fix(bins): Windows-safe GIT_CEILING join; next-version probes the full default-base chain

GIT_CEILING_DIRECTORIES was joined with ':' — git on Windows splits on
';' and drive letters contain ':', silently disabling the #2144
second-layer defense there; now path.delimiter. next-version's
default-base detection only tried origin/HEAD then 'main', diverging
from the canonical 4-step chain diff-scope uses — origin/main and
origin/master probes added, pinned by fixture repos.

bin/gstack-memory-ingest.ts

@@ -54,7 +54,7 @@ import {
   rmSync,
   realpathSync,
 } from "fs";
-import { join, basename, dirname } from "path";
+import { join, basename, dirname, delimiter } from "path";
 import { execFileSync, spawnSync, spawn, type ChildProcess } from "child_process";
 import { homedir } from "os";
 import { createHash } from "crypto";
@@ -1443,8 +1443,10 @@ function runGbrainImport(
     }
     const baseEnv: NodeJS.ProcessEnv = {
       ...process.env,
+      // path.delimiter, not ':' — git splits this on ';' on Windows, and
+      // drive-letter paths contain ':' themselves.
       GIT_CEILING_DIRECTORIES: process.env.GIT_CEILING_DIRECTORIES
-        ? `${ceiling}:${process.env.GIT_CEILING_DIRECTORIES}`
+        ? `${ceiling}${delimiter}${process.env.GIT_CEILING_DIRECTORIES}`
         : ceiling,
     };
     const child = spawnGbrainAsync(

bin/gstack-next-version

@@ -407,13 +407,29 @@ function parseArgs(argv: string[]): { base: string; bump: Bump; current: string;
   if (help) return { base: "", bump: "micro", current: "", excludePR: null, help: true };
   if (!base) {
     // Detect the default branch instead of assuming main (local-only repos
-    // on trunk/master work like GitHub repos on main).
+    // on trunk/master work like GitHub repos on main). Same probe order as
+    // the canonical chain in bin/gstack-diff-scope and {{BASE_BRANCH_DETECT}}
+    // (scripts/resolvers/utility.ts): origin/HEAD -> origin/main ->
+    // origin/master -> literal "main". origin/HEAD is unset on plain clones
+    // that never ran `git remote set-head`, so the rev-parse probes matter.
     try {
       const head = execFileSync("git", ["symbolic-ref", "refs/remotes/origin/HEAD"], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-      base = head.replace("refs/remotes/origin/", "") || "main";
+      base = head.replace("refs/remotes/origin/", "");
     } catch {
-      base = "main";
+      // fall through to the rev-parse probes
     }
+    if (!base) {
+      for (const candidate of ["main", "master"]) {
+        try {
+          execFileSync("git", ["rev-parse", "--verify", "-q", `origin/${candidate}`], { stdio: ["ignore", "ignore", "ignore"] });
+          base = candidate;
+          break;
+        } catch {
+          // probe failed; try the next candidate
+        }
+      }
+    }
+    if (!base) base = "main";
   }
   if (!bump) {
     console.error("Error: --bump is required (major|minor|patch|micro)");

test/gstack-next-version.test.ts

@@ -4,6 +4,7 @@
 // when the relevant CLI isn't available).
 
 import { test, expect, describe } from "bun:test";
+import { execFileSync } from "node:child_process";
 import { mkdirSync, mkdtempSync, writeFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -221,6 +222,104 @@ describe("resolveVersionPath (monorepo VERSION-path support)", () => {
   });
 });
 
+// Fixture-repo coverage for the default-base detection chain in parseArgs:
+// origin/HEAD symbolic-ref → origin/main probe → origin/master probe →
+// literal "main". No --base and no --current-version are passed, so the
+// detected base is observable through base_version: each fixture branch
+// carries a distinct VERSION and readBaseVersion does
+// `git show origin/<detected-base>:VERSION`.
+describe("default-base detection (no --base)", () => {
+  const SCRIPT = join(import.meta.dir, "..", "bin", "gstack-next-version");
+  // Point git at a nonexistent global/system config so operator settings
+  // (init.defaultBranch, commit.gpgsign, hooks, ...) can't leak into fixtures.
+  const noCfg = join(mkdtempSync(join(tmpdir(), "nextver-gitcfg-")), "empty");
+  const GIT_ENV = {
+    ...process.env,
+    GIT_CONFIG_GLOBAL: noCfg,
+    GIT_CONFIG_SYSTEM: noCfg,
+    GIT_AUTHOR_NAME: "fixture",
+    GIT_AUTHOR_EMAIL: "fixture@example.com",
+    GIT_COMMITTER_NAME: "fixture",
+    GIT_COMMITTER_EMAIL: "fixture@example.com",
+  };
+
+  function git(cwd: string, ...args: string[]): void {
+    execFileSync("git", args, { cwd, env: GIT_ENV, stdio: ["ignore", "pipe", "pipe"] });
+  }
+
+  // Origin repo whose branches each hold a distinct VERSION, plus a clone
+  // (the clone is the repo the CLI runs in).
+  function makeClone(branches: Array<[name: string, version: string]>): { root: string; clone: string } {
+    const root = mkdtempSync(join(tmpdir(), "nextver-base-"));
+    const origin = join(root, "origin");
+    mkdirSync(origin);
+    git(origin, "init", "-q", "-b", branches[0][0]);
+    for (let i = 0; i < branches.length; i++) {
+      const [name, version] = branches[i];
+      if (i > 0) git(origin, "checkout", "-q", "-b", name);
+      writeFileSync(join(origin, "VERSION"), `${version}\n`);
+      git(origin, "add", "VERSION");
+      git(origin, "commit", "-q", "--no-gpg-sign", "-m", `VERSION ${version}`);
+    }
+    git(root, "clone", "-q", "origin", "clone");
+    return { root, clone: join(root, "clone") };
+  }
+
+  function runWithoutBase(cwd: string): { exitCode: number; parsed: any } {
+    const proc = Bun.spawnSync(
+      ["bun", "run", SCRIPT, "--bump", "patch", "--workspace-root", "null"],
+      { cwd },
+    );
+    const out = new TextDecoder().decode(proc.stdout);
+    return { exitCode: proc.exitCode, parsed: JSON.parse(out) };
+  }
+
+  test("origin/HEAD symbolic-ref wins — resolves trunk even though origin/main exists", () => {
+    const { root, clone } = makeClone([["main", "1.1.1.1"], ["trunk", "2.2.2.2"]]);
+    try {
+      git(clone, "symbolic-ref", "refs/remotes/origin/HEAD", "refs/remotes/origin/trunk");
+      const { exitCode, parsed } = runWithoutBase(clone);
+      expect(exitCode).toBe(0);
+      // trunk's VERSION, not main's — the rev-parse probes never ran.
+      expect(parsed.base_version).toBe("2.2.2.2");
+      expect(parsed.version).toBe("2.2.3.0");
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 30_000);
+
+  test("no origin/HEAD, no origin/main: the origin/master probe resolves master", () => {
+    const { root, clone } = makeClone([["master", "3.3.3.3"]]);
+    try {
+      // Plain clones that never ran `git remote set-head` have no origin/HEAD.
+      git(clone, "remote", "set-head", "origin", "--delete");
+      const { exitCode, parsed } = runWithoutBase(clone);
+      expect(exitCode).toBe(0);
+      // Read at origin/master. The "main" literal fallback would have warned
+      // and assumed 0.0.0.0 instead.
+      expect(parsed.base_version).toBe("3.3.3.3");
+      expect(parsed.version).toBe("3.3.4.0");
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 30_000);
+
+  test("neither origin/HEAD nor main/master: falls back to the 'main' literal", () => {
+    const { root, clone } = makeClone([["develop", "4.4.4.4"]]);
+    try {
+      git(clone, "remote", "set-head", "origin", "--delete");
+      const { exitCode, parsed } = runWithoutBase(clone);
+      expect(exitCode).toBe(0);
+      // base = literal "main"; origin/main doesn't exist, so readBaseVersion
+      // warns and assumes 0.0.0.0 — which pins WHICH base the fallback chose.
+      expect(parsed.base_version).toBe("0.0.0.0");
+      expect(parsed.warnings.join("\n")).toContain("origin/main");
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 30_000);
+});
+
 // Integration smoke — only runs if gh is available and authenticated. Confirms
 // the CLI executes end-to-end against real APIs without crashing.
 describe("integration (smoke)", () => {