@bensandee/tooling 0.89.1 → 0.90.0

package/dist/bin.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import { accessSync, appendFileSync, closeSync, constants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
-import * as path$1 from "node:path";
-import path from "node:path";
+import path, * as path$1 from "node:path";
 import { parseArgs, parseEnv } from "node:util";
 import { FatalError, TransientError, UnexpectedError, describeError, describeError as describeError$1, redact, redact as redact$1 } from "@bensandee/common";
 import { defineCommand, renderUsage, runCommand, runMain } from "citty";
@@ -176,7 +175,7 @@ function loadEnvFileForBin(rawArgs, bin, io = processIo) {
 //#region src/env-file-preload.ts
 const envFileLoad = loadEnvFileForBin(process.argv.slice(2), {
 	name: "bst",
-	version: "0.89.1"
+	version: "0.90.0"
 });
 //#endregion
 //#region ../cli-kit/src/logger.ts
@@ -828,7 +827,7 @@ const DockerImageOverrideSchema = z.strictObject({
 	buildArgs: z.record(z.string(), z.string()).optional().meta({ description: "Build args passed to `docker build` for this package. Values support ${VAR} and ${VAR:-default} expansion against process.env." }),
 	imageName: z.string().min(1).optional().meta({ description: "Image name used for docker:build tags, docker:publish refs, and docker:check cross-referencing. Falls back to the derived name: the package.json name for the root package (npm scope stripped), or {root-name}-{package-name} for a monorepo package. A value that already carries a registry host (e.g. 'ghcr.io/me/app') is used as written by docker:publish, with no registryNamespace prefix added, and must name the registry this run logs in to -- one naming any other host refuses before login." }),
 	version: z.string().optional().meta({ description: "Version used for docker:publish tags; overrides the version resolved from the enclosing package." }),
-	publish: z.boolean().optional().meta({ description: "The publish decision either way: true keeps an image published -- including one its compose service is declared only in the check overlay, which a later release stops publishing by default -- and false excludes it while publishDocker stays true. Unset means the discovery default, which publishes everything except a check-only image once that rule is enforced." })
+	publish: z.boolean().optional().meta({ description: "The publish decision either way: true keeps an image published -- including one whose compose service is declared only in the check overlay, which is not published by default -- and false excludes it while publishDocker stays true. Unset means the discovery default, which publishes everything except a check-only image." })
 });
 const DockerMapSchema = z.record(z.string(), DockerImageOverrideSchema);
 const TolerantDockerMapSchema = z.record(z.string(), tolerantBlock(DockerImageOverrideSchema));
@@ -1701,6 +1700,7 @@ const LintSweepConfigSchema = z.strictObject({
 });
 const AgentEgressConfigSchema = z.strictObject({ browseHosts: z.array(z.string().min(1)).optional().meta({ description: "Host patterns this repo's agent containers may fetch from, on top of the hosts every run needs: an exact host (`fastdl.mongodb.org`) or a wildcard over its leftmost label (`*.example.com`). No ports. These join the browse lane, which serves GET and HEAD only." }) });
 const AgentConfigSchema = z.strictObject({
+	enabled: z.boolean().optional().meta({ description: "The repo's explicit consent to the agent (default false). Only `true`, read from the repo's **default branch**, lets the agent work the repo: claim units, run sweeps, recover orphans, merge, act on a chat proposal or start a new spec. A missing key, `false`, a missing `.tooling.json` or a read that fails all mean not enabled, and the answer is re-read within about a minute. Every other `agent.*` key below has no effect without this one; `repo:sync` warns when the block sets one of them and this key is not `true`. Where this is `true`, `repo:sync` also installs `@bensandee/agent-cli`. Provisioning the agent's labels is not consent, and is never gated by this key." }),
 	autonomy: z.boolean().optional().meta({ description: "Opt into interior autonomy (default false). When a phase's latest rationale reports readiness \"ready\" with an empty openQuestions[] and the review phase is clean, the agent applies the existing plan -> implement -> review -> park-at-mergeable advance itself instead of parking for a human. Never applies to the design/spec gate or the final merge from the mergeable terminal -- those always wait on a human. Also arms the trunk-red detector: when this repo's default branch combined status settles red, the agent files a tracking issue naming the failing checks and labels it agent/spec, starting the fix through the ordinary spec/plan/implement/review pipeline. It also closes that issue, with a comment, if the default branch recovers on its own before a human acts on it. Also arms the world-changed retrigger sweep: a pull request labelled agent-flags/autopilot that is parked at a -stuck or -failed terminal is re-queued when the fact its park recorded stops being true (the default branch went green, or moved past a conflicted base)." }),
 	preRunRebase: z.boolean().optional().meta({ description: "Merge the current default branch into the work branch before the implement (execute) phase's container starts (default true). A clean merge or an already-up-to-date branch runs the container as is; a conflicting merge is aborted, recorded on the run's status comment, and the run proceeds on the un-synced branch -- it never fails the run. Two consecutive conflicting attempts hand the unit to agent/repair before any container runs; a timeout or a failed merge never counts toward that pair. Set false to skip the attempt entirely for this repo: no fetch, no merge, no abort, and the branch is worked exactly as cloned." }),
 	backlog: z.boolean().optional().meta({ description: "Whether the agent may self-trigger backlog runs consuming this repo's .agent/findings/ ledger (default: on wherever the ledger exists, which only happens in a repo whose own review loop wrote it). A backlog run opens a pull request that fixes or refutes the pending findings; false disarms it, leaving the ledger to accumulate for a human. A run starts only once at least three findings are pending or one is older than seven days." }),
@@ -3375,7 +3375,7 @@ function localTarget(call, entry) {
 }
 //#endregion
 //#region src/release/docker-check-only-phase.ts
-const DOCKER_CHECK_ONLY_PHASE = "warn";
+const DOCKER_CHECK_ONLY_PHASE = "enforce";
 //#endregion
 //#region src/release/docker.ts
 function defaultPublish(checkOnlyIn, phase) {
@@ -3816,7 +3816,7 @@ function runDockerBuild(executor, config) {
 		log$1.info(`Built ${pkg.imageName}:latest`);
 		return { packages: [pkg] };
 	}
-	const packages = detectDockerPackages(executor, config.cwd, repoName, config.checkOnlyPhase ?? "warn");
+	const packages = detectDockerPackages(executor, config.cwd, repoName, config.checkOnlyPhase ?? "enforce");
 	if (packages.length === 0) {
 		log$1.info("No packages with docker config found");
 		return { packages: [] };
@@ -3976,7 +3976,7 @@ function reportCheckOnlyImages(packages, phase) {
 	}
 }
 function runDockerPublish(executor, config) {
-	const checkOnlyPhase = config.checkOnlyPhase ?? "warn";
+	const checkOnlyPhase = config.checkOnlyPhase ?? "enforce";
 	const { packages } = runDockerBuild(executor, {
 		cwd: config.cwd,
 		packageDir: void 0,
@@ -4439,8 +4439,8 @@ function buildWorkflowYaml(options) {
 }
 //#endregion
 //#region src/generators/mise-pin.ts
-const MISE_VERSION = "2026.10.3";
-const MISE_LINUX_X64_SHA256 = "8d48bc510b7d844fad0bc7156c0855c2a1e7230c51e498a7f6b63b021f8b57c5";
+const MISE_VERSION = "2026.10.8";
+const MISE_LINUX_X64_SHA256 = "c72477ae6c3a8e7d817a322f43da70e4643e75ee5c21265f1c19c894273b7428";
 const SETUP_MISE_ACTION_URL = "https://code.orangebikelabs.com/bensandee/common/actions/setup-mise";
 const SETUP_MISE_ACTION_TAG = "setup-mise@latest";
 const SETUP_MISE_ACTION_SHA = "ebe622ef0d24c7efec4a5f6093ddb18500900e24";
@@ -4858,6 +4858,39 @@ function diagnoseCheckScriptForwardingAt(targetDir) {
 	return diagnoseCheckScriptForwarding(scripts);
 }
 //#endregion
+//#region src/generators/agent-cli-dep.ts
+const AGENT_CLI_PACKAGE = "@bensandee/agent-cli";
+const AgentEnabledSliceSchema = z.looseObject({ agent: z.looseObject({ enabled: z.boolean().optional() }).optional() });
+function agentEnabled(ctx) {
+	return parseToolingConfigSlice(ctx.read(".tooling.json"), AgentEnabledSliceSchema, { block: "agent" })?.agent?.enabled === true;
+}
+function wantsAgentCli(ctx) {
+	if (!agentEnabled(ctx)) return false;
+	if (isWorkspacePackage(ctx, "@bensandee/agent-cli")) return false;
+	return !readUnmanagedDevDepNames(ctx).has(AGENT_CLI_PACKAGE);
+}
+function isWorkspacePackage(ctx, packageName) {
+	if (ctx.config.structure !== "monorepo") return false;
+	const packagesDir = path.join(ctx.targetDir, "packages");
+	if (!existsSync(packagesDir)) return false;
+	try {
+		for (const entry of readdirSync(packagesDir, { withFileTypes: true })) {
+			if (!entry.isDirectory()) continue;
+			const pkgJsonPath = path.join(packagesDir, entry.name, "package.json");
+			if (!existsSync(pkgJsonPath)) continue;
+			try {
+				if (parsePackageJson(readFileSync(pkgJsonPath, "utf-8"))?.name === packageName) return true;
+			} catch (_error) {}
+		}
+	} catch (_error) {}
+	return false;
+}
+const UnmanagedSliceSchema = z.object({ unmanagedDevDependencies: UnmanagedDevDependenciesSchema.optional() });
+function readUnmanagedDevDepNames(ctx) {
+	const slice = parseToolingConfigSlice(ctx.read(".tooling.json"), UnmanagedSliceSchema, { block: "unmanagedDevDependencies" });
+	return new Set(slice?.unmanagedDevDependencies ?? []);
+}
+//#endregion
 //#region src/generators/package-json.ts
 const NODE_ENGINES_FLOOR = "24.13.0";
 const ENGINES_NODE = `>=${NODE_ENGINES_FLOOR}`;
@@ -4966,18 +4999,18 @@ function perPackageDevDeps(config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["typescript"];
 		deps["@types/node"] = {
 			"@changesets/cli": "3.0.3",
@@ -4985,18 +5018,18 @@ function perPackageDevDeps(config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["@types/node"];
 	}
 	if (config.builder === "tsdown") deps["tsdown"] = {
@@ -5005,18 +5038,18 @@ function perPackageDevDeps(config) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["tsdown"];
 	return deps;
 }
@@ -5028,18 +5061,18 @@ function vitestDevDeps() {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["vitest"],
 		"@vitest/coverage-v8": {
 			"@changesets/cli": "3.0.3",
@@ -5047,18 +5080,18 @@ function vitestDevDeps() {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["@vitest/coverage-v8"]
 	};
 }
@@ -5069,18 +5102,18 @@ function rootDevDeps(config) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["lefthook"] };
 	if (config.stack !== "none") {
 		deps["knip"] = {
@@ -5089,18 +5122,18 @@ function rootDevDeps(config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["knip"];
 		deps["oxlint"] = {
 			"@changesets/cli": "3.0.3",
@@ -5108,18 +5141,18 @@ function rootDevDeps(config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["oxlint"];
 		Object.assign(deps, vitestDevDeps());
 	}
@@ -5129,37 +5162,21 @@ function rootDevDeps(config) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["oxlint-tsgolint"];
 	return deps;
 }
-function isWorkspacePackage(ctx, packageName) {
-	if (ctx.config.structure !== "monorepo") return false;
-	const packagesDir = path.join(ctx.targetDir, "packages");
-	if (!existsSync(packagesDir)) return false;
-	try {
-		for (const entry of readdirSync(packagesDir, { withFileTypes: true })) {
-			if (!entry.isDirectory()) continue;
-			const pkgJsonPath = path.join(packagesDir, entry.name, "package.json");
-			if (!existsSync(pkgJsonPath)) continue;
-			try {
-				if (parsePackageJson(readFileSync(pkgJsonPath, "utf-8"))?.name === packageName) return true;
-			} catch (_error) {}
-		}
-	} catch (_error) {}
-	return false;
-}
 function addReleaseDeps(deps, config) {
 	switch (config.releaseStrategy) {
 		case "release-it":
@@ -5169,18 +5186,18 @@ function addReleaseDeps(deps, config) {
 				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
-				"knip": "6.39.0",
-				"lefthook": "2.1.16",
-				"modern-web-guidance": "0.0.191",
-				"oxfmt": "0.71.0",
-				"oxlint": "1.86.0",
+				"knip": "6.41.0",
+				"lefthook": "2.2.1",
+				"modern-web-guidance": "0.0.193",
+				"oxfmt": "0.72.0",
+				"oxlint": "1.87.0",
 				"oxlint-tsgolint": "7.0.2003",
 				"prettier": "3.9.9",
-				"release-it": "21.1.0",
+				"release-it": "21.1.1",
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.28.3"
+				"pnpm": "11.28.5"
 			}["release-it"];
 			if (config.structure === "monorepo") deps["@release-it/bumper"] = {
 				"@changesets/cli": "3.0.3",
@@ -5188,18 +5205,18 @@ function addReleaseDeps(deps, config) {
 				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
-				"knip": "6.39.0",
-				"lefthook": "2.1.16",
-				"modern-web-guidance": "0.0.191",
-				"oxfmt": "0.71.0",
-				"oxlint": "1.86.0",
+				"knip": "6.41.0",
+				"lefthook": "2.2.1",
+				"modern-web-guidance": "0.0.193",
+				"oxfmt": "0.72.0",
+				"oxlint": "1.87.0",
 				"oxlint-tsgolint": "7.0.2003",
 				"prettier": "3.9.9",
-				"release-it": "21.1.0",
+				"release-it": "21.1.1",
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.28.3"
+				"pnpm": "11.28.5"
 			}["@release-it/bumper"];
 			break;
 		case "simple":
@@ -5209,18 +5226,18 @@ function addReleaseDeps(deps, config) {
 				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
-				"knip": "6.39.0",
-				"lefthook": "2.1.16",
-				"modern-web-guidance": "0.0.191",
-				"oxfmt": "0.71.0",
-				"oxlint": "1.86.0",
+				"knip": "6.41.0",
+				"lefthook": "2.2.1",
+				"modern-web-guidance": "0.0.193",
+				"oxfmt": "0.72.0",
+				"oxlint": "1.87.0",
 				"oxlint-tsgolint": "7.0.2003",
 				"prettier": "3.9.9",
-				"release-it": "21.1.0",
+				"release-it": "21.1.1",
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.28.3"
+				"pnpm": "11.28.5"
 			}["commit-and-tag-version"];
 			break;
 		case "changesets": deps["@changesets/cli"] = {
@@ -5229,18 +5246,18 @@ function addReleaseDeps(deps, config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["@changesets/cli"];
 	}
 }
@@ -5307,10 +5324,6 @@ function reclaimManagedDevDeps(ctx, pkg, managedDevDeps, unmanaged, changes) {
 	}
 	pkg.devDependencies = existingDevDeps;
 }
-function readUnmanagedDevDeps(ctx) {
-	const slice = parseToolingConfigSlice(ctx.read(".tooling.json"), z.object({ unmanagedDevDependencies: UnmanagedDevDependenciesSchema.optional() }), { block: "unmanagedDevDependencies" });
-	return new Set(slice?.unmanagedDevDependencies ?? []);
-}
 function isAsciiCheckEnabled(ctx) {
 	return parseToolingConfigSlice(ctx.read(".tooling.json"), z.object({ ascii: AsciiConfigSchema.optional() }), { block: "ascii" })?.ascii?.enabled === true;
 }
@@ -5345,18 +5358,18 @@ function applyMetadataDefaults(pkg, ctx, changes) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["pnpm"];
 	const desiredPm = pinnedPnpm ? `pnpm@${pinnedPnpm}` : void 0;
 	if (desiredPm) {
@@ -5395,26 +5408,27 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...rootDevDeps(ctx.config) };
 	if (!isMonorepo) Object.assign(devDeps, perPackageDevDeps(ctx.config));
 	if (ctx.config.stack !== "none" || ctx.config.ci === "forgejo") devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.15.0";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.89.1";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.90.0";
 	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.17.0";
+	if (wantsAgentCli(ctx)) devDeps[AGENT_CLI_PACKAGE] = "0.1.1";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["oxfmt"];
 	if (ctx.config.formatter === "prettier") devDeps["prettier"] = {
 		"@changesets/cli": "3.0.3",
@@ -5422,18 +5436,18 @@ function buildManagedDevDeps(ctx) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["prettier"];
 	addReleaseDeps(devDeps, ctx.config);
 	return devDeps;
@@ -5442,7 +5456,7 @@ async function generatePackageJson(ctx) {
 	const filePath = "package.json";
 	const existing = ctx.read(filePath);
 	const allScripts = buildManagedScripts(ctx);
-	const unmanaged = readUnmanagedDevDeps(ctx);
+	const unmanaged = readUnmanagedDevDepNames(ctx);
 	const devDeps = buildManagedDevDeps(ctx);
 	if (existing) {
 		const pkg = parsePackageJson(existing);
@@ -5492,18 +5506,18 @@ async function generatePackageJson(ctx) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["pnpm"]}`
 	};
 	ctx.write(filePath, JSON.stringify(pkg, null, 2) + "\n");
@@ -7828,19 +7842,25 @@ function foreignOwnedBinaries(ctx) {
 function ignoreBinariesField(binaries) {
 	return binaries.length > 0 ? `\n  ignoreBinaries: ${JSON.stringify(binaries)},` : "";
 }
-function buildKnipConfigSingle(ignoreBinaries) {
+function ignorableDependencies(ctx) {
+	return wantsAgentCli(ctx) ? [AGENT_CLI_PACKAGE] : [];
+}
+function ignoreDependenciesField(dependencies) {
+	return dependencies.length > 0 ? `\n  ignoreDependencies: ${JSON.stringify(dependencies)},` : "";
+}
+function buildKnipConfigSingle(ignoreBinaries, ignoreDependencies) {
 	return `import type { KnipConfig } from "knip";
 
 export default {
   entry: ["src/index.ts"],
-  project: ["src/**/*.ts"],${ignoreBinariesField(ignoreBinaries)}
+  project: ["src/**/*.ts"],${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
 } satisfies KnipConfig;
 `;
 }
-function buildKnipConfigMonorepo(ignoreBinaries) {
+function buildKnipConfigMonorepo(ignoreBinaries, ignoreDependencies) {
 	return `import type { KnipConfig } from "knip";
 
-export default {${ignoreBinariesField(ignoreBinaries)}
+export default {${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
   workspaces: {
     ".": {
       entry: [],
@@ -7901,16 +7921,17 @@ function hookIsInProjectScope(content, path) {
 	if (patterns === void 0) return true;
 	return patterns.some((pattern) => picomatch(pattern, { dot: true })(HOOK_FILE));
 }
-function ensureIgnorePattern(content, path, ignoreBinaries) {
+function ensureIgnorePattern(content, path, ignoreBinaries, ignoreDependencies) {
 	const needsHooksIgnore = hookIsInProjectScope(content, path);
-	if (isJsonConfig(path)) return ensureIgnoreInJson(content, ignoreBinaries, needsHooksIgnore);
-	return ensureIgnoreInTs(content, ignoreBinaries, needsHooksIgnore);
+	if (isJsonConfig(path)) return ensureIgnoreInJson(content, ignoreBinaries, ignoreDependencies, needsHooksIgnore);
+	return ensureIgnoreInTs(content, ignoreBinaries, ignoreDependencies, needsHooksIgnore);
 }
 const KnipJsonSchema = z.object({
 	ignore: z.array(z.string()).optional(),
-	ignoreBinaries: z.array(z.string()).optional()
+	ignoreBinaries: z.array(z.string()).optional(),
+	ignoreDependencies: z.array(z.string()).optional()
 }).passthrough();
-function ensureIgnoreInJson(content, ignoreBinaries, needsHooksIgnore) {
+function ensureIgnoreInJson(content, ignoreBinaries, ignoreDependencies, needsHooksIgnore) {
 	let parsedJson;
 	try {
 		parsedJson = JSON.parse(content);
@@ -7931,6 +7952,12 @@ function ensureIgnoreInJson(content, ignoreBinaries, needsHooksIgnore) {
 		parsed.ignoreBinaries = [...parsed.ignoreBinaries ?? [], ...missingBinaries];
 		changed = true;
 	}
+	const existingDependencies = new Set(parsed.ignoreDependencies ?? []);
+	const missingDependencies = ignoreDependencies.filter((dependency) => !existingDependencies.has(dependency));
+	if (missingDependencies.length > 0) {
+		parsed.ignoreDependencies = [...parsed.ignoreDependencies ?? [], ...missingDependencies];
+		changed = true;
+	}
 	if (!changed) return void 0;
 	return JSON.stringify(parsed, null, 2) + "\n";
 }
@@ -7940,7 +7967,30 @@ function missingIgnoreBinariesInTs(content, binaries) {
 	const arrayContent = match[1] ?? "";
 	return binaries.filter((binary) => !arrayContent.includes(`"${binary}"`));
 }
-function ensureIgnoreInTs(content, ignoreBinaries, needsHooksIgnore) {
+function missingIgnoreDependenciesInTs(content, dependencies) {
+	const match = /ignoreDependencies:\s*\[([^\]]*)\]/.exec(content);
+	if (!match) return dependencies;
+	const arrayContent = match[1] ?? "";
+	return dependencies.filter((dependency) => !arrayContent.includes(`"${dependency}"`));
+}
+function insertIntoTsArray(content, field, entries) {
+	const quoted = entries.map((entry) => `"${entry}"`).join(", ");
+	const arrayPattern = new RegExp("(" + field + ":\\s*\\[)");
+	if (arrayPattern.test(content)) return {
+		content: content.replace(arrayPattern, `$1${quoted}, `),
+		changed: true
+	};
+	const exportPattern = /(export default\s*\{)\n/;
+	if (exportPattern.test(content)) return {
+		content: content.replace(exportPattern, `$1\n  ${field}: [${quoted}],\n`),
+		changed: true
+	};
+	return {
+		content,
+		changed: false
+	};
+}
+function ensureIgnoreInTs(content, ignoreBinaries, ignoreDependencies, needsHooksIgnore) {
 	let result = content;
 	let changed = false;
 	if (needsHooksIgnore && !result.includes(".claude/hooks")) {
@@ -7958,18 +8008,15 @@ function ensureIgnoreInTs(content, ignoreBinaries, needsHooksIgnore) {
 	}
 	const missingBinaries = missingIgnoreBinariesInTs(result, ignoreBinaries);
 	if (missingBinaries.length > 0) {
-		const quoted = missingBinaries.map((binary) => `"${binary}"`).join(", ");
-		const binariesArrayPattern = /(ignoreBinaries:\s*\[)/;
-		if (binariesArrayPattern.test(result)) {
-			result = result.replace(binariesArrayPattern, `$1${quoted}, `);
-			changed = true;
-		} else {
-			const exportPattern = /(export default\s*\{)\n/;
-			if (exportPattern.test(result)) {
-				result = result.replace(exportPattern, `$1\n  ignoreBinaries: [${quoted}],\n`);
-				changed = true;
-			}
-		}
+		const inserted = insertIntoTsArray(result, "ignoreBinaries", missingBinaries);
+		result = inserted.content;
+		changed = changed || inserted.changed;
+	}
+	const missingDependencies = missingIgnoreDependenciesInTs(result, ignoreDependencies);
+	if (missingDependencies.length > 0) {
+		const inserted = insertIntoTsArray(result, "ignoreDependencies", missingDependencies);
+		result = inserted.content;
+		changed = changed || inserted.changed;
 	}
 	return changed ? result : void 0;
 }
@@ -7985,6 +8032,7 @@ async function generateKnip(ctx) {
 	};
 	const isMonorepo = ctx.config.structure === "monorepo";
 	const ignoreBinaries = foreignOwnedBinaries(ctx);
+	const ignoreDependencies = ignorableDependencies(ctx);
 	const buildConfig = isMonorepo ? buildKnipConfigMonorepo : buildKnipConfigSingle;
 	const existingPath = KNIP_CONFIG_PATHS.find((p) => ctx.exists(p));
 	if (existingPath) {
@@ -7995,7 +8043,7 @@ async function generateKnip(ctx) {
 			description: "Could not read existing knip config"
 		};
 		if (content.trim() === "") {
-			const blank = isJsonConfig(existingPath) ? ensureIgnorePattern("{}", existingPath, ignoreBinaries) ?? "{}\n" : formattedTemplate(ctx, existingPath, buildConfig(ignoreBinaries));
+			const blank = isJsonConfig(existingPath) ? ensureIgnorePattern("{}", existingPath, ignoreBinaries, ignoreDependencies) ?? "{}\n" : formattedTemplate(ctx, existingPath, buildConfig(ignoreBinaries, ignoreDependencies));
 			ctx.write(existingPath, blank);
 			return {
 				filePath: existingPath,
@@ -8003,13 +8051,13 @@ async function generateKnip(ctx) {
 				description: createdDescription(existingPath)
 			};
 		}
-		const updated = ensureIgnorePattern(content, existingPath, ignoreBinaries);
+		const updated = ensureIgnorePattern(content, existingPath, ignoreBinaries, ignoreDependencies);
 		if (updated) {
 			ctx.write(existingPath, updated);
 			return {
 				filePath: existingPath,
 				action: "updated",
-				description: "Added \".claude/hooks/**\" and/or foreign-owned ignoreBinaries"
+				description: "Added \".claude/hooks/**\", foreign-owned ignoreBinaries, and/or ignored dependencies"
 			};
 		}
 		return {
@@ -8018,7 +8066,7 @@ async function generateKnip(ctx) {
 			description: existingPath === filePath ? "Already configured" : `Existing config found at ${existingPath}`
 		};
 	}
-	ctx.write(filePath, formattedTemplate(ctx, filePath, buildConfig(ignoreBinaries)));
+	ctx.write(filePath, formattedTemplate(ctx, filePath, buildConfig(ignoreBinaries, ignoreDependencies)));
 	return {
 		filePath,
 		action: "created",
@@ -9136,7 +9184,7 @@ const COMMENTS_GUIDE_BODY = [
 	"",
 	"- Default to none. A comment earns its place by carrying what the code cannot -- a rejected alternative, the bug that forced this shape, an invariant enforced elsewhere -- and earns it one decision at a time, in a sentence or two each: what was rejected, and what it cost. Five decisions is five sentences, not five paragraphs. Recoverable from the code? Leave it unwritten.",
 	"- Present tense, about what is. No `now`, `previously`, `changed to`: diff narration is stale on the next edit, and the commit message carries it. No running ledgers or changelogs: when adjusting a threshold, constant, or baseline, state the active invariant and prune past deltas.",
-	"- Never cite a lifecycle-managed doc, PR, or issue from code: no PR or issue numbers (`PR #123`, `closes #456`), no path under `docs/superpowers/` or `docs/design/`, none carrying a `retired/` or `completed/` segment, no `docs/plan-*.md`, and no bare decision or task ID (`D3`, `T2`). They move, retire, and renumber, nothing checks the reference, and the reader has no way to tell a dead one from a live one. State the constraint itself, or cite a maintained reference doc instead. A `docs/` path that is a glob or an elided example rather than a reference (`docs/*.md`) is vocabulary, not a citation, and is fine.",
+	"- Never cite a lifecycle-managed doc, PR, or issue from code: no PR or issue numbers (`PR #123`, `closes #456`), no path under `docs/specs/`, `docs/plans/`, `docs/superpowers/` or `docs/design/`, none carrying a `retired/` or `completed/` segment, no `docs/plan-*.md`, and no bare decision or task ID (`D3`, `T2`). They move, retire, and renumber, nothing checks the reference, and the reader has no way to tell a dead one from a live one. State the constraint itself, or cite a maintained reference doc instead. A `docs/` path that is a glob or an elided example rather than a reference (`docs/*.md`) is vocabulary, not a citation, and is fine.",
 	"- Code that exists only to accept an older shape -- a file, field, flag, environment variable, label or comment format -- carries `// @compat <id> until <expiry>: <reason>` on the line above it. The expiry is a date (`YYYY-MM-DD`) when the old shape lives with consumers who upgrade on their own schedule; a version of the code's own package (`v1.4.0`) when its consumer upgrades with each release; or `forge-clean` for old data on the forge, which has neither. Remove the code and every test that carries the same id together.",
 	"- **The code is the fact.** When a comment disagrees with it, fix it in one line or delete it -- never grow one to argue the code is right."
 ].join("\n");
@@ -9198,7 +9246,7 @@ const PLAN_LIFECYCLE_GUIDE_BODY = [
 	"",
 	"A plan's **directory** is the source of truth for whether it shipped -- not its `Status:` line, not its checkboxes. Read the source it names.",
 	"",
-	"`.superpowers/` (no `docs/` prefix) is scratch state, not a plan's home -- a plan doc always lives under `docs/superpowers/plans/`, even one drafted while running a plan through subagents.",
+	"`.superpowers/` (no `docs/` prefix) is scratch state, not a plan's home -- a plan doc lives under `docs/plans/` (older ones under `docs/superpowers/plans/`), even one drafted while running a plan through subagents.",
 	"",
 	"Retiring the plan is the last task of the plan, done in the PR that delivers the work: \"in the tree\" means committed on this branch, not merged to a default branch. Run `bst docs:retire <plan.md> --status <verb> --shipped \"<text>\"` -- it moves the doc, relinks what the move breaks, de-links paths pointing outside `docs/`, and writes the dated terminal `Status:` line, the historical banner, and the \"Shipped:\" paragraph. You supply the judgement: the honest verb -- `completed` / `superseded` / `abandoned` / `rejected` -- and a truthful `--shipped` naming the delivering PR; never fabricate it for uncommitted code or claim a merge that has not happened. A plan that lands one phase of a larger spec retires the plan and leaves the spec open.",
 	"",
@@ -9215,11 +9263,11 @@ const PLANNING_GUIDE_BODY = [
 	"",
 	"## The spec",
 	"",
-	"Say why and what, not how: the problem, who it is for, the constraints, what done looks like, and the alternatives you rejected, each with its reason. Work with several independent parts gets one spec per part. Save it as `docs/superpowers/specs/<YYYY-MM-DD>-<topic>-design.md`.",
+	"Say why and what, not how: the problem, who it is for, the constraints, what done looks like, and the alternatives you rejected, each with its reason. Work with several independent parts gets one spec per part. Save it as `docs/specs/<YYYY-MM-DD>-<topic>-design.md`.",
 	"",
 	"## The plan",
 	"",
-	"Write for an executor who has not seen this repo or the spec. They write idiomatic code once they know the exact interface and the exact test, and make a reasonable choice wherever the plan leaves one open; what they cannot know is what you decided. A plan records those decisions -- it is not a transcript of the code. Save it under `docs/superpowers/plans/`.",
+	"Write for an executor who has not seen this repo or the spec. They write idiomatic code once they know the exact interface and the exact test, and make a reasonable choice wherever the plan leaves one open; what they cannot know is what you decided. A plan records those decisions -- it is not a transcript of the code. Save it under `docs/plans/`.",
 	"",
 	"- Check the plan's premises against the tree before building on them. \"Today X is broken\" is a claim: read the code that handles X, not just the line that throws.",
 	"- Label each task `Task <n>:` at the start of its heading or checkbox, numbered from 1, so `bst plan:brief` can find it. A checkbox's first sentence is the task's name on the control panel: end it with a period inside one short line, and put the files, commands, and checks in the sentences after it.",
@@ -9288,18 +9336,18 @@ function webUiGuideBody() {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["modern-web-guidance"]}`;
 	return [
 		"# Web UI",
@@ -9859,7 +9907,7 @@ function reportFailures(failed, command) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.89.1 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.90.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -10880,7 +10928,7 @@ function originHeadBranch(git, cwd) {
 	return name === "" ? void 0 : name;
 }
 function unconfirmedDefaultWarning(branch, namedByTree) {
-	return `health: could not confirm the default branch, so the reference was read against origin/${branch}, while .tooling.json#defaultBranch names ${namedByTree}. Record it in this clone with \`git remote set-head origin ${namedByTree}\`, or run in GitHub or Forgejo Actions, where the event payload names it.`;
+	return `health: could not confirm the default branch, so the reference was read against origin/${branch}, while .tooling.json#defaultBranch names ${namedByTree}. If ${namedByTree} is the repository's default branch, record it in this clone with \`git remote set-head origin --auto\`, or run in GitHub or Forgejo Actions, where the event payload names it.`;
 }
 function gitRunner(executor) {
 	return (args, cwd) => {
@@ -11962,10 +12010,10 @@ function runComposeLintGate(targetDir, config, memo) {
 	for (const warning of findDockerRebuildRisks(targetDir, config, memo)) log$1.warn(warning);
 	return issues.length;
 }
-function runCheckOnlyImageGate(config, targetDir, memo) {
+function runCheckOnlyImageGate(config, targetDir, memo, phase) {
 	if (!config.publishDocker) return [];
 	const images = [];
-	for (const risk of findCheckOnlyPublishRisks(targetDir, void 0, memo)) {
+	for (const risk of findCheckOnlyPublishRisks(targetDir, phase, memo)) {
 		log$1.warn(`Image "${risk.imageName}" is declared only in ${risk.declaredIn}, the check overlay, so a later tooling release stops publishing it with docker:publish by default. Keep it: set publish to true for "${risk.imageName}" under .tooling.json#docker. Settle it: set publish to false there, or move the service into a base compose file.`);
 		images.push(risk.imageName);
 	}
@@ -11979,6 +12027,18 @@ function runWorkflowAptGate(targetDir) {
 	}
 	return steps;
 }
+function findInertAgentKeys(saved) {
+	const agent = saved?.agent;
+	if (!agent) return [];
+	if (agent.enabled === true) return [];
+	return Object.keys(agent).filter((key) => key !== "enabled").toSorted();
+}
+function runInertAgentSettingsGate(saved) {
+	const keys = findInertAgentKeys(saved);
+	if (keys.length === 0) return [];
+	log$1.warn(`.tooling.json sets ${keys.map((key) => `agent.${key}`).join(", ")}, but agent.enabled is not true, so the agent ignores them. Set "agent.enabled": true, or remove those keys.`);
+	return keys;
+}
 function runPublishConfigGate(config, targetDir) {
 	if (!config.publishNpm) return 0;
 	const issues = lintPublishConfig(targetDir, config.structure);
@@ -12204,7 +12264,7 @@ const syncCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, toolchain, checkOnlyImages, aptSteps, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
+			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, toolchain, checkOnlyImages, aptSteps, inertAgentKeys, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
 		}
 	},
 	async run({ args }) {
@@ -12252,6 +12312,7 @@ async function runUpdate(targetDir, flags = {}) {
 	}
 	warnStaleChecksAdd(saved);
 	warnCoveredChecksAdd(saved, targetDir);
+	runInertAgentSettingsGate(saved);
 	if (runComposeLintGate(targetDir, saved, dockerDiscovery) > 0) {
 		process.exitCode = 1;
 		return [];
@@ -12277,12 +12338,17 @@ function gateFailure(toolchainWarned = false) {
 		toolchain: { warned: toolchainWarned },
 		checkOnlyImages: [],
 		aptSteps: [],
+		inertAgentKeys: [],
 		warnCount: 0,
 		exitCode: 1
 	};
 }
-function upToDateReport(toolchain, checkOnlyImages, aptSteps) {
-	const warnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length + aptSteps.length;
+function advisoryWarnCount(advisories) {
+	return (advisories.toolchainWarned ? 1 : 0) + advisories.checkOnlyImages.length + advisories.aptSteps.length + (advisories.inertAgentKeys.length > 0 ? 1 : 0);
+}
+function upToDateReport(advisories) {
+	const toolchain = { warned: advisories.toolchainWarned };
+	const warnCount = advisoryWarnCount(advisories);
 	if (warnCount > 0) {
 		if (!isJsonMode()) rawLog$1(formatWarnMarker(warnCount));
 	} else log$1.success("Repository is up to date.");
@@ -12291,8 +12357,9 @@ function upToDateReport(toolchain, checkOnlyImages, aptSteps) {
 		actionable: [],
 		failed: [],
 		toolchain,
-		checkOnlyImages,
-		aptSteps,
+		checkOnlyImages: advisories.checkOnlyImages,
+		aptSteps: advisories.aptSteps,
+		inertAgentKeys: advisories.inertAgentKeys,
 		warnCount,
 		exitCode: 0
 	};
@@ -12315,17 +12382,21 @@ async function runCheckReport(targetDir) {
 		...gateFailure(),
 		toolchain: { warned: toolchain.warned }
 	};
-	const checkOnlyImages = runCheckOnlyImageGate(config, targetDir, dockerDiscovery);
-	const aptSteps = runWorkflowAptGate(targetDir);
+	const advisories = {
+		toolchainWarned: toolchain.warned,
+		checkOnlyImages: runCheckOnlyImageGate(config, targetDir, dockerDiscovery),
+		aptSteps: runWorkflowAptGate(targetDir),
+		inertAgentKeys: runInertAgentSettingsGate(saved)
+	};
 	const { ctx, pendingWrites } = createDryRunContext(config, dockerDiscovery);
 	logDetectionSummary(ctx);
 	const results = await runGenerators(ctx);
 	const failed = failedResults(results);
 	reportFailures(failed, "repo:sync");
 	const actionable = actionableResults(results, pendingWrites, targetDir);
-	const advisoryWarnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length + aptSteps.length;
-	const toolchainState = { warned: toolchain.warned };
-	if (actionable.length === 0 && failed.length === 0) return upToDateReport(toolchainState, checkOnlyImages, aptSteps);
+	const advisoryCount = advisoryWarnCount(advisories);
+	const toolchainState = { warned: advisories.toolchainWarned };
+	if (actionable.length === 0 && failed.length === 0) return upToDateReport(advisories);
 	if (actionable.length === 0) return {
 		status: "failed",
 		actionable: [],
@@ -12333,21 +12404,23 @@ async function runCheckReport(targetDir) {
 		toolchain: toolchainState,
 		checkOnlyImages: [],
 		aptSteps: [],
+		inertAgentKeys: [],
 		warnCount: 0,
 		exitCode: 1
 	};
 	log$1.warn(`${actionable.length} file(s) would be changed by repo:sync`);
 	for (const r of actionable) logActionableChange(r, targetDir, pendingWrites);
 	if (failed.length === 0 && actionable.every((r) => isWorkflowDirPath(r.filePath))) {
-		const warnCount = actionable.length + advisoryWarnCount;
+		const warnCount = actionable.length + advisoryCount;
 		if (!isJsonMode()) rawLog$1(formatWarnMarker(warnCount));
 		return {
 			status: "workflow-drift",
 			actionable,
 			failed: [],
 			toolchain: toolchainState,
-			checkOnlyImages,
-			aptSteps,
+			checkOnlyImages: advisories.checkOnlyImages,
+			aptSteps: advisories.aptSteps,
+			inertAgentKeys: advisories.inertAgentKeys,
 			warnCount,
 			exitCode: 0
 		};
@@ -12359,6 +12432,7 @@ async function runCheckReport(targetDir) {
 		toolchain: toolchainState,
 		checkOnlyImages: [],
 		aptSteps: [],
+		inertAgentKeys: [],
 		warnCount: 0,
 		exitCode: 1
 	};
@@ -15251,7 +15325,7 @@ function retireDestination(src, verb) {
 	if (dir === DOCS_ROOT && LEGACY_ACTIVE_PATTERN.test(base)) return `${DOCS_ROOT}/${RETIRED_DIR}/${verb}-${base.slice(5)}`;
 	return `${dir}/${RETIRED_DIR}/${base}`;
 }
-function discoverPairs(exec, config) {
+function candidatePairs(exec, config) {
 	const candidates = [];
 	for (const active of [...conventionalActiveDirs(exec), ...config.extraDirs]) candidates.push({
 		active,
@@ -15266,8 +15340,16 @@ function discoverPairs(exec, config) {
 		activePattern: LEGACY_ACTIVE_PATTERN,
 		enforced: isEnforced(DOCS_ROOT, config.enforced)
 	});
+	return candidates;
+}
+function matchableActiveDirs(exec, config) {
 	const seen = /* @__PURE__ */ new Set();
-	return candidates.filter((pair) => {
+	for (const pair of candidatePairs(exec, config)) if (exec.readDir(pair.active) !== void 0) seen.add(pair.active);
+	return [...seen].toSorted();
+}
+function discoverPairs(exec, config) {
+	const seen = /* @__PURE__ */ new Set();
+	return candidatePairs(exec, config).filter((pair) => {
 		if (seen.has(pair.active)) return false;
 		if (!(listDocs(exec, pair.active, pair.activePattern).length > 0 || pair.retiredDirs.some((dir) => listDocs(exec, dir).length > 0))) return false;
 		seen.add(pair.active);
@@ -20115,7 +20197,7 @@ function composePs(executor, config) {
 //#region src/docker-check/health.ts
 const DOCKER_RUN_START_FAILURE_EXIT_CODE = 125;
 const PROBE_TIMEOUT_SECONDS = "5";
-const PROBE_IMAGE = "curlimages/curl:8.21.0@sha256:7c12af72ceb38b7432ab85e1a265cff6ae58e06f95539d539b654f2cfa64bb13";
+const PROBE_IMAGE = "curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777";
 function getContainerHealth(containers, serviceName) {
 	return containers.find((c) => c.Service === serviceName)?.Health ?? "unknown";
 }
@@ -24093,7 +24175,7 @@ function collectViolations(exec, config, opts) {
 		retiredCount += result.retired;
 	}
 	violations.push(...collectSpecRetirementViolations(exec, pairs, config, opts));
-	const activeDirs = pairs.map((pair) => pair.active).toSorted();
+	const activeDirs = matchableActiveDirs(exec, config);
 	const unmatchedEnforced = Array.isArray(config.enforced) ? config.enforced.filter((entry) => !activeDirs.includes(entry)) : [];
 	return {
 		violations,
@@ -24236,7 +24318,7 @@ const docsCheckCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: violations ([{file, rule, message, fix, severity (fatal | advisory)}]), activeCount, retiredCount, pairCount, pass, activeDirs, unmatchedEnforced. When docs are disabled in .tooling.json the document is only enabled (false)."
+			description: "Emit one JSON document: violations ([{file, rule, message, fix, severity (fatal | advisory)}]), activeCount, retiredCount, pairCount, pass, activeDirs, unmatchedEnforced. activeDirs lists every existing doc directory an enforced entry can match, holding docs or not; unmatchedEnforced the .tooling.json#docs.enforced entries that match none of them. When docs are disabled in .tooling.json the document is only enabled (false)."
 		},
 		verbose: {
 			type: "boolean",
@@ -25871,6 +25953,9 @@ var EmptyCommentError = class extends FatalError {
 		super("The comment resolved to empty text.");
 	}
 };
+function rejectEmptyComment(comment) {
+	if (comment !== void 0 && comment.trim() === "") throw new EmptyCommentError();
+}
 var PullRequestStateError = class extends FatalError {
 	number;
 	action;
@@ -25880,20 +25965,35 @@ var PullRequestStateError = class extends FatalError {
 		this.action = action;
 	}
 };
+var NotAPullRequestError = class extends FatalError {
+	number;
+	constructor(number) {
+		super(`#${String(number)} is an issue, not a pull request.`);
+		this.number = number;
+	}
+};
+var StateNotTakenError = class extends FatalError {
+	number;
+	expected;
+	actual;
+	constructor(number, expected, actual) {
+		super(`The forge did not change #${String(number)}: it is still ${actual}, not ${expected}.`);
+		this.number = number;
+		this.expected = expected;
+		this.actual = actual;
+	}
+};
 const TARGET_STATE = {
 	close: "closed",
 	reopen: "open"
 };
-async function setIssueState(resolve, request) {
-	const ref = parseIssueRef(request.ref);
-	const number = requireIssueNumber(ref);
-	if (request.comment !== void 0 && request.comment.trim() === "") throw new EmptyCommentError();
-	const commentGiven = request.comment !== void 0;
-	const { api } = resolve(resolveIssueTarget(ref.target, request.repo));
+async function changeState(api, number, request, subject) {
 	const before = await api.get(number);
-	if (before.isPullRequest) throw new PullRequestStateError(number, request.action);
+	if (subject === "issue" && before.isPullRequest) throw new PullRequestStateError(number, request.action);
+	if (subject === "pull-request" && !before.isPullRequest) throw new NotAPullRequestError(number);
+	const commentGiven = request.comment !== void 0;
 	const targetState = TARGET_STATE[request.action];
-	const buildResult = (url, current, changed, posted) => ({
+	const buildResult = (url, current, changed, posted, merged) => ({
 		number,
 		url,
 		action: request.action,
@@ -25902,20 +26002,32 @@ async function setIssueState(resolve, request) {
 			current
 		},
 		changed,
-		...commentGiven ? { comment: { posted } } : {}
+		...commentGiven ? { comment: { posted } } : {},
+		...merged === void 0 ? {} : { merged }
 	});
-	if (before.state === targetState) return buildResult(before.url, before.state, false, false);
+	if (before.state === targetState) {
+		const merged = subject === "pull-request" ? (await api.pullRequest(number)).merged : void 0;
+		return buildResult(before.url, before.state, false, false, merged);
+	}
 	if (request.dryRun) return buildResult(before.url, targetState, true, true);
 	if (commentGiven) await api.addComment(number, request.comment ?? "");
 	let after;
 	try {
 		after = await api.setState(number, targetState);
+		if (after.state !== targetState) throw new StateNotTakenError(number, targetState, after.state);
 	} catch (error) {
 		if (commentGiven && error instanceof Error) error.message = `The comment on #${String(number)} was already posted; a retry will duplicate it. ` + error.message;
 		throw error;
 	}
 	return buildResult(after.url, after.state, true, true);
 }
+async function setIssueState(resolve, request) {
+	const ref = parseIssueRef(request.ref);
+	const number = requireIssueNumber(ref);
+	rejectEmptyComment(request.comment);
+	const { api } = resolve(resolveIssueTarget(ref.target, request.repo));
+	return changeState(api, number, request, "issue");
+}
 const PAST_TENSE = {
 	close: "Closed",
 	reopen: "Reopened"
@@ -26808,7 +26920,7 @@ async function runCli(config) {
 //#region src/cli-main.ts
 setLogLevel(resolveLogLevel({}));
 setForgejoLogger(log$1);
-const displayVersion = "0.89.1";
+const displayVersion = "0.90.0";
 const bstSubCommands = {
 	"repo:sync": syncCommand,
 	"checks:run": runChecksCommand,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.89.1",
+  "version": "0.90.0",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {
@@ -52,10 +52,10 @@
     "@types/node": "24.19.1",
     "@types/picomatch": "4.0.3",
     "commit-and-tag-version": "13.2.1",
-    "modern-web-guidance": "0.0.191",
-    "oxfmt": "0.71.0",
+    "modern-web-guidance": "0.0.193",
+    "oxfmt": "0.72.0",
     "prettier": "3.9.9",
-    "release-it": "21.1.0",
+    "release-it": "21.1.1",
     "tsdown": "0.23.0"
   },
   "scripts": {

package/tooling.schema.json

@@ -94,7 +94,7 @@
             "type": "string"
           },
           "publish": {
-            "description": "The publish decision either way: true keeps an image published -- including one its compose service is declared only in the check overlay, which a later release stops publishing by default -- and false excludes it while publishDocker stays true. Unset means the discovery default, which publishes everything except a check-only image once that rule is enforced.",
+            "description": "The publish decision either way: true keeps an image published -- including one whose compose service is declared only in the check overlay, which is not published by default -- and false excludes it while publishDocker stays true. Unset means the discovery default, which publishes everything except a check-only image.",
             "type": "boolean"
           }
         },
@@ -600,6 +600,10 @@
       "description": "agent:start behaviour overrides. Opt-in: see agent.autonomy for the interior-autonomy gate.",
       "type": "object",
       "properties": {
+        "enabled": {
+          "description": "The repo's explicit consent to the agent (default false). Only `true`, read from the repo's **default branch**, lets the agent work the repo: claim units, run sweeps, recover orphans, merge, act on a chat proposal or start a new spec. A missing key, `false`, a missing `.tooling.json` or a read that fails all mean not enabled, and the answer is re-read within about a minute. Every other `agent.*` key below has no effect without this one; `repo:sync` warns when the block sets one of them and this key is not `true`. Where this is `true`, `repo:sync` also installs `@bensandee/agent-cli`. Provisioning the agent's labels is not consent, and is never gated by this key.",
+          "type": "boolean"
+        },
         "autonomy": {
           "description": "Opt into interior autonomy (default false). When a phase's latest rationale reports readiness \"ready\" with an empty openQuestions[] and the review phase is clean, the agent applies the existing plan -> implement -> review -> park-at-mergeable advance itself instead of parking for a human. Never applies to the design/spec gate or the final merge from the mergeable terminal -- those always wait on a human. Also arms the trunk-red detector: when this repo's default branch combined status settles red, the agent files a tracking issue naming the failing checks and labels it agent/spec, starting the fix through the ordinary spec/plan/implement/review pipeline. It also closes that issue, with a comment, if the default branch recovers on its own before a human acts on it. Also arms the world-changed retrigger sweep: a pull request labelled agent-flags/autopilot that is parked at a -stuck or -failed terminal is re-queued when the fact its park recorded stops being true (the default branch went green, or moved past a conflicted base).",
           "type": "boolean"