemory(argv, projectRoot) {
   const args = parseArgs(argv);
-  const name = args._positional[0];
+  const rawName = args._positional[0];
   const wantJson = args.json === true;
 
-  if (!name) {
+  if (!rawName) {
     console.error('Uso: refacil-sdd-ai sdd get-memory <nombre-cambio> [--json]');
     process.exit(1);
   }
 
   const root = projectRoot;
+  autoMigrateOpenspec(root);
+  const resolved = resolveExistingChangeName(root, rawName);
+  if (!resolved.ok) {
+    console.error(resolved.reason);
+    process.exit(1);
+  }
+  const name = resolved.name;
   const memoryPath = path.join(root, 'refacil-sdd', 'changes', name, 'memory.yaml');
 
   if (!fs.existsSync(memoryPath)) {
@@ -297,7 +318,7 @@ function cmdGetMemory(argv, projectRoot) {
   if (wantJson) {
     let parsed = {};
     try {
-      parsed = parseMemoryYaml(content);
+      parsed = parseYaml(content);
     } catch (_) {
       parsed = {};
     }
@@ -309,14 +330,21 @@ function cmdGetMemory(argv, projectRoot) {
 
 function cmdSetReviewFails(argv, projectRoot) {
   const args = parseArgs(argv);
-  const name = args._positional[0];
+  const rawName = args._positional[0];
 
-  if (!name) {
+  if (!rawName) {
     console.error('Uso: refacil-sdd-ai sdd set-review-fails <nombre-cambio> --files <csv>');
     process.exit(1);
   }
 
   const root = projectRoot;
+  autoMigrateOpenspec(root);
+  const resolved = resolveExistingChangeName(root, rawName);
+  if (!resolved.ok) {
+    console.error(resolved.reason);
+    process.exit(1);
+  }
+  const name = resolved.name;
   const changeDir = path.join(root, 'refacil-sdd', 'changes', name);
   if (!fs.existsSync(changeDir)) {
     console.error(`No existe el cambio '${name}' en refacil-sdd/changes/${name}/`);
@@ -334,14 +362,21 @@ function cmdSetReviewFails(argv, projectRoot) {
 
 function cmdClearReviewFails(argv, projectRoot) {
   const args = parseArgs(argv);
-  const name = args._positional[0];
+  const rawName = args._positional[0];
 
-  if (!name) {
+  if (!rawName) {
     console.error('Uso: refacil-sdd-ai sdd clear-review-fails <nombre-cambio>');
     process.exit(1);
   }
 
   const root = projectRoot;
+  autoMigrateOpenspec(root);
+  const resolved = resolveExistingChangeName(root, rawName);
+  if (!resolved.ok) {
+    console.error(resolved.reason);
+    process.exit(1);
+  }
+  const name = resolved.name;
   const reviewFailsPath = path.join(root, 'refacil-sdd', 'changes', name, '.review-last-fails.json');
 
   if (fs.existsSync(reviewFailsPath)) {
@@ -392,15 +427,21 @@ function cmdList(argv, projectRoot) {
 
 function cmdStatus(argv, projectRoot) {
   const args = parseArgs(argv);
-  const name = args._positional[0];
+  const rawName = args._positional[0];
   const wantJson = args.json === true;
 
-  if (!name) {
+  if (!rawName) {
     console.error('Uso: refacil-sdd-ai sdd status <nombre-cambio> [--json]');
     process.exit(1);
   }
 
   autoMigrateOpenspec(projectRoot);
+  const resolved = resolveExistingChangeName(projectRoot, rawName);
+  if (!resolved.ok) {
+    console.error(resolved.reason);
+    process.exit(1);
+  }
+  const name = resolved.name;
 
   const changeDir = path.join(projectRoot, 'refacil-sdd', 'changes', name);
   if (!fs.existsSync(changeDir)) {
@@ -481,9 +522,9 @@ function cmdStatus(argv, projectRoot) {
 
 function cmdMarkReviewed(argv, projectRoot) {
   const args = parseArgs(argv);
-  const name = args._positional[0];
+  const rawName = args._positional[0];
 
-  if (!name) {
+  if (!rawName) {
     console.error('Uso: refacil-sdd-ai sdd mark-reviewed <nombre-cambio> --verdict <verdict> --summary "<resumen>" [--fail-count N] [--preexisting-count N] [--blockers]');
     process.exit(1);
   }
@@ -499,6 +540,12 @@ function cmdMarkReviewed(argv, projectRoot) {
   }
 
   autoMigrateOpenspec(projectRoot);
+  const resolved = resolveExistingChangeName(projectRoot, rawName);
+  if (!resolved.ok) {
+    console.error(resolved.reason);
+    process.exit(1);
+  }
+  const name = resolved.name;
 
   const changeDir = path.join(projectRoot, 'refacil-sdd', 'changes', name);
   if (!fs.existsSync(changeDir)) {
@@ -522,9 +569,9 @@ function cmdMarkReviewed(argv, projectRoot) {
 
 function cmdTasksUpdate(argv, projectRoot) {
   const args = parseArgs(argv);
-  const name = args._positional[0];
+  const rawName = args._positional[0];
 
-  if (!name) {
+  if (!rawName) {
     console.error('Uso: refacil-sdd-ai sdd tasks-update <nombre-cambio> --task N --done');
     process.exit(1);
   }
@@ -541,6 +588,12 @@ function cmdTasksUpdate(argv, projectRoot) {
   }
 
   autoMigrateOpenspec(projectRoot);
+  const resolved = resolveExistingChangeName(projectRoot, rawName);
+  if (!resolved.ok) {
+    console.error(resolved.reason);
+    process.exit(1);
+  }
+  const name = resolved.name;
 
   const tasksFile = path.join(projectRoot, 'refacil-sdd', 'changes', name, 'tasks.md');
   if (!fs.existsSync(tasksFile)) {
@@ -577,6 +630,88 @@ function cmdTasksUpdate(argv, projectRoot) {
   console.log(`Task ${taskN} de '${name}' marcada como completada.`);
 }
 
+function cmdConfig(argv, projectRoot) {
+  const args = parseArgs(argv);
+  const wantJson = args.json === true;
+
+  const { protectedBranches, baseBranch, sources } = loadBranchConfigWithSources(projectRoot);
+
+  if (wantJson) {
+    process.stdout.write(JSON.stringify({ protectedBranches, baseBranch }) + '\n');
+  } else {
+    console.log(`protectedBranches [${sources.protectedBranches}]: ${protectedBranches.join(', ')}`);
+    console.log(`baseBranch [${sources.baseBranch}]: ${baseBranch}`);
+  }
+}
+
+
+function cmdWriteConfig(argv, projectRoot) {
+  const args = parseArgs(argv);
+
+  const isGlobal = args.global === true;
+  const rawBaseBranch = args['base-branch'];
+  const rawProtectedBranches = args['protected-branches'];
+
+  // CR-03: no flags provided
+  if (rawBaseBranch === undefined && rawProtectedBranches === undefined) {
+    console.error('Uso: refacil-sdd-ai sdd write-config [--global] [--base-branch <branch>] [--protected-branches <csv>]');
+    console.error('Debe especificar al menos --base-branch o --protected-branches.');
+    process.exit(1);
+  }
+
+  // CR-01: empty --base-branch after trim
+  if (rawBaseBranch !== undefined && (typeof rawBaseBranch !== 'string' || rawBaseBranch.trim() === '')) {
+    console.error('Error: --base-branch no puede estar vacío.');
+    process.exit(1);
+  }
+
+  // CR-02: --protected-branches: split, trim, filter; error if empty result
+  let protectedBranchesList;
+  if (rawProtectedBranches !== undefined) {
+    protectedBranchesList = String(rawProtectedBranches).split(',').map((s) => s.trim()).filter(Boolean);
+    if (protectedBranchesList.length === 0) {
+      console.error('Error: --protected-branches no puede resultar en una lista vacía.');
+      process.exit(1);
+    }
+  }
+
+  const targetPath = isGlobal
+    ? path.join(os.homedir(), '.refacil-sdd-ai', 'config.yaml')
+    : path.join(projectRoot, 'refacil-sdd', 'config.yaml');
+
+  // CR-04: read existing file; null if absent or corrupt
+  const existing = readConfigFile(targetPath) || {};
+
+  // Merge: start from existing, overwrite only provided keys
+  const merged = Object.assign({}, existing);
+  if (rawBaseBranch !== undefined) {
+    merged.baseBranch = rawBaseBranch.trim();
+  }
+  if (protectedBranchesList !== undefined) {
+    merged.protectedBranches = protectedBranchesList;
+  }
+
+  // CA-03: no-op when all provided keys already match existing config (semantic comparison)
+  const isNoOp = Object.keys(existing).length > 0 &&
+    (rawBaseBranch === undefined || existing.baseBranch === rawBaseBranch.trim()) &&
+    (protectedBranchesList === undefined ||
+      (Array.isArray(existing.protectedBranches) &&
+       JSON.stringify(existing.protectedBranches.slice().sort()) === JSON.stringify(protectedBranchesList.slice().sort())));
+  if (isNoOp) {
+    console.log(`Sin cambios: ${targetPath} ya tiene los valores indicados.`);
+    process.exit(0);
+  }
+  const proposed = serializeMemoryYaml(merged);
+
+  // Create directory if absent
+  fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+
+  fs.writeFileSync(targetPath, proposed, 'utf8');
+
+  const level = isGlobal ? 'global' : 'proyecto';
+  console.log(`Configuración de ramas escrita en ${targetPath} (nivel: ${level})`);
+}
+
 function sddHelp() {
   console.log(`
   refacil-sdd-ai sdd — Gestión de artefactos SDD-AI
@@ -607,6 +742,14 @@ function sddHelp() {
     sdd set-review-fails <nombre>      Escribe .review-last-fails.json con archivos fallidos
       --files <csv>                      Archivos con fallos (separados por coma)
     sdd clear-review-fails <nombre>    Elimina .review-last-fails.json del cambio
+    sdd config [--json]                Muestra la configuración efectiva de ramas
+                                         (project > global > defaults)
+      [--json]                           Salida en JSON (útil para agentes)
+    sdd write-config                   Escribe la configuración de ramas en el archivo de config
+      [--global]                         Escribe en ~/.refacil-sdd-ai/config.yaml (global)
+                                         Sin --global: escribe en refacil-sdd/config.yaml (proyecto)
+      [--base-branch <branch>]           Rama base para nuevos cambios
+      [--protected-branches <csv>]       Ramas protegidas (separadas por coma)
 
   Notas:
     - Los nombres de cambio deben empezar con minúscula y usar solo [a-z0-9-]
@@ -655,10 +798,16 @@ function handleSdd(sub, argv, projectRoot) {
     case 'clear-review-fails':
       cmdClearReviewFails(args, root);
       break;
+    case 'config':
+      cmdConfig(args, root);
+      break;
+    case 'write-config':
+      cmdWriteConfig(args, root);
+      break;
     default:
       sddHelp();
       process.exit(1);
   }
 }
 
-module.exports = { handleSdd, parseArgs, autoMigrateOpenspec, validateChangeName, findProjectRoot };
+module.exports = { handleSdd, parseArgs, autoMigrateOpenspec, validateChangeName, resolveExistingChangeName, findProjectRoot, cmdWriteConfig };

package/lib/config.js

@@ -0,0 +1,216 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const DEFAULT_PROTECTED_BRANCHES = ['master', 'main', 'develop', 'dev', 'testing', 'qa'];
+const DEFAULT_BASE_BRANCH = 'develop';
+
+// Minimal YAML parser — supports string scalars and string-array values only.
+function parseYaml(content) {
+  const result = {};
+  const lines = content.split('\n');
+  let currentKey = null;
+  let currentList = null;
+
+  for (const line of lines) {
+    if (!line.trim() || line.trim().startsWith('#')) continue;
+
+    // List item: "  - value"
+    if (/^\s{2,}- /.test(line)) {
+      const value = line.replace(/^\s*- /, '').trim();
+      if (currentKey && currentList !== null) {
+        currentList.push(value);
+      }
+      continue;
+    }
+
+    // Key-value: "key: value" or "key:" (empty / start of list)
+    const kvMatch = line.match(/^([a-zA-Z][a-zA-Z0-9_-]*):\s*(.*)/);
+    if (kvMatch) {
+      currentKey = kvMatch[1];
+      const val = kvMatch[2].trim();
+      if (val === '') {
+        currentList = [];
+        result[currentKey] = currentList;
+      } else {
+        currentList = null;
+        result[currentKey] = val;
+      }
+      continue;
+    }
+
+    currentKey = null;
+    currentList = null;
+  }
+
+  return result;
+}
+
+/**
+ * Try to read and parse a YAML config file.
+ * Returns the parsed object on success, or null if the file does not exist or cannot be parsed.
+ * File-not-found is silent (expected). Read/parse errors emit a warning to stderr.
+ */
+function readConfigFile(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return null;
+    const content = fs.readFileSync(filePath, 'utf8');
+    const parsed = parseYaml(content);
+    if (Object.keys(parsed).length === 0 && content.trim().length > 0) {
+      process.stderr.write(`[refacil-sdd-ai] warning: could not parse config file at ${filePath} — treating as empty.\n`);
+    }
+    return parsed;
+  } catch (_) {
+    process.stderr.write(`[refacil-sdd-ai] warning: could not read config file at ${filePath} — ignoring.\n`);
+    return null;
+  }
+}
+
+/**
+ * Validate `protectedBranches` from a parsed config object.
+ * Returns the value if valid, or null + emits a warning if invalid.
+ * @param {object} cfg  — parsed YAML object
+ * @param {string} src  — source label for the warning ('project' | 'global')
+ */
+function extractProtectedBranches(cfg, src) {
+  if (!('protectedBranches' in cfg)) return null;
+  const val = cfg.protectedBranches;
+  if (!Array.isArray(val)) {
+    process.stderr.write(
+      `[refacil-sdd-ai] warning: protectedBranches in ${src} config must be a list — ignoring.\n`,
+    );
+    return null;
+  }
+  return val;
+}
+
+/**
+ * Validate `baseBranch` from a parsed config object.
+ * Returns the value if valid, or null + emits a warning if invalid.
+ * @param {object} cfg  — parsed YAML object
+ * @param {string} src  — source label for the warning ('project' | 'global')
+ */
+function extractBaseBranch(cfg, src) {
+  if (!('baseBranch' in cfg)) return null;
+  const val = cfg.baseBranch;
+  if (typeof val !== 'string' || val.trim() === '') {
+    process.stderr.write(
+      `[refacil-sdd-ai] warning: baseBranch in ${src} config must be a non-empty string — ignoring.\n`,
+    );
+    return null;
+  }
+  return val.trim();
+}
+
+/**
+ * Load branch configuration with cascade (project > global > defaults) and source tracking.
+ *
+ * Returns:
+ * ```
+ * {
+ *   protectedBranches: string[],
+ *   baseBranch: string,
+ *   sources: {
+ *     protectedBranches: 'project' | 'global' | 'default',
+ *     baseBranch: 'project' | 'global' | 'default',
+ *   }
+ * }
+ * ```
+ *
+ * Never throws — all errors are handled internally.
+ *
+ * @param {string} projectRoot  — absolute path to the project root
+ */
+function loadBranchConfigWithSources(projectRoot) {
+  const projectConfigPath = path.join(projectRoot, 'refacil-sdd', 'config.yaml');
+  const globalConfigPath = path.join(os.homedir(), '.refacil-sdd-ai', 'config.yaml');
+
+  const projectCfg = readConfigFile(projectConfigPath);
+  const globalCfg = readConfigFile(globalConfigPath);
+
+  // --- protectedBranches ---
+  let protectedBranches = null;
+  let protectedBranchesSource = 'default';
+
+  if (projectCfg !== null) {
+    const val = extractProtectedBranches(projectCfg, 'project');
+    if (val !== null) {
+      protectedBranches = val;
+      protectedBranchesSource = 'project';
+    }
+  }
+
+  if (protectedBranches === null && globalCfg !== null) {
+    const val = extractProtectedBranches(globalCfg, 'global');
+    if (val !== null) {
+      protectedBranches = val;
+      protectedBranchesSource = 'global';
+    }
+  }
+
+  if (protectedBranches === null) {
+    protectedBranches = DEFAULT_PROTECTED_BRANCHES.slice();
+    protectedBranchesSource = 'default';
+  }
+
+  if (protectedBranches.length === 0) {
+    process.stderr.write('[refacil-sdd-ai] warning: protectedBranches is empty — no branches will be protected.\n');
+  }
+
+  // --- baseBranch ---
+  let baseBranch = null;
+  let baseBranchSource = 'default';
+
+  if (projectCfg !== null) {
+    const val = extractBaseBranch(projectCfg, 'project');
+    if (val !== null) {
+      baseBranch = val;
+      baseBranchSource = 'project';
+    }
+  }
+
+  if (baseBranch === null && globalCfg !== null) {
+    const val = extractBaseBranch(globalCfg, 'global');
+    if (val !== null) {
+      baseBranch = val;
+      baseBranchSource = 'global';
+    }
+  }
+
+  if (baseBranch === null) {
+    baseBranch = DEFAULT_BASE_BRANCH;
+    baseBranchSource = 'default';
+  }
+
+  return {
+    protectedBranches,
+    baseBranch,
+    sources: {
+      protectedBranches: protectedBranchesSource,
+      baseBranch: baseBranchSource,
+    },
+  };
+}
+
+/**
+ * Load branch configuration (no source tracking).
+ * Returns { protectedBranches, baseBranch }.
+ * Never throws.
+ *
+ * @param {string} projectRoot  — absolute path to the project root
+ */
+function loadBranchConfig(projectRoot) {
+  const { protectedBranches, baseBranch } = loadBranchConfigWithSources(projectRoot);
+  return { protectedBranches, baseBranch };
+}
+
+module.exports = {
+  parseYaml,
+  readConfigFile,
+  loadBranchConfig,
+  loadBranchConfigWithSources,
+  DEFAULT_PROTECTED_BRANCHES,
+  DEFAULT_BASE_BRANCH,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "refacil-sdd-ai",
-  "version": "4.5.7",
+  "version": "5.0.0",
   "description": "SDD-AI: Specification-Driven Development with AI — development methodology using AI with Claude Code, Cursor and OpenCode",
   "bin": {
     "refacil-sdd-ai": "./bin/cli.js"
@@ -31,13 +31,13 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": ""
+    "url": "https://github.com/Erikole21/refacil-sdd-ai"
   },
   "engines": {
     "node": ">=20.0.0"
   },
   "scripts": {
-    "test": "node --test test/hooks.test.js test/installer.test.js test/ignore-files.test.js test/methodology-migration-pending.test.js test/sdd.test.js test/refactor-integrar-openspec-nativo.test.js test/refactor-rutas-refacil-sdd.test.js test/refactor-agents-english.test.js test/remove-openspec-legacy.test.js test/find-project-root.test.js test/opencode-installer.test.js test/opencode-plugin.test.js"
+    "test": "node --test test/hooks.test.js test/installer.test.js test/ignore-files.test.js test/methodology-migration-pending.test.js test/sdd.test.js test/config.test.js test/refactor-integrar-openspec-nativo.test.js test/refactor-rutas-refacil-sdd.test.js test/refactor-agents-english.test.js test/remove-openspec-legacy.test.js test/find-project-root.test.js test/opencode-installer.test.js test/opencode-plugin.test.js"
   },
   "dependencies": {
     "ws": "^8.18.0"

package/skills/apply/SKILL.md

@@ -50,12 +50,59 @@ Note: `specs` is `true` if `specs.md` exists in the root **OR** at least one `.m
 
 Run `git branch --show-current` to get the current branch.
 
-Apply the **Protected branch policy and branch creation** defined in `refacil-prereqs/METHODOLOGY-CONTRACT.md`.
+If the current branch is already a working branch (`feature/*`, `fix/*`, `hotfix/*`, `refactor/*`, etc.), continue without interruption to Step 1.5.
 
-- **If the current branch is protected**: execute the full branch creation protocol **before continuing**. Do not delegate to the sub-agent until on a working branch.
-- For `refacil:apply`, the suggested branch prefix is `feature/`.
-- If the current branch is already a working branch (`feature/*`, `fix/*`, `hotfix/*`, `refactor/*`, etc.), continue without interruption.
-- If the user does not approve the branch creation/change, **stop**. Do not continue with implementation.
+If the current branch is protected, execute the 3-gate protocol below strictly. Each gate is a hard stop — do not proceed to the next gate until the user has replied.
+
+---
+
+**[GATE 1 — STOP AND WAIT: ask for task identifier]**
+
+Ask the user exactly this question and then STOP. Do NOT run any git command. Do NOT propose a branch name. Do NOT continue to Gate 2 until the user replies:
+
+> "What is the task number or identifier for this branch? (e.g. SEGINF-20, REF-123, or a short descriptive name)"
+
+If the user says they have no ID, note that and proceed to Gate 2 with `<ID> = none`.
+
+---
+
+**[GATE 2 — STOP AND WAIT: propose branch name and ask for approval]**
+
+Only after receiving the user's reply to Gate 1:
+
+1. Verify clean working directory (`git status --porcelain`).
+2. If there are uncommitted changes, ask for approval to stash them (`git stash push -m "auto-stash-refacil"`). Do NOT stash without approval.
+3. Detect the effective configuration by running:
+   ```
+   refacil-sdd-ai sdd config --json
+   ```
+   Parse `baseBranch` and `protectedBranches` from the JSON output.
+   If the command fails or exits non-zero, fall back to:
+   - `protectedBranches` = [master, main]
+   - `baseBranch` = main (or master if main does not exist in the repo)
+4. Determine the base branch:
+   - Use the `baseBranch` value from the config (or the fallback).
+   - Only if that branch does not exist in the repo (new repo), use `main` or `master` as a temporary exception and recommend adopting the standard flow.
+5. Compose the branch name with `feature/` prefix:
+   - Feature: `feature/<ID>` (e.g. `feature/SEGINF-20`)
+   - Without ID: propose a short descriptive name (e.g. `feature/add-configurable-branches`)
+6. Present the proposed name and ask for approval. Then STOP. Do NOT run `git checkout` or `git switch`. Do NOT create the branch yet. Wait for the user's explicit confirmation:
+
+> "I'll create branch `<proposed-name>` from `<base-branch>`. Shall I proceed?"
+
+---
+
+**[GATE 3 — execute only after explicit approval from Gate 2]**
+
+Only after the user explicitly confirms (e.g. "yes", "go", "ok", "proceed"):
+
+1. Switch to the base branch and update it (`git checkout <base>` + `git pull origin <base>`).
+2. Create the working branch (`git checkout -b <branch-name>`).
+3. If a stash was approved in Gate 2, restore it (`git stash pop`).
+
+If the user does not approve at Gate 2, stop entirely. Do not create any branch. Do not continue with implementation.
+
+---
 
 ### Step 1.5: Build structured briefing (reduces sub-agent tool calls)
 

package/skills/archive/SKILL.md

@@ -22,7 +22,7 @@ Verify the change is truly complete:
 
 2. **Tests pass**: Resolve and run the test command according to `refacil-prereqs/METHODOLOGY-CONTRACT.md`. If there are failing tests, inform and ask if they want to continue.
 
-3. **No pending files**: Run `git status` and verify if there are uncommitted changes related to the feature. If there are, suggest committing before archiving.
+3. **Working tree scope hygiene**: Run `git status` and check whether there are files unrelated to the current change scope. It is expected to have uncommitted changes in this step. If unrelated files are detected, warn the user and ask whether to continue archiving anyway. Do not suggest commit in this step; commit/push decisions are handled in `refacil:up-code`.
 
 4. **Review approved (blocking)**: Verify that the `.review-passed` file exists in the change folder (`refacil-sdd/changes/[change-name]/.review-passed`) following **`METHODOLOGY-CONTRACT.md` §8** (dotfile; do not conclude by listings without dotfiles). If it does NOT exist, **stop the archiving** and inform the user:
    ```
@@ -126,6 +126,8 @@ Bug fixes only contain `summary.md` (and optionally `.review-passed`). The CLI `
 
 The spec and review evidence are written **before** running the CLI archive command, while the artifacts are still at their original paths. The CLI only moves the folder — it never syncs specs.
 
+`refacil-sdd-ai sdd archive` normalizes the provided `changeName` to lowercase before validation/path resolution. Prefer lowercase names for consistency across commands and records.
+
 1. **Sync spec to `refacil-sdd/specs/` (before archiving)**:
    - Read `refacil-sdd/changes/<changeName>/specs.md` (and all `.md` under `specs/` if that subfolder exists).
    - Determine the spec folder name: use `<changeName>` unless a more descriptive name is clearly better.

package/skills/bug/SKILL.md

@@ -75,11 +75,59 @@ If the sub-agent reported `crossRepo: true` in any hypothesis: before implementi
 
 Run `git branch --show-current` to get the current branch.
 
-Apply the **Protected branch policy and branch creation** defined in `refacil-prereqs/METHODOLOGY-CONTRACT.md`.
+If the current branch is already a working branch (`feature/*`, `fix/*`, `hotfix/*`, `refactor/*`, etc.), continue without interruption to Step 5.
 
-- If the current branch is protected, execute the full protocol before continuing.
-- For `refacil:bug`, the suggested branch prefix is `fix/`.
-- If the current branch is already a working branch (`feature/*`, `fix/*`, `hotfix/*`, `refactor/*`, etc.), continue without interruption.
+If the current branch is protected, execute the 3-gate protocol below strictly. Each gate is a hard stop — do not proceed to the next gate until the user has replied.
+
+---
+
+**[GATE 1 — STOP AND WAIT: ask for task identifier]**
+
+Ask the user exactly this question and then STOP. Do NOT run any git command. Do NOT propose a branch name. Do NOT continue to Gate 2 until the user replies:
+
+> "What is the task number or identifier for this branch? (e.g. SEGINF-20, REF-123, or a short descriptive name)"
+
+If the user says they have no ID, note that and proceed to Gate 2 with `<ID> = none`.
+
+---
+
+**[GATE 2 — STOP AND WAIT: propose branch name and ask for approval]**
+
+Only after receiving the user's reply to Gate 1:
+
+1. Verify clean working directory (`git status --porcelain`).
+2. If there are uncommitted changes, ask for approval to stash them (`git stash push -m "auto-stash-refacil"`). Do NOT stash without approval.
+3. Detect the effective configuration by running:
+   ```
+   refacil-sdd-ai sdd config --json
+   ```
+   Parse `baseBranch` and `protectedBranches` from the JSON output.
+   If the command fails or exits non-zero, fall back to:
+   - `protectedBranches` = [master, main]
+   - `baseBranch` = main (or master if main does not exist in the repo)
+4. Determine the base branch:
+   - Use the `baseBranch` value from the config (or the fallback).
+   - Only if that branch does not exist in the repo (new repo), use `main` or `master` as a temporary exception and recommend adopting the standard flow.
+5. Compose the branch name with `fix/` prefix:
+   - Bugfix: `fix/<ID>` (e.g. `fix/SEGINF-20`)
+   - Without ID: propose a short descriptive name (e.g. `fix/session-timeout-redis`)
+6. Present the proposed name and ask for approval. Then STOP. Do NOT run `git checkout` or `git switch`. Do NOT create the branch yet. Wait for the user's explicit confirmation:
+
+> "I'll create branch `<proposed-name>` from `<base-branch>`. Shall I proceed?"
+
+---
+
+**[GATE 3 — execute only after explicit approval from Gate 2]**
+
+Only after the user explicitly confirms (e.g. "yes", "go", "ok", "proceed"):
+
+1. Switch to the base branch and update it (`git checkout <base>` + `git pull origin <base>`).
+2. Create the working branch (`git checkout -b <branch-name>`).
+3. If a stash was approved in Gate 2, restore it (`git stash pop`).
+
+If the user does not approve at Gate 2, stop entirely. Do not create any branch. Do not continue with implementation.
+
+---
 
 ### Step 5: Delegate implementation to the refacil-debugger sub-agent (mode: fix)
 

package/skills/prereqs/METHODOLOGY-CONTRACT.md

@@ -34,24 +34,28 @@ Coverage (if applicable): detect the project command (`test:cov`, `coverage`, `p
 
 ## §4 — Protected branch policy and branch creation
 
-Protected branches (never develop directly on them): `master`, `main`, `develop`, `dev`, `testing`, `qa`.
+> **Dynamic config**: before applying any branch rule, run `refacil-sdd-ai sdd config --json`
+> to obtain the effective `protectedBranches` and `baseBranch` for this project.
+> The values below are the built-in defaults and serve as the fallback if the command is unavailable.
+
+Protected branches built-in defaults (authoritative list: `refacil-sdd-ai sdd config --json`): `master`, `main`, `develop`, `dev`, `testing`, `qa`. These are the fallback when no config file is present. When `sdd config --json` is unavailable, treat at minimum `master` and `main` as protected — they are the universally protected branches across all projects.
 
 Critical rule:
 - **NEVER** make direct changes on protected branches.
-- All integration to protected branches is done via PR, without exceptions (including `testing`).
+- All integration to protected branches is done via PR.
 
 ### Working branch creation
 
-- General rule: every new working branch (`feature/*`, `fix/*`, `hotfix/*`, `refactor/*`, etc.) must be created from an updated `develop` or `dev`.
-- Exception for new repos: if neither `develop` nor `dev` exists yet, creating temporarily from `main` or `master` is allowed.
-- If the exception is used, recommend creating `develop`/`dev` and adopting that flow as the repo standard.
-- **NEVER** create working branches from `testing`, `qa`, or from other feature/bug branches.
+- General rule: every new working branch (`feature/*`, `fix/*`, `hotfix/*`, `refactor/*`, etc.) must be created from the `baseBranch` returned by `sdd config --json`.
+- Exception for new repos: if the configured `baseBranch` does not exist yet, creating temporarily from `main` or `master` is allowed.
+- If the exception is used, recommend creating the configured `baseBranch` and adopting that flow as the repo standard.
+- **NEVER** create working branches from any other protected branch (as listed by `sdd config --json`), or from other feature/bug branches.
 
 ### Integration
 
 - All integration to any protected branch requires a **PR**.
-- No exceptions: `testing`, `develop`, `main`, `master`, `qa`, `release/*` — all require PR.
-- Recommend the user create a PR to `testing` so the changes are available in the test environment.
+- No exceptions: all protected branches (as returned by `sdd config --json`), plus `release/*` patterns — all require PR.
+- Recommend the user create a PR to one of the protected branches listed by `sdd config --json` to make the changes available for integration.
 
 ### Protocol when the current branch is protected
 
@@ -76,8 +80,8 @@ Only after receiving the user's reply to Gate 1:
 1. Verify clean working directory (`git status --porcelain`).
 2. If there are uncommitted changes, ask for approval to stash them (`git stash push -m "auto-stash-refacil"`). Do NOT stash without approval.
 3. Detect the base branch:
-   - Prefer `develop`, then `dev`.
-   - Only if neither exists (new repo), use `main` or `master` as a temporary exception.
+   - Use the `baseBranch` from `sdd config --json`.
+   - Only if that branch does not exist (new repo), use `main` or `master` as a temporary exception.
 4. Compose the branch name:
    - Feature: `feature/<ID>` (e.g. `feature/SEGINF-20`)
    - Bugfix: `fix/<ID>` (e.g. `fix/SEGINF-20`)

package/skills/setup/SKILL.md

@@ -40,6 +40,45 @@ mkdir -p refacil-sdd/changes
 
 Inform the user that SDD artifacts will be stored in `refacil-sdd/changes/<change-name>/`.
 
+### Step 3b: Branch configuration (project-level)
+
+Check and optionally set project-specific branch configuration that overrides the global config.
+
+**3b.1 Show inherited values** — run:
+
+```bash
+refacil-sdd-ai sdd config --json
+```
+
+Parse the JSON output and display the effective values with their source:
+
+```
+  baseBranch [<source>]: <value>
+  protectedBranches [<source>]: <value>
+```
+
+Where `<source>` is one of `project`, `global`, or `default`.
+
+**3b.2 Check for existing project config** — if `refacil-sdd/config.yaml` already exists, show its current values and ask the user if they want to update them. If the user declines, skip to Step 4.
+
+**3b.3 Ask for project-level overrides** — prompt the user:
+
+```
+Do you want to set project-specific branch configuration?
+  baseBranch (inherited: <value> from <source>):
+  protectedBranches (inherited: <value> from <source>):
+Press Enter to skip and inherit the values shown above.
+```
+
+- If the user provides values: run `refacil-sdd-ai sdd write-config --base-branch <v> --protected-branches <csv>` (no `--global` flag — this writes to `refacil-sdd/config.yaml`).
+- If the user skips (presses Enter or provides no values): do **not** write any file. Project will inherit from global or defaults.
+
+**3b.4 Confirm the result** — after writing (or skipping), show the new effective config:
+
+```bash
+refacil-sdd-ai sdd config
+```
+
 ### Step 4: Generate `.agents/` and `AGENTS.md`
 
 Analyze the repo and generate the documentation structure. If they already exist, ask whether to regenerate.
@@ -139,7 +178,7 @@ If the user wants to customize additional exclusions, they can edit them directl
 
 ```
 === refacil:setup completed ===
- Node.js / refacil-sdd-ai / refacil-sdd/changes/ / AGENTS.md / CLAUDE.md / .cursorrules / .claudeignore / .cursorignore / skills OK
+ Node.js / refacil-sdd-ai / refacil-sdd/changes/ / branch config / AGENTS.md / CLAUDE.md / .cursorrules / .claudeignore / .cursorignore / skills OK
 
  Restart Claude Code or Cursor session if this is the first skills installation.
  The next step is to review the available flow.

package/skills/up-code/SKILL.md

@@ -17,7 +17,10 @@ Applies the branch and integration policy defined in `refacil-prereqs/METHODOLOG
 
 Run `git branch --show-current` to get the branch name.
 
-- If the current branch is protected (according to `METHODOLOGY-CONTRACT.md`), **stop** and inform the user:
+Run `refacil-sdd-ai sdd config --json` to obtain the effective `protectedBranches` list for this project.
+If the command fails or exits non-zero, use the default list: master, main.
+
+- If the current branch is in the `protectedBranches` list, **stop** and inform the user:
   ```
   Cannot push code from a protected branch ([name]).
   Branch validation is done in /refacil:apply or /refacil:bug before writing code.
@@ -78,12 +81,13 @@ Run `git push -u origin [current-branch]` to push the changes.
  Remote: origin/[branch-name]
 ```
 
-2. **Ask the user** which branch they want to create the PR to. Suggest `testing` as the default target:
+2. **Ask the user** which branch they want to create the PR to. Show the list of protected branches obtained from `sdd config --json` in Step 1 so the user can pick one:
    ```
-   Which branch do you want to create the PR to? (recommended: testing)
+   Which branch do you want to create the PR to?
+   Protected branches available: [list from sdd config --json]
    ```
 
-  If the user indicates a different branch than `testing`, verify it exists on the remote by inspecting `git branch -r` output before generating the link. If it does not exist, inform the user and ask them to confirm or correct the name.
+  Verify the chosen branch exists on the remote by inspecting `git branch -r` output before generating the link. If it does not exist, inform the user and ask them to confirm or correct the name. If the user indicates a branch not in the protected branches list, warn them before proceeding.
 
 3. Get the remote repository URL with `git remote get-url origin` and detect the VCS hosting used by this repository to generate the correct PR/MR link:
    - **GitHub** (url contains `github.com`): `https://github.com/[owner]/[repo]/compare/[target-branch]...[current-branch]?expand=1`
@@ -93,12 +97,12 @@ Run `git push -u origin [current-branch]` to push the changes.
    - For SSH remotes (`git@host:group/repo.git`), extract host/namespace/repo from the segment after `:`.
    - If hosting cannot be determined, do not assume a provider: show the detected remote URL and ask the user which platform is used before generating the final PR/MR link.
 
-4. Show the generated link (provider-specific) to the user and recommend PR to `testing`:
+4. Show the generated link (provider-specific) to the user:
 ```
  Create your PR here: [link]
 
- Tip: PR to testing is recommended to enable integrated testing
- before promoting to other protected branches.
+ Tip: PRing to a protected branch (e.g. one of those listed by `sdd config --json`) is recommended
+ before promoting to main/master.
 ```
 
 **This is the terminal step of the SDD flow.** Do not ask for a next skill — the cycle closes here. Apply the terminal step rule from `METHODOLOGY-CONTRACT.md §5`.