@bensandee/tooling 0.89.1 → 0.91.0

package/dist/bin.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 import { accessSync, appendFileSync, closeSync, constants, copyFileSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
-import * as path$1 from "node:path";
-import path from "node:path";
+import path, * as path$1 from "node:path";
 import { parseArgs, parseEnv } from "node:util";
 import { FatalError, TransientError, UnexpectedError, describeError, describeError as describeError$1, redact, redact as redact$1 } from "@bensandee/common";
 import { defineCommand, renderUsage, runCommand, runMain } from "citty";
@@ -176,7 +175,7 @@ function loadEnvFileForBin(rawArgs, bin, io = processIo) {
 //#region src/env-file-preload.ts
 const envFileLoad = loadEnvFileForBin(process.argv.slice(2), {
 	name: "bst",
-	version: "0.89.1"
+	version: "0.91.0"
 });
 //#endregion
 //#region ../cli-kit/src/logger.ts
@@ -784,7 +783,7 @@ const LintConfigSchema = z.strictObject({ strictTypeAware: z.boolean().optional(
 const ChecksConfigSchema = z.strictObject({
 	add: z.array(z.string()).optional().meta({ description: "Extra package.json scripts to run as first-class check steps, appended to the built-in list (e.g. ['lint:php']). An added step with no matching script is a hard failure." }),
 	skip: z.array(z.string()).optional().meta({ description: "Check steps to skip, unioned with the built-in CI defaults (never replacing them). Supports glob patterns." }),
-	runOnVersionPr: z.boolean().optional().meta({ description: "Run the CI check job on the changesets version PR (changeset-release/main). Default false: the generated check job is skipped there, because that branch is regenerated on every push to main and main's own run gates the release. Has no effect unless releaseStrategy is changesets." })
+	runOnVersionPr: z.boolean().optional().meta({ description: "Run the CI check job on the changesets version PR (changeset-release/<defaultBranch>). Default false: the generated check job is skipped there, because that branch is regenerated on every push to the default branch and that branch's own run gates the release. Has no effect unless releaseStrategy is changesets." })
 });
 const CoverageConfigSchema = z.strictObject({
 	history: z.enum(["orphan-branch", "none"]).optional().meta({ description: "How coverage history is persisted. 'orphan-branch' (default) appends to a dedicated branch; 'none' disables CI history but keeps the local ratchet." }),
@@ -828,7 +827,7 @@ const DockerImageOverrideSchema = z.strictObject({
 	buildArgs: z.record(z.string(), z.string()).optional().meta({ description: "Build args passed to `docker build` for this package. Values support ${VAR} and ${VAR:-default} expansion against process.env." }),
 	imageName: z.string().min(1).optional().meta({ description: "Image name used for docker:build tags, docker:publish refs, and docker:check cross-referencing. Falls back to the derived name: the package.json name for the root package (npm scope stripped), or {root-name}-{package-name} for a monorepo package. A value that already carries a registry host (e.g. 'ghcr.io/me/app') is used as written by docker:publish, with no registryNamespace prefix added, and must name the registry this run logs in to -- one naming any other host refuses before login." }),
 	version: z.string().optional().meta({ description: "Version used for docker:publish tags; overrides the version resolved from the enclosing package." }),
-	publish: z.boolean().optional().meta({ description: "The publish decision either way: true keeps an image published -- including one its compose service is declared only in the check overlay, which a later release stops publishing by default -- and false excludes it while publishDocker stays true. Unset means the discovery default, which publishes everything except a check-only image once that rule is enforced." })
+	publish: z.boolean().optional().meta({ description: "The publish decision either way: true keeps an image published -- including one whose compose service is declared only in the check overlay, which is not published by default -- and false excludes it while publishDocker stays true. Unset means the discovery default, which publishes everything except a check-only image." })
 });
 const DockerMapSchema = z.record(z.string(), DockerImageOverrideSchema);
 const TolerantDockerMapSchema = z.record(z.string(), tolerantBlock(DockerImageOverrideSchema));
@@ -836,6 +835,16 @@ const TolerantDockerCheckConfigSchema = z.object({
 	...DockerCheckConfigSchema.shape,
 	healthChecks: z.array(tolerantBlock(DeclarativeHealthCheckSchema)).optional()
 });
+const DEFAULT_BRANCH_NAME_PATTERN = /^(?!.*\/\/)(?!.*\.\.)(?!.*\/$)(?!.*\.lock$)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const DefaultBranchNameSchema = z.string().regex(DEFAULT_BRANCH_NAME_PATTERN, "must be a plain branch name: ASCII letters, digits, '.', '_', '-' and '/', starting with a letter or digit, with no '//', '..', trailing '/', or '.lock' suffix");
+const AgentEnabledSliceSchema = z.looseObject({ agent: z.looseObject({ enabled: z.boolean().optional() }).optional() });
+function agentEnabledIn(raw) {
+	try {
+		return parseToolingConfigSlice(raw, AgentEnabledSliceSchema, { block: "agent" })?.agent?.enabled === true;
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region src/utils/stack.ts
 const IGNORED_DIRS = /* @__PURE__ */ new Set([
@@ -1701,6 +1710,7 @@ const LintSweepConfigSchema = z.strictObject({
 });
 const AgentEgressConfigSchema = z.strictObject({ browseHosts: z.array(z.string().min(1)).optional().meta({ description: "Host patterns this repo's agent containers may fetch from, on top of the hosts every run needs: an exact host (`fastdl.mongodb.org`) or a wildcard over its leftmost label (`*.example.com`). No ports. These join the browse lane, which serves GET and HEAD only." }) });
 const AgentConfigSchema = z.strictObject({
+	enabled: z.boolean().optional().meta({ description: "The repo's explicit consent to the agent (default false). Only `true`, read from the repo's **default branch**, lets the agent work the repo: claim units, run sweeps, recover orphans, merge, act on a chat proposal or start a new spec. A missing key, `false`, a missing `.tooling.json` or a read that fails all mean not enabled, and the answer is re-read within about a minute. Every other `agent.*` key below has no effect without this one; `repo:sync` warns when the block sets one of them and this key is not `true`. Where this is `true`, `repo:sync` also installs `@bensandee/agent-cli`. `bst setup:agent` sets it to true and runs the sync. Provisioning the agent's labels is not consent, and is never gated by this key." }),
 	autonomy: z.boolean().optional().meta({ description: "Opt into interior autonomy (default false). When a phase's latest rationale reports readiness \"ready\" with an empty openQuestions[] and the review phase is clean, the agent applies the existing plan -> implement -> review -> park-at-mergeable advance itself instead of parking for a human. Never applies to the design/spec gate or the final merge from the mergeable terminal -- those always wait on a human. Also arms the trunk-red detector: when this repo's default branch combined status settles red, the agent files a tracking issue naming the failing checks and labels it agent/spec, starting the fix through the ordinary spec/plan/implement/review pipeline. It also closes that issue, with a comment, if the default branch recovers on its own before a human acts on it. Also arms the world-changed retrigger sweep: a pull request labelled agent-flags/autopilot that is parked at a -stuck or -failed terminal is re-queued when the fact its park recorded stops being true (the default branch went green, or moved past a conflicted base)." }),
 	preRunRebase: z.boolean().optional().meta({ description: "Merge the current default branch into the work branch before the implement (execute) phase's container starts (default true). A clean merge or an already-up-to-date branch runs the container as is; a conflicting merge is aborted, recorded on the run's status comment, and the run proceeds on the un-synced branch -- it never fails the run. Two consecutive conflicting attempts hand the unit to agent/repair before any container runs; a timeout or a failed merge never counts toward that pair. Set false to skip the attempt entirely for this repo: no fetch, no merge, no abort, and the branch is worked exactly as cloned." }),
 	backlog: z.boolean().optional().meta({ description: "Whether the agent may self-trigger backlog runs consuming this repo's .agent/findings/ ledger (default: on wherever the ledger exists, which only happens in a repo whose own review loop wrote it). A backlog run opens a pull request that fixes or refutes the pending findings; false disarms it, leaving the ledger to accumulate for a human. A run starts only once at least three findings are pending or one is older than seven days." }),
@@ -1769,7 +1779,7 @@ const ToolingConfigSchema = z.strictObject({
 	docs: z.union([z.literal(false), DocsConfigSchema]).optional().meta({ description: "Plan/spec lifecycle gate (`bst docs:check`). Overrides only -- dirs are discovered by convention. Set to false to disable. Violations are advisory until a pair is named in `enforced`." }),
 	deploy: DeployConfigSchema.optional().meta({ description: "Generate a deploy-dispatch step in the release workflow that triggers a workflow_dispatch event in another repo after a successful release. The resolved release token must have rights on `dispatchRepo`." }),
 	pnpmWorkspace: z.literal(false).optional().meta({ description: "Set to false to opt out of pnpm-workspace.yaml management (skips both generation and the repo:sync --check validation)." }),
-	defaultBranch: z.string().optional().meta({ description: "Repository default branch name. Used by `checks:run` to decide when to enable coverage automatically. Default: detected via git (origin/HEAD), falling back to 'main'." }),
+	defaultBranch: DefaultBranchNameSchema.optional().meta({ description: "Repository default branch name, B. Drives the generated CI `on.push` trigger and every default-branch gate in `ci.yml` and `release.yml`, the release path (`release:changesets`, the version PR, `release:trigger`) and `checks:run`'s coverage gate. Generated output uses 'main' when unset; `checks:run` still falls back to `origin/HEAD`. Must be a plain branch name: ASCII letters, digits, '.', '_', '-' and '/'." }),
 	unmanagedDevDependencies: UnmanagedDevDependenciesSchema.optional().meta({ description: "devDependency names repo:sync must never add or re-pin. Escape hatch for holding a tooling-managed dep (oxlint, vitest, knip, ...) at a deliberately off-canonical version; without it, repo:sync raises any managed devDep whose version has drifted below the canonical pin." }),
 	stack: StackSchema.optional().meta({ description: "Whether the repo has TS/JS source. Detected from source evidence; TypeScript is never inferred from absence." }),
 	builder: z.enum([
@@ -1786,6 +1796,7 @@ const ToolingConfigSchema = z.strictObject({
 });
 const TolerantToolingConfigSchema = z.object({
 	...ToolingConfigSchema.shape,
+	defaultBranch: z.string().optional(),
 	docker: TolerantDockerMapSchema.optional(),
 	dockerCheck: z.union([z.literal(false), TolerantDockerCheckConfigSchema]).optional(),
 	coverage: z.union([z.literal(false), tolerantBlock(CoverageConfigSchema)]).optional(),
@@ -1831,10 +1842,16 @@ function loadToolingConfig(targetDir) {
 	if (!file) return void 0;
 	return parseConfigFile(file, TolerantToolingConfigSchema);
 }
+function parseToolingConfigStrict(raw, displayPath) {
+	return parseConfigFile({
+		raw,
+		displayPath
+	}, ToolingConfigSchema);
+}
 function loadToolingConfigStrict(targetDir) {
 	const file = readConfigFile(targetDir);
 	if (!file) return void 0;
-	return parseConfigFile(file, ToolingConfigSchema);
+	return parseToolingConfigStrict(file.raw, file.displayPath);
 }
 const OVERRIDE_KEYS = [
 	"structure",
@@ -3375,7 +3392,7 @@ function localTarget(call, entry) {
 }
 //#endregion
 //#region src/release/docker-check-only-phase.ts
-const DOCKER_CHECK_ONLY_PHASE = "warn";
+const DOCKER_CHECK_ONLY_PHASE = "enforce";
 //#endregion
 //#region src/release/docker.ts
 function defaultPublish(checkOnlyIn, phase) {
@@ -3816,7 +3833,7 @@ function runDockerBuild(executor, config) {
 		log$1.info(`Built ${pkg.imageName}:latest`);
 		return { packages: [pkg] };
 	}
-	const packages = detectDockerPackages(executor, config.cwd, repoName, config.checkOnlyPhase ?? "warn");
+	const packages = detectDockerPackages(executor, config.cwd, repoName, config.checkOnlyPhase ?? "enforce");
 	if (packages.length === 0) {
 		log$1.info("No packages with docker config found");
 		return { packages: [] };
@@ -3976,7 +3993,7 @@ function reportCheckOnlyImages(packages, phase) {
 	}
 }
 function runDockerPublish(executor, config) {
-	const checkOnlyPhase = config.checkOnlyPhase ?? "warn";
+	const checkOnlyPhase = config.checkOnlyPhase ?? "enforce";
 	const { packages } = runDockerBuild(executor, {
 		cwd: config.cwd,
 		packageDir: void 0,
@@ -4439,8 +4456,8 @@ function buildWorkflowYaml(options) {
 }
 //#endregion
 //#region src/generators/mise-pin.ts
-const MISE_VERSION = "2026.10.3";
-const MISE_LINUX_X64_SHA256 = "8d48bc510b7d844fad0bc7156c0855c2a1e7230c51e498a7f6b63b021f8b57c5";
+const MISE_VERSION = "2026.10.8";
+const MISE_LINUX_X64_SHA256 = "c72477ae6c3a8e7d817a322f43da70e4643e75ee5c21265f1c19c894273b7428";
 const SETUP_MISE_ACTION_URL = "https://code.orangebikelabs.com/bensandee/common/actions/setup-mise";
 const SETUP_MISE_ACTION_TAG = "setup-mise@latest";
 const SETUP_MISE_ACTION_SHA = "ebe622ef0d24c7efec4a5f6093ddb18500900e24";
@@ -4449,13 +4466,22 @@ const SETUP_MISE_ACTION_SHA = "ebe622ef0d24c7efec4a5f6093ddb18500900e24";
 function actionsExpr(expr) {
 	return `\${{ ${expr} }}`;
 }
-const MAIN_BRANCH_REF = "refs/heads/main";
-const IS_MAIN_BRANCH = `github.ref == '${MAIN_BRANCH_REF}'`;
-const IS_NOT_MAIN_BRANCH = `github.ref != '${MAIN_BRANCH_REF}'`;
-const IS_MAIN_JOB_ENV = { IS_MAIN: actionsExpr(IS_MAIN_BRANCH) };
+function branchNameLiteral(name) {
+	if (DEFAULT_BRANCH_NAME_PATTERN.test(name)) return name;
+	return name.replace(/'/g, "''");
+}
+function isDefaultBranch(name) {
+	return `github.ref == 'refs/heads/${branchNameLiteral(name)}'`;
+}
+function isNotDefaultBranch(name) {
+	return `github.ref != 'refs/heads/${branchNameLiteral(name)}'`;
+}
+function defaultBranchJobEnv(name) {
+	return { IS_MAIN: actionsExpr(isDefaultBranch(name)) };
+}
 const IS_MAIN_ENV_GUARD = "env.IS_MAIN == 'true'";
-function onlyOnDefaultBranch(condition) {
-	return `${IS_MAIN_BRANCH} && (${condition})`;
+function onlyOnDefaultBranch(name, condition) {
+	return `${isDefaultBranch(name)} && (${condition})`;
 }
 function npmrcAuthKey(registryUrl) {
 	return `${registryUrl.replace(/^https?:/i, "").replace(/\/+$/, "")}/`;
@@ -4858,6 +4884,38 @@ function diagnoseCheckScriptForwardingAt(targetDir) {
 	return diagnoseCheckScriptForwarding(scripts);
 }
 //#endregion
+//#region src/generators/agent-cli-dep.ts
+const AGENT_CLI_PACKAGE = "@bensandee/agent-cli";
+function agentEnabled(ctx) {
+	return agentEnabledIn(ctx.read(".tooling.json"));
+}
+function wantsAgentCli(ctx) {
+	if (!agentEnabled(ctx)) return false;
+	if (isWorkspacePackage(ctx, "@bensandee/agent-cli")) return false;
+	return !readUnmanagedDevDepNames(ctx).has(AGENT_CLI_PACKAGE);
+}
+function isWorkspacePackage(ctx, packageName) {
+	if (ctx.config.structure !== "monorepo") return false;
+	const packagesDir = path.join(ctx.targetDir, "packages");
+	if (!existsSync(packagesDir)) return false;
+	try {
+		for (const entry of readdirSync(packagesDir, { withFileTypes: true })) {
+			if (!entry.isDirectory()) continue;
+			const pkgJsonPath = path.join(packagesDir, entry.name, "package.json");
+			if (!existsSync(pkgJsonPath)) continue;
+			try {
+				if (parsePackageJson(readFileSync(pkgJsonPath, "utf-8"))?.name === packageName) return true;
+			} catch (_error) {}
+		}
+	} catch (_error) {}
+	return false;
+}
+const UnmanagedSliceSchema = z.object({ unmanagedDevDependencies: UnmanagedDevDependenciesSchema.optional() });
+function readUnmanagedDevDepNames(ctx) {
+	const slice = parseToolingConfigSlice(ctx.read(".tooling.json"), UnmanagedSliceSchema, { block: "unmanagedDevDependencies" });
+	return new Set(slice?.unmanagedDevDependencies ?? []);
+}
+//#endregion
 //#region src/generators/package-json.ts
 const NODE_ENGINES_FLOOR = "24.13.0";
 const ENGINES_NODE = `>=${NODE_ENGINES_FLOOR}`;
@@ -4966,18 +5024,18 @@ function perPackageDevDeps(config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["typescript"];
 		deps["@types/node"] = {
 			"@changesets/cli": "3.0.3",
@@ -4985,18 +5043,18 @@ function perPackageDevDeps(config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["@types/node"];
 	}
 	if (config.builder === "tsdown") deps["tsdown"] = {
@@ -5005,18 +5063,18 @@ function perPackageDevDeps(config) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["tsdown"];
 	return deps;
 }
@@ -5028,18 +5086,18 @@ function vitestDevDeps() {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["vitest"],
 		"@vitest/coverage-v8": {
 			"@changesets/cli": "3.0.3",
@@ -5047,18 +5105,18 @@ function vitestDevDeps() {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["@vitest/coverage-v8"]
 	};
 }
@@ -5069,18 +5127,18 @@ function rootDevDeps(config) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["lefthook"] };
 	if (config.stack !== "none") {
 		deps["knip"] = {
@@ -5089,18 +5147,18 @@ function rootDevDeps(config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["knip"];
 		deps["oxlint"] = {
 			"@changesets/cli": "3.0.3",
@@ -5108,18 +5166,18 @@ function rootDevDeps(config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["oxlint"];
 		Object.assign(deps, vitestDevDeps());
 	}
@@ -5129,37 +5187,21 @@ function rootDevDeps(config) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["oxlint-tsgolint"];
 	return deps;
 }
-function isWorkspacePackage(ctx, packageName) {
-	if (ctx.config.structure !== "monorepo") return false;
-	const packagesDir = path.join(ctx.targetDir, "packages");
-	if (!existsSync(packagesDir)) return false;
-	try {
-		for (const entry of readdirSync(packagesDir, { withFileTypes: true })) {
-			if (!entry.isDirectory()) continue;
-			const pkgJsonPath = path.join(packagesDir, entry.name, "package.json");
-			if (!existsSync(pkgJsonPath)) continue;
-			try {
-				if (parsePackageJson(readFileSync(pkgJsonPath, "utf-8"))?.name === packageName) return true;
-			} catch (_error) {}
-		}
-	} catch (_error) {}
-	return false;
-}
 function addReleaseDeps(deps, config) {
 	switch (config.releaseStrategy) {
 		case "release-it":
@@ -5169,18 +5211,18 @@ function addReleaseDeps(deps, config) {
 				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
-				"knip": "6.39.0",
-				"lefthook": "2.1.16",
-				"modern-web-guidance": "0.0.191",
-				"oxfmt": "0.71.0",
-				"oxlint": "1.86.0",
+				"knip": "6.41.0",
+				"lefthook": "2.2.1",
+				"modern-web-guidance": "0.0.193",
+				"oxfmt": "0.72.0",
+				"oxlint": "1.87.0",
 				"oxlint-tsgolint": "7.0.2003",
 				"prettier": "3.9.9",
-				"release-it": "21.1.0",
+				"release-it": "21.1.1",
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.28.3"
+				"pnpm": "11.28.5"
 			}["release-it"];
 			if (config.structure === "monorepo") deps["@release-it/bumper"] = {
 				"@changesets/cli": "3.0.3",
@@ -5188,18 +5230,18 @@ function addReleaseDeps(deps, config) {
 				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
-				"knip": "6.39.0",
-				"lefthook": "2.1.16",
-				"modern-web-guidance": "0.0.191",
-				"oxfmt": "0.71.0",
-				"oxlint": "1.86.0",
+				"knip": "6.41.0",
+				"lefthook": "2.2.1",
+				"modern-web-guidance": "0.0.193",
+				"oxfmt": "0.72.0",
+				"oxlint": "1.87.0",
 				"oxlint-tsgolint": "7.0.2003",
 				"prettier": "3.9.9",
-				"release-it": "21.1.0",
+				"release-it": "21.1.1",
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.28.3"
+				"pnpm": "11.28.5"
 			}["@release-it/bumper"];
 			break;
 		case "simple":
@@ -5209,18 +5251,18 @@ function addReleaseDeps(deps, config) {
 				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
-				"knip": "6.39.0",
-				"lefthook": "2.1.16",
-				"modern-web-guidance": "0.0.191",
-				"oxfmt": "0.71.0",
-				"oxlint": "1.86.0",
+				"knip": "6.41.0",
+				"lefthook": "2.2.1",
+				"modern-web-guidance": "0.0.193",
+				"oxfmt": "0.72.0",
+				"oxlint": "1.87.0",
 				"oxlint-tsgolint": "7.0.2003",
 				"prettier": "3.9.9",
-				"release-it": "21.1.0",
+				"release-it": "21.1.1",
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.28.3"
+				"pnpm": "11.28.5"
 			}["commit-and-tag-version"];
 			break;
 		case "changesets": deps["@changesets/cli"] = {
@@ -5229,18 +5271,18 @@ function addReleaseDeps(deps, config) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["@changesets/cli"];
 	}
 }
@@ -5307,10 +5349,6 @@ function reclaimManagedDevDeps(ctx, pkg, managedDevDeps, unmanaged, changes) {
 	}
 	pkg.devDependencies = existingDevDeps;
 }
-function readUnmanagedDevDeps(ctx) {
-	const slice = parseToolingConfigSlice(ctx.read(".tooling.json"), z.object({ unmanagedDevDependencies: UnmanagedDevDependenciesSchema.optional() }), { block: "unmanagedDevDependencies" });
-	return new Set(slice?.unmanagedDevDependencies ?? []);
-}
 function isAsciiCheckEnabled(ctx) {
 	return parseToolingConfigSlice(ctx.read(".tooling.json"), z.object({ ascii: AsciiConfigSchema.optional() }), { block: "ascii" })?.ascii?.enabled === true;
 }
@@ -5345,18 +5383,18 @@ function applyMetadataDefaults(pkg, ctx, changes) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["pnpm"];
 	const desiredPm = pinnedPnpm ? `pnpm@${pinnedPnpm}` : void 0;
 	if (desiredPm) {
@@ -5395,26 +5433,27 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...rootDevDeps(ctx.config) };
 	if (!isMonorepo) Object.assign(devDeps, perPackageDevDeps(ctx.config));
 	if (ctx.config.stack !== "none" || ctx.config.ci === "forgejo") devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.15.0";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.89.1";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.91.0";
 	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.17.0";
+	if (wantsAgentCli(ctx)) devDeps[AGENT_CLI_PACKAGE] = "0.1.2";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["oxfmt"];
 	if (ctx.config.formatter === "prettier") devDeps["prettier"] = {
 		"@changesets/cli": "3.0.3",
@@ -5422,18 +5461,18 @@ function buildManagedDevDeps(ctx) {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["prettier"];
 	addReleaseDeps(devDeps, ctx.config);
 	return devDeps;
@@ -5442,7 +5481,7 @@ async function generatePackageJson(ctx) {
 	const filePath = "package.json";
 	const existing = ctx.read(filePath);
 	const allScripts = buildManagedScripts(ctx);
-	const unmanaged = readUnmanagedDevDeps(ctx);
+	const unmanaged = readUnmanagedDevDepNames(ctx);
 	const devDeps = buildManagedDevDeps(ctx);
 	if (existing) {
 		const pkg = parsePackageJson(existing);
@@ -5492,18 +5531,18 @@ async function generatePackageJson(ctx) {
 			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
-			"knip": "6.39.0",
-			"lefthook": "2.1.16",
-			"modern-web-guidance": "0.0.191",
-			"oxfmt": "0.71.0",
-			"oxlint": "1.86.0",
+			"knip": "6.41.0",
+			"lefthook": "2.2.1",
+			"modern-web-guidance": "0.0.193",
+			"oxfmt": "0.72.0",
+			"oxlint": "1.87.0",
 			"oxlint-tsgolint": "7.0.2003",
 			"prettier": "3.9.9",
-			"release-it": "21.1.0",
+			"release-it": "21.1.1",
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.28.3"
+			"pnpm": "11.28.5"
 		}["pnpm"]}`
 	};
 	ctx.write(filePath, JSON.stringify(pkg, null, 2) + "\n");
@@ -7318,6 +7357,59 @@ async function generateGitattributes(ctx) {
 	};
 }
 //#endregion
+//#region src/default-branch.ts
+const DEFAULT_BRANCH = "main";
+const DefaultBranchSliceSchema = z.object({ defaultBranch: z.union([z.literal(""), DefaultBranchNameSchema]).optional() });
+function configuredDefaultBranch(raw) {
+	const configured = parseToolingConfigSlice(raw, DefaultBranchSliceSchema, { block: "defaultBranch" })?.defaultBranch;
+	if (configured === void 0 || configured === "") return DEFAULT_BRANCH;
+	return configured;
+}
+function readConfiguredDefaultBranch(dir) {
+	const configPath = path.join(dir, ".tooling.json");
+	if (!existsSync(configPath)) return DEFAULT_BRANCH;
+	let raw;
+	try {
+		raw = readFileSync(configPath, "utf-8");
+	} catch (error) {
+		throw new FatalError(`Cannot read ${configPath}: ${describeError$1(error)}`, { cause: error });
+	}
+	return configuredDefaultBranch(raw);
+}
+function processCiEventSource() {
+	return {
+		env: process.env,
+		readFile: (absolutePath) => {
+			try {
+				return readFileSync(absolutePath, "utf-8");
+			} catch (_error) {
+				return;
+			}
+		}
+	};
+}
+const CiEventSchema = z.object({ repository: z.object({ default_branch: z.string().min(1) }) });
+function ciDefaultBranch(source) {
+	if (source === void 0 || source.env["GITHUB_ACTIONS"] !== "true") return void 0;
+	const eventPath = source.env["GITHUB_EVENT_PATH"];
+	if (eventPath === void 0 || eventPath === "") return void 0;
+	const raw = source.readFile(eventPath);
+	if (raw === void 0 || raw.trim() === "") return void 0;
+	let json;
+	try {
+		json = JSON.parse(raw);
+	} catch (_error) {
+		return;
+	}
+	const result = CiEventSchema.safeParse(json);
+	return result.success ? result.data.repository.default_branch : void 0;
+}
+function refuseForgeDefaultMismatch(configured, source, command) {
+	const reported = ciDefaultBranch(source);
+	if (reported === void 0 || reported === configured) return;
+	throw new FatalError(`${command}: .tooling.json#defaultBranch is "${configured}", but the forge reports "${reported}" as this repository's default branch. Set .tooling.json#defaultBranch to "${reported}" and run bst repo:sync.`);
+}
+//#endregion
 //#region src/generators/release-ci.ts
 const DEFAULT_POST_RELEASE_COMMAND = [
 	"pnpm exec bst webhook:send",
@@ -7337,7 +7429,7 @@ function hookSecretEnv(secrets) {
 	};
 }
 function postReleaseHookStep(opts) {
-	const ifCondition = opts?.condition ?? (opts?.guardMain ? IS_MAIN_BRANCH : void 0);
+	const ifCondition = opts?.condition ?? (opts?.guardMain ? isDefaultBranch(opts.defaultBranch) : void 0);
 	return { step: {
 		name: "Post-release hook",
 		...ifCondition && { if: ifCondition },
@@ -7348,7 +7440,7 @@ function postReleaseHookStep(opts) {
 function postReleaseHookJob(opts) {
 	return {
 		needs: opts.needsJob,
-		if: onlyOnDefaultBranch(opts.publishCondition),
+		if: onlyOnDefaultBranch(opts.defaultBranch, opts.publishCondition),
 		"continue-on-error": true,
 		steps: [...commonSteps(opts.ci), { step: {
 			name: "Post-release hook",
@@ -7492,6 +7584,7 @@ function releaseWorkflowPath(ci) {
 async function generateReleaseCi(ctx) {
 	const filePath = "release-ci";
 	const isGitHub = ctx.config.ci === "github";
+	const defaultBranch = configuredDefaultBranch(ctx.read(".tooling.json"));
 	if (ctx.config.ci === "none" || ctx.config.releaseStrategy === "none") return {
 		filePath,
 		action: "skipped",
@@ -7535,6 +7628,7 @@ async function generateReleaseCi(ctx) {
 	let extraJobs;
 	let jobOutputs;
 	if (ctx.config.releaseStrategy === "release-it") steps.push(postReleaseHookStep({
+		defaultBranch,
 		command: getPostReleaseHookCommand(ctx),
 		secrets: hookSecrets
 	}));
@@ -7544,6 +7638,7 @@ async function generateReleaseCi(ctx) {
 			tag: actionsExpr("steps.release.outputs.tag")
 		};
 		extraJobs = { "post-release-hook": postReleaseHookJob({
+			defaultBranch,
 			ci: ctx.config.ci,
 			needsJob: "release",
 			publishCondition: "needs.release.outputs.pushed == 'true'",
@@ -7559,7 +7654,7 @@ async function generateReleaseCi(ctx) {
 		on,
 		...isGitHub && { permissions: { contents: "write" } },
 		jobName: "release",
-		jobIf: IS_MAIN_BRANCH,
+		jobIf: isDefaultBranch(defaultBranch),
 		...jobOutputs && { jobOutputs },
 		steps,
 		...extraJobs && { extraJobs }
@@ -7590,7 +7685,9 @@ async function generateReleaseCi(ctx) {
 }
 //#endregion
 //#region src/release/version-branch.ts
-const VERSION_PR_BRANCH = "changeset-release/main";
+function versionPrBranch(defaultBranch) {
+	return `changeset-release/${defaultBranch}`;
+}
 //#endregion
 //#region src/generators/ci.ts
 function coverageHistorySteps() {
@@ -7624,7 +7721,7 @@ function healthSteps(includeHistory) {
 		run: "pnpm exec bst health:status --limit 10"
 	} }];
 }
-function changesetsReleaseStep(ci, publishesNpm, npmAuth) {
+function changesetsReleaseStep(ci, publishesNpm, npmAuth, defaultBranch) {
 	if (ci === "github") {
 		const changesetsEnv = {
 			GITHUB_TOKEN: actionsExpr("secrets.RELEASE_TOKEN"),
@@ -7633,7 +7730,7 @@ function changesetsReleaseStep(ci, publishesNpm, npmAuth) {
 		return { step: {
 			id: "release",
 			uses: "changesets/action@v1",
-			if: IS_MAIN_BRANCH,
+			if: isDefaultBranch(defaultBranch),
 			with: {
 				publish: "pnpm changeset publish",
 				version: "pnpm changeset version"
@@ -7651,19 +7748,19 @@ function changesetsReleaseStep(ci, publishesNpm, npmAuth) {
 	return { step: {
 		id: "release",
 		name: "Release",
-		if: IS_MAIN_BRANCH,
+		if: isDefaultBranch(defaultBranch),
 		env: releaseEnv,
 		run: npmAuth.publishRun("pnpm exec bst release:changesets")
 	} };
 }
-function ciConcurrency(ci) {
+function ciConcurrency(ci, defaultBranch) {
 	if (ci === "forgejo") return {
-		group: `ci-${actionsExpr(`${IS_MAIN_BRANCH} && github.sha || github.ref`)}`,
-		"cancel-in-progress": actionsExpr(IS_NOT_MAIN_BRANCH)
+		group: `ci-${actionsExpr(`${isDefaultBranch(defaultBranch)} && github.sha || github.ref`)}`,
+		"cancel-in-progress": actionsExpr(isNotDefaultBranch(defaultBranch))
 	};
 	return {
 		group: `ci-${actionsExpr("github.ref")}`,
-		"cancel-in-progress": actionsExpr(IS_NOT_MAIN_BRANCH)
+		"cancel-in-progress": actionsExpr(isNotDefaultBranch(defaultBranch))
 	};
 }
 function checkSteps(ci, coverageEnabled, emitDockerSweepStep) {
@@ -7694,6 +7791,7 @@ async function generateCi(ctx) {
 		action: "skipped",
 		description: "CI workflow not requested"
 	};
+	const defaultBranch = configuredDefaultBranch(ctx.read(".tooling.json"));
 	const isGitHub = ctx.config.ci === "github";
 	const isForgejo = !isGitHub;
 	const isChangesets = ctx.config.releaseStrategy === "changesets";
@@ -7708,7 +7806,7 @@ async function generateCi(ctx) {
 	const hasAssets = isChangesets && (hasReleaseAssets(ctx) || hasVersionStamp(ctx));
 	const host = hasDocker ? resolveGenTimeHost(ctx) : null;
 	const publishedIf = "steps.release.outputs.published == 'true'";
-	const publishedOnMainIf = onlyOnDefaultBranch(publishedIf);
+	const publishedOnDefaultIf = onlyOnDefaultBranch(defaultBranch, publishedIf);
 	const githubChangesetsDeriveTagStep = { step: {
 		name: "Derive release tag",
 		id: "derive-tag",
@@ -7729,17 +7827,17 @@ async function generateCi(ctx) {
 		...checkSteps(ctx.config.ci, coverage.enabled, hasDockerPackages(ctx)),
 		...emitCoverageSteps ? coverageHistorySteps() : [],
 		...healthSteps(emitHealthHistory),
-		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm, npmAuth)] : [],
+		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm, npmAuth, defaultBranch)] : [],
 		...isChangesets && isGitHub ? [githubChangesetsDeriveTagStep] : [],
 		...hasAssets ? [{ step: {
 			name: "Upload Release Assets",
-			if: publishedOnMainIf,
+			if: publishedOnDefaultIf,
 			env: releaseEnv,
 			run: "pnpm exec bst release:assets"
 		} }] : [],
 		...hasDocker ? [{ step: {
 			name: "Publish Docker images",
-			if: publishedOnMainIf,
+			if: publishedOnDefaultIf,
 			env: dockerPublishEnv(host),
 			run: "pnpm exec bst docker:publish"
 		} }] : [],
@@ -7747,7 +7845,7 @@ async function generateCi(ctx) {
 			deploy,
 			packageName: ctx.config.name,
 			releaseEnv,
-			condition: publishedOnMainIf,
+			condition: publishedOnDefaultIf,
 			secrets: hookSecrets
 		})] : []
 	];
@@ -7759,6 +7857,7 @@ async function generateCi(ctx) {
 			tag: changesetsTagOutputExpr
 		};
 		extraJobs = { "post-release-hook": postReleaseHookJob({
+			defaultBranch,
 			ci: ctx.config.ci,
 			needsJob: "check",
 			publishCondition: "needs.check.outputs.published == 'true'",
@@ -7767,7 +7866,7 @@ async function generateCi(ctx) {
 			secrets: hookSecrets
 		}) };
 	}
-	const checkJobEnv = emitCoverageSteps || emitHealthHistory ? IS_MAIN_JOB_ENV : {};
+	const checkJobEnv = emitCoverageSteps || emitHealthHistory ? defaultBranchJobEnv(defaultBranch) : {};
 	const checksSlice = parseToolingConfigSlice(ctx.read(".tooling.json"), z.object({ checks: ChecksConfigSchema.optional() }), { block: "checks" });
 	const skipOnVersionPr = isChangesets && checksSlice?.checks?.runOnVersionPr !== true;
 	const content = buildWorkflowYaml({
@@ -7775,16 +7874,16 @@ async function generateCi(ctx) {
 		name: "CI",
 		on: {
 			push: {
-				branches: ["main"],
+				branches: [defaultBranch],
 				"tags-ignore": ["**"]
 			},
 			pull_request: null
 		},
 		...isGitHub && (emitCoverageSteps || emitHealthHistory) && { permissions: { contents: "write" } },
 		enableEmailNotifications: isForgejo,
-		...isChangesets && { concurrency: ciConcurrency(ctx.config.ci) },
+		...isChangesets && { concurrency: ciConcurrency(ctx.config.ci, defaultBranch) },
 		jobName: "check",
-		...skipOnVersionPr && { jobIf: `github.head_ref != 'changeset-release/main'` },
+		...skipOnVersionPr && { jobIf: `github.head_ref != '${versionPrBranch(defaultBranch)}'` },
 		...Object.keys(checkJobEnv).length > 0 && { jobEnv: checkJobEnv },
 		...jobOutputs && { jobOutputs },
 		steps,
@@ -7828,19 +7927,25 @@ function foreignOwnedBinaries(ctx) {
 function ignoreBinariesField(binaries) {
 	return binaries.length > 0 ? `\n  ignoreBinaries: ${JSON.stringify(binaries)},` : "";
 }
-function buildKnipConfigSingle(ignoreBinaries) {
+function ignorableDependencies(ctx) {
+	return wantsAgentCli(ctx) ? [AGENT_CLI_PACKAGE] : [];
+}
+function ignoreDependenciesField(dependencies) {
+	return dependencies.length > 0 ? `\n  ignoreDependencies: ${JSON.stringify(dependencies)},` : "";
+}
+function buildKnipConfigSingle(ignoreBinaries, ignoreDependencies) {
 	return `import type { KnipConfig } from "knip";
 
 export default {
   entry: ["src/index.ts"],
-  project: ["src/**/*.ts"],${ignoreBinariesField(ignoreBinaries)}
+  project: ["src/**/*.ts"],${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
 } satisfies KnipConfig;
 `;
 }
-function buildKnipConfigMonorepo(ignoreBinaries) {
+function buildKnipConfigMonorepo(ignoreBinaries, ignoreDependencies) {
 	return `import type { KnipConfig } from "knip";
 
-export default {${ignoreBinariesField(ignoreBinaries)}
+export default {${ignoreBinariesField(ignoreBinaries)}${ignoreDependenciesField(ignoreDependencies)}
   workspaces: {
     ".": {
       entry: [],
@@ -7901,16 +8006,17 @@ function hookIsInProjectScope(content, path) {
 	if (patterns === void 0) return true;
 	return patterns.some((pattern) => picomatch(pattern, { dot: true })(HOOK_FILE));
 }
-function ensureIgnorePattern(content, path, ignoreBinaries) {
+function ensureIgnorePattern(content, path, ignoreBinaries, ignoreDependencies) {
 	const needsHooksIgnore = hookIsInProjectScope(content, path);
-	if (isJsonConfig(path)) return ensureIgnoreInJson(content, ignoreBinaries, needsHooksIgnore);
-	return ensureIgnoreInTs(content, ignoreBinaries, needsHooksIgnore);
+	if (isJsonConfig(path)) return ensureIgnoreInJson(content, ignoreBinaries, ignoreDependencies, needsHooksIgnore);
+	return ensureIgnoreInTs(content, ignoreBinaries, ignoreDependencies, needsHooksIgnore);
 }
 const KnipJsonSchema = z.object({
 	ignore: z.array(z.string()).optional(),
-	ignoreBinaries: z.array(z.string()).optional()
+	ignoreBinaries: z.array(z.string()).optional(),
+	ignoreDependencies: z.array(z.string()).optional()
 }).passthrough();
-function ensureIgnoreInJson(content, ignoreBinaries, needsHooksIgnore) {
+function ensureIgnoreInJson(content, ignoreBinaries, ignoreDependencies, needsHooksIgnore) {
 	let parsedJson;
 	try {
 		parsedJson = JSON.parse(content);
@@ -7931,6 +8037,12 @@ function ensureIgnoreInJson(content, ignoreBinaries, needsHooksIgnore) {
 		parsed.ignoreBinaries = [...parsed.ignoreBinaries ?? [], ...missingBinaries];
 		changed = true;
 	}
+	const existingDependencies = new Set(parsed.ignoreDependencies ?? []);
+	const missingDependencies = ignoreDependencies.filter((dependency) => !existingDependencies.has(dependency));
+	if (missingDependencies.length > 0) {
+		parsed.ignoreDependencies = [...parsed.ignoreDependencies ?? [], ...missingDependencies];
+		changed = true;
+	}
 	if (!changed) return void 0;
 	return JSON.stringify(parsed, null, 2) + "\n";
 }
@@ -7940,7 +8052,30 @@ function missingIgnoreBinariesInTs(content, binaries) {
 	const arrayContent = match[1] ?? "";
 	return binaries.filter((binary) => !arrayContent.includes(`"${binary}"`));
 }
-function ensureIgnoreInTs(content, ignoreBinaries, needsHooksIgnore) {
+function missingIgnoreDependenciesInTs(content, dependencies) {
+	const match = /ignoreDependencies:\s*\[([^\]]*)\]/.exec(content);
+	if (!match) return dependencies;
+	const arrayContent = match[1] ?? "";
+	return dependencies.filter((dependency) => !arrayContent.includes(`"${dependency}"`));
+}
+function insertIntoTsArray(content, field, entries) {
+	const quoted = entries.map((entry) => `"${entry}"`).join(", ");
+	const arrayPattern = new RegExp("(" + field + ":\\s*\\[)");
+	if (arrayPattern.test(content)) return {
+		content: content.replace(arrayPattern, `$1${quoted}, `),
+		changed: true
+	};
+	const exportPattern = /(export default\s*\{)\n/;
+	if (exportPattern.test(content)) return {
+		content: content.replace(exportPattern, `$1\n  ${field}: [${quoted}],\n`),
+		changed: true
+	};
+	return {
+		content,
+		changed: false
+	};
+}
+function ensureIgnoreInTs(content, ignoreBinaries, ignoreDependencies, needsHooksIgnore) {
 	let result = content;
 	let changed = false;
 	if (needsHooksIgnore && !result.includes(".claude/hooks")) {
@@ -7958,18 +8093,15 @@ function ensureIgnoreInTs(content, ignoreBinaries, needsHooksIgnore) {
 	}
 	const missingBinaries = missingIgnoreBinariesInTs(result, ignoreBinaries);
 	if (missingBinaries.length > 0) {
-		const quoted = missingBinaries.map((binary) => `"${binary}"`).join(", ");
-		const binariesArrayPattern = /(ignoreBinaries:\s*\[)/;
-		if (binariesArrayPattern.test(result)) {
-			result = result.replace(binariesArrayPattern, `$1${quoted}, `);
-			changed = true;
-		} else {
-			const exportPattern = /(export default\s*\{)\n/;
-			if (exportPattern.test(result)) {
-				result = result.replace(exportPattern, `$1\n  ignoreBinaries: [${quoted}],\n`);
-				changed = true;
-			}
-		}
+		const inserted = insertIntoTsArray(result, "ignoreBinaries", missingBinaries);
+		result = inserted.content;
+		changed = changed || inserted.changed;
+	}
+	const missingDependencies = missingIgnoreDependenciesInTs(result, ignoreDependencies);
+	if (missingDependencies.length > 0) {
+		const inserted = insertIntoTsArray(result, "ignoreDependencies", missingDependencies);
+		result = inserted.content;
+		changed = changed || inserted.changed;
 	}
 	return changed ? result : void 0;
 }
@@ -7985,6 +8117,7 @@ async function generateKnip(ctx) {
 	};
 	const isMonorepo = ctx.config.structure === "monorepo";
 	const ignoreBinaries = foreignOwnedBinaries(ctx);
+	const ignoreDependencies = ignorableDependencies(ctx);
 	const buildConfig = isMonorepo ? buildKnipConfigMonorepo : buildKnipConfigSingle;
 	const existingPath = KNIP_CONFIG_PATHS.find((p) => ctx.exists(p));
 	if (existingPath) {
@@ -7995,7 +8128,7 @@ async function generateKnip(ctx) {
 			description: "Could not read existing knip config"
 		};
 		if (content.trim() === "") {
-			const blank = isJsonConfig(existingPath) ? ensureIgnorePattern("{}", existingPath, ignoreBinaries) ?? "{}\n" : formattedTemplate(ctx, existingPath, buildConfig(ignoreBinaries));
+			const blank = isJsonConfig(existingPath) ? ensureIgnorePattern("{}", existingPath, ignoreBinaries, ignoreDependencies) ?? "{}\n" : formattedTemplate(ctx, existingPath, buildConfig(ignoreBinaries, ignoreDependencies));
 			ctx.write(existingPath, blank);
 			return {
 				filePath: existingPath,
@@ -8003,13 +8136,13 @@ async function generateKnip(ctx) {
 				description: createdDescription(existingPath)
 			};
 		}
-		const updated = ensureIgnorePattern(content, existingPath, ignoreBinaries);
+		const updated = ensureIgnorePattern(content, existingPath, ignoreBinaries, ignoreDependencies);
 		if (updated) {
 			ctx.write(existingPath, updated);
 			return {
 				filePath: existingPath,
 				action: "updated",
-				description: "Added \".claude/hooks/**\" and/or foreign-owned ignoreBinaries"
+				description: "Added \".claude/hooks/**\", foreign-owned ignoreBinaries, and/or ignored dependencies"
 			};
 		}
 		return {
@@ -8018,7 +8151,7 @@ async function generateKnip(ctx) {
 			description: existingPath === filePath ? "Already configured" : `Existing config found at ${existingPath}`
 		};
 	}
-	ctx.write(filePath, formattedTemplate(ctx, filePath, buildConfig(ignoreBinaries)));
+	ctx.write(filePath, formattedTemplate(ctx, filePath, buildConfig(ignoreBinaries, ignoreDependencies)));
 	return {
 		filePath,
 		action: "created",
@@ -8447,7 +8580,7 @@ async function generateReleaseIt(ctx) {
 }
 //#endregion
 //#region src/generators/changesets.ts
-function buildConfig$2() {
+function buildConfig$2(defaultBranch) {
 	return {
 		$schema: "https://unpkg.com/@changesets/config@3.1.1/schema.json",
 		changelog: "@changesets/cli/changelog",
@@ -8455,7 +8588,7 @@ function buildConfig$2() {
 		fixed: [],
 		linked: [],
 		access: "public",
-		baseBranch: "main",
+		baseBranch: defaultBranch,
 		updateInternalDependencies: "patch",
 		ignore: []
 	};
@@ -8467,7 +8600,7 @@ async function generateChangesets(ctx) {
 		action: "skipped",
 		description: "Changesets not requested"
 	};
-	const content = JSON.stringify(buildConfig$2(), null, 2) + "\n";
+	const content = JSON.stringify(buildConfig$2(configuredDefaultBranch(ctx.read(".tooling.json"))), null, 2) + "\n";
 	const existing = ctx.read(filePath);
 	if (existing) return {
 		filePath,
@@ -9095,6 +9228,7 @@ const AGENT_RULES_MID = [
 const TS_EXTENSIONLESS_RULE = "- Prefer extensionless imports; if an extension is required, use `.ts` over `.js`.";
 const CHANGESETS_RULE = "- A user-facing change owes a changeset in `.changeset/`, written with the change: `patch` for a fix, `minor` for a feature, naming every package it affects. One file per smallest unit of work.";
 const WORK_STATUS_RULE = "- Before starting or resuming work, run `bst work:status`.";
+const WORK_START_RULE = "- Before starting or resuming work, run `bst work:start <n>`.";
 const FIND_COMMAND_RULE = "- Find a command with `bst --help`, its flags with `bst <command> --help`, before guessing.";
 const FORGEJO_CLI_RULE_SUFFIX = " For Forgejo API work, run `bst-fj --help`.";
 const AGENT_CLI_RULE_SUFFIX = " For the agent's runs and transcripts, run `bst-agent --help`.";
@@ -9115,20 +9249,22 @@ function declaresAgentCli(packageJson) {
 function findCommandRule(packageJson) {
 	return FIND_COMMAND_RULE + (declaresForgejoCli(packageJson) ? FORGEJO_CLI_RULE_SUFFIX : "") + (declaresAgentCli(packageJson) ? AGENT_CLI_RULE_SUFFIX : "");
 }
-const AGENT_RULES_TAIL = [
-	"- The bst-hook blocks a short list of dangerous commands (`.claude/hooks/bst-hook-guide.md` lists them); Claude Code's auto mode judges everything else.",
-	"- Machine-reading a `bst` command? Pass `--json` after the command name (`bst <cmd> --json`, not `bst --json <cmd>`); capture `2>&1` and parse it as one JSON document, failures included as `{ok: false, error}`. `--verbose` breaks this.",
-	WORK_STATUS_RULE,
-	FIND_COMMAND_RULE,
-	"",
-	"#### Git discipline",
-	"",
-	"**The branch you are on is the mode switch.** The bst-hook refuses any command that would move a protected branch, so on one you leave changes unstaged; on a feature branch you commit, push, and open the PR yourself. Pick the mode, announce it, and only ask when it's genuinely ambiguous.",
-	"",
-	"**Small change** -- a fix, a doc edit, a one-file tweak: work on the default branch and leave it unstaged. Don't commit; surface the commit message as text for the user to run.",
-	"",
-	"**Large effort** -- anything that warranted a written plan or spec (spec, then plan, then code, each approved before the next): start it in a worktree (see the Git guide), commit as you go, finish with `bst pr:create`. Push later commits with `bst pr:update`, which rewrites nothing unless given `--title`/`--body`. The one exception: a headless agent run (a spec, plan, execute, or review container) never starts a worktree -- it works and commits on the branch it was started on."
-];
+function agentRulesTail(agentWorked) {
+	return [
+		"- The bst-hook blocks a short list of dangerous commands (`.claude/hooks/bst-hook-guide.md` lists them); Claude Code's auto mode judges everything else.",
+		"- Machine-reading a `bst` command? Pass `--json` after the command name (`bst <cmd> --json`, not `bst --json <cmd>`); capture `2>&1` and parse it as one JSON document, failures included as `{ok: false, error}`. `--verbose` breaks this.",
+		agentWorked ? WORK_START_RULE : WORK_STATUS_RULE,
+		FIND_COMMAND_RULE,
+		"",
+		"#### Git discipline",
+		"",
+		"**The branch you are on is the mode switch.** The bst-hook refuses any command that would move a protected branch, so on one you leave changes unstaged; on a feature branch you commit, push, and open the PR yourself. Pick the mode, announce it, and only ask when it's genuinely ambiguous.",
+		"",
+		"**Small change** -- a fix, a doc edit, a one-file tweak: work on the default branch and leave it unstaged. Don't commit; surface the commit message as text for the user to run.",
+		"",
+		"**Large effort** -- anything that warranted a written plan or spec (spec, then plan, then code, each approved before the next): start it in a worktree (see the Git guide), commit as you go, finish with `bst pr:create`. Push later commits with `bst pr:update`, which rewrites nothing unless given `--title`/`--body`. The one exception: a headless agent run (a spec, plan, execute, or review container) never starts a worktree -- it works and commits on the branch it was started on."
+	];
+}
 const COMMENTS_GUIDE_BODY = [
 	"# Comments",
 	"",
@@ -9136,7 +9272,7 @@ const COMMENTS_GUIDE_BODY = [
 	"",
 	"- Default to none. A comment earns its place by carrying what the code cannot -- a rejected alternative, the bug that forced this shape, an invariant enforced elsewhere -- and earns it one decision at a time, in a sentence or two each: what was rejected, and what it cost. Five decisions is five sentences, not five paragraphs. Recoverable from the code? Leave it unwritten.",
 	"- Present tense, about what is. No `now`, `previously`, `changed to`: diff narration is stale on the next edit, and the commit message carries it. No running ledgers or changelogs: when adjusting a threshold, constant, or baseline, state the active invariant and prune past deltas.",
-	"- Never cite a lifecycle-managed doc, PR, or issue from code: no PR or issue numbers (`PR #123`, `closes #456`), no path under `docs/superpowers/` or `docs/design/`, none carrying a `retired/` or `completed/` segment, no `docs/plan-*.md`, and no bare decision or task ID (`D3`, `T2`). They move, retire, and renumber, nothing checks the reference, and the reader has no way to tell a dead one from a live one. State the constraint itself, or cite a maintained reference doc instead. A `docs/` path that is a glob or an elided example rather than a reference (`docs/*.md`) is vocabulary, not a citation, and is fine.",
+	"- Never cite a lifecycle-managed doc, PR, or issue from code: no PR or issue numbers (`PR #123`, `closes #456`), no path under `docs/specs/`, `docs/plans/`, `docs/superpowers/` or `docs/design/`, none carrying a `retired/` or `completed/` segment, no `docs/plan-*.md`, and no bare decision or task ID (`D3`, `T2`). They move, retire, and renumber, nothing checks the reference, and the reader has no way to tell a dead one from a live one. State the constraint itself, or cite a maintained reference doc instead. A `docs/` path that is a glob or an elided example rather than a reference (`docs/*.md`) is vocabulary, not a citation, and is fine.",
 	"- Code that exists only to accept an older shape -- a file, field, flag, environment variable, label or comment format -- carries `// @compat <id> until <expiry>: <reason>` on the line above it. The expiry is a date (`YYYY-MM-DD`) when the old shape lives with consumers who upgrade on their own schedule; a version of the code's own package (`v1.4.0`) when its consumer upgrades with each release; or `forge-clean` for old data on the forge, which has neither. Remove the code and every test that carries the same id together.",
 	"- **The code is the fact.** When a comment disagrees with it, fix it in one line or delete it -- never grow one to argue the code is right."
 ].join("\n");
@@ -9167,7 +9303,11 @@ const GIT_GUIDE_BODY = [
 	"",
 	"## Claiming work by hand",
 	"",
-	"If the bst agent drives this repo, claim an issue or pull request before you work it by hand, so the agent does not start a run beside you. First check its labels: an `agent/<stage>-running` label means a run is live -- do not start; wait or ask. Otherwise add `agent-flags/hand-authored` (on Forgejo, `bst-fj issue:label <n> agent-flags/hand-authored`, which takes a pull request number too). The flag on either an issue or its pull request holds both. Remove it when you hand the work back, before you add any `agent/` label. If the repo has no such label, no agent drives it; skip this step.",
+	"If the bst agent drives this repo, claim an issue or pull request before you work it by hand, so the agent does not start a run beside you: run `bst work:start <n>`. It prints the same orientation `bst work:status` does and then puts `agent-flags/hand-authored` on the object. It claims only where the repo's default branch sets `agent.enabled: true`, and does nothing anywhere else. **Exit 1 means do not start**: a run is live on the pair, or the agent holds it -- the output names which. Exit 0 means the pair is yours, whether the command wrote the flag or found it there already.",
+	"",
+	"A pull request you open yourself that closes no claimed issue needs its own `bst work:start <n>` once it exists -- the flag on either half of a pair holds both, but there is no pair until something closes something.",
+	"",
+	"Hand the work back with the control panel's **Release to the agent**, or by removing `agent-flags/hand-authored` from both halves. Removing it does not queue anything: the agent picks the object up on its next cycle only if a label or a comment asks it to.",
 	"",
 	"## Issue linking",
 	"",
@@ -9198,7 +9338,7 @@ const PLAN_LIFECYCLE_GUIDE_BODY = [
 	"",
 	"A plan's **directory** is the source of truth for whether it shipped -- not its `Status:` line, not its checkboxes. Read the source it names.",
 	"",
-	"`.superpowers/` (no `docs/` prefix) is scratch state, not a plan's home -- a plan doc always lives under `docs/superpowers/plans/`, even one drafted while running a plan through subagents.",
+	"`.superpowers/` (no `docs/` prefix) is scratch state, not a plan's home -- a plan doc lives under `docs/plans/` (older ones under `docs/superpowers/plans/`), even one drafted while running a plan through subagents.",
 	"",
 	"Retiring the plan is the last task of the plan, done in the PR that delivers the work: \"in the tree\" means committed on this branch, not merged to a default branch. Run `bst docs:retire <plan.md> --status <verb> --shipped \"<text>\"` -- it moves the doc, relinks what the move breaks, de-links paths pointing outside `docs/`, and writes the dated terminal `Status:` line, the historical banner, and the \"Shipped:\" paragraph. You supply the judgement: the honest verb -- `completed` / `superseded` / `abandoned` / `rejected` -- and a truthful `--shipped` naming the delivering PR; never fabricate it for uncommitted code or claim a merge that has not happened. A plan that lands one phase of a larger spec retires the plan and leaves the spec open.",
 	"",
@@ -9215,11 +9355,11 @@ const PLANNING_GUIDE_BODY = [
 	"",
 	"## The spec",
 	"",
-	"Say why and what, not how: the problem, who it is for, the constraints, what done looks like, and the alternatives you rejected, each with its reason. Work with several independent parts gets one spec per part. Save it as `docs/superpowers/specs/<YYYY-MM-DD>-<topic>-design.md`.",
+	"Say why and what, not how: the problem, who it is for, the constraints, what done looks like, and the alternatives you rejected, each with its reason. Work with several independent parts gets one spec per part. Save it as `docs/specs/<YYYY-MM-DD>-<topic>-design.md`.",
 	"",
 	"## The plan",
 	"",
-	"Write for an executor who has not seen this repo or the spec. They write idiomatic code once they know the exact interface and the exact test, and make a reasonable choice wherever the plan leaves one open; what they cannot know is what you decided. A plan records those decisions -- it is not a transcript of the code. Save it under `docs/superpowers/plans/`.",
+	"Write for an executor who has not seen this repo or the spec. They write idiomatic code once they know the exact interface and the exact test, and make a reasonable choice wherever the plan leaves one open; what they cannot know is what you decided. A plan records those decisions -- it is not a transcript of the code. Save it under `docs/plans/`.",
 	"",
 	"- Check the plan's premises against the tree before building on them. \"Today X is broken\" is a claim: read the code that handles X, not just the line that throws.",
 	"- Label each task `Task <n>:` at the start of its heading or checkbox, numbered from 1, so `bst plan:brief` can find it. A checkbox's first sentence is the task's name on the control panel: end it with a period inside one short line, and put the files, commands, and checks in the sentences after it.",
@@ -9288,18 +9428,18 @@ function webUiGuideBody() {
 		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
-		"knip": "6.39.0",
-		"lefthook": "2.1.16",
-		"modern-web-guidance": "0.0.191",
-		"oxfmt": "0.71.0",
-		"oxlint": "1.86.0",
+		"knip": "6.41.0",
+		"lefthook": "2.2.1",
+		"modern-web-guidance": "0.0.193",
+		"oxfmt": "0.72.0",
+		"oxlint": "1.87.0",
 		"oxlint-tsgolint": "7.0.2003",
 		"prettier": "3.9.9",
-		"release-it": "21.1.0",
+		"release-it": "21.1.1",
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.28.3"
+		"pnpm": "11.28.5"
 	}["modern-web-guidance"]}`;
 	return [
 		"# Web UI",
@@ -9548,13 +9688,13 @@ function guideIndex(guides) {
 	for (const guide of guides.filter((g) => g.enabled)) lines.push(`- Before you ${guide.trigger}: \`${GUIDES_DIR}/${guide.name}\`.`);
 	return lines.join("\n");
 }
-function agentRulesBody(config, guides, packageJson) {
+function agentRulesBody(config, guides, packageJson, agentWorked) {
 	const lines = [...AGENT_RULES_HEAD];
 	if (config.stack === "typescript") lines.push(TS_TYPECAST_RULE);
 	lines.push(...AGENT_RULES_MID);
 	if (config.stack === "typescript") lines.push(TS_EXTENSIONLESS_RULE);
 	if (config.releaseStrategy === "changesets") lines.push(CHANGESETS_RULE);
-	const tail = AGENT_RULES_TAIL.map((line) => line === FIND_COMMAND_RULE ? findCommandRule(packageJson) : line);
+	const tail = agentRulesTail(agentWorked).map((line) => line === FIND_COMMAND_RULE ? findCommandRule(packageJson) : line);
 	lines.push(...tail, "", guideIndex(guides));
 	return lines.join("\n");
 }
@@ -9618,7 +9758,7 @@ function syncClaudeMdFile(ctx, guides) {
 		name: "agent-rules",
 		startMarker: "<!-- @tooling:agent-rules -->",
 		endMarker: "<!-- @tooling:endagent-rules -->",
-		body: agentRulesBody(ctx.config, guides, ctx.packageJson),
+		body: agentRulesBody(ctx.config, guides, ctx.packageJson, agentEnabled(ctx)),
 		enabled: true
 	}, ...RETIRED_BLOCK_NAMES.map((name) => ({
 		name,
@@ -9859,7 +9999,7 @@ function reportFailures(failed, command) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.89.1 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.91.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -9987,7 +10127,7 @@ function logDetectionSummary(ctx) {
 		log$1.info(`Release assets convention detected in ${label} -- emit build artifacts to ${CONVENTION_OUTPUT_DIR}/ (gitignored).`);
 	}
 }
-async function runInit(config, options = {}) {
+async function runInitReport(config, options = {}) {
 	const detected = detectProject(config.targetDir);
 	const { ctx, archivedFiles, sawCrlf } = createContext(config, options.confirmOverwrite ?? (async (relativePath) => {
 		const result = await select({
@@ -10024,7 +10164,10 @@ async function runInit(config, options = {}) {
 	}
 	if (!hasChanges && options.noPrompt) {
 		if (failed.length === 0) log$1.success("Repository is up to date.");
-		return results;
+		return {
+			results,
+			install: "not-run"
+		};
 	}
 	if (results.some((r) => r.action === "archived" && r.filePath.startsWith(".husky/"))) try {
 		execSync("git config --unset core.hooksPath", {
@@ -10043,16 +10186,19 @@ async function runInit(config, options = {}) {
 	if (!options.noPrompt) log$1.info(`Migration prompt written to ${promptPath}`);
 	const packageJsonChanged = results.some((r) => r.filePath === "package.json" && (r.action === "created" || r.action === "updated"));
 	const hasLockfile = ctx.exists("pnpm-lock.yaml");
+	let install = "not-run";
 	if (packageJsonChanged && hasLockfile) {
 		log$1.info("package.json changed -- running pnpm install...");
 		try {
 			execSync("pnpm install", {
 				cwd: config.targetDir,
-				stdio: "inherit",
+				stdio: options.installOutput === "capture" ? "ignore" : "inherit",
 				timeout: 12e4
 			});
+			install = "ran";
 		} catch (_error) {
 			log$1.warn("pnpm install failed -- run it manually");
+			install = "failed";
 		}
 	}
 	if (hasChanges && ctx.exists("package.json")) try {
@@ -10067,7 +10213,13 @@ async function runInit(config, options = {}) {
 		"Run: pnpm check",
 		...!options.noPrompt ? ["Run: claude \"Execute the migration steps in .tooling-migrate.md\""] : []
 	].map((step, i) => `${i + 1}. ${step}`).join("\n"), "Next steps");
-	return results;
+	return {
+		results,
+		install
+	};
+}
+async function runInit(config, options = {}) {
+	return (await runInitReport(config, options)).results;
 }
 //#endregion
 //#region src/docker-check/compose-lint.ts
@@ -10806,34 +10958,6 @@ function repoPrefix(executor, cwd) {
 function ceilingFileNamesAt(prefix) {
 	return HEALTH_CEILING_FILES.map((name) => `${prefix}${name}`);
 }
-function processCiEventSource() {
-	return {
-		env: process.env,
-		readFile: (absolutePath) => {
-			try {
-				return readFileSync(absolutePath, "utf-8");
-			} catch (_error) {
-				return;
-			}
-		}
-	};
-}
-const CiEventSchema = z.object({ repository: z.object({ default_branch: z.string().min(1) }) });
-function ciDefaultBranch(source) {
-	if (source === void 0 || source.env["GITHUB_ACTIONS"] !== "true") return void 0;
-	const eventPath = source.env["GITHUB_EVENT_PATH"];
-	if (eventPath === void 0 || eventPath === "") return void 0;
-	const raw = source.readFile(eventPath);
-	if (raw === void 0 || raw.trim() === "") return void 0;
-	let json;
-	try {
-		json = JSON.parse(raw);
-	} catch (_error) {
-		return;
-	}
-	const result = CiEventSchema.safeParse(json);
-	return result.success ? result.data.repository.default_branch : void 0;
-}
 const DefaultBranchSchema = z.object({ defaultBranch: z.string().optional() });
 function parseDefaultBranchOverride(raw) {
 	if (raw === void 0 || raw.trim() === "") return void 0;
@@ -10880,7 +11004,7 @@ function originHeadBranch(git, cwd) {
 	return name === "" ? void 0 : name;
 }
 function unconfirmedDefaultWarning(branch, namedByTree) {
-	return `health: could not confirm the default branch, so the reference was read against origin/${branch}, while .tooling.json#defaultBranch names ${namedByTree}. Record it in this clone with \`git remote set-head origin ${namedByTree}\`, or run in GitHub or Forgejo Actions, where the event payload names it.`;
+	return `health: could not confirm the default branch, so the reference was read against origin/${branch}, while .tooling.json#defaultBranch names ${namedByTree}. If ${namedByTree} is the repository's default branch, record it in this clone with \`git remote set-head origin --auto\`, or run in GitHub or Forgejo Actions, where the event payload names it.`;
 }
 function gitRunner(executor) {
 	return (args, cwd) => {
@@ -11962,10 +12086,10 @@ function runComposeLintGate(targetDir, config, memo) {
 	for (const warning of findDockerRebuildRisks(targetDir, config, memo)) log$1.warn(warning);
 	return issues.length;
 }
-function runCheckOnlyImageGate(config, targetDir, memo) {
+function runCheckOnlyImageGate(config, targetDir, memo, phase) {
 	if (!config.publishDocker) return [];
 	const images = [];
-	for (const risk of findCheckOnlyPublishRisks(targetDir, void 0, memo)) {
+	for (const risk of findCheckOnlyPublishRisks(targetDir, phase, memo)) {
 		log$1.warn(`Image "${risk.imageName}" is declared only in ${risk.declaredIn}, the check overlay, so a later tooling release stops publishing it with docker:publish by default. Keep it: set publish to true for "${risk.imageName}" under .tooling.json#docker. Settle it: set publish to false there, or move the service into a base compose file.`);
 		images.push(risk.imageName);
 	}
@@ -11979,6 +12103,18 @@ function runWorkflowAptGate(targetDir) {
 	}
 	return steps;
 }
+function findInertAgentKeys(saved) {
+	const agent = saved?.agent;
+	if (!agent) return [];
+	if (agent.enabled === true) return [];
+	return Object.keys(agent).filter((key) => key !== "enabled").toSorted();
+}
+function runInertAgentSettingsGate(saved) {
+	const keys = findInertAgentKeys(saved);
+	if (keys.length === 0) return [];
+	log$1.warn(`.tooling.json sets ${keys.map((key) => `agent.${key}`).join(", ")}, but agent.enabled is not true, so the agent ignores them. Run \`bst setup:agent\` to enable the agent, or remove those keys.`);
+	return keys;
+}
 function runPublishConfigGate(config, targetDir) {
 	if (!config.publishNpm) return 0;
 	const issues = lintPublishConfig(targetDir, config.structure);
@@ -12024,6 +12160,18 @@ function warnStaleChecksAdd(config) {
 	if (stale.length === 0) return;
 	log$1.warn(`.tooling.json#checks.add names built-in step(s) checks:run already runs: ${stale.join(", ")}. The entries are deduplicated at run time and do nothing -- remove them.`);
 }
+function warnUnconfiguredDefaultBranch(targetDir, saved, git = defaultGitRunner) {
+	if (saved?.defaultBranch !== void 0) return;
+	const head = git([
+		"symbolic-ref",
+		"--short",
+		"refs/remotes/origin/HEAD"
+	], targetDir);
+	if (head === void 0) return;
+	const name = head.startsWith("origin/") ? head.slice(7) : head;
+	if (name === "" || name === "main") return;
+	log$1.warn(`origin/HEAD names "${name}", but .tooling.json sets no defaultBranch, so the generated CI workflow triggers on "${DEFAULT_BRANCH}" and gates its release steps there. Set .tooling.json#defaultBranch to "${name}" and run bst repo:sync.`);
+}
 function warnCoveredChecksAdd(config, targetDir) {
 	const covered = coveredChecksAddEntries(config, readPackageJson(targetDir)?.scripts ?? {});
 	for (const entry of covered) log$1.warn(`.tooling.json#checks.add entry "${entry.name}" is already run by the "${entry.coveredBy}" step's script ("${entry.fragment}"), so every pipeline run executes it twice. Remove the add entry, or drop the inline invocation from the "${entry.coveredBy}" script.`);
@@ -12143,26 +12291,14 @@ function checkDeclaredToolsActive(targetDir, declared) {
 }
 function runToolchainGate(targetDir) {
 	const miseTomlPath = path.join(targetDir, "mise.toml");
-	if (!existsSync(miseTomlPath)) return {
-		failures: 0,
-		warned: false
-	};
+	if (!existsSync(miseTomlPath)) return 0;
 	if (miseIsAbsent(targetDir)) {
-		log$1.warn(`mise.toml declares this repo's toolchain, but mise is not on PATH. Install it (${MISE_INSTALL_URL}), then add \`eval "$(mise activate bash)"\` to ~/.bashrc for interactive shells and \`eval "$(mise activate bash --shims)"\` to ~/.profile, so editors, git hooks, and AI sessions get the same tools.`);
-		return {
-			failures: 0,
-			warned: true
-		};
+		log$1.error(`mise.toml declares this repo's toolchain, but mise is not on PATH. Install it (${MISE_INSTALL_URL}), then add \`eval "$(mise activate bash)"\` to ~/.bashrc for interactive shells and \`eval "$(mise activate bash --shims)"\` to ~/.profile, so editors, git hooks, and AI sessions get the same tools. If this repo's mise.toml has an [env] block, also add the directory your checkouts live in to \`trusted_config_paths\` in ~/.config/mise/config.toml.`);
+		return 1;
 	}
 	const declared = readDeclaredTools(miseTomlPath);
-	if (!declared) return {
-		failures: 0,
-		warned: false
-	};
-	return {
-		failures: checkDeclaredToolsActive(targetDir, declared),
-		warned: false
-	};
+	if (!declared) return 0;
+	return checkDeclaredToolsActive(targetDir, declared);
 }
 //#endregion
 //#region src/commands/repo-sync.ts
@@ -12204,7 +12340,7 @@ const syncCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, toolchain, checkOnlyImages, aptSteps, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
+			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, checkOnlyImages, aptSteps, inertAgentKeys, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
 		}
 	},
 	async run({ args }) {
@@ -12242,47 +12378,71 @@ const syncCommand = defineCommand({
 		})).length > 0) process.exitCode = 1;
 	}
 });
-async function runUpdate(targetDir, flags = {}) {
+async function runUpdateReport(targetDir, flags = {}, options = {}) {
 	const dockerDiscovery = createDockerDiscoveryMemo();
 	const saved = loadToolingConfigStrict(targetDir);
 	if (!saved) {
 		log$1.error("No .tooling.json found. Run `bst repo:sync` first to initialize the project.");
 		process.exitCode = 1;
-		return [];
+		return {
+			status: "stopped",
+			results: [],
+			install: "not-run"
+		};
 	}
 	warnStaleChecksAdd(saved);
+	warnUnconfiguredDefaultBranch(targetDir, saved);
 	warnCoveredChecksAdd(saved, targetDir);
+	runInertAgentSettingsGate(saved);
 	if (runComposeLintGate(targetDir, saved, dockerDiscovery) > 0) {
 		process.exitCode = 1;
-		return [];
+		return {
+			status: "stopped",
+			results: [],
+			install: "not-run"
+		};
 	}
 	const config = mergeWithSavedConfig(buildDefaultConfig(targetDir, flags), saved);
 	runReleaseTargetGate(config, targetDir);
 	runVersionStampGate(saved, targetDir, config.releaseStrategy);
 	if (runPublishConfigGate(config, targetDir) > 0) {
 		process.exitCode = 1;
-		return [];
+		return {
+			status: "stopped",
+			results: [],
+			install: "not-run"
+		};
 	}
-	return runInit(config, {
-		noPrompt: true,
-		confirmOverwrite: async () => "overwrite",
-		dockerDiscovery
-	});
+	return {
+		status: "ran",
+		...await runInitReport(config, {
+			noPrompt: true,
+			confirmOverwrite: async () => "overwrite",
+			dockerDiscovery,
+			installOutput: options.installOutput
+		})
+	};
+}
+async function runUpdate(targetDir, flags = {}) {
+	return (await runUpdateReport(targetDir, flags)).results;
 }
-function gateFailure(toolchainWarned = false) {
+function gateFailure() {
 	return {
 		status: "failed",
 		actionable: [],
 		failed: [],
-		toolchain: { warned: toolchainWarned },
 		checkOnlyImages: [],
 		aptSteps: [],
+		inertAgentKeys: [],
 		warnCount: 0,
 		exitCode: 1
 	};
 }
-function upToDateReport(toolchain, checkOnlyImages, aptSteps) {
-	const warnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length + aptSteps.length;
+function advisoryWarnCount(advisories) {
+	return advisories.checkOnlyImages.length + advisories.aptSteps.length + (advisories.inertAgentKeys.length > 0 ? 1 : 0);
+}
+function upToDateReport(advisories) {
+	const warnCount = advisoryWarnCount(advisories);
 	if (warnCount > 0) {
 		if (!isJsonMode()) rawLog$1(formatWarnMarker(warnCount));
 	} else log$1.success("Repository is up to date.");
@@ -12290,9 +12450,9 @@ function upToDateReport(toolchain, checkOnlyImages, aptSteps) {
 		status: "up-to-date",
 		actionable: [],
 		failed: [],
-		toolchain,
-		checkOnlyImages,
-		aptSteps,
+		checkOnlyImages: advisories.checkOnlyImages,
+		aptSteps: advisories.aptSteps,
+		inertAgentKeys: advisories.inertAgentKeys,
 		warnCount,
 		exitCode: 0
 	};
@@ -12300,6 +12460,7 @@ function upToDateReport(toolchain, checkOnlyImages, aptSteps) {
 async function runCheckReport(targetDir) {
 	const dockerDiscovery = createDockerDiscoveryMemo();
 	const saved = loadToolingConfigStrict(targetDir);
+	warnUnconfiguredDefaultBranch(targetDir, saved);
 	if (saved) {
 		warnStaleChecksAdd(saved);
 		warnCoveredChecksAdd(saved, targetDir);
@@ -12310,44 +12471,42 @@ async function runCheckReport(targetDir) {
 	if (runReleaseTargetGate(config, targetDir)) return gateFailure();
 	if (runVersionStampGate(saved, targetDir, config.releaseStrategy) > 0) return gateFailure();
 	if (runPublishConfigGate(config, targetDir) > 0) return gateFailure();
-	const toolchain = runToolchainGate(targetDir);
-	if (toolchain.failures > 0) return {
-		...gateFailure(),
-		toolchain: { warned: toolchain.warned }
+	if (runToolchainGate(targetDir) > 0) return gateFailure();
+	const advisories = {
+		checkOnlyImages: runCheckOnlyImageGate(config, targetDir, dockerDiscovery),
+		aptSteps: runWorkflowAptGate(targetDir),
+		inertAgentKeys: runInertAgentSettingsGate(saved)
 	};
-	const checkOnlyImages = runCheckOnlyImageGate(config, targetDir, dockerDiscovery);
-	const aptSteps = runWorkflowAptGate(targetDir);
 	const { ctx, pendingWrites } = createDryRunContext(config, dockerDiscovery);
 	logDetectionSummary(ctx);
 	const results = await runGenerators(ctx);
 	const failed = failedResults(results);
 	reportFailures(failed, "repo:sync");
 	const actionable = actionableResults(results, pendingWrites, targetDir);
-	const advisoryWarnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length + aptSteps.length;
-	const toolchainState = { warned: toolchain.warned };
-	if (actionable.length === 0 && failed.length === 0) return upToDateReport(toolchainState, checkOnlyImages, aptSteps);
+	const advisoryCount = advisoryWarnCount(advisories);
+	if (actionable.length === 0 && failed.length === 0) return upToDateReport(advisories);
 	if (actionable.length === 0) return {
 		status: "failed",
 		actionable: [],
 		failed,
-		toolchain: toolchainState,
 		checkOnlyImages: [],
 		aptSteps: [],
+		inertAgentKeys: [],
 		warnCount: 0,
 		exitCode: 1
 	};
 	log$1.warn(`${actionable.length} file(s) would be changed by repo:sync`);
 	for (const r of actionable) logActionableChange(r, targetDir, pendingWrites);
 	if (failed.length === 0 && actionable.every((r) => isWorkflowDirPath(r.filePath))) {
-		const warnCount = actionable.length + advisoryWarnCount;
+		const warnCount = actionable.length + advisoryCount;
 		if (!isJsonMode()) rawLog$1(formatWarnMarker(warnCount));
 		return {
 			status: "workflow-drift",
 			actionable,
 			failed: [],
-			toolchain: toolchainState,
-			checkOnlyImages,
-			aptSteps,
+			checkOnlyImages: advisories.checkOnlyImages,
+			aptSteps: advisories.aptSteps,
+			inertAgentKeys: advisories.inertAgentKeys,
 			warnCount,
 			exitCode: 0
 		};
@@ -12356,9 +12515,9 @@ async function runCheckReport(targetDir) {
 		status: "drift",
 		actionable,
 		failed,
-		toolchain: toolchainState,
 		checkOnlyImages: [],
 		aptSteps: [],
+		inertAgentKeys: [],
 		warnCount: 0,
 		exitCode: 1
 	};
@@ -12715,8 +12874,9 @@ function childOutput(result) {
 }
 //#endregion
 //#region src/release/publish/version.ts
-const MAIN_REF = "refs/heads/main";
-const BRANCH_REF = `refs/heads/${VERSION_PR_BRANCH}`;
+function defaultBranchRef(config) {
+	return `refs/heads/${config.defaultBranch}`;
+}
 function readRemoteRef(executor, config, auth, ref) {
 	const result = executor.exec("git", [
 		...auth.args,
@@ -12728,13 +12888,13 @@ function readRemoteRef(executor, config, auth, ref) {
 	return result.stdout.split("\n").find((entry) => entry.trim().endsWith(`\t${ref}`))?.split("	")[0]?.trim() ?? "";
 }
 function isSuperseded(executor, config, auth, baseSha) {
-	const remoteMain = readRemoteRef(executor, config, auth, MAIN_REF);
-	if (remoteMain === null || remoteMain === "" || baseSha === "") {
-		debug(config, "Supersession check: main tip or base commit unreadable -- proceeding");
+	const remoteDefault = readRemoteRef(executor, config, auth, defaultBranchRef(config));
+	if (remoteDefault === null || remoteDefault === "" || baseSha === "") {
+		debug(config, `Supersession check: ${config.defaultBranch} tip or base commit unreadable -- proceeding`);
 		return false;
 	}
-	if (remoteMain === baseSha) return false;
-	log$1.warn(`Superseded release run: this job versioned ${baseSha}, but main has advanced to ${remoteMain}. A newer run is versioning a superset of these changesets -- skipping to avoid overwriting its version commit on ${VERSION_PR_BRANCH}.`);
+	if (remoteDefault === baseSha) return false;
+	log$1.warn(`Superseded release run: this job versioned ${baseSha}, but ${config.defaultBranch} has advanced to ${remoteDefault}. A newer run is versioning a superset of these changesets -- skipping to avoid overwriting its version commit on ${versionPrBranch(config.defaultBranch)}.`);
 	return true;
 }
 const DATELESS_VERSION_RE = /^## (\d+\.\d+\.\d+(?:-[^\s)]+)?)$/gm;
@@ -12821,12 +12981,14 @@ function buildPrContent(executor, cwd, packagesBefore) {
 async function runVersionMode(executor, config) {
 	log$1.info("Changesets detected -- versioning packages");
 	const auth = buildGitAuth(config);
+	const branch = versionPrBranch(config.defaultBranch);
+	const branchRef = `refs/heads/${branch}`;
 	const baseShaResult = executor.exec("git", ["rev-parse", "HEAD"], { cwd: config.cwd });
 	const baseSha = baseShaResult.exitCode === 0 ? baseShaResult.stdout.trim() : "";
-	const leaseTip = config.dryRun ? null : readRemoteRef(executor, config, auth, BRANCH_REF);
-	if (leaseTip === null && !config.dryRun) throw new FatalError(`Could not read the current tip of ${VERSION_PR_BRANCH} from the remote, so this run cannot take a push lease. Refusing to force-push without one -- an unleased push is what allows a concurrent run's version commit to be silently discarded.`);
+	const leaseTip = config.dryRun ? null : readRemoteRef(executor, config, auth, branchRef);
+	if (leaseTip === null && !config.dryRun) throw new FatalError(`Could not read the current tip of ${branch} from the remote, so this run cannot take a push lease. Refusing to force-push without one -- an unleased push is what allows a concurrent run's version commit to be silently discarded.`);
 	debug(config, `Base commit: ${baseSha || "(unknown)"}`);
-	debug(config, `Lease tip for ${VERSION_PR_BRANCH}: ${leaseTip === null ? "(dry-run)" : leaseTip || "(absent)"}`);
+	debug(config, `Lease tip for ${branch}: ${leaseTip === null ? "(dry-run)" : leaseTip || "(absent)"}`);
 	const packagesBefore = executor.listWorkspacePackages(config.cwd);
 	debug(config, `Packages before versioning: ${packagesBefore.map((pkg) => `${pkg.name}@${pkg.version}`).join(", ") || "(none)"}`);
 	const changesetConfigPath = path.join(config.cwd, ".changeset", "config.json");
@@ -12888,28 +13050,28 @@ async function runVersionMode(executor, config) {
 		pr: "none"
 	};
 	if (leaseTip === null) throw new UnexpectedError("Push lease was never observed on a non-dry-run release");
-	debug(config, `Force-pushing version commit to ${VERSION_PR_BRANCH} (lease: ${leaseTip || "(absent)"})`);
+	debug(config, `Force-pushing version commit to ${branch} (lease: ${leaseTip || "(absent)"})`);
 	const pushResult = executor.exec("git", [
 		...auth.args,
 		"push",
 		auth.url,
-		`HEAD:${BRANCH_REF}`,
-		`--force-with-lease=${BRANCH_REF}:${leaseTip}`
+		`HEAD:${branchRef}`,
+		`--force-with-lease=${branchRef}:${leaseTip}`
 	], { cwd: config.cwd });
 	debugExec(config, "git push", pushResult);
-	if (pushResult.exitCode !== 0) throw new FatalError(`git push to ${VERSION_PR_BRANCH} failed (exit code ${String(pushResult.exitCode)}). If the lease was rejected, the branch moved after this run started (expected ${leaseTip || "the branch to be absent"}) -- another run pushed a version commit, and overwriting it would discard that release. This job fails rather than clobber it.\n${pushResult.stderr || pushResult.stdout}`);
+	if (pushResult.exitCode !== 0) throw new FatalError(`git push to ${branch} failed (exit code ${String(pushResult.exitCode)}). If the lease was rejected, the branch moved after this run started (expected ${leaseTip || "the branch to be absent"}) -- another run pushed a version commit, and overwriting it would discard that release. This job fails rather than clobber it.\n${pushResult.stderr || pushResult.stdout}`);
 	const conn = {
 		serverUrl: config.serverUrl,
 		repository: config.repository,
 		token: config.token
 	};
-	const existingPr = await findOpenPr(executor, conn, VERSION_PR_BRANCH);
-	debug(config, `Existing open PR for ${VERSION_PR_BRANCH}: ${existingPr === null ? "(none)" : `#${String(existingPr)}`}`);
+	const existingPr = await findOpenPr(executor, conn, branch);
+	debug(config, `Existing open PR for ${branch}: ${existingPr === null ? "(none)" : `#${String(existingPr)}`}`);
 	if (existingPr === null) try {
 		await createPr(executor, conn, {
 			title,
-			head: VERSION_PR_BRANCH,
-			base: "main",
+			head: branch,
+			base: config.defaultBranch,
 			body
 		});
 		log$1.info("Created version PR");
@@ -12919,7 +13081,7 @@ async function runVersionMode(executor, config) {
 		};
 	} catch (error) {
 		debug(config, `createPr failed, retrying as update: ${describeError$1(error)}`);
-		const racePr = await findOpenPr(executor, conn, VERSION_PR_BRANCH);
+		const racePr = await findOpenPr(executor, conn, branch);
 		if (racePr === null) throw error;
 		await updatePr(executor, conn, racePr, {
 			title,
@@ -13404,7 +13566,7 @@ const releaseForgejoCommand = defineCommand({
 		const result = await runRelease(buildReleaseConfig({
 			dryRun,
 			verbose: args.verbose === true || isEnvVerbose()
-		}), createRealExecutor$1());
+		}), createRealExecutor$1(), processCiEventSource());
 		out.json(releasePayload(result, dryRun));
 		if (result.mode === "publish") {
 			const outputFile = process.env["GITHUB_OUTPUT"];
@@ -13445,6 +13607,7 @@ function buildReleaseConfig(flags) {
 	return {
 		...resolved.conn,
 		cwd: process.cwd(),
+		defaultBranch: readConfiguredDefaultBranch(process.cwd()),
 		dryRun: flags.dryRun ?? false,
 		verbose: flags.verbose ?? false
 	};
@@ -13458,15 +13621,16 @@ function getCurrentBranch(executor, cwd) {
 		"HEAD"
 	], { cwd }).stdout.trim();
 }
-async function runRelease(config, executor) {
+async function runRelease(config, executor, ciEvent) {
 	debug(config, `Repository: ${config.repository} on ${config.serverUrl}`);
 	debug(config, `Config: dryRun=${String(config.dryRun)}`);
 	const branch = getCurrentBranch(executor, config.cwd);
 	debug(config, `Current branch: ${branch}`);
-	if (branch !== "main") {
-		debug(config, `Skipping release on non-main branch: ${branch}`);
+	if (branch !== config.defaultBranch) {
+		debug(config, `Skipping release: ${branch} is not the configured default branch (${config.defaultBranch})`);
 		return { mode: "none" };
 	}
+	refuseForgeDefaultMismatch(config.defaultBranch, ciEvent, "release:changesets");
 	const identity = await configureGitIdentity(executor, "forgejo", config.cwd, config);
 	log$1.info(`Git identity: ${identity.name} <${identity.email}>`);
 	const changesetFiles = executor.listChangesetFiles(config.cwd);
@@ -13668,7 +13832,7 @@ const releaseTriggerCommand = defineCommand({
 	args: {
 		ref: {
 			type: "string",
-			description: "Git ref to trigger on (default: main)",
+			description: "Git ref to trigger on (default: .tooling.json#defaultBranch, else main)",
 			required: false
 		},
 		bump: {
@@ -13688,7 +13852,7 @@ const releaseTriggerCommand = defineCommand({
 	},
 	async run({ args }) {
 		const out = createCliOutput(args.json === true);
-		const ref = args.ref ?? "main";
+		const ref = args.ref ?? readConfiguredDefaultBranch(process.cwd());
 		const inputs = {};
 		if (args.bump) inputs["bump"] = args.bump;
 		if (args.prerelease) inputs["prerelease"] = args.prerelease;
@@ -13705,33 +13869,131 @@ const releaseTriggerCommand = defineCommand({
 	}
 });
 //#endregion
-//#region ../forgejo/src/issue-comments.ts
-const CommentResponseSchema = z.object({
+//#region ../forgejo/src/label-provisioning.ts
+const LabelSchema$1 = z.object({
 	id: z.number(),
-	body: z.string().nullish(),
-	user: z.object({ login: z.string() }).nullish(),
-	created_at: z.string(),
-	updated_at: z.string().nullish(),
-	html_url: z.string().nullish(),
-	assets: AttachmentListSchema.nullish()
+	name: z.string(),
+	color: z.string().optional(),
+	description: z.string().optional(),
+	exclusive: z.boolean().optional()
 });
-const CommentListSchema = z.array(CommentResponseSchema);
-function parseCommentOrThrow(raw) {
-	const parsed = CommentResponseSchema.safeParse(raw);
-	if (!parsed.success) throw new UnexpectedError(`Unexpected comment response: ${parsed.error.message}`);
-	return parsed.data;
+const LabelListSchema = z.array(LabelSchema$1);
+const LABELS_PAGE_SIZE = 100;
+const LABELS_MAX_PAGES = 20;
+async function fetchAllForgejoLabels(executor, conn) {
+	const labels = [];
+	for (let page = 1; page <= LABELS_MAX_PAGES; page++) {
+		const res = await executor.fetch(`${conn.serverUrl}/api/v1/repos/${conn.repository}/labels?limit=${String(LABELS_PAGE_SIZE)}&page=${String(page)}`, { headers: authHeaders$2(conn) });
+		if (!res.ok) await throwForgejoFailure(res, {
+			verb: "list labels",
+			resource: conn.repository
+		}, repoNotFoundMessage(conn));
+		const parsed = LabelListSchema.safeParse(await res.json());
+		if (!parsed.success) throw new UnexpectedError(`Unexpected label-list response: ${parsed.error.message}`);
+		labels.push(...parsed.data);
+		if (parsed.data.length < LABELS_PAGE_SIZE) break;
+	}
+	return labels;
 }
-function parseCommentListOrThrow(raw) {
-	const parsed = CommentListSchema.safeParse(raw);
-	if (!parsed.success) throw new UnexpectedError(`Unexpected comment-list response: ${parsed.error.message}`);
-	return parsed.data;
+async function resolveLabelIds(executor, conn, names) {
+	if (names.length === 0) return [];
+	const labels = await fetchAllForgejoLabels(executor, conn);
+	return names.map((name) => {
+		const match = labels.find((label) => label.name === name);
+		if (match === void 0) {
+			const known = labels.map((label) => label.name).join(", ");
+			throw new FatalError(`No label named "${name}" found among the repository's labels in ${conn.repository} (organization-level labels are not searched). Known labels: ${known}`);
+		}
+		return match.id;
+	});
 }
-function normalizeComment(raw) {
-	return {
-		id: raw.id,
-		author: raw.user?.login ?? "",
-		createdAt: raw.created_at,
-		updatedAt: raw.updated_at ?? raw.created_at,
+const LabelSpecSchema = z.strictObject({
+	name: z.string().min(1),
+	color: z.string().regex(/^#[0-9a-fA-F]{6}$/),
+	description: z.string(),
+	exclusive: z.boolean().optional()
+});
+z.record(z.string(), z.array(LabelSpecSchema));
+//#endregion
+//#region ../forgejo/src/issue-labels.ts
+const TimelineEntrySchema = z.object({
+	id: z.number(),
+	type: z.string(),
+	body: z.string().nullish(),
+	created_at: z.string(),
+	label: z.object({ name: z.string() }).nullish(),
+	user: z.object({ login: z.string() }).nullish()
+});
+z.array(TimelineEntrySchema).nullable();
+async function resolveLabelId(executor, conn, name, labelIds) {
+	const cached = labelIds?.get(name);
+	if (cached !== void 0) return cached;
+	const [id] = await resolveLabelIds(executor, conn, [name]);
+	if (id === void 0) throw new UnexpectedError(`Label id resolution returned nothing for "${name}"`);
+	return id;
+}
+async function addForgejoIssueLabel(executor, conn, number, name, labelIds) {
+	const id = await resolveLabelId(executor, conn, name, labelIds);
+	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels`, {
+		method: "POST",
+		headers: jsonHeaders(conn),
+		body: JSON.stringify({ labels: [id] })
+	}, { idempotent: true });
+	if (!res.ok) await throwForgejoFailure(res, {
+		verb: "add label",
+		resource: `#${String(number)}`
+	}, issueNotFoundMessage(conn, number));
+}
+async function removeForgejoIssueLabel(executor, conn, number, name, labelIds) {
+	const id = await resolveLabelId(executor, conn, name, labelIds);
+	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels/${String(id)}`, {
+		method: "DELETE",
+		headers: authHeaders$2(conn)
+	}, { idempotent: true });
+	if (!res.ok) await throwForgejoFailure(res, {
+		verb: "remove label",
+		resource: `#${String(number)}`
+	}, issueNotFoundMessage(conn, number));
+}
+async function replaceForgejoIssueLabels(executor, conn, number, labelIds) {
+	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels`, {
+		method: "PUT",
+		headers: jsonHeaders(conn),
+		body: JSON.stringify({ labels: labelIds })
+	}, { idempotent: true });
+	if (!res.ok) await throwForgejoFailure(res, {
+		verb: "replace labels",
+		resource: `#${String(number)}`
+	}, issueNotFoundMessage(conn, number));
+}
+//#endregion
+//#region ../forgejo/src/issue-comments.ts
+const CommentResponseSchema = z.object({
+	id: z.number(),
+	body: z.string().nullish(),
+	user: z.object({ login: z.string() }).nullish(),
+	created_at: z.string(),
+	updated_at: z.string().nullish(),
+	html_url: z.string().nullish(),
+	assets: AttachmentListSchema.nullish()
+});
+const CommentListSchema = z.array(CommentResponseSchema);
+function parseCommentOrThrow(raw) {
+	const parsed = CommentResponseSchema.safeParse(raw);
+	if (!parsed.success) throw new UnexpectedError(`Unexpected comment response: ${parsed.error.message}`);
+	return parsed.data;
+}
+function parseCommentListOrThrow(raw) {
+	const parsed = CommentListSchema.safeParse(raw);
+	if (!parsed.success) throw new UnexpectedError(`Unexpected comment-list response: ${parsed.error.message}`);
+	return parsed.data;
+}
+function normalizeComment(raw) {
+	return {
+		id: raw.id,
+		author: raw.user?.login ?? "",
+		createdAt: raw.created_at,
+		updatedAt: raw.updated_at ?? raw.created_at,
 		body: raw.body ?? "",
 		...raw.html_url === void 0 || raw.html_url === null ? {} : { url: raw.html_url },
 		attachments: (raw.assets ?? []).map(normalizeAttachment)
@@ -13780,52 +14042,6 @@ async function addForgejoComment(executor, conn, number, body) {
 	return normalizeComment(parseCommentOrThrow(await res.json()));
 }
 //#endregion
-//#region ../forgejo/src/label-provisioning.ts
-const LabelSchema$1 = z.object({
-	id: z.number(),
-	name: z.string(),
-	color: z.string().optional(),
-	description: z.string().optional(),
-	exclusive: z.boolean().optional()
-});
-const LabelListSchema = z.array(LabelSchema$1);
-const LABELS_PAGE_SIZE = 100;
-const LABELS_MAX_PAGES = 20;
-async function fetchAllForgejoLabels(executor, conn) {
-	const labels = [];
-	for (let page = 1; page <= LABELS_MAX_PAGES; page++) {
-		const res = await executor.fetch(`${conn.serverUrl}/api/v1/repos/${conn.repository}/labels?limit=${String(LABELS_PAGE_SIZE)}&page=${String(page)}`, { headers: authHeaders$2(conn) });
-		if (!res.ok) await throwForgejoFailure(res, {
-			verb: "list labels",
-			resource: conn.repository
-		}, repoNotFoundMessage(conn));
-		const parsed = LabelListSchema.safeParse(await res.json());
-		if (!parsed.success) throw new UnexpectedError(`Unexpected label-list response: ${parsed.error.message}`);
-		labels.push(...parsed.data);
-		if (parsed.data.length < LABELS_PAGE_SIZE) break;
-	}
-	return labels;
-}
-async function resolveLabelIds(executor, conn, names) {
-	if (names.length === 0) return [];
-	const labels = await fetchAllForgejoLabels(executor, conn);
-	return names.map((name) => {
-		const match = labels.find((label) => label.name === name);
-		if (match === void 0) {
-			const known = labels.map((label) => label.name).join(", ");
-			throw new FatalError(`No label named "${name}" found among the repository's labels in ${conn.repository} (organization-level labels are not searched). Known labels: ${known}`);
-		}
-		return match.id;
-	});
-}
-const LabelSpecSchema = z.strictObject({
-	name: z.string().min(1),
-	color: z.string().regex(/^#[0-9a-fA-F]{6}$/),
-	description: z.string(),
-	exclusive: z.boolean().optional()
-});
-z.record(z.string(), z.array(LabelSpecSchema));
-//#endregion
 //#region ../forgejo/src/issues.ts
 const IssueResponseSchema = z.object({
 	number: z.number(),
@@ -14271,6 +14487,178 @@ function resolveIssueTransport(executor, cwd, target, injectedToken, signal = nu
 	};
 }
 //#endregion
+//#region src/work-status/labels.ts
+const SCOPE_ORDER = [
+	"agent",
+	"agent-flags",
+	"agent-note",
+	"priority",
+	"other"
+];
+function scopeOf(name) {
+	const separator = name.indexOf("/");
+	if (separator < 0) return "other";
+	const prefix = name.slice(0, separator);
+	if (prefix === "agent" || prefix === "agent-flags" || prefix === "agent-note" || prefix === "priority") return prefix;
+	return "other";
+}
+function groupLabels(names, descriptions) {
+	const groups = [];
+	for (const scope of SCOPE_ORDER) {
+		const inScope = names.filter((name) => scopeOf(name) === scope).toSorted((a, b) => a.localeCompare(b)).map((name) => ({
+			name,
+			description: descriptions.get(name) ?? null
+		}));
+		if (inScope.length === 0) continue;
+		groups.push({
+			scope,
+			labels: inScope
+		});
+	}
+	return groups;
+}
+const RUNNING_LABEL = /^agent\/[a-z-]+-running$/;
+const HAND_AUTHORED_LABEL = "agent-flags/hand-authored";
+function liftedFacts(names) {
+	return {
+		runLive: names.filter((name) => RUNNING_LABEL.test(name)).toSorted(),
+		heldByHand: names.includes(HAND_AUTHORED_LABEL)
+	};
+}
+function labelNamesOf(section) {
+	const names = [];
+	for (const group of [...section.pr, ...section.issue]) for (const label of group.labels) names.push(label.name);
+	return names;
+}
+function ownerOf(names) {
+	const agent = names.filter((name) => name.startsWith("agent/")).toSorted();
+	const running = agent.find((name) => RUNNING_LABEL.test(name));
+	if (running !== void 0) return {
+		owner: "agent",
+		label: running,
+		running: true
+	};
+	if (names.includes("agent-flags/hand-authored")) return { owner: "person" };
+	const held = agent[0];
+	if (held !== void 0) return {
+		owner: "agent",
+		label: held,
+		running: false
+	};
+	return { owner: "unclaimed" };
+}
+//#endregion
+//#region src/work-status/claim.ts
+const HANDOVER_ROUTES = "Claim it from the control panel's \"Claim for hand work\", or remove the agent label by hand and run bst work:start again.";
+function decideClaim(report, enabled) {
+	if (!enabled) return {
+		kind: "answer",
+		exitCode: 0,
+		result: {
+			outcome: "not-agent-repo",
+			reason: "Nothing was claimed: this repository's default branch does not set agent.enabled, so the agent does not work it and there is nothing to claim against."
+		}
+	};
+	if (report.owner === null) return {
+		kind: "answer",
+		exitCode: 1,
+		result: {
+			outcome: "failed",
+			reason: "A label read failed, so a run may be live on this object unseen. Nothing was claimed; retry once the forge read works."
+		}
+	};
+	const held = ownershipOf(report);
+	if (held.kind === "running") return {
+		kind: "answer",
+		exitCode: 1,
+		result: {
+			outcome: "refused",
+			label: held.label,
+			reason: `A run is live on this object (${held.label}); a claim does not stop it.`
+		}
+	};
+	if (held.kind === "person") return {
+		kind: "answer",
+		exitCode: 0,
+		result: { outcome: "already-claimed" }
+	};
+	if (held.kind === "agent") return {
+		kind: "answer",
+		exitCode: 1,
+		result: {
+			outcome: "refused",
+			label: held.label,
+			reason: `The agent holds this object (${held.label}). ${HANDOVER_ROUTES}`
+		}
+	};
+	return { kind: "write" };
+}
+function ownershipOf(report) {
+	if (report.labels.state === "ok") {
+		const ownership = ownerOf(labelNamesOf(report.labels));
+		if (ownership.owner === "agent") return ownership.running ? {
+			kind: "running",
+			label: ownership.label
+		} : {
+			kind: "agent",
+			label: ownership.label
+		};
+		if (ownership.owner === "person") return { kind: "person" };
+		return { kind: "unclaimed" };
+	}
+	if (report.owner === "agent") {
+		const live = report.runLive?.[0];
+		return live === void 0 ? {
+			kind: "agent",
+			label: "an agent label"
+		} : {
+			kind: "running",
+			label: live
+		};
+	}
+	return report.owner === "person" ? { kind: "person" } : { kind: "unclaimed" };
+}
+async function writeClaim(executor, cwd, target, number) {
+	try {
+		const { conn } = requireForgejoTransport(executor, cwd, target, "bst work:start claims work on Forgejo, the forge the agent drives; a GitHub checkout has no agent to hand work to.");
+		const flag = (await fetchAllForgejoLabels(executor, conn)).find((label) => label.name === HAND_AUTHORED_LABEL);
+		if (flag === void 0) return {
+			outcome: "failed",
+			reason: `The forge has no label named ${HAND_AUTHORED_LABEL}. Provision the agent's labels first with bst-agent agent:labels --repo ${conn.repository}, or the control panel's Provision labels.`
+		};
+		await addForgejoIssueLabel(executor, conn, number, HAND_AUTHORED_LABEL, /* @__PURE__ */ new Map([[HAND_AUTHORED_LABEL, flag.id]]));
+		return {
+			outcome: "claimed",
+			label: HAND_AUTHORED_LABEL
+		};
+	} catch (error) {
+		return {
+			outcome: "failed",
+			reason: describeError$1(error)
+		};
+	}
+}
+//#endregion
+//#region src/work-status/consent.ts
+async function readAgentConsent(git, defaultBranch) {
+	const onBranch = await git.show(`origin/${defaultBranch}`, ".tooling.json");
+	if (onBranch !== null) return {
+		enabled: agentEnabledIn(onBranch),
+		source: "default-branch"
+	};
+	return {
+		enabled: agentEnabledIn(readWorkingTree(git.topLevel)),
+		source: "working-tree"
+	};
+}
+function readWorkingTree(topLevel) {
+	try {
+		return readFileSync(path.join(topLevel, ".tooling.json"), "utf8");
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region ../forgejo/src/issue-run.ts
 var NothingToUpdateError = class extends FatalError {
 	constructor() {
@@ -15162,6 +15550,42 @@ async function createWorkGit(executor, cwd) {
 	};
 }
 //#endregion
+//#region src/work-status/prepare.ts
+function tryResolveWorkForge(executor, topLevel, target) {
+	try {
+		return resolveWorkForge(executor, topLevel, target);
+	} catch (error) {
+		return error instanceof Error ? error : new UnexpectedError(String(error));
+	}
+}
+function sameRepository(one, other) {
+	return one.toLowerCase() === other.toLowerCase();
+}
+function refNamesAnotherRepository(checkoutRepository, refRepository) {
+	return new FatalError(`Usage: this command reads this checkout's repository (${checkoutRepository}); the ref names ${refRepository}`);
+}
+async function prepareWorkStatus(refText, cwd) {
+	const ref = refText === "" ? null : parseIssueRef(refText);
+	const executor = createRealExecutor$1();
+	const git = await createWorkGit(executor, cwd);
+	const target = ref?.target;
+	if (target !== void 0) {
+		const checkout = await git.originRepository();
+		if (checkout !== null && !sameRepository(target.repository, checkout)) throw refNamesAnotherRepository(checkout, target.repository);
+	}
+	let forge = tryResolveWorkForge(executor, git.topLevel);
+	if (target !== void 0 && !(forge instanceof Error)) {
+		if (!sameRepository(target.repository, forge.repository)) throw refNamesAnotherRepository(forge.repository, target.repository);
+		forge = tryResolveWorkForge(executor, git.topLevel, target);
+	}
+	return {
+		ref,
+		executor,
+		git,
+		forge
+	};
+}
+//#endregion
 //#region src/docs-check/discover.ts
 const DOCS_ROOT = "docs";
 const RETIRED_DIR = "retired";
@@ -15251,7 +15675,7 @@ function retireDestination(src, verb) {
 	if (dir === DOCS_ROOT && LEGACY_ACTIVE_PATTERN.test(base)) return `${DOCS_ROOT}/${RETIRED_DIR}/${verb}-${base.slice(5)}`;
 	return `${dir}/${RETIRED_DIR}/${base}`;
 }
-function discoverPairs(exec, config) {
+function candidatePairs(exec, config) {
 	const candidates = [];
 	for (const active of [...conventionalActiveDirs(exec), ...config.extraDirs]) candidates.push({
 		active,
@@ -15266,8 +15690,16 @@ function discoverPairs(exec, config) {
 		activePattern: LEGACY_ACTIVE_PATTERN,
 		enforced: isEnforced(DOCS_ROOT, config.enforced)
 	});
+	return candidates;
+}
+function matchableActiveDirs(exec, config) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const pair of candidatePairs(exec, config)) if (exec.readDir(pair.active) !== void 0) seen.add(pair.active);
+	return [...seen].toSorted();
+}
+function discoverPairs(exec, config) {
 	const seen = /* @__PURE__ */ new Set();
-	return candidates.filter((pair) => {
+	return candidatePairs(exec, config).filter((pair) => {
 		if (seen.has(pair.active)) return false;
 		if (!(listDocs(exec, pair.active, pair.activePattern).length > 0 || pair.retiredDirs.some((dir) => listDocs(exec, dir).length > 0))) return false;
 		seen.add(pair.active);
@@ -17416,45 +17848,6 @@ function feedbackSince(comments, headCommitDate, cap, agentLogin) {
 	};
 }
 //#endregion
-//#region src/work-status/labels.ts
-const SCOPE_ORDER = [
-	"agent",
-	"agent-flags",
-	"agent-note",
-	"priority",
-	"other"
-];
-function scopeOf(name) {
-	const separator = name.indexOf("/");
-	if (separator < 0) return "other";
-	const prefix = name.slice(0, separator);
-	if (prefix === "agent" || prefix === "agent-flags" || prefix === "agent-note" || prefix === "priority") return prefix;
-	return "other";
-}
-function groupLabels(names, descriptions) {
-	const groups = [];
-	for (const scope of SCOPE_ORDER) {
-		const inScope = names.filter((name) => scopeOf(name) === scope).toSorted((a, b) => a.localeCompare(b)).map((name) => ({
-			name,
-			description: descriptions.get(name) ?? null
-		}));
-		if (inScope.length === 0) continue;
-		groups.push({
-			scope,
-			labels: inScope
-		});
-	}
-	return groups;
-}
-const RUNNING_LABEL = /^agent\/[a-z-]+-running$/;
-const HAND_AUTHORED_LABEL = "agent-flags/hand-authored";
-function liftedFacts(names) {
-	return {
-		runLive: names.filter((name) => RUNNING_LABEL.test(name)).toSorted(),
-		heldByHand: names.includes(HAND_AUTHORED_LABEL)
-	};
-}
-//#endregion
 //#region src/work-status/report.ts
 const COMMIT_CAP = 20;
 const FEEDBACK_CAP = 20;
@@ -17690,11 +18083,14 @@ function objectSection({ resolved, forgeDown }) {
 	return ok(facts);
 }
 function liftedFactsOf(resolved, forgeDown) {
-	const read = liftedFacts(labelNames([resolved.pr, resolved.issue]));
+	const names = labelNames([resolved.pr, resolved.issue]);
+	const read = liftedFacts(names);
+	const ownership = ownerOf(names);
 	const complete = forgeDown === null && resolved.prFailed === null && resolved.issueFailed === null;
 	return {
 		runLive: complete || read.runLive.length > 0 ? read.runLive : null,
-		heldByHand: complete || read.heldByHand ? read.heldByHand : null
+		heldByHand: complete || read.heldByHand ? read.heldByHand : null,
+		owner: complete || ownership.owner !== "unclaimed" ? ownership.owner : null
 	};
 }
 async function docsSection({ git, docsExtraDirs, resolved }) {
@@ -17810,6 +18206,7 @@ async function buildWorkStatus(deps, ref) {
 		},
 		runLive: lifted.runLive,
 		heldByHand: lifted.heldByHand,
+		owner: lifted.owner,
 		object: await section(() => objectSection(inputs)),
 		docs: await section(() => docsSection(inputs)),
 		labels: await section(() => labelsSection(inputs)),
@@ -17851,13 +18248,22 @@ function heading({ kind, branch, head }) {
 	if (head !== null) named.push(`head ${short(head)}`);
 	return `work:status ${named.join(", ")}`;
 }
-function renderWorkStatus(report) {
+function claimableNumber(report) {
+	if (report.object.state !== "ok") return null;
+	if (report.target.kind === "issue") return report.object.issue?.number ?? null;
+	return report.object.pr?.number ?? report.object.issue?.number ?? null;
+}
+function renderWorkStatus(report, options) {
 	const quiet = nothingInFlight(report);
 	if (quiet !== null) return [heading(report.target), quiet].join("\n");
 	const lines = [heading(report.target)];
 	for (const label of report.runLive ?? []) lines.push(`RUN LIVE: ${label} -- a run is working this object; do not start another.`);
 	if (report.runLive === null || report.heldByHand === null) lines.push("UNKNOWN: whether a run is live or a human holds this -- not every label could be read.");
 	if (report.heldByHand === true) lines.push("HELD BY HAND: agent-flags/hand-authored -- a human claimed this one; do not drive it.");
+	if (options?.agentEnabled === true && report.owner === "unclaimed") {
+		const number = claimableNumber(report);
+		if (number !== null) lines.push(`UNCLAIMED: no agent label and no hand claim -- run \`bst work:start ${String(number)}\` before you work this.`);
+	}
 	lines.push(...block("object", report.object, objectRows));
 	lines.push(...block("docs", report.docs, (value) => {
 		const rows = [`  base ${value.base}`];
@@ -17906,20 +18312,77 @@ function renderWorkStatus(report) {
 	return lines.join("\n");
 }
 //#endregion
-//#region src/commands/work-status.ts
-function tryResolveWorkForge(executor, topLevel, target) {
-	try {
-		return resolveWorkForge(executor, topLevel, target);
-	} catch (error) {
-		return error instanceof Error ? error : new UnexpectedError(String(error));
-	}
-}
-function sameRepository(one, other) {
-	return one.toLowerCase() === other.toLowerCase();
+//#region src/commands/work-start.ts
+function claimLine(result) {
+	if (result.outcome === "claimed") return `claim: claimed -- ${result.label ?? "agent-flags/hand-authored"} is on this object.`;
+	if (result.outcome === "already-claimed") return "claim: already-claimed -- the flag is already on it; nothing was written.";
+	if (result.outcome === "not-agent-repo") return `claim: not-agent-repo -- ${result.reason ?? "nothing was claimed."}`;
+	return `claim: ${result.outcome} -- ${result.reason ?? "nothing was claimed."}`;
 }
-function refNamesAnotherRepository(checkoutRepository, refRepository) {
-	return new FatalError(`Usage: bst work:status reads this checkout's repository (${checkoutRepository}); the ref names ${refRepository}`);
+function claimFailed(result) {
+	return result.outcome === "refused" || result.outcome === "failed";
 }
+const workStartCommand = defineCommand({
+	meta: {
+		name: "work:start",
+		description: "Claim an issue or pull request for hand work: put agent-flags/hand-authored on it so the agent leaves it alone"
+	},
+	args: {
+		ref: {
+			type: "positional",
+			required: true,
+			description: "Issue or pull request number or URL to claim"
+		},
+		json: {
+			type: "boolean",
+			description: "Emit one JSON document: the whole work:status report plus a claim member {outcome, label?, reason?}. outcome is claimed (the flag was written), already-claimed (it was already on the object, nothing written), not-agent-repo (the default branch does not set agent.enabled, nothing written), refused (a live run or an agent label holds it; exit 1), or failed (a read or write could not be done; exit 1). refused and failed carry ok: false and an error member of kind runtime, and the report survives beside them."
+		},
+		verbose: {
+			type: "boolean",
+			description: "Emit detailed debug logging"
+		}
+	},
+	async run({ args }) {
+		const { ref, executor, git, forge } = await prepareWorkStatus(typeof args.ref === "string" ? args.ref.trim() : "", process.cwd());
+		const number = ref?.number;
+		if (number === void 0) throw new FatalError("Usage: bst work:start needs an issue or pull request number or URL");
+		const docs = resolveDocsConfig(git.topLevel);
+		const defaultBranch = resolveDefaultBranch({ cwd: git.topLevel });
+		const report = await buildWorkStatus({
+			git,
+			forge,
+			docsExtraDirs: docs.extraDirs,
+			defaultBranch
+		}, ref);
+		const consent = await readAgentConsent(git, defaultBranch);
+		const decision = decideClaim(report, consent.enabled);
+		let result;
+		let exitCode;
+		if (decision.kind === "write") {
+			result = await writeClaim(executor, git.topLevel, ref?.target, number);
+			exitCode = claimFailed(result) ? 1 : 0;
+		} else {
+			result = decision.result;
+			exitCode = decision.exitCode;
+		}
+		const out = createCliOutput(args.json === true);
+		const failed = claimFailed(result);
+		out.json({
+			ok: !failed,
+			...report,
+			claim: result,
+			...failed ? { error: {
+				kind: "runtime",
+				message: result.reason ?? result.outcome
+			} } : {}
+		});
+		out.text(renderWorkStatus(report, { agentEnabled: consent.enabled }));
+		out.text(claimLine(result));
+		if (exitCode !== 0) process.exitCode = exitCode;
+	}
+});
+//#endregion
+//#region src/commands/work-status.ts
 const workStatusCommand = defineCommand({
 	meta: {
 		name: "work:status",
@@ -17933,7 +18396,7 @@ const workStatusCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: target, runLive, heldByHand (each null when not every label could be read), and six sections (object, docs, labels, feedback, findings, commits), each {state: ok} with its fields, {state: absent, reason} or {state: unavailable, reason}. The output is advice, not a gate: the feedback cutoff is the newest agent run or review comment on the pull request and is approximate, and review comments on diff lines are not in the thread this reads."
+			description: "Emit one JSON document: target, runLive, heldByHand, owner (agent, person or unclaimed; each null when not every label could be read), and six sections (object, docs, labels, feedback, findings, commits), each {state: ok} with its fields, {state: absent, reason} or {state: unavailable, reason}. The output is advice, not a gate: the feedback cutoff is the newest agent run or review comment on the pull request and is approximate, and review comments on diff lines are not in the thread this reads."
 		},
 		verbose: {
 			type: "boolean",
@@ -17941,20 +18404,7 @@ const workStatusCommand = defineCommand({
 		}
 	},
 	async run({ args }) {
-		const refText = typeof args.ref === "string" ? args.ref.trim() : "";
-		const ref = refText === "" ? null : parseIssueRef(refText);
-		const executor = createRealExecutor$1();
-		const git = await createWorkGit(executor, process.cwd());
-		const target = ref?.target;
-		if (target !== void 0) {
-			const checkout = await git.originRepository();
-			if (checkout !== null && !sameRepository(target.repository, checkout)) throw refNamesAnotherRepository(checkout, target.repository);
-		}
-		let forge = tryResolveWorkForge(executor, git.topLevel);
-		if (target !== void 0 && !(forge instanceof Error)) {
-			if (!sameRepository(target.repository, forge.repository)) throw refNamesAnotherRepository(forge.repository, target.repository);
-			forge = tryResolveWorkForge(executor, git.topLevel, target);
-		}
+		const { ref, git, forge } = await prepareWorkStatus(typeof args.ref === "string" ? args.ref.trim() : "", process.cwd());
 		const docs = resolveDocsConfig(git.topLevel);
 		const defaultBranch = resolveDefaultBranch({ cwd: git.topLevel });
 		const report = await buildWorkStatus({
@@ -17963,12 +18413,13 @@ const workStatusCommand = defineCommand({
 			docsExtraDirs: docs.extraDirs,
 			defaultBranch
 		}, ref);
+		const consent = await readAgentConsent(git, defaultBranch);
 		const out = createCliOutput(args.json === true);
 		out.json({
 			ok: true,
 			...report
 		});
-		out.text(renderWorkStatus(report));
+		out.text(renderWorkStatus(report, { agentEnabled: consent.enabled }));
 	}
 });
 //#endregion
@@ -18224,8 +18675,9 @@ const PASSED_VERDICT = {
 	reason: null
 };
 async function mergeVersionPrForgejo(executor, conn, options) {
-	const prNumber = await findOpenPr(executor, conn, VERSION_PR_BRANCH);
-	if (prNumber === null) throw new FatalError(`No open PR found for branch ${VERSION_PR_BRANCH}`);
+	const branch = versionPrBranch(options.defaultBranch);
+	const prNumber = await findOpenPr(executor, conn, branch);
+	if (prNumber === null) throw new FatalError(`No open PR found for branch ${branch}`);
 	const sleep$1 = options.sleep ?? sleep;
 	const recheckDelayMs = envMsOverride(process.env["BST_TEST_VERSION_MERGE_RECHECK_MS"], RECHECK_DELAY_MS);
 	const confirmation = await confirmMergeable(executor, conn, prNumber, {
@@ -18246,12 +18698,12 @@ async function mergeVersionPrForgejo(executor, conn, options) {
 		headSha,
 		mergeBase: decidedFrom.mergeBase,
 		changedFiles: decidedFrom.changedFiles,
-		branch: VERSION_PR_BRANCH,
+		branch,
 		rechecked,
 		verdict: { ...PASSED_VERDICT }
 	};
 	if (options.dryRun) {
-		log$1.info(`[dry-run] Would merge PR #${String(prNumber)} at ${headSha} and delete branch ${VERSION_PR_BRANCH}`);
+		log$1.info(`[dry-run] Would merge PR #${String(prNumber)} at ${headSha} and delete branch ${branch}`);
 		return {
 			...outcome,
 			status: "would-merge"
@@ -18262,7 +18714,7 @@ async function mergeVersionPrForgejo(executor, conn, options) {
 		deleteBranch: true,
 		expectedHeadSha: headSha
 	});
-	log$1.info(`Merged PR #${String(prNumber)} and deleted branch ${VERSION_PR_BRANCH}`);
+	log$1.info(`Merged PR #${String(prNumber)} and deleted branch ${branch}`);
 	return {
 		...outcome,
 		status: "merged"
@@ -18277,16 +18729,17 @@ const GitHubVersionPrSchema = z.object({
 	changedFiles: z.number()
 });
 function mergeVersionPrGitHub(executor, options) {
+	const branch = versionPrBranch(options.defaultBranch);
 	const view = executor.exec("gh", [
 		"pr",
 		"view",
-		VERSION_PR_BRANCH,
+		branch,
 		"--json",
 		"number,state,isDraft,mergeable,headRefOid,changedFiles"
 	], { cwd: process.cwd() });
-	if (view.exitCode !== 0) throw new FatalError(`Failed to read PR for branch ${VERSION_PR_BRANCH}: ${view.stderr || view.stdout || "unknown error"}`);
+	if (view.exitCode !== 0) throw new FatalError(`Failed to read PR for branch ${branch}: ${view.stderr || view.stdout || "unknown error"}`);
 	const parsed = GitHubVersionPrSchema.safeParse(JSON.parse(view.stdout));
-	if (!parsed.success) throw new FatalError(`Unexpected 'gh pr view' response for branch ${VERSION_PR_BRANCH}: ${parsed.error.message}`);
+	if (!parsed.success) throw new FatalError(`Unexpected 'gh pr view' response for branch ${branch}: ${parsed.error.message}`);
 	const data = parsed.data;
 	const emptiness = data.changedFiles === 0 ? "empty" : "non-empty";
 	const mergeable = data.mergeable === "CONFLICTING" ? "conflicted" : "mergeable";
@@ -18305,12 +18758,12 @@ function mergeVersionPrGitHub(executor, options) {
 		headSha,
 		mergeBase: null,
 		changedFiles: data.changedFiles,
-		branch: VERSION_PR_BRANCH,
+		branch,
 		rechecked: false,
 		verdict: { ...PASSED_VERDICT }
 	};
 	if (options.dryRun) {
-		log$1.info(`[dry-run] Would merge PR #${String(data.number)} at ${headSha} and delete branch ${VERSION_PR_BRANCH}`);
+		log$1.info(`[dry-run] Would merge PR #${String(data.number)} at ${headSha} and delete branch ${branch}`);
 		return {
 			...outcome,
 			status: "would-merge"
@@ -18319,14 +18772,14 @@ function mergeVersionPrGitHub(executor, options) {
 	const result = executor.exec("gh", [
 		"pr",
 		"merge",
-		VERSION_PR_BRANCH,
+		branch,
 		"--merge",
 		"--delete-branch",
 		"--match-head-commit",
 		headSha
 	], { cwd: process.cwd() });
 	if (result.exitCode !== 0) throw new FatalError(`Failed to merge PR: ${result.stderr || result.stdout || "unknown error"}`);
-	log$1.info(`Merged changesets PR and deleted branch ${VERSION_PR_BRANCH}`);
+	log$1.info(`Merged changesets PR and deleted branch ${branch}`);
 	return {
 		...outcome,
 		status: "merged"
@@ -18354,7 +18807,14 @@ const releaseMergeCommand = defineCommand({
 		const dryRun = args["dry-run"] === true;
 		const resolved = resolveConnection(process.cwd());
 		const executor = createRealExecutor$1();
-		const result = resolved.type === "forgejo" ? await mergeVersionPrForgejo(executor, resolved.conn, { dryRun }) : mergeVersionPrGitHub(executor, { dryRun });
+		const defaultBranch = readConfiguredDefaultBranch(process.cwd());
+		const result = resolved.type === "forgejo" ? await mergeVersionPrForgejo(executor, resolved.conn, {
+			dryRun,
+			defaultBranch
+		}) : mergeVersionPrGitHub(executor, {
+			dryRun,
+			defaultBranch
+		});
 		out.json(result);
 	}
 });
@@ -20115,7 +20575,7 @@ function composePs(executor, config) {
 //#region src/docker-check/health.ts
 const DOCKER_RUN_START_FAILURE_EXIT_CODE = 125;
 const PROBE_TIMEOUT_SECONDS = "5";
-const PROBE_IMAGE = "curlimages/curl:8.21.0@sha256:7c12af72ceb38b7432ab85e1a265cff6ae58e06f95539d539b654f2cfa64bb13";
+const PROBE_IMAGE = "curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777";
 function getContainerHealth(containers, serviceName) {
 	return containers.find((c) => c.Service === serviceName)?.Health ?? "unknown";
 }
@@ -20814,6 +21274,102 @@ async function runHooksCheck(config) {
 	};
 }
 //#endregion
+//#region src/commands/setup-agent.ts
+const RawToolingConfigSchema = z.record(z.string(), z.unknown());
+function previousState(saved) {
+	const enabled = saved.agent?.enabled;
+	if (enabled === void 0) return "absent";
+	if (enabled === true) return "true";
+	return "false";
+}
+function withAgentEnabled(raw) {
+	const agent = RawToolingConfigSchema.safeParse(raw["agent"]);
+	const block = agent.success ? { ...agent.data } : {};
+	block["enabled"] = true;
+	return {
+		...raw,
+		agent: block
+	};
+}
+const CHANGE_ACTIONS = /* @__PURE__ */ new Set([
+	"created",
+	"updated",
+	"removed",
+	"archived"
+]);
+async function runSetupAgent(targetDir, options) {
+	const saved = loadToolingConfigStrict(targetDir);
+	if (saved === void 0) throw new FatalError(`No .tooling.json in ${targetDir}. Run bst repo:sync first to create one, so the repo's own conventions are chosen before the agent is enabled.`);
+	const previous = previousState(saved);
+	let consent = "already-enabled";
+	if (previous !== "true") {
+		const displayPath = path.join(targetDir, ".tooling.json");
+		let parsedFile;
+		try {
+			parsedFile = JSON.parse(readFileSync(displayPath, "utf8"));
+		} catch (error) {
+			throw new FatalError(`Could not read ${displayPath} as JSON: ${describeError$1(error)}`);
+		}
+		const rawFile = RawToolingConfigSchema.safeParse(parsedFile);
+		if (!rawFile.success) throw new FatalError(`Could not read ${displayPath} as a config object: ${rawFile.error.message}`);
+		const edited = withAgentEnabled(rawFile.data);
+		const content = `${JSON.stringify(edited, null, 2)}\n`;
+		parseToolingConfigStrict(content, displayPath);
+		const context = createContext(mergeWithSavedConfig(buildDefaultConfig(targetDir, {}), saved), async () => "overwrite");
+		context.ctx.write(".tooling.json", context.ctx.format(".tooling.json", content));
+		consent = "written";
+	}
+	if (consent === "written") log$1.success("Set agent.enabled to true in .tooling.json");
+	else log$1.info("agent.enabled is already true");
+	const report = await runUpdateReport(targetDir, {}, { installOutput: options.installOutput });
+	const failed = failedResults(report.results);
+	const changed = report.results.filter((result) => CHANGE_ACTIONS.has(result.action)).map((result) => ({
+		filePath: result.filePath,
+		action: result.action
+	}));
+	let status;
+	if (report.status === "stopped" || failed.length > 0) status = "failed";
+	else if (changed.length > 0) status = "changed";
+	else status = "up-to-date";
+	if (status === "failed") log$1.error("The sync failed. Fix what it reported, then run bst setup:agent again.");
+	else log$1.info("Commit these changes and land them on the default branch; the agent reads consent there within about a minute.");
+	return {
+		dir: targetDir,
+		consent,
+		previous,
+		sync: {
+			status,
+			changed,
+			failed,
+			install: report.install
+		},
+		exitCode: status === "failed" ? 1 : 0
+	};
+}
+const setupAgentCommand = defineCommand({
+	meta: {
+		name: "setup:agent",
+		description: "Enable the agent for this repository: set agent.enabled to true in .tooling.json, then run the same sync as repo:sync, which installs @bensandee/agent-cli and generates the files the agent reads. Commits nothing -- land the change on the default branch yourself."
+	},
+	args: {
+		dir: {
+			type: "positional",
+			valueHint: "dir",
+			description: "Directory to enable (default: current directory)",
+			required: false
+		},
+		json: {
+			type: "boolean",
+			description: "Output the report as JSON: dir, consent, previous, sync { status, changed, failed, install }, exitCode"
+		}
+	},
+	async run({ args }) {
+		const report = await runSetupAgent(path.resolve(args.dir ?? "."), { installOutput: args.json === true || isJsonMode() ? "capture" : "inherit" });
+		createCliOutput(args.json === true).json(report);
+		process.exitCode = report.exitCode;
+	}
+});
+//#endregion
 //#region src/commands/setup-secrets.ts
 function isCancelled(value) {
 	return clack.isCancel(value);
@@ -21758,6 +22314,7 @@ const coverageRecordCommand = defineCommand({
 			});
 			return;
 		}
+		refuseForgeDefaultMismatch(readConfiguredDefaultBranch(targetDir), processCiEventSource(), "coverage:record");
 		const summaryPath = path.join(targetDir, COVERAGE_SUMMARY_FILE);
 		if (!existsSync(summaryPath)) throw new FatalError(`${COVERAGE_SUMMARY_FILE} not found. Run \`pnpm test:coverage\` before \`coverage:record\`.`);
 		const summary = parseV8Summary(readFileSync(summaryPath, "utf-8"));
@@ -23230,6 +23787,7 @@ const healthRecordCommand = defineCommand({
 			});
 			return;
 		}
+		refuseForgeDefaultMismatch(readConfiguredDefaultBranch(targetDir), processCiEventSource(), "health:record");
 		const executor = createRealHealthExecutor(targetDir);
 		const headResult = executor.exec("git", ["rev-parse", "HEAD"], { cwd: targetDir });
 		if (headResult.exitCode !== 0) throw new FatalError(`Failed to resolve HEAD sha: ${headResult.stderr.trim()}`);
@@ -24093,7 +24651,7 @@ function collectViolations(exec, config, opts) {
 		retiredCount += result.retired;
 	}
 	violations.push(...collectSpecRetirementViolations(exec, pairs, config, opts));
-	const activeDirs = pairs.map((pair) => pair.active).toSorted();
+	const activeDirs = matchableActiveDirs(exec, config);
 	const unmatchedEnforced = Array.isArray(config.enforced) ? config.enforced.filter((entry) => !activeDirs.includes(entry)) : [];
 	return {
 		violations,
@@ -24236,7 +24794,7 @@ const docsCheckCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: violations ([{file, rule, message, fix, severity (fatal | advisory)}]), activeCount, retiredCount, pairCount, pass, activeDirs, unmatchedEnforced. When docs are disabled in .tooling.json the document is only enabled (false)."
+			description: "Emit one JSON document: violations ([{file, rule, message, fix, severity (fatal | advisory)}]), activeCount, retiredCount, pairCount, pass, activeDirs, unmatchedEnforced. activeDirs lists every existing doc directory an enforced entry can match, holding docs or not; unmatchedEnforced the .tooling.json#docs.enforced entries that match none of them. When docs are disabled in .tooling.json the document is only enabled (false)."
 		},
 		verbose: {
 			type: "boolean",
@@ -25581,58 +26139,6 @@ const issueDownloadCommand = defineCommand({
 	}
 });
 //#endregion
-//#region ../forgejo/src/issue-labels.ts
-const TimelineEntrySchema = z.object({
-	id: z.number(),
-	type: z.string(),
-	body: z.string().nullish(),
-	created_at: z.string(),
-	label: z.object({ name: z.string() }).nullish(),
-	user: z.object({ login: z.string() }).nullish()
-});
-z.array(TimelineEntrySchema).nullable();
-async function resolveLabelId(executor, conn, name, labelIds) {
-	const cached = labelIds?.get(name);
-	if (cached !== void 0) return cached;
-	const [id] = await resolveLabelIds(executor, conn, [name]);
-	if (id === void 0) throw new UnexpectedError(`Label id resolution returned nothing for "${name}"`);
-	return id;
-}
-async function addForgejoIssueLabel(executor, conn, number, name, labelIds) {
-	const id = await resolveLabelId(executor, conn, name, labelIds);
-	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels`, {
-		method: "POST",
-		headers: jsonHeaders(conn),
-		body: JSON.stringify({ labels: [id] })
-	}, { idempotent: true });
-	if (!res.ok) await throwForgejoFailure(res, {
-		verb: "add label",
-		resource: `#${String(number)}`
-	}, issueNotFoundMessage(conn, number));
-}
-async function removeForgejoIssueLabel(executor, conn, number, name, labelIds) {
-	const id = await resolveLabelId(executor, conn, name, labelIds);
-	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels/${String(id)}`, {
-		method: "DELETE",
-		headers: authHeaders$2(conn)
-	}, { idempotent: true });
-	if (!res.ok) await throwForgejoFailure(res, {
-		verb: "remove label",
-		resource: `#${String(number)}`
-	}, issueNotFoundMessage(conn, number));
-}
-async function replaceForgejoIssueLabels(executor, conn, number, labelIds) {
-	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels`, {
-		method: "PUT",
-		headers: jsonHeaders(conn),
-		body: JSON.stringify({ labels: labelIds })
-	}, { idempotent: true });
-	if (!res.ok) await throwForgejoFailure(res, {
-		verb: "replace labels",
-		resource: `#${String(number)}`
-	}, issueNotFoundMessage(conn, number));
-}
-//#endregion
 //#region ../forgejo/src/issue-run-labels.ts
 async function labelIssue(resolve, request) {
 	const ref = parseIssueRef(request.ref);
@@ -25871,6 +26377,9 @@ var EmptyCommentError = class extends FatalError {
 		super("The comment resolved to empty text.");
 	}
 };
+function rejectEmptyComment(comment) {
+	if (comment !== void 0 && comment.trim() === "") throw new EmptyCommentError();
+}
 var PullRequestStateError = class extends FatalError {
 	number;
 	action;
@@ -25880,20 +26389,35 @@ var PullRequestStateError = class extends FatalError {
 		this.action = action;
 	}
 };
+var NotAPullRequestError = class extends FatalError {
+	number;
+	constructor(number) {
+		super(`#${String(number)} is an issue, not a pull request.`);
+		this.number = number;
+	}
+};
+var StateNotTakenError = class extends FatalError {
+	number;
+	expected;
+	actual;
+	constructor(number, expected, actual) {
+		super(`The forge did not change #${String(number)}: it is still ${actual}, not ${expected}.`);
+		this.number = number;
+		this.expected = expected;
+		this.actual = actual;
+	}
+};
 const TARGET_STATE = {
 	close: "closed",
 	reopen: "open"
 };
-async function setIssueState(resolve, request) {
-	const ref = parseIssueRef(request.ref);
-	const number = requireIssueNumber(ref);
-	if (request.comment !== void 0 && request.comment.trim() === "") throw new EmptyCommentError();
-	const commentGiven = request.comment !== void 0;
-	const { api } = resolve(resolveIssueTarget(ref.target, request.repo));
+async function changeState(api, number, request, subject) {
 	const before = await api.get(number);
-	if (before.isPullRequest) throw new PullRequestStateError(number, request.action);
+	if (subject === "issue" && before.isPullRequest) throw new PullRequestStateError(number, request.action);
+	if (subject === "pull-request" && !before.isPullRequest) throw new NotAPullRequestError(number);
+	const commentGiven = request.comment !== void 0;
 	const targetState = TARGET_STATE[request.action];
-	const buildResult = (url, current, changed, posted) => ({
+	const buildResult = (url, current, changed, posted, merged) => ({
 		number,
 		url,
 		action: request.action,
@@ -25902,20 +26426,32 @@ async function setIssueState(resolve, request) {
 			current
 		},
 		changed,
-		...commentGiven ? { comment: { posted } } : {}
+		...commentGiven ? { comment: { posted } } : {},
+		...merged === void 0 ? {} : { merged }
 	});
-	if (before.state === targetState) return buildResult(before.url, before.state, false, false);
+	if (before.state === targetState) {
+		const merged = subject === "pull-request" ? (await api.pullRequest(number)).merged : void 0;
+		return buildResult(before.url, before.state, false, false, merged);
+	}
 	if (request.dryRun) return buildResult(before.url, targetState, true, true);
 	if (commentGiven) await api.addComment(number, request.comment ?? "");
 	let after;
 	try {
 		after = await api.setState(number, targetState);
+		if (after.state !== targetState) throw new StateNotTakenError(number, targetState, after.state);
 	} catch (error) {
 		if (commentGiven && error instanceof Error) error.message = `The comment on #${String(number)} was already posted; a retry will duplicate it. ` + error.message;
 		throw error;
 	}
 	return buildResult(after.url, after.state, true, true);
 }
+async function setIssueState(resolve, request) {
+	const ref = parseIssueRef(request.ref);
+	const number = requireIssueNumber(ref);
+	rejectEmptyComment(request.comment);
+	const { api } = resolve(resolveIssueTarget(ref.target, request.repo));
+	return changeState(api, number, request, "issue");
+}
 const PAST_TENSE = {
 	close: "Closed",
 	reopen: "Reopened"
@@ -26808,7 +27344,7 @@ async function runCli(config) {
 //#region src/cli-main.ts
 setLogLevel(resolveLogLevel({}));
 setForgejoLogger(log$1);
-const displayVersion = "0.89.1";
+const displayVersion = "0.91.0";
 const bstSubCommands = {
 	"repo:sync": syncCommand,
 	"checks:run": runChecksCommand,
@@ -26831,6 +27367,7 @@ const bstSubCommands = {
 	"hooks:audit": hooksAuditCommand,
 	"hooks:sync": hooksSyncCommand,
 	"setup:secrets": setupSecretsCommand,
+	"setup:agent": setupAgentCommand,
 	"webhook:send": webhookSendCommand,
 	"coverage:summary": coverageSummaryCommand,
 	"coverage:check": coverageCheckCommand,
@@ -26864,7 +27401,8 @@ const bstSubCommands = {
 	"plan:brief": planBriefCommand,
 	"plan:review-package": planReviewPackageCommand,
 	"plan:status": planStatusCommand,
-	"work:status": workStatusCommand
+	"work:status": workStatusCommand,
+	"work:start": workStartCommand
 };
 async function runBstCli(extraSubCommands = {}) {
 	await runCli({