@bensandee/tooling 0.90.0 → 0.91.0

package/dist/bin.mjs

@@ -175,7 +175,7 @@ function loadEnvFileForBin(rawArgs, bin, io = processIo) {
 //#region src/env-file-preload.ts
 const envFileLoad = loadEnvFileForBin(process.argv.slice(2), {
 	name: "bst",
-	version: "0.90.0"
+	version: "0.91.0"
 });
 //#endregion
 //#region ../cli-kit/src/logger.ts
@@ -783,7 +783,7 @@ const LintConfigSchema = z.strictObject({ strictTypeAware: z.boolean().optional(
 const ChecksConfigSchema = z.strictObject({
 	add: z.array(z.string()).optional().meta({ description: "Extra package.json scripts to run as first-class check steps, appended to the built-in list (e.g. ['lint:php']). An added step with no matching script is a hard failure." }),
 	skip: z.array(z.string()).optional().meta({ description: "Check steps to skip, unioned with the built-in CI defaults (never replacing them). Supports glob patterns." }),
-	runOnVersionPr: z.boolean().optional().meta({ description: "Run the CI check job on the changesets version PR (changeset-release/main). Default false: the generated check job is skipped there, because that branch is regenerated on every push to main and main's own run gates the release. Has no effect unless releaseStrategy is changesets." })
+	runOnVersionPr: z.boolean().optional().meta({ description: "Run the CI check job on the changesets version PR (changeset-release/<defaultBranch>). Default false: the generated check job is skipped there, because that branch is regenerated on every push to the default branch and that branch's own run gates the release. Has no effect unless releaseStrategy is changesets." })
 });
 const CoverageConfigSchema = z.strictObject({
 	history: z.enum(["orphan-branch", "none"]).optional().meta({ description: "How coverage history is persisted. 'orphan-branch' (default) appends to a dedicated branch; 'none' disables CI history but keeps the local ratchet." }),
@@ -835,6 +835,16 @@ const TolerantDockerCheckConfigSchema = z.object({
 	...DockerCheckConfigSchema.shape,
 	healthChecks: z.array(tolerantBlock(DeclarativeHealthCheckSchema)).optional()
 });
+const DEFAULT_BRANCH_NAME_PATTERN = /^(?!.*\/\/)(?!.*\.\.)(?!.*\/$)(?!.*\.lock$)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const DefaultBranchNameSchema = z.string().regex(DEFAULT_BRANCH_NAME_PATTERN, "must be a plain branch name: ASCII letters, digits, '.', '_', '-' and '/', starting with a letter or digit, with no '//', '..', trailing '/', or '.lock' suffix");
+const AgentEnabledSliceSchema = z.looseObject({ agent: z.looseObject({ enabled: z.boolean().optional() }).optional() });
+function agentEnabledIn(raw) {
+	try {
+		return parseToolingConfigSlice(raw, AgentEnabledSliceSchema, { block: "agent" })?.agent?.enabled === true;
+	} catch {
+		return false;
+	}
+}
 //#endregion
 //#region src/utils/stack.ts
 const IGNORED_DIRS = /* @__PURE__ */ new Set([
@@ -1700,7 +1710,7 @@ const LintSweepConfigSchema = z.strictObject({
 });
 const AgentEgressConfigSchema = z.strictObject({ browseHosts: z.array(z.string().min(1)).optional().meta({ description: "Host patterns this repo's agent containers may fetch from, on top of the hosts every run needs: an exact host (`fastdl.mongodb.org`) or a wildcard over its leftmost label (`*.example.com`). No ports. These join the browse lane, which serves GET and HEAD only." }) });
 const AgentConfigSchema = z.strictObject({
-	enabled: z.boolean().optional().meta({ description: "The repo's explicit consent to the agent (default false). Only `true`, read from the repo's **default branch**, lets the agent work the repo: claim units, run sweeps, recover orphans, merge, act on a chat proposal or start a new spec. A missing key, `false`, a missing `.tooling.json` or a read that fails all mean not enabled, and the answer is re-read within about a minute. Every other `agent.*` key below has no effect without this one; `repo:sync` warns when the block sets one of them and this key is not `true`. Where this is `true`, `repo:sync` also installs `@bensandee/agent-cli`. Provisioning the agent's labels is not consent, and is never gated by this key." }),
+	enabled: z.boolean().optional().meta({ description: "The repo's explicit consent to the agent (default false). Only `true`, read from the repo's **default branch**, lets the agent work the repo: claim units, run sweeps, recover orphans, merge, act on a chat proposal or start a new spec. A missing key, `false`, a missing `.tooling.json` or a read that fails all mean not enabled, and the answer is re-read within about a minute. Every other `agent.*` key below has no effect without this one; `repo:sync` warns when the block sets one of them and this key is not `true`. Where this is `true`, `repo:sync` also installs `@bensandee/agent-cli`. `bst setup:agent` sets it to true and runs the sync. Provisioning the agent's labels is not consent, and is never gated by this key." }),
 	autonomy: z.boolean().optional().meta({ description: "Opt into interior autonomy (default false). When a phase's latest rationale reports readiness \"ready\" with an empty openQuestions[] and the review phase is clean, the agent applies the existing plan -> implement -> review -> park-at-mergeable advance itself instead of parking for a human. Never applies to the design/spec gate or the final merge from the mergeable terminal -- those always wait on a human. Also arms the trunk-red detector: when this repo's default branch combined status settles red, the agent files a tracking issue naming the failing checks and labels it agent/spec, starting the fix through the ordinary spec/plan/implement/review pipeline. It also closes that issue, with a comment, if the default branch recovers on its own before a human acts on it. Also arms the world-changed retrigger sweep: a pull request labelled agent-flags/autopilot that is parked at a -stuck or -failed terminal is re-queued when the fact its park recorded stops being true (the default branch went green, or moved past a conflicted base)." }),
 	preRunRebase: z.boolean().optional().meta({ description: "Merge the current default branch into the work branch before the implement (execute) phase's container starts (default true). A clean merge or an already-up-to-date branch runs the container as is; a conflicting merge is aborted, recorded on the run's status comment, and the run proceeds on the un-synced branch -- it never fails the run. Two consecutive conflicting attempts hand the unit to agent/repair before any container runs; a timeout or a failed merge never counts toward that pair. Set false to skip the attempt entirely for this repo: no fetch, no merge, no abort, and the branch is worked exactly as cloned." }),
 	backlog: z.boolean().optional().meta({ description: "Whether the agent may self-trigger backlog runs consuming this repo's .agent/findings/ ledger (default: on wherever the ledger exists, which only happens in a repo whose own review loop wrote it). A backlog run opens a pull request that fixes or refutes the pending findings; false disarms it, leaving the ledger to accumulate for a human. A run starts only once at least three findings are pending or one is older than seven days." }),
@@ -1769,7 +1779,7 @@ const ToolingConfigSchema = z.strictObject({
 	docs: z.union([z.literal(false), DocsConfigSchema]).optional().meta({ description: "Plan/spec lifecycle gate (`bst docs:check`). Overrides only -- dirs are discovered by convention. Set to false to disable. Violations are advisory until a pair is named in `enforced`." }),
 	deploy: DeployConfigSchema.optional().meta({ description: "Generate a deploy-dispatch step in the release workflow that triggers a workflow_dispatch event in another repo after a successful release. The resolved release token must have rights on `dispatchRepo`." }),
 	pnpmWorkspace: z.literal(false).optional().meta({ description: "Set to false to opt out of pnpm-workspace.yaml management (skips both generation and the repo:sync --check validation)." }),
-	defaultBranch: z.string().optional().meta({ description: "Repository default branch name. Used by `checks:run` to decide when to enable coverage automatically. Default: detected via git (origin/HEAD), falling back to 'main'." }),
+	defaultBranch: DefaultBranchNameSchema.optional().meta({ description: "Repository default branch name, B. Drives the generated CI `on.push` trigger and every default-branch gate in `ci.yml` and `release.yml`, the release path (`release:changesets`, the version PR, `release:trigger`) and `checks:run`'s coverage gate. Generated output uses 'main' when unset; `checks:run` still falls back to `origin/HEAD`. Must be a plain branch name: ASCII letters, digits, '.', '_', '-' and '/'." }),
 	unmanagedDevDependencies: UnmanagedDevDependenciesSchema.optional().meta({ description: "devDependency names repo:sync must never add or re-pin. Escape hatch for holding a tooling-managed dep (oxlint, vitest, knip, ...) at a deliberately off-canonical version; without it, repo:sync raises any managed devDep whose version has drifted below the canonical pin." }),
 	stack: StackSchema.optional().meta({ description: "Whether the repo has TS/JS source. Detected from source evidence; TypeScript is never inferred from absence." }),
 	builder: z.enum([
@@ -1786,6 +1796,7 @@ const ToolingConfigSchema = z.strictObject({
 });
 const TolerantToolingConfigSchema = z.object({
 	...ToolingConfigSchema.shape,
+	defaultBranch: z.string().optional(),
 	docker: TolerantDockerMapSchema.optional(),
 	dockerCheck: z.union([z.literal(false), TolerantDockerCheckConfigSchema]).optional(),
 	coverage: z.union([z.literal(false), tolerantBlock(CoverageConfigSchema)]).optional(),
@@ -1831,10 +1842,16 @@ function loadToolingConfig(targetDir) {
 	if (!file) return void 0;
 	return parseConfigFile(file, TolerantToolingConfigSchema);
 }
+function parseToolingConfigStrict(raw, displayPath) {
+	return parseConfigFile({
+		raw,
+		displayPath
+	}, ToolingConfigSchema);
+}
 function loadToolingConfigStrict(targetDir) {
 	const file = readConfigFile(targetDir);
 	if (!file) return void 0;
-	return parseConfigFile(file, ToolingConfigSchema);
+	return parseToolingConfigStrict(file.raw, file.displayPath);
 }
 const OVERRIDE_KEYS = [
 	"structure",
@@ -4449,13 +4466,22 @@ const SETUP_MISE_ACTION_SHA = "ebe622ef0d24c7efec4a5f6093ddb18500900e24";
 function actionsExpr(expr) {
 	return `\${{ ${expr} }}`;
 }
-const MAIN_BRANCH_REF = "refs/heads/main";
-const IS_MAIN_BRANCH = `github.ref == '${MAIN_BRANCH_REF}'`;
-const IS_NOT_MAIN_BRANCH = `github.ref != '${MAIN_BRANCH_REF}'`;
-const IS_MAIN_JOB_ENV = { IS_MAIN: actionsExpr(IS_MAIN_BRANCH) };
+function branchNameLiteral(name) {
+	if (DEFAULT_BRANCH_NAME_PATTERN.test(name)) return name;
+	return name.replace(/'/g, "''");
+}
+function isDefaultBranch(name) {
+	return `github.ref == 'refs/heads/${branchNameLiteral(name)}'`;
+}
+function isNotDefaultBranch(name) {
+	return `github.ref != 'refs/heads/${branchNameLiteral(name)}'`;
+}
+function defaultBranchJobEnv(name) {
+	return { IS_MAIN: actionsExpr(isDefaultBranch(name)) };
+}
 const IS_MAIN_ENV_GUARD = "env.IS_MAIN == 'true'";
-function onlyOnDefaultBranch(condition) {
-	return `${IS_MAIN_BRANCH} && (${condition})`;
+function onlyOnDefaultBranch(name, condition) {
+	return `${isDefaultBranch(name)} && (${condition})`;
 }
 function npmrcAuthKey(registryUrl) {
 	return `${registryUrl.replace(/^https?:/i, "").replace(/\/+$/, "")}/`;
@@ -4860,9 +4886,8 @@ function diagnoseCheckScriptForwardingAt(targetDir) {
 //#endregion
 //#region src/generators/agent-cli-dep.ts
 const AGENT_CLI_PACKAGE = "@bensandee/agent-cli";
-const AgentEnabledSliceSchema = z.looseObject({ agent: z.looseObject({ enabled: z.boolean().optional() }).optional() });
 function agentEnabled(ctx) {
-	return parseToolingConfigSlice(ctx.read(".tooling.json"), AgentEnabledSliceSchema, { block: "agent" })?.agent?.enabled === true;
+	return agentEnabledIn(ctx.read(".tooling.json"));
 }
 function wantsAgentCli(ctx) {
 	if (!agentEnabled(ctx)) return false;
@@ -5408,9 +5433,9 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...rootDevDeps(ctx.config) };
 	if (!isMonorepo) Object.assign(devDeps, perPackageDevDeps(ctx.config));
 	if (ctx.config.stack !== "none" || ctx.config.ci === "forgejo") devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.15.0";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.90.0";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.91.0";
 	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.17.0";
-	if (wantsAgentCli(ctx)) devDeps[AGENT_CLI_PACKAGE] = "0.1.1";
+	if (wantsAgentCli(ctx)) devDeps[AGENT_CLI_PACKAGE] = "0.1.2";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
@@ -7332,6 +7357,59 @@ async function generateGitattributes(ctx) {
 	};
 }
 //#endregion
+//#region src/default-branch.ts
+const DEFAULT_BRANCH = "main";
+const DefaultBranchSliceSchema = z.object({ defaultBranch: z.union([z.literal(""), DefaultBranchNameSchema]).optional() });
+function configuredDefaultBranch(raw) {
+	const configured = parseToolingConfigSlice(raw, DefaultBranchSliceSchema, { block: "defaultBranch" })?.defaultBranch;
+	if (configured === void 0 || configured === "") return DEFAULT_BRANCH;
+	return configured;
+}
+function readConfiguredDefaultBranch(dir) {
+	const configPath = path.join(dir, ".tooling.json");
+	if (!existsSync(configPath)) return DEFAULT_BRANCH;
+	let raw;
+	try {
+		raw = readFileSync(configPath, "utf-8");
+	} catch (error) {
+		throw new FatalError(`Cannot read ${configPath}: ${describeError$1(error)}`, { cause: error });
+	}
+	return configuredDefaultBranch(raw);
+}
+function processCiEventSource() {
+	return {
+		env: process.env,
+		readFile: (absolutePath) => {
+			try {
+				return readFileSync(absolutePath, "utf-8");
+			} catch (_error) {
+				return;
+			}
+		}
+	};
+}
+const CiEventSchema = z.object({ repository: z.object({ default_branch: z.string().min(1) }) });
+function ciDefaultBranch(source) {
+	if (source === void 0 || source.env["GITHUB_ACTIONS"] !== "true") return void 0;
+	const eventPath = source.env["GITHUB_EVENT_PATH"];
+	if (eventPath === void 0 || eventPath === "") return void 0;
+	const raw = source.readFile(eventPath);
+	if (raw === void 0 || raw.trim() === "") return void 0;
+	let json;
+	try {
+		json = JSON.parse(raw);
+	} catch (_error) {
+		return;
+	}
+	const result = CiEventSchema.safeParse(json);
+	return result.success ? result.data.repository.default_branch : void 0;
+}
+function refuseForgeDefaultMismatch(configured, source, command) {
+	const reported = ciDefaultBranch(source);
+	if (reported === void 0 || reported === configured) return;
+	throw new FatalError(`${command}: .tooling.json#defaultBranch is "${configured}", but the forge reports "${reported}" as this repository's default branch. Set .tooling.json#defaultBranch to "${reported}" and run bst repo:sync.`);
+}
+//#endregion
 //#region src/generators/release-ci.ts
 const DEFAULT_POST_RELEASE_COMMAND = [
 	"pnpm exec bst webhook:send",
@@ -7351,7 +7429,7 @@ function hookSecretEnv(secrets) {
 	};
 }
 function postReleaseHookStep(opts) {
-	const ifCondition = opts?.condition ?? (opts?.guardMain ? IS_MAIN_BRANCH : void 0);
+	const ifCondition = opts?.condition ?? (opts?.guardMain ? isDefaultBranch(opts.defaultBranch) : void 0);
 	return { step: {
 		name: "Post-release hook",
 		...ifCondition && { if: ifCondition },
@@ -7362,7 +7440,7 @@ function postReleaseHookStep(opts) {
 function postReleaseHookJob(opts) {
 	return {
 		needs: opts.needsJob,
-		if: onlyOnDefaultBranch(opts.publishCondition),
+		if: onlyOnDefaultBranch(opts.defaultBranch, opts.publishCondition),
 		"continue-on-error": true,
 		steps: [...commonSteps(opts.ci), { step: {
 			name: "Post-release hook",
@@ -7506,6 +7584,7 @@ function releaseWorkflowPath(ci) {
 async function generateReleaseCi(ctx) {
 	const filePath = "release-ci";
 	const isGitHub = ctx.config.ci === "github";
+	const defaultBranch = configuredDefaultBranch(ctx.read(".tooling.json"));
 	if (ctx.config.ci === "none" || ctx.config.releaseStrategy === "none") return {
 		filePath,
 		action: "skipped",
@@ -7549,6 +7628,7 @@ async function generateReleaseCi(ctx) {
 	let extraJobs;
 	let jobOutputs;
 	if (ctx.config.releaseStrategy === "release-it") steps.push(postReleaseHookStep({
+		defaultBranch,
 		command: getPostReleaseHookCommand(ctx),
 		secrets: hookSecrets
 	}));
@@ -7558,6 +7638,7 @@ async function generateReleaseCi(ctx) {
 			tag: actionsExpr("steps.release.outputs.tag")
 		};
 		extraJobs = { "post-release-hook": postReleaseHookJob({
+			defaultBranch,
 			ci: ctx.config.ci,
 			needsJob: "release",
 			publishCondition: "needs.release.outputs.pushed == 'true'",
@@ -7573,7 +7654,7 @@ async function generateReleaseCi(ctx) {
 		on,
 		...isGitHub && { permissions: { contents: "write" } },
 		jobName: "release",
-		jobIf: IS_MAIN_BRANCH,
+		jobIf: isDefaultBranch(defaultBranch),
 		...jobOutputs && { jobOutputs },
 		steps,
 		...extraJobs && { extraJobs }
@@ -7604,7 +7685,9 @@ async function generateReleaseCi(ctx) {
 }
 //#endregion
 //#region src/release/version-branch.ts
-const VERSION_PR_BRANCH = "changeset-release/main";
+function versionPrBranch(defaultBranch) {
+	return `changeset-release/${defaultBranch}`;
+}
 //#endregion
 //#region src/generators/ci.ts
 function coverageHistorySteps() {
@@ -7638,7 +7721,7 @@ function healthSteps(includeHistory) {
 		run: "pnpm exec bst health:status --limit 10"
 	} }];
 }
-function changesetsReleaseStep(ci, publishesNpm, npmAuth) {
+function changesetsReleaseStep(ci, publishesNpm, npmAuth, defaultBranch) {
 	if (ci === "github") {
 		const changesetsEnv = {
 			GITHUB_TOKEN: actionsExpr("secrets.RELEASE_TOKEN"),
@@ -7647,7 +7730,7 @@ function changesetsReleaseStep(ci, publishesNpm, npmAuth) {
 		return { step: {
 			id: "release",
 			uses: "changesets/action@v1",
-			if: IS_MAIN_BRANCH,
+			if: isDefaultBranch(defaultBranch),
 			with: {
 				publish: "pnpm changeset publish",
 				version: "pnpm changeset version"
@@ -7665,19 +7748,19 @@ function changesetsReleaseStep(ci, publishesNpm, npmAuth) {
 	return { step: {
 		id: "release",
 		name: "Release",
-		if: IS_MAIN_BRANCH,
+		if: isDefaultBranch(defaultBranch),
 		env: releaseEnv,
 		run: npmAuth.publishRun("pnpm exec bst release:changesets")
 	} };
 }
-function ciConcurrency(ci) {
+function ciConcurrency(ci, defaultBranch) {
 	if (ci === "forgejo") return {
-		group: `ci-${actionsExpr(`${IS_MAIN_BRANCH} && github.sha || github.ref`)}`,
-		"cancel-in-progress": actionsExpr(IS_NOT_MAIN_BRANCH)
+		group: `ci-${actionsExpr(`${isDefaultBranch(defaultBranch)} && github.sha || github.ref`)}`,
+		"cancel-in-progress": actionsExpr(isNotDefaultBranch(defaultBranch))
 	};
 	return {
 		group: `ci-${actionsExpr("github.ref")}`,
-		"cancel-in-progress": actionsExpr(IS_NOT_MAIN_BRANCH)
+		"cancel-in-progress": actionsExpr(isNotDefaultBranch(defaultBranch))
 	};
 }
 function checkSteps(ci, coverageEnabled, emitDockerSweepStep) {
@@ -7708,6 +7791,7 @@ async function generateCi(ctx) {
 		action: "skipped",
 		description: "CI workflow not requested"
 	};
+	const defaultBranch = configuredDefaultBranch(ctx.read(".tooling.json"));
 	const isGitHub = ctx.config.ci === "github";
 	const isForgejo = !isGitHub;
 	const isChangesets = ctx.config.releaseStrategy === "changesets";
@@ -7722,7 +7806,7 @@ async function generateCi(ctx) {
 	const hasAssets = isChangesets && (hasReleaseAssets(ctx) || hasVersionStamp(ctx));
 	const host = hasDocker ? resolveGenTimeHost(ctx) : null;
 	const publishedIf = "steps.release.outputs.published == 'true'";
-	const publishedOnMainIf = onlyOnDefaultBranch(publishedIf);
+	const publishedOnDefaultIf = onlyOnDefaultBranch(defaultBranch, publishedIf);
 	const githubChangesetsDeriveTagStep = { step: {
 		name: "Derive release tag",
 		id: "derive-tag",
@@ -7743,17 +7827,17 @@ async function generateCi(ctx) {
 		...checkSteps(ctx.config.ci, coverage.enabled, hasDockerPackages(ctx)),
 		...emitCoverageSteps ? coverageHistorySteps() : [],
 		...healthSteps(emitHealthHistory),
-		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm, npmAuth)] : [],
+		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm, npmAuth, defaultBranch)] : [],
 		...isChangesets && isGitHub ? [githubChangesetsDeriveTagStep] : [],
 		...hasAssets ? [{ step: {
 			name: "Upload Release Assets",
-			if: publishedOnMainIf,
+			if: publishedOnDefaultIf,
 			env: releaseEnv,
 			run: "pnpm exec bst release:assets"
 		} }] : [],
 		...hasDocker ? [{ step: {
 			name: "Publish Docker images",
-			if: publishedOnMainIf,
+			if: publishedOnDefaultIf,
 			env: dockerPublishEnv(host),
 			run: "pnpm exec bst docker:publish"
 		} }] : [],
@@ -7761,7 +7845,7 @@ async function generateCi(ctx) {
 			deploy,
 			packageName: ctx.config.name,
 			releaseEnv,
-			condition: publishedOnMainIf,
+			condition: publishedOnDefaultIf,
 			secrets: hookSecrets
 		})] : []
 	];
@@ -7773,6 +7857,7 @@ async function generateCi(ctx) {
 			tag: changesetsTagOutputExpr
 		};
 		extraJobs = { "post-release-hook": postReleaseHookJob({
+			defaultBranch,
 			ci: ctx.config.ci,
 			needsJob: "check",
 			publishCondition: "needs.check.outputs.published == 'true'",
@@ -7781,7 +7866,7 @@ async function generateCi(ctx) {
 			secrets: hookSecrets
 		}) };
 	}
-	const checkJobEnv = emitCoverageSteps || emitHealthHistory ? IS_MAIN_JOB_ENV : {};
+	const checkJobEnv = emitCoverageSteps || emitHealthHistory ? defaultBranchJobEnv(defaultBranch) : {};
 	const checksSlice = parseToolingConfigSlice(ctx.read(".tooling.json"), z.object({ checks: ChecksConfigSchema.optional() }), { block: "checks" });
 	const skipOnVersionPr = isChangesets && checksSlice?.checks?.runOnVersionPr !== true;
 	const content = buildWorkflowYaml({
@@ -7789,16 +7874,16 @@ async function generateCi(ctx) {
 		name: "CI",
 		on: {
 			push: {
-				branches: ["main"],
+				branches: [defaultBranch],
 				"tags-ignore": ["**"]
 			},
 			pull_request: null
 		},
 		...isGitHub && (emitCoverageSteps || emitHealthHistory) && { permissions: { contents: "write" } },
 		enableEmailNotifications: isForgejo,
-		...isChangesets && { concurrency: ciConcurrency(ctx.config.ci) },
+		...isChangesets && { concurrency: ciConcurrency(ctx.config.ci, defaultBranch) },
 		jobName: "check",
-		...skipOnVersionPr && { jobIf: `github.head_ref != 'changeset-release/main'` },
+		...skipOnVersionPr && { jobIf: `github.head_ref != '${versionPrBranch(defaultBranch)}'` },
 		...Object.keys(checkJobEnv).length > 0 && { jobEnv: checkJobEnv },
 		...jobOutputs && { jobOutputs },
 		steps,
@@ -8495,7 +8580,7 @@ async function generateReleaseIt(ctx) {
 }
 //#endregion
 //#region src/generators/changesets.ts
-function buildConfig$2() {
+function buildConfig$2(defaultBranch) {
 	return {
 		$schema: "https://unpkg.com/@changesets/config@3.1.1/schema.json",
 		changelog: "@changesets/cli/changelog",
@@ -8503,7 +8588,7 @@ function buildConfig$2() {
 		fixed: [],
 		linked: [],
 		access: "public",
-		baseBranch: "main",
+		baseBranch: defaultBranch,
 		updateInternalDependencies: "patch",
 		ignore: []
 	};
@@ -8515,7 +8600,7 @@ async function generateChangesets(ctx) {
 		action: "skipped",
 		description: "Changesets not requested"
 	};
-	const content = JSON.stringify(buildConfig$2(), null, 2) + "\n";
+	const content = JSON.stringify(buildConfig$2(configuredDefaultBranch(ctx.read(".tooling.json"))), null, 2) + "\n";
 	const existing = ctx.read(filePath);
 	if (existing) return {
 		filePath,
@@ -9143,6 +9228,7 @@ const AGENT_RULES_MID = [
 const TS_EXTENSIONLESS_RULE = "- Prefer extensionless imports; if an extension is required, use `.ts` over `.js`.";
 const CHANGESETS_RULE = "- A user-facing change owes a changeset in `.changeset/`, written with the change: `patch` for a fix, `minor` for a feature, naming every package it affects. One file per smallest unit of work.";
 const WORK_STATUS_RULE = "- Before starting or resuming work, run `bst work:status`.";
+const WORK_START_RULE = "- Before starting or resuming work, run `bst work:start <n>`.";
 const FIND_COMMAND_RULE = "- Find a command with `bst --help`, its flags with `bst <command> --help`, before guessing.";
 const FORGEJO_CLI_RULE_SUFFIX = " For Forgejo API work, run `bst-fj --help`.";
 const AGENT_CLI_RULE_SUFFIX = " For the agent's runs and transcripts, run `bst-agent --help`.";
@@ -9163,20 +9249,22 @@ function declaresAgentCli(packageJson) {
 function findCommandRule(packageJson) {
 	return FIND_COMMAND_RULE + (declaresForgejoCli(packageJson) ? FORGEJO_CLI_RULE_SUFFIX : "") + (declaresAgentCli(packageJson) ? AGENT_CLI_RULE_SUFFIX : "");
 }
-const AGENT_RULES_TAIL = [
-	"- The bst-hook blocks a short list of dangerous commands (`.claude/hooks/bst-hook-guide.md` lists them); Claude Code's auto mode judges everything else.",
-	"- Machine-reading a `bst` command? Pass `--json` after the command name (`bst <cmd> --json`, not `bst --json <cmd>`); capture `2>&1` and parse it as one JSON document, failures included as `{ok: false, error}`. `--verbose` breaks this.",
-	WORK_STATUS_RULE,
-	FIND_COMMAND_RULE,
-	"",
-	"#### Git discipline",
-	"",
-	"**The branch you are on is the mode switch.** The bst-hook refuses any command that would move a protected branch, so on one you leave changes unstaged; on a feature branch you commit, push, and open the PR yourself. Pick the mode, announce it, and only ask when it's genuinely ambiguous.",
-	"",
-	"**Small change** -- a fix, a doc edit, a one-file tweak: work on the default branch and leave it unstaged. Don't commit; surface the commit message as text for the user to run.",
-	"",
-	"**Large effort** -- anything that warranted a written plan or spec (spec, then plan, then code, each approved before the next): start it in a worktree (see the Git guide), commit as you go, finish with `bst pr:create`. Push later commits with `bst pr:update`, which rewrites nothing unless given `--title`/`--body`. The one exception: a headless agent run (a spec, plan, execute, or review container) never starts a worktree -- it works and commits on the branch it was started on."
-];
+function agentRulesTail(agentWorked) {
+	return [
+		"- The bst-hook blocks a short list of dangerous commands (`.claude/hooks/bst-hook-guide.md` lists them); Claude Code's auto mode judges everything else.",
+		"- Machine-reading a `bst` command? Pass `--json` after the command name (`bst <cmd> --json`, not `bst --json <cmd>`); capture `2>&1` and parse it as one JSON document, failures included as `{ok: false, error}`. `--verbose` breaks this.",
+		agentWorked ? WORK_START_RULE : WORK_STATUS_RULE,
+		FIND_COMMAND_RULE,
+		"",
+		"#### Git discipline",
+		"",
+		"**The branch you are on is the mode switch.** The bst-hook refuses any command that would move a protected branch, so on one you leave changes unstaged; on a feature branch you commit, push, and open the PR yourself. Pick the mode, announce it, and only ask when it's genuinely ambiguous.",
+		"",
+		"**Small change** -- a fix, a doc edit, a one-file tweak: work on the default branch and leave it unstaged. Don't commit; surface the commit message as text for the user to run.",
+		"",
+		"**Large effort** -- anything that warranted a written plan or spec (spec, then plan, then code, each approved before the next): start it in a worktree (see the Git guide), commit as you go, finish with `bst pr:create`. Push later commits with `bst pr:update`, which rewrites nothing unless given `--title`/`--body`. The one exception: a headless agent run (a spec, plan, execute, or review container) never starts a worktree -- it works and commits on the branch it was started on."
+	];
+}
 const COMMENTS_GUIDE_BODY = [
 	"# Comments",
 	"",
@@ -9215,7 +9303,11 @@ const GIT_GUIDE_BODY = [
 	"",
 	"## Claiming work by hand",
 	"",
-	"If the bst agent drives this repo, claim an issue or pull request before you work it by hand, so the agent does not start a run beside you. First check its labels: an `agent/<stage>-running` label means a run is live -- do not start; wait or ask. Otherwise add `agent-flags/hand-authored` (on Forgejo, `bst-fj issue:label <n> agent-flags/hand-authored`, which takes a pull request number too). The flag on either an issue or its pull request holds both. Remove it when you hand the work back, before you add any `agent/` label. If the repo has no such label, no agent drives it; skip this step.",
+	"If the bst agent drives this repo, claim an issue or pull request before you work it by hand, so the agent does not start a run beside you: run `bst work:start <n>`. It prints the same orientation `bst work:status` does and then puts `agent-flags/hand-authored` on the object. It claims only where the repo's default branch sets `agent.enabled: true`, and does nothing anywhere else. **Exit 1 means do not start**: a run is live on the pair, or the agent holds it -- the output names which. Exit 0 means the pair is yours, whether the command wrote the flag or found it there already.",
+	"",
+	"A pull request you open yourself that closes no claimed issue needs its own `bst work:start <n>` once it exists -- the flag on either half of a pair holds both, but there is no pair until something closes something.",
+	"",
+	"Hand the work back with the control panel's **Release to the agent**, or by removing `agent-flags/hand-authored` from both halves. Removing it does not queue anything: the agent picks the object up on its next cycle only if a label or a comment asks it to.",
 	"",
 	"## Issue linking",
 	"",
@@ -9596,13 +9688,13 @@ function guideIndex(guides) {
 	for (const guide of guides.filter((g) => g.enabled)) lines.push(`- Before you ${guide.trigger}: \`${GUIDES_DIR}/${guide.name}\`.`);
 	return lines.join("\n");
 }
-function agentRulesBody(config, guides, packageJson) {
+function agentRulesBody(config, guides, packageJson, agentWorked) {
 	const lines = [...AGENT_RULES_HEAD];
 	if (config.stack === "typescript") lines.push(TS_TYPECAST_RULE);
 	lines.push(...AGENT_RULES_MID);
 	if (config.stack === "typescript") lines.push(TS_EXTENSIONLESS_RULE);
 	if (config.releaseStrategy === "changesets") lines.push(CHANGESETS_RULE);
-	const tail = AGENT_RULES_TAIL.map((line) => line === FIND_COMMAND_RULE ? findCommandRule(packageJson) : line);
+	const tail = agentRulesTail(agentWorked).map((line) => line === FIND_COMMAND_RULE ? findCommandRule(packageJson) : line);
 	lines.push(...tail, "", guideIndex(guides));
 	return lines.join("\n");
 }
@@ -9666,7 +9758,7 @@ function syncClaudeMdFile(ctx, guides) {
 		name: "agent-rules",
 		startMarker: "<!-- @tooling:agent-rules -->",
 		endMarker: "<!-- @tooling:endagent-rules -->",
-		body: agentRulesBody(ctx.config, guides, ctx.packageJson),
+		body: agentRulesBody(ctx.config, guides, ctx.packageJson, agentEnabled(ctx)),
 		enabled: true
 	}, ...RETIRED_BLOCK_NAMES.map((name) => ({
 		name,
@@ -9907,7 +9999,7 @@ function reportFailures(failed, command) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.90.0 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.91.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -10035,7 +10127,7 @@ function logDetectionSummary(ctx) {
 		log$1.info(`Release assets convention detected in ${label} -- emit build artifacts to ${CONVENTION_OUTPUT_DIR}/ (gitignored).`);
 	}
 }
-async function runInit(config, options = {}) {
+async function runInitReport(config, options = {}) {
 	const detected = detectProject(config.targetDir);
 	const { ctx, archivedFiles, sawCrlf } = createContext(config, options.confirmOverwrite ?? (async (relativePath) => {
 		const result = await select({
@@ -10072,7 +10164,10 @@ async function runInit(config, options = {}) {
 	}
 	if (!hasChanges && options.noPrompt) {
 		if (failed.length === 0) log$1.success("Repository is up to date.");
-		return results;
+		return {
+			results,
+			install: "not-run"
+		};
 	}
 	if (results.some((r) => r.action === "archived" && r.filePath.startsWith(".husky/"))) try {
 		execSync("git config --unset core.hooksPath", {
@@ -10091,16 +10186,19 @@ async function runInit(config, options = {}) {
 	if (!options.noPrompt) log$1.info(`Migration prompt written to ${promptPath}`);
 	const packageJsonChanged = results.some((r) => r.filePath === "package.json" && (r.action === "created" || r.action === "updated"));
 	const hasLockfile = ctx.exists("pnpm-lock.yaml");
+	let install = "not-run";
 	if (packageJsonChanged && hasLockfile) {
 		log$1.info("package.json changed -- running pnpm install...");
 		try {
 			execSync("pnpm install", {
 				cwd: config.targetDir,
-				stdio: "inherit",
+				stdio: options.installOutput === "capture" ? "ignore" : "inherit",
 				timeout: 12e4
 			});
+			install = "ran";
 		} catch (_error) {
 			log$1.warn("pnpm install failed -- run it manually");
+			install = "failed";
 		}
 	}
 	if (hasChanges && ctx.exists("package.json")) try {
@@ -10115,7 +10213,13 @@ async function runInit(config, options = {}) {
 		"Run: pnpm check",
 		...!options.noPrompt ? ["Run: claude \"Execute the migration steps in .tooling-migrate.md\""] : []
 	].map((step, i) => `${i + 1}. ${step}`).join("\n"), "Next steps");
-	return results;
+	return {
+		results,
+		install
+	};
+}
+async function runInit(config, options = {}) {
+	return (await runInitReport(config, options)).results;
 }
 //#endregion
 //#region src/docker-check/compose-lint.ts
@@ -10854,34 +10958,6 @@ function repoPrefix(executor, cwd) {
 function ceilingFileNamesAt(prefix) {
 	return HEALTH_CEILING_FILES.map((name) => `${prefix}${name}`);
 }
-function processCiEventSource() {
-	return {
-		env: process.env,
-		readFile: (absolutePath) => {
-			try {
-				return readFileSync(absolutePath, "utf-8");
-			} catch (_error) {
-				return;
-			}
-		}
-	};
-}
-const CiEventSchema = z.object({ repository: z.object({ default_branch: z.string().min(1) }) });
-function ciDefaultBranch(source) {
-	if (source === void 0 || source.env["GITHUB_ACTIONS"] !== "true") return void 0;
-	const eventPath = source.env["GITHUB_EVENT_PATH"];
-	if (eventPath === void 0 || eventPath === "") return void 0;
-	const raw = source.readFile(eventPath);
-	if (raw === void 0 || raw.trim() === "") return void 0;
-	let json;
-	try {
-		json = JSON.parse(raw);
-	} catch (_error) {
-		return;
-	}
-	const result = CiEventSchema.safeParse(json);
-	return result.success ? result.data.repository.default_branch : void 0;
-}
 const DefaultBranchSchema = z.object({ defaultBranch: z.string().optional() });
 function parseDefaultBranchOverride(raw) {
 	if (raw === void 0 || raw.trim() === "") return void 0;
@@ -12036,7 +12112,7 @@ function findInertAgentKeys(saved) {
 function runInertAgentSettingsGate(saved) {
 	const keys = findInertAgentKeys(saved);
 	if (keys.length === 0) return [];
-	log$1.warn(`.tooling.json sets ${keys.map((key) => `agent.${key}`).join(", ")}, but agent.enabled is not true, so the agent ignores them. Set "agent.enabled": true, or remove those keys.`);
+	log$1.warn(`.tooling.json sets ${keys.map((key) => `agent.${key}`).join(", ")}, but agent.enabled is not true, so the agent ignores them. Run \`bst setup:agent\` to enable the agent, or remove those keys.`);
 	return keys;
 }
 function runPublishConfigGate(config, targetDir) {
@@ -12084,6 +12160,18 @@ function warnStaleChecksAdd(config) {
 	if (stale.length === 0) return;
 	log$1.warn(`.tooling.json#checks.add names built-in step(s) checks:run already runs: ${stale.join(", ")}. The entries are deduplicated at run time and do nothing -- remove them.`);
 }
+function warnUnconfiguredDefaultBranch(targetDir, saved, git = defaultGitRunner) {
+	if (saved?.defaultBranch !== void 0) return;
+	const head = git([
+		"symbolic-ref",
+		"--short",
+		"refs/remotes/origin/HEAD"
+	], targetDir);
+	if (head === void 0) return;
+	const name = head.startsWith("origin/") ? head.slice(7) : head;
+	if (name === "" || name === "main") return;
+	log$1.warn(`origin/HEAD names "${name}", but .tooling.json sets no defaultBranch, so the generated CI workflow triggers on "${DEFAULT_BRANCH}" and gates its release steps there. Set .tooling.json#defaultBranch to "${name}" and run bst repo:sync.`);
+}
 function warnCoveredChecksAdd(config, targetDir) {
 	const covered = coveredChecksAddEntries(config, readPackageJson(targetDir)?.scripts ?? {});
 	for (const entry of covered) log$1.warn(`.tooling.json#checks.add entry "${entry.name}" is already run by the "${entry.coveredBy}" step's script ("${entry.fragment}"), so every pipeline run executes it twice. Remove the add entry, or drop the inline invocation from the "${entry.coveredBy}" script.`);
@@ -12203,26 +12291,14 @@ function checkDeclaredToolsActive(targetDir, declared) {
 }
 function runToolchainGate(targetDir) {
 	const miseTomlPath = path.join(targetDir, "mise.toml");
-	if (!existsSync(miseTomlPath)) return {
-		failures: 0,
-		warned: false
-	};
+	if (!existsSync(miseTomlPath)) return 0;
 	if (miseIsAbsent(targetDir)) {
-		log$1.warn(`mise.toml declares this repo's toolchain, but mise is not on PATH. Install it (${MISE_INSTALL_URL}), then add \`eval "$(mise activate bash)"\` to ~/.bashrc for interactive shells and \`eval "$(mise activate bash --shims)"\` to ~/.profile, so editors, git hooks, and AI sessions get the same tools.`);
-		return {
-			failures: 0,
-			warned: true
-		};
+		log$1.error(`mise.toml declares this repo's toolchain, but mise is not on PATH. Install it (${MISE_INSTALL_URL}), then add \`eval "$(mise activate bash)"\` to ~/.bashrc for interactive shells and \`eval "$(mise activate bash --shims)"\` to ~/.profile, so editors, git hooks, and AI sessions get the same tools. If this repo's mise.toml has an [env] block, also add the directory your checkouts live in to \`trusted_config_paths\` in ~/.config/mise/config.toml.`);
+		return 1;
 	}
 	const declared = readDeclaredTools(miseTomlPath);
-	if (!declared) return {
-		failures: 0,
-		warned: false
-	};
-	return {
-		failures: checkDeclaredToolsActive(targetDir, declared),
-		warned: false
-	};
+	if (!declared) return 0;
+	return checkDeclaredToolsActive(targetDir, declared);
 }
 //#endregion
 //#region src/commands/repo-sync.ts
@@ -12264,7 +12340,7 @@ const syncCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, toolchain, checkOnlyImages, aptSteps, inertAgentKeys, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
+			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, checkOnlyImages, aptSteps, inertAgentKeys, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
 		}
 	},
 	async run({ args }) {
@@ -12302,40 +12378,59 @@ const syncCommand = defineCommand({
 		})).length > 0) process.exitCode = 1;
 	}
 });
-async function runUpdate(targetDir, flags = {}) {
+async function runUpdateReport(targetDir, flags = {}, options = {}) {
 	const dockerDiscovery = createDockerDiscoveryMemo();
 	const saved = loadToolingConfigStrict(targetDir);
 	if (!saved) {
 		log$1.error("No .tooling.json found. Run `bst repo:sync` first to initialize the project.");
 		process.exitCode = 1;
-		return [];
+		return {
+			status: "stopped",
+			results: [],
+			install: "not-run"
+		};
 	}
 	warnStaleChecksAdd(saved);
+	warnUnconfiguredDefaultBranch(targetDir, saved);
 	warnCoveredChecksAdd(saved, targetDir);
 	runInertAgentSettingsGate(saved);
 	if (runComposeLintGate(targetDir, saved, dockerDiscovery) > 0) {
 		process.exitCode = 1;
-		return [];
+		return {
+			status: "stopped",
+			results: [],
+			install: "not-run"
+		};
 	}
 	const config = mergeWithSavedConfig(buildDefaultConfig(targetDir, flags), saved);
 	runReleaseTargetGate(config, targetDir);
 	runVersionStampGate(saved, targetDir, config.releaseStrategy);
 	if (runPublishConfigGate(config, targetDir) > 0) {
 		process.exitCode = 1;
-		return [];
+		return {
+			status: "stopped",
+			results: [],
+			install: "not-run"
+		};
 	}
-	return runInit(config, {
-		noPrompt: true,
-		confirmOverwrite: async () => "overwrite",
-		dockerDiscovery
-	});
+	return {
+		status: "ran",
+		...await runInitReport(config, {
+			noPrompt: true,
+			confirmOverwrite: async () => "overwrite",
+			dockerDiscovery,
+			installOutput: options.installOutput
+		})
+	};
 }
-function gateFailure(toolchainWarned = false) {
+async function runUpdate(targetDir, flags = {}) {
+	return (await runUpdateReport(targetDir, flags)).results;
+}
+function gateFailure() {
 	return {
 		status: "failed",
 		actionable: [],
 		failed: [],
-		toolchain: { warned: toolchainWarned },
 		checkOnlyImages: [],
 		aptSteps: [],
 		inertAgentKeys: [],
@@ -12344,10 +12439,9 @@ function gateFailure(toolchainWarned = false) {
 	};
 }
 function advisoryWarnCount(advisories) {
-	return (advisories.toolchainWarned ? 1 : 0) + advisories.checkOnlyImages.length + advisories.aptSteps.length + (advisories.inertAgentKeys.length > 0 ? 1 : 0);
+	return advisories.checkOnlyImages.length + advisories.aptSteps.length + (advisories.inertAgentKeys.length > 0 ? 1 : 0);
 }
 function upToDateReport(advisories) {
-	const toolchain = { warned: advisories.toolchainWarned };
 	const warnCount = advisoryWarnCount(advisories);
 	if (warnCount > 0) {
 		if (!isJsonMode()) rawLog$1(formatWarnMarker(warnCount));
@@ -12356,7 +12450,6 @@ function upToDateReport(advisories) {
 		status: "up-to-date",
 		actionable: [],
 		failed: [],
-		toolchain,
 		checkOnlyImages: advisories.checkOnlyImages,
 		aptSteps: advisories.aptSteps,
 		inertAgentKeys: advisories.inertAgentKeys,
@@ -12367,6 +12460,7 @@ function upToDateReport(advisories) {
 async function runCheckReport(targetDir) {
 	const dockerDiscovery = createDockerDiscoveryMemo();
 	const saved = loadToolingConfigStrict(targetDir);
+	warnUnconfiguredDefaultBranch(targetDir, saved);
 	if (saved) {
 		warnStaleChecksAdd(saved);
 		warnCoveredChecksAdd(saved, targetDir);
@@ -12377,13 +12471,8 @@ async function runCheckReport(targetDir) {
 	if (runReleaseTargetGate(config, targetDir)) return gateFailure();
 	if (runVersionStampGate(saved, targetDir, config.releaseStrategy) > 0) return gateFailure();
 	if (runPublishConfigGate(config, targetDir) > 0) return gateFailure();
-	const toolchain = runToolchainGate(targetDir);
-	if (toolchain.failures > 0) return {
-		...gateFailure(),
-		toolchain: { warned: toolchain.warned }
-	};
+	if (runToolchainGate(targetDir) > 0) return gateFailure();
 	const advisories = {
-		toolchainWarned: toolchain.warned,
 		checkOnlyImages: runCheckOnlyImageGate(config, targetDir, dockerDiscovery),
 		aptSteps: runWorkflowAptGate(targetDir),
 		inertAgentKeys: runInertAgentSettingsGate(saved)
@@ -12395,13 +12484,11 @@ async function runCheckReport(targetDir) {
 	reportFailures(failed, "repo:sync");
 	const actionable = actionableResults(results, pendingWrites, targetDir);
 	const advisoryCount = advisoryWarnCount(advisories);
-	const toolchainState = { warned: advisories.toolchainWarned };
 	if (actionable.length === 0 && failed.length === 0) return upToDateReport(advisories);
 	if (actionable.length === 0) return {
 		status: "failed",
 		actionable: [],
 		failed,
-		toolchain: toolchainState,
 		checkOnlyImages: [],
 		aptSteps: [],
 		inertAgentKeys: [],
@@ -12417,7 +12504,6 @@ async function runCheckReport(targetDir) {
 			status: "workflow-drift",
 			actionable,
 			failed: [],
-			toolchain: toolchainState,
 			checkOnlyImages: advisories.checkOnlyImages,
 			aptSteps: advisories.aptSteps,
 			inertAgentKeys: advisories.inertAgentKeys,
@@ -12429,7 +12515,6 @@ async function runCheckReport(targetDir) {
 		status: "drift",
 		actionable,
 		failed,
-		toolchain: toolchainState,
 		checkOnlyImages: [],
 		aptSteps: [],
 		inertAgentKeys: [],
@@ -12789,8 +12874,9 @@ function childOutput(result) {
 }
 //#endregion
 //#region src/release/publish/version.ts
-const MAIN_REF = "refs/heads/main";
-const BRANCH_REF = `refs/heads/${VERSION_PR_BRANCH}`;
+function defaultBranchRef(config) {
+	return `refs/heads/${config.defaultBranch}`;
+}
 function readRemoteRef(executor, config, auth, ref) {
 	const result = executor.exec("git", [
 		...auth.args,
@@ -12802,13 +12888,13 @@ function readRemoteRef(executor, config, auth, ref) {
 	return result.stdout.split("\n").find((entry) => entry.trim().endsWith(`\t${ref}`))?.split("	")[0]?.trim() ?? "";
 }
 function isSuperseded(executor, config, auth, baseSha) {
-	const remoteMain = readRemoteRef(executor, config, auth, MAIN_REF);
-	if (remoteMain === null || remoteMain === "" || baseSha === "") {
-		debug(config, "Supersession check: main tip or base commit unreadable -- proceeding");
+	const remoteDefault = readRemoteRef(executor, config, auth, defaultBranchRef(config));
+	if (remoteDefault === null || remoteDefault === "" || baseSha === "") {
+		debug(config, `Supersession check: ${config.defaultBranch} tip or base commit unreadable -- proceeding`);
 		return false;
 	}
-	if (remoteMain === baseSha) return false;
-	log$1.warn(`Superseded release run: this job versioned ${baseSha}, but main has advanced to ${remoteMain}. A newer run is versioning a superset of these changesets -- skipping to avoid overwriting its version commit on ${VERSION_PR_BRANCH}.`);
+	if (remoteDefault === baseSha) return false;
+	log$1.warn(`Superseded release run: this job versioned ${baseSha}, but ${config.defaultBranch} has advanced to ${remoteDefault}. A newer run is versioning a superset of these changesets -- skipping to avoid overwriting its version commit on ${versionPrBranch(config.defaultBranch)}.`);
 	return true;
 }
 const DATELESS_VERSION_RE = /^## (\d+\.\d+\.\d+(?:-[^\s)]+)?)$/gm;
@@ -12895,12 +12981,14 @@ function buildPrContent(executor, cwd, packagesBefore) {
 async function runVersionMode(executor, config) {
 	log$1.info("Changesets detected -- versioning packages");
 	const auth = buildGitAuth(config);
+	const branch = versionPrBranch(config.defaultBranch);
+	const branchRef = `refs/heads/${branch}`;
 	const baseShaResult = executor.exec("git", ["rev-parse", "HEAD"], { cwd: config.cwd });
 	const baseSha = baseShaResult.exitCode === 0 ? baseShaResult.stdout.trim() : "";
-	const leaseTip = config.dryRun ? null : readRemoteRef(executor, config, auth, BRANCH_REF);
-	if (leaseTip === null && !config.dryRun) throw new FatalError(`Could not read the current tip of ${VERSION_PR_BRANCH} from the remote, so this run cannot take a push lease. Refusing to force-push without one -- an unleased push is what allows a concurrent run's version commit to be silently discarded.`);
+	const leaseTip = config.dryRun ? null : readRemoteRef(executor, config, auth, branchRef);
+	if (leaseTip === null && !config.dryRun) throw new FatalError(`Could not read the current tip of ${branch} from the remote, so this run cannot take a push lease. Refusing to force-push without one -- an unleased push is what allows a concurrent run's version commit to be silently discarded.`);
 	debug(config, `Base commit: ${baseSha || "(unknown)"}`);
-	debug(config, `Lease tip for ${VERSION_PR_BRANCH}: ${leaseTip === null ? "(dry-run)" : leaseTip || "(absent)"}`);
+	debug(config, `Lease tip for ${branch}: ${leaseTip === null ? "(dry-run)" : leaseTip || "(absent)"}`);
 	const packagesBefore = executor.listWorkspacePackages(config.cwd);
 	debug(config, `Packages before versioning: ${packagesBefore.map((pkg) => `${pkg.name}@${pkg.version}`).join(", ") || "(none)"}`);
 	const changesetConfigPath = path.join(config.cwd, ".changeset", "config.json");
@@ -12962,28 +13050,28 @@ async function runVersionMode(executor, config) {
 		pr: "none"
 	};
 	if (leaseTip === null) throw new UnexpectedError("Push lease was never observed on a non-dry-run release");
-	debug(config, `Force-pushing version commit to ${VERSION_PR_BRANCH} (lease: ${leaseTip || "(absent)"})`);
+	debug(config, `Force-pushing version commit to ${branch} (lease: ${leaseTip || "(absent)"})`);
 	const pushResult = executor.exec("git", [
 		...auth.args,
 		"push",
 		auth.url,
-		`HEAD:${BRANCH_REF}`,
-		`--force-with-lease=${BRANCH_REF}:${leaseTip}`
+		`HEAD:${branchRef}`,
+		`--force-with-lease=${branchRef}:${leaseTip}`
 	], { cwd: config.cwd });
 	debugExec(config, "git push", pushResult);
-	if (pushResult.exitCode !== 0) throw new FatalError(`git push to ${VERSION_PR_BRANCH} failed (exit code ${String(pushResult.exitCode)}). If the lease was rejected, the branch moved after this run started (expected ${leaseTip || "the branch to be absent"}) -- another run pushed a version commit, and overwriting it would discard that release. This job fails rather than clobber it.\n${pushResult.stderr || pushResult.stdout}`);
+	if (pushResult.exitCode !== 0) throw new FatalError(`git push to ${branch} failed (exit code ${String(pushResult.exitCode)}). If the lease was rejected, the branch moved after this run started (expected ${leaseTip || "the branch to be absent"}) -- another run pushed a version commit, and overwriting it would discard that release. This job fails rather than clobber it.\n${pushResult.stderr || pushResult.stdout}`);
 	const conn = {
 		serverUrl: config.serverUrl,
 		repository: config.repository,
 		token: config.token
 	};
-	const existingPr = await findOpenPr(executor, conn, VERSION_PR_BRANCH);
-	debug(config, `Existing open PR for ${VERSION_PR_BRANCH}: ${existingPr === null ? "(none)" : `#${String(existingPr)}`}`);
+	const existingPr = await findOpenPr(executor, conn, branch);
+	debug(config, `Existing open PR for ${branch}: ${existingPr === null ? "(none)" : `#${String(existingPr)}`}`);
 	if (existingPr === null) try {
 		await createPr(executor, conn, {
 			title,
-			head: VERSION_PR_BRANCH,
-			base: "main",
+			head: branch,
+			base: config.defaultBranch,
 			body
 		});
 		log$1.info("Created version PR");
@@ -12993,7 +13081,7 @@ async function runVersionMode(executor, config) {
 		};
 	} catch (error) {
 		debug(config, `createPr failed, retrying as update: ${describeError$1(error)}`);
-		const racePr = await findOpenPr(executor, conn, VERSION_PR_BRANCH);
+		const racePr = await findOpenPr(executor, conn, branch);
 		if (racePr === null) throw error;
 		await updatePr(executor, conn, racePr, {
 			title,
@@ -13478,7 +13566,7 @@ const releaseForgejoCommand = defineCommand({
 		const result = await runRelease(buildReleaseConfig({
 			dryRun,
 			verbose: args.verbose === true || isEnvVerbose()
-		}), createRealExecutor$1());
+		}), createRealExecutor$1(), processCiEventSource());
 		out.json(releasePayload(result, dryRun));
 		if (result.mode === "publish") {
 			const outputFile = process.env["GITHUB_OUTPUT"];
@@ -13519,6 +13607,7 @@ function buildReleaseConfig(flags) {
 	return {
 		...resolved.conn,
 		cwd: process.cwd(),
+		defaultBranch: readConfiguredDefaultBranch(process.cwd()),
 		dryRun: flags.dryRun ?? false,
 		verbose: flags.verbose ?? false
 	};
@@ -13532,15 +13621,16 @@ function getCurrentBranch(executor, cwd) {
 		"HEAD"
 	], { cwd }).stdout.trim();
 }
-async function runRelease(config, executor) {
+async function runRelease(config, executor, ciEvent) {
 	debug(config, `Repository: ${config.repository} on ${config.serverUrl}`);
 	debug(config, `Config: dryRun=${String(config.dryRun)}`);
 	const branch = getCurrentBranch(executor, config.cwd);
 	debug(config, `Current branch: ${branch}`);
-	if (branch !== "main") {
-		debug(config, `Skipping release on non-main branch: ${branch}`);
+	if (branch !== config.defaultBranch) {
+		debug(config, `Skipping release: ${branch} is not the configured default branch (${config.defaultBranch})`);
 		return { mode: "none" };
 	}
+	refuseForgeDefaultMismatch(config.defaultBranch, ciEvent, "release:changesets");
 	const identity = await configureGitIdentity(executor, "forgejo", config.cwd, config);
 	log$1.info(`Git identity: ${identity.name} <${identity.email}>`);
 	const changesetFiles = executor.listChangesetFiles(config.cwd);
@@ -13742,7 +13832,7 @@ const releaseTriggerCommand = defineCommand({
 	args: {
 		ref: {
 			type: "string",
-			description: "Git ref to trigger on (default: main)",
+			description: "Git ref to trigger on (default: .tooling.json#defaultBranch, else main)",
 			required: false
 		},
 		bump: {
@@ -13762,7 +13852,7 @@ const releaseTriggerCommand = defineCommand({
 	},
 	async run({ args }) {
 		const out = createCliOutput(args.json === true);
-		const ref = args.ref ?? "main";
+		const ref = args.ref ?? readConfiguredDefaultBranch(process.cwd());
 		const inputs = {};
 		if (args.bump) inputs["bump"] = args.bump;
 		if (args.prerelease) inputs["prerelease"] = args.prerelease;
@@ -13779,6 +13869,104 @@ const releaseTriggerCommand = defineCommand({
 	}
 });
 //#endregion
+//#region ../forgejo/src/label-provisioning.ts
+const LabelSchema$1 = z.object({
+	id: z.number(),
+	name: z.string(),
+	color: z.string().optional(),
+	description: z.string().optional(),
+	exclusive: z.boolean().optional()
+});
+const LabelListSchema = z.array(LabelSchema$1);
+const LABELS_PAGE_SIZE = 100;
+const LABELS_MAX_PAGES = 20;
+async function fetchAllForgejoLabels(executor, conn) {
+	const labels = [];
+	for (let page = 1; page <= LABELS_MAX_PAGES; page++) {
+		const res = await executor.fetch(`${conn.serverUrl}/api/v1/repos/${conn.repository}/labels?limit=${String(LABELS_PAGE_SIZE)}&page=${String(page)}`, { headers: authHeaders$2(conn) });
+		if (!res.ok) await throwForgejoFailure(res, {
+			verb: "list labels",
+			resource: conn.repository
+		}, repoNotFoundMessage(conn));
+		const parsed = LabelListSchema.safeParse(await res.json());
+		if (!parsed.success) throw new UnexpectedError(`Unexpected label-list response: ${parsed.error.message}`);
+		labels.push(...parsed.data);
+		if (parsed.data.length < LABELS_PAGE_SIZE) break;
+	}
+	return labels;
+}
+async function resolveLabelIds(executor, conn, names) {
+	if (names.length === 0) return [];
+	const labels = await fetchAllForgejoLabels(executor, conn);
+	return names.map((name) => {
+		const match = labels.find((label) => label.name === name);
+		if (match === void 0) {
+			const known = labels.map((label) => label.name).join(", ");
+			throw new FatalError(`No label named "${name}" found among the repository's labels in ${conn.repository} (organization-level labels are not searched). Known labels: ${known}`);
+		}
+		return match.id;
+	});
+}
+const LabelSpecSchema = z.strictObject({
+	name: z.string().min(1),
+	color: z.string().regex(/^#[0-9a-fA-F]{6}$/),
+	description: z.string(),
+	exclusive: z.boolean().optional()
+});
+z.record(z.string(), z.array(LabelSpecSchema));
+//#endregion
+//#region ../forgejo/src/issue-labels.ts
+const TimelineEntrySchema = z.object({
+	id: z.number(),
+	type: z.string(),
+	body: z.string().nullish(),
+	created_at: z.string(),
+	label: z.object({ name: z.string() }).nullish(),
+	user: z.object({ login: z.string() }).nullish()
+});
+z.array(TimelineEntrySchema).nullable();
+async function resolveLabelId(executor, conn, name, labelIds) {
+	const cached = labelIds?.get(name);
+	if (cached !== void 0) return cached;
+	const [id] = await resolveLabelIds(executor, conn, [name]);
+	if (id === void 0) throw new UnexpectedError(`Label id resolution returned nothing for "${name}"`);
+	return id;
+}
+async function addForgejoIssueLabel(executor, conn, number, name, labelIds) {
+	const id = await resolveLabelId(executor, conn, name, labelIds);
+	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels`, {
+		method: "POST",
+		headers: jsonHeaders(conn),
+		body: JSON.stringify({ labels: [id] })
+	}, { idempotent: true });
+	if (!res.ok) await throwForgejoFailure(res, {
+		verb: "add label",
+		resource: `#${String(number)}`
+	}, issueNotFoundMessage(conn, number));
+}
+async function removeForgejoIssueLabel(executor, conn, number, name, labelIds) {
+	const id = await resolveLabelId(executor, conn, name, labelIds);
+	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels/${String(id)}`, {
+		method: "DELETE",
+		headers: authHeaders$2(conn)
+	}, { idempotent: true });
+	if (!res.ok) await throwForgejoFailure(res, {
+		verb: "remove label",
+		resource: `#${String(number)}`
+	}, issueNotFoundMessage(conn, number));
+}
+async function replaceForgejoIssueLabels(executor, conn, number, labelIds) {
+	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels`, {
+		method: "PUT",
+		headers: jsonHeaders(conn),
+		body: JSON.stringify({ labels: labelIds })
+	}, { idempotent: true });
+	if (!res.ok) await throwForgejoFailure(res, {
+		verb: "replace labels",
+		resource: `#${String(number)}`
+	}, issueNotFoundMessage(conn, number));
+}
+//#endregion
 //#region ../forgejo/src/issue-comments.ts
 const CommentResponseSchema = z.object({
 	id: z.number(),
@@ -13854,52 +14042,6 @@ async function addForgejoComment(executor, conn, number, body) {
 	return normalizeComment(parseCommentOrThrow(await res.json()));
 }
 //#endregion
-//#region ../forgejo/src/label-provisioning.ts
-const LabelSchema$1 = z.object({
-	id: z.number(),
-	name: z.string(),
-	color: z.string().optional(),
-	description: z.string().optional(),
-	exclusive: z.boolean().optional()
-});
-const LabelListSchema = z.array(LabelSchema$1);
-const LABELS_PAGE_SIZE = 100;
-const LABELS_MAX_PAGES = 20;
-async function fetchAllForgejoLabels(executor, conn) {
-	const labels = [];
-	for (let page = 1; page <= LABELS_MAX_PAGES; page++) {
-		const res = await executor.fetch(`${conn.serverUrl}/api/v1/repos/${conn.repository}/labels?limit=${String(LABELS_PAGE_SIZE)}&page=${String(page)}`, { headers: authHeaders$2(conn) });
-		if (!res.ok) await throwForgejoFailure(res, {
-			verb: "list labels",
-			resource: conn.repository
-		}, repoNotFoundMessage(conn));
-		const parsed = LabelListSchema.safeParse(await res.json());
-		if (!parsed.success) throw new UnexpectedError(`Unexpected label-list response: ${parsed.error.message}`);
-		labels.push(...parsed.data);
-		if (parsed.data.length < LABELS_PAGE_SIZE) break;
-	}
-	return labels;
-}
-async function resolveLabelIds(executor, conn, names) {
-	if (names.length === 0) return [];
-	const labels = await fetchAllForgejoLabels(executor, conn);
-	return names.map((name) => {
-		const match = labels.find((label) => label.name === name);
-		if (match === void 0) {
-			const known = labels.map((label) => label.name).join(", ");
-			throw new FatalError(`No label named "${name}" found among the repository's labels in ${conn.repository} (organization-level labels are not searched). Known labels: ${known}`);
-		}
-		return match.id;
-	});
-}
-const LabelSpecSchema = z.strictObject({
-	name: z.string().min(1),
-	color: z.string().regex(/^#[0-9a-fA-F]{6}$/),
-	description: z.string(),
-	exclusive: z.boolean().optional()
-});
-z.record(z.string(), z.array(LabelSpecSchema));
-//#endregion
 //#region ../forgejo/src/issues.ts
 const IssueResponseSchema = z.object({
 	number: z.number(),
@@ -14345,6 +14487,178 @@ function resolveIssueTransport(executor, cwd, target, injectedToken, signal = nu
 	};
 }
 //#endregion
+//#region src/work-status/labels.ts
+const SCOPE_ORDER = [
+	"agent",
+	"agent-flags",
+	"agent-note",
+	"priority",
+	"other"
+];
+function scopeOf(name) {
+	const separator = name.indexOf("/");
+	if (separator < 0) return "other";
+	const prefix = name.slice(0, separator);
+	if (prefix === "agent" || prefix === "agent-flags" || prefix === "agent-note" || prefix === "priority") return prefix;
+	return "other";
+}
+function groupLabels(names, descriptions) {
+	const groups = [];
+	for (const scope of SCOPE_ORDER) {
+		const inScope = names.filter((name) => scopeOf(name) === scope).toSorted((a, b) => a.localeCompare(b)).map((name) => ({
+			name,
+			description: descriptions.get(name) ?? null
+		}));
+		if (inScope.length === 0) continue;
+		groups.push({
+			scope,
+			labels: inScope
+		});
+	}
+	return groups;
+}
+const RUNNING_LABEL = /^agent\/[a-z-]+-running$/;
+const HAND_AUTHORED_LABEL = "agent-flags/hand-authored";
+function liftedFacts(names) {
+	return {
+		runLive: names.filter((name) => RUNNING_LABEL.test(name)).toSorted(),
+		heldByHand: names.includes(HAND_AUTHORED_LABEL)
+	};
+}
+function labelNamesOf(section) {
+	const names = [];
+	for (const group of [...section.pr, ...section.issue]) for (const label of group.labels) names.push(label.name);
+	return names;
+}
+function ownerOf(names) {
+	const agent = names.filter((name) => name.startsWith("agent/")).toSorted();
+	const running = agent.find((name) => RUNNING_LABEL.test(name));
+	if (running !== void 0) return {
+		owner: "agent",
+		label: running,
+		running: true
+	};
+	if (names.includes("agent-flags/hand-authored")) return { owner: "person" };
+	const held = agent[0];
+	if (held !== void 0) return {
+		owner: "agent",
+		label: held,
+		running: false
+	};
+	return { owner: "unclaimed" };
+}
+//#endregion
+//#region src/work-status/claim.ts
+const HANDOVER_ROUTES = "Claim it from the control panel's \"Claim for hand work\", or remove the agent label by hand and run bst work:start again.";
+function decideClaim(report, enabled) {
+	if (!enabled) return {
+		kind: "answer",
+		exitCode: 0,
+		result: {
+			outcome: "not-agent-repo",
+			reason: "Nothing was claimed: this repository's default branch does not set agent.enabled, so the agent does not work it and there is nothing to claim against."
+		}
+	};
+	if (report.owner === null) return {
+		kind: "answer",
+		exitCode: 1,
+		result: {
+			outcome: "failed",
+			reason: "A label read failed, so a run may be live on this object unseen. Nothing was claimed; retry once the forge read works."
+		}
+	};
+	const held = ownershipOf(report);
+	if (held.kind === "running") return {
+		kind: "answer",
+		exitCode: 1,
+		result: {
+			outcome: "refused",
+			label: held.label,
+			reason: `A run is live on this object (${held.label}); a claim does not stop it.`
+		}
+	};
+	if (held.kind === "person") return {
+		kind: "answer",
+		exitCode: 0,
+		result: { outcome: "already-claimed" }
+	};
+	if (held.kind === "agent") return {
+		kind: "answer",
+		exitCode: 1,
+		result: {
+			outcome: "refused",
+			label: held.label,
+			reason: `The agent holds this object (${held.label}). ${HANDOVER_ROUTES}`
+		}
+	};
+	return { kind: "write" };
+}
+function ownershipOf(report) {
+	if (report.labels.state === "ok") {
+		const ownership = ownerOf(labelNamesOf(report.labels));
+		if (ownership.owner === "agent") return ownership.running ? {
+			kind: "running",
+			label: ownership.label
+		} : {
+			kind: "agent",
+			label: ownership.label
+		};
+		if (ownership.owner === "person") return { kind: "person" };
+		return { kind: "unclaimed" };
+	}
+	if (report.owner === "agent") {
+		const live = report.runLive?.[0];
+		return live === void 0 ? {
+			kind: "agent",
+			label: "an agent label"
+		} : {
+			kind: "running",
+			label: live
+		};
+	}
+	return report.owner === "person" ? { kind: "person" } : { kind: "unclaimed" };
+}
+async function writeClaim(executor, cwd, target, number) {
+	try {
+		const { conn } = requireForgejoTransport(executor, cwd, target, "bst work:start claims work on Forgejo, the forge the agent drives; a GitHub checkout has no agent to hand work to.");
+		const flag = (await fetchAllForgejoLabels(executor, conn)).find((label) => label.name === HAND_AUTHORED_LABEL);
+		if (flag === void 0) return {
+			outcome: "failed",
+			reason: `The forge has no label named ${HAND_AUTHORED_LABEL}. Provision the agent's labels first with bst-agent agent:labels --repo ${conn.repository}, or the control panel's Provision labels.`
+		};
+		await addForgejoIssueLabel(executor, conn, number, HAND_AUTHORED_LABEL, /* @__PURE__ */ new Map([[HAND_AUTHORED_LABEL, flag.id]]));
+		return {
+			outcome: "claimed",
+			label: HAND_AUTHORED_LABEL
+		};
+	} catch (error) {
+		return {
+			outcome: "failed",
+			reason: describeError$1(error)
+		};
+	}
+}
+//#endregion
+//#region src/work-status/consent.ts
+async function readAgentConsent(git, defaultBranch) {
+	const onBranch = await git.show(`origin/${defaultBranch}`, ".tooling.json");
+	if (onBranch !== null) return {
+		enabled: agentEnabledIn(onBranch),
+		source: "default-branch"
+	};
+	return {
+		enabled: agentEnabledIn(readWorkingTree(git.topLevel)),
+		source: "working-tree"
+	};
+}
+function readWorkingTree(topLevel) {
+	try {
+		return readFileSync(path.join(topLevel, ".tooling.json"), "utf8");
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region ../forgejo/src/issue-run.ts
 var NothingToUpdateError = class extends FatalError {
 	constructor() {
@@ -15236,6 +15550,42 @@ async function createWorkGit(executor, cwd) {
 	};
 }
 //#endregion
+//#region src/work-status/prepare.ts
+function tryResolveWorkForge(executor, topLevel, target) {
+	try {
+		return resolveWorkForge(executor, topLevel, target);
+	} catch (error) {
+		return error instanceof Error ? error : new UnexpectedError(String(error));
+	}
+}
+function sameRepository(one, other) {
+	return one.toLowerCase() === other.toLowerCase();
+}
+function refNamesAnotherRepository(checkoutRepository, refRepository) {
+	return new FatalError(`Usage: this command reads this checkout's repository (${checkoutRepository}); the ref names ${refRepository}`);
+}
+async function prepareWorkStatus(refText, cwd) {
+	const ref = refText === "" ? null : parseIssueRef(refText);
+	const executor = createRealExecutor$1();
+	const git = await createWorkGit(executor, cwd);
+	const target = ref?.target;
+	if (target !== void 0) {
+		const checkout = await git.originRepository();
+		if (checkout !== null && !sameRepository(target.repository, checkout)) throw refNamesAnotherRepository(checkout, target.repository);
+	}
+	let forge = tryResolveWorkForge(executor, git.topLevel);
+	if (target !== void 0 && !(forge instanceof Error)) {
+		if (!sameRepository(target.repository, forge.repository)) throw refNamesAnotherRepository(forge.repository, target.repository);
+		forge = tryResolveWorkForge(executor, git.topLevel, target);
+	}
+	return {
+		ref,
+		executor,
+		git,
+		forge
+	};
+}
+//#endregion
 //#region src/docs-check/discover.ts
 const DOCS_ROOT = "docs";
 const RETIRED_DIR = "retired";
@@ -17498,45 +17848,6 @@ function feedbackSince(comments, headCommitDate, cap, agentLogin) {
 	};
 }
 //#endregion
-//#region src/work-status/labels.ts
-const SCOPE_ORDER = [
-	"agent",
-	"agent-flags",
-	"agent-note",
-	"priority",
-	"other"
-];
-function scopeOf(name) {
-	const separator = name.indexOf("/");
-	if (separator < 0) return "other";
-	const prefix = name.slice(0, separator);
-	if (prefix === "agent" || prefix === "agent-flags" || prefix === "agent-note" || prefix === "priority") return prefix;
-	return "other";
-}
-function groupLabels(names, descriptions) {
-	const groups = [];
-	for (const scope of SCOPE_ORDER) {
-		const inScope = names.filter((name) => scopeOf(name) === scope).toSorted((a, b) => a.localeCompare(b)).map((name) => ({
-			name,
-			description: descriptions.get(name) ?? null
-		}));
-		if (inScope.length === 0) continue;
-		groups.push({
-			scope,
-			labels: inScope
-		});
-	}
-	return groups;
-}
-const RUNNING_LABEL = /^agent\/[a-z-]+-running$/;
-const HAND_AUTHORED_LABEL = "agent-flags/hand-authored";
-function liftedFacts(names) {
-	return {
-		runLive: names.filter((name) => RUNNING_LABEL.test(name)).toSorted(),
-		heldByHand: names.includes(HAND_AUTHORED_LABEL)
-	};
-}
-//#endregion
 //#region src/work-status/report.ts
 const COMMIT_CAP = 20;
 const FEEDBACK_CAP = 20;
@@ -17772,11 +18083,14 @@ function objectSection({ resolved, forgeDown }) {
 	return ok(facts);
 }
 function liftedFactsOf(resolved, forgeDown) {
-	const read = liftedFacts(labelNames([resolved.pr, resolved.issue]));
+	const names = labelNames([resolved.pr, resolved.issue]);
+	const read = liftedFacts(names);
+	const ownership = ownerOf(names);
 	const complete = forgeDown === null && resolved.prFailed === null && resolved.issueFailed === null;
 	return {
 		runLive: complete || read.runLive.length > 0 ? read.runLive : null,
-		heldByHand: complete || read.heldByHand ? read.heldByHand : null
+		heldByHand: complete || read.heldByHand ? read.heldByHand : null,
+		owner: complete || ownership.owner !== "unclaimed" ? ownership.owner : null
 	};
 }
 async function docsSection({ git, docsExtraDirs, resolved }) {
@@ -17892,6 +18206,7 @@ async function buildWorkStatus(deps, ref) {
 		},
 		runLive: lifted.runLive,
 		heldByHand: lifted.heldByHand,
+		owner: lifted.owner,
 		object: await section(() => objectSection(inputs)),
 		docs: await section(() => docsSection(inputs)),
 		labels: await section(() => labelsSection(inputs)),
@@ -17933,13 +18248,22 @@ function heading({ kind, branch, head }) {
 	if (head !== null) named.push(`head ${short(head)}`);
 	return `work:status ${named.join(", ")}`;
 }
-function renderWorkStatus(report) {
+function claimableNumber(report) {
+	if (report.object.state !== "ok") return null;
+	if (report.target.kind === "issue") return report.object.issue?.number ?? null;
+	return report.object.pr?.number ?? report.object.issue?.number ?? null;
+}
+function renderWorkStatus(report, options) {
 	const quiet = nothingInFlight(report);
 	if (quiet !== null) return [heading(report.target), quiet].join("\n");
 	const lines = [heading(report.target)];
 	for (const label of report.runLive ?? []) lines.push(`RUN LIVE: ${label} -- a run is working this object; do not start another.`);
 	if (report.runLive === null || report.heldByHand === null) lines.push("UNKNOWN: whether a run is live or a human holds this -- not every label could be read.");
 	if (report.heldByHand === true) lines.push("HELD BY HAND: agent-flags/hand-authored -- a human claimed this one; do not drive it.");
+	if (options?.agentEnabled === true && report.owner === "unclaimed") {
+		const number = claimableNumber(report);
+		if (number !== null) lines.push(`UNCLAIMED: no agent label and no hand claim -- run \`bst work:start ${String(number)}\` before you work this.`);
+	}
 	lines.push(...block("object", report.object, objectRows));
 	lines.push(...block("docs", report.docs, (value) => {
 		const rows = [`  base ${value.base}`];
@@ -17988,20 +18312,77 @@ function renderWorkStatus(report) {
 	return lines.join("\n");
 }
 //#endregion
-//#region src/commands/work-status.ts
-function tryResolveWorkForge(executor, topLevel, target) {
-	try {
-		return resolveWorkForge(executor, topLevel, target);
-	} catch (error) {
-		return error instanceof Error ? error : new UnexpectedError(String(error));
-	}
+//#region src/commands/work-start.ts
+function claimLine(result) {
+	if (result.outcome === "claimed") return `claim: claimed -- ${result.label ?? "agent-flags/hand-authored"} is on this object.`;
+	if (result.outcome === "already-claimed") return "claim: already-claimed -- the flag is already on it; nothing was written.";
+	if (result.outcome === "not-agent-repo") return `claim: not-agent-repo -- ${result.reason ?? "nothing was claimed."}`;
+	return `claim: ${result.outcome} -- ${result.reason ?? "nothing was claimed."}`;
 }
-function sameRepository(one, other) {
-	return one.toLowerCase() === other.toLowerCase();
-}
-function refNamesAnotherRepository(checkoutRepository, refRepository) {
-	return new FatalError(`Usage: bst work:status reads this checkout's repository (${checkoutRepository}); the ref names ${refRepository}`);
+function claimFailed(result) {
+	return result.outcome === "refused" || result.outcome === "failed";
 }
+const workStartCommand = defineCommand({
+	meta: {
+		name: "work:start",
+		description: "Claim an issue or pull request for hand work: put agent-flags/hand-authored on it so the agent leaves it alone"
+	},
+	args: {
+		ref: {
+			type: "positional",
+			required: true,
+			description: "Issue or pull request number or URL to claim"
+		},
+		json: {
+			type: "boolean",
+			description: "Emit one JSON document: the whole work:status report plus a claim member {outcome, label?, reason?}. outcome is claimed (the flag was written), already-claimed (it was already on the object, nothing written), not-agent-repo (the default branch does not set agent.enabled, nothing written), refused (a live run or an agent label holds it; exit 1), or failed (a read or write could not be done; exit 1). refused and failed carry ok: false and an error member of kind runtime, and the report survives beside them."
+		},
+		verbose: {
+			type: "boolean",
+			description: "Emit detailed debug logging"
+		}
+	},
+	async run({ args }) {
+		const { ref, executor, git, forge } = await prepareWorkStatus(typeof args.ref === "string" ? args.ref.trim() : "", process.cwd());
+		const number = ref?.number;
+		if (number === void 0) throw new FatalError("Usage: bst work:start needs an issue or pull request number or URL");
+		const docs = resolveDocsConfig(git.topLevel);
+		const defaultBranch = resolveDefaultBranch({ cwd: git.topLevel });
+		const report = await buildWorkStatus({
+			git,
+			forge,
+			docsExtraDirs: docs.extraDirs,
+			defaultBranch
+		}, ref);
+		const consent = await readAgentConsent(git, defaultBranch);
+		const decision = decideClaim(report, consent.enabled);
+		let result;
+		let exitCode;
+		if (decision.kind === "write") {
+			result = await writeClaim(executor, git.topLevel, ref?.target, number);
+			exitCode = claimFailed(result) ? 1 : 0;
+		} else {
+			result = decision.result;
+			exitCode = decision.exitCode;
+		}
+		const out = createCliOutput(args.json === true);
+		const failed = claimFailed(result);
+		out.json({
+			ok: !failed,
+			...report,
+			claim: result,
+			...failed ? { error: {
+				kind: "runtime",
+				message: result.reason ?? result.outcome
+			} } : {}
+		});
+		out.text(renderWorkStatus(report, { agentEnabled: consent.enabled }));
+		out.text(claimLine(result));
+		if (exitCode !== 0) process.exitCode = exitCode;
+	}
+});
+//#endregion
+//#region src/commands/work-status.ts
 const workStatusCommand = defineCommand({
 	meta: {
 		name: "work:status",
@@ -18015,7 +18396,7 @@ const workStatusCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: target, runLive, heldByHand (each null when not every label could be read), and six sections (object, docs, labels, feedback, findings, commits), each {state: ok} with its fields, {state: absent, reason} or {state: unavailable, reason}. The output is advice, not a gate: the feedback cutoff is the newest agent run or review comment on the pull request and is approximate, and review comments on diff lines are not in the thread this reads."
+			description: "Emit one JSON document: target, runLive, heldByHand, owner (agent, person or unclaimed; each null when not every label could be read), and six sections (object, docs, labels, feedback, findings, commits), each {state: ok} with its fields, {state: absent, reason} or {state: unavailable, reason}. The output is advice, not a gate: the feedback cutoff is the newest agent run or review comment on the pull request and is approximate, and review comments on diff lines are not in the thread this reads."
 		},
 		verbose: {
 			type: "boolean",
@@ -18023,20 +18404,7 @@ const workStatusCommand = defineCommand({
 		}
 	},
 	async run({ args }) {
-		const refText = typeof args.ref === "string" ? args.ref.trim() : "";
-		const ref = refText === "" ? null : parseIssueRef(refText);
-		const executor = createRealExecutor$1();
-		const git = await createWorkGit(executor, process.cwd());
-		const target = ref?.target;
-		if (target !== void 0) {
-			const checkout = await git.originRepository();
-			if (checkout !== null && !sameRepository(target.repository, checkout)) throw refNamesAnotherRepository(checkout, target.repository);
-		}
-		let forge = tryResolveWorkForge(executor, git.topLevel);
-		if (target !== void 0 && !(forge instanceof Error)) {
-			if (!sameRepository(target.repository, forge.repository)) throw refNamesAnotherRepository(forge.repository, target.repository);
-			forge = tryResolveWorkForge(executor, git.topLevel, target);
-		}
+		const { ref, git, forge } = await prepareWorkStatus(typeof args.ref === "string" ? args.ref.trim() : "", process.cwd());
 		const docs = resolveDocsConfig(git.topLevel);
 		const defaultBranch = resolveDefaultBranch({ cwd: git.topLevel });
 		const report = await buildWorkStatus({
@@ -18045,12 +18413,13 @@ const workStatusCommand = defineCommand({
 			docsExtraDirs: docs.extraDirs,
 			defaultBranch
 		}, ref);
+		const consent = await readAgentConsent(git, defaultBranch);
 		const out = createCliOutput(args.json === true);
 		out.json({
 			ok: true,
 			...report
 		});
-		out.text(renderWorkStatus(report));
+		out.text(renderWorkStatus(report, { agentEnabled: consent.enabled }));
 	}
 });
 //#endregion
@@ -18306,8 +18675,9 @@ const PASSED_VERDICT = {
 	reason: null
 };
 async function mergeVersionPrForgejo(executor, conn, options) {
-	const prNumber = await findOpenPr(executor, conn, VERSION_PR_BRANCH);
-	if (prNumber === null) throw new FatalError(`No open PR found for branch ${VERSION_PR_BRANCH}`);
+	const branch = versionPrBranch(options.defaultBranch);
+	const prNumber = await findOpenPr(executor, conn, branch);
+	if (prNumber === null) throw new FatalError(`No open PR found for branch ${branch}`);
 	const sleep$1 = options.sleep ?? sleep;
 	const recheckDelayMs = envMsOverride(process.env["BST_TEST_VERSION_MERGE_RECHECK_MS"], RECHECK_DELAY_MS);
 	const confirmation = await confirmMergeable(executor, conn, prNumber, {
@@ -18328,12 +18698,12 @@ async function mergeVersionPrForgejo(executor, conn, options) {
 		headSha,
 		mergeBase: decidedFrom.mergeBase,
 		changedFiles: decidedFrom.changedFiles,
-		branch: VERSION_PR_BRANCH,
+		branch,
 		rechecked,
 		verdict: { ...PASSED_VERDICT }
 	};
 	if (options.dryRun) {
-		log$1.info(`[dry-run] Would merge PR #${String(prNumber)} at ${headSha} and delete branch ${VERSION_PR_BRANCH}`);
+		log$1.info(`[dry-run] Would merge PR #${String(prNumber)} at ${headSha} and delete branch ${branch}`);
 		return {
 			...outcome,
 			status: "would-merge"
@@ -18344,7 +18714,7 @@ async function mergeVersionPrForgejo(executor, conn, options) {
 		deleteBranch: true,
 		expectedHeadSha: headSha
 	});
-	log$1.info(`Merged PR #${String(prNumber)} and deleted branch ${VERSION_PR_BRANCH}`);
+	log$1.info(`Merged PR #${String(prNumber)} and deleted branch ${branch}`);
 	return {
 		...outcome,
 		status: "merged"
@@ -18359,16 +18729,17 @@ const GitHubVersionPrSchema = z.object({
 	changedFiles: z.number()
 });
 function mergeVersionPrGitHub(executor, options) {
+	const branch = versionPrBranch(options.defaultBranch);
 	const view = executor.exec("gh", [
 		"pr",
 		"view",
-		VERSION_PR_BRANCH,
+		branch,
 		"--json",
 		"number,state,isDraft,mergeable,headRefOid,changedFiles"
 	], { cwd: process.cwd() });
-	if (view.exitCode !== 0) throw new FatalError(`Failed to read PR for branch ${VERSION_PR_BRANCH}: ${view.stderr || view.stdout || "unknown error"}`);
+	if (view.exitCode !== 0) throw new FatalError(`Failed to read PR for branch ${branch}: ${view.stderr || view.stdout || "unknown error"}`);
 	const parsed = GitHubVersionPrSchema.safeParse(JSON.parse(view.stdout));
-	if (!parsed.success) throw new FatalError(`Unexpected 'gh pr view' response for branch ${VERSION_PR_BRANCH}: ${parsed.error.message}`);
+	if (!parsed.success) throw new FatalError(`Unexpected 'gh pr view' response for branch ${branch}: ${parsed.error.message}`);
 	const data = parsed.data;
 	const emptiness = data.changedFiles === 0 ? "empty" : "non-empty";
 	const mergeable = data.mergeable === "CONFLICTING" ? "conflicted" : "mergeable";
@@ -18387,12 +18758,12 @@ function mergeVersionPrGitHub(executor, options) {
 		headSha,
 		mergeBase: null,
 		changedFiles: data.changedFiles,
-		branch: VERSION_PR_BRANCH,
+		branch,
 		rechecked: false,
 		verdict: { ...PASSED_VERDICT }
 	};
 	if (options.dryRun) {
-		log$1.info(`[dry-run] Would merge PR #${String(data.number)} at ${headSha} and delete branch ${VERSION_PR_BRANCH}`);
+		log$1.info(`[dry-run] Would merge PR #${String(data.number)} at ${headSha} and delete branch ${branch}`);
 		return {
 			...outcome,
 			status: "would-merge"
@@ -18401,14 +18772,14 @@ function mergeVersionPrGitHub(executor, options) {
 	const result = executor.exec("gh", [
 		"pr",
 		"merge",
-		VERSION_PR_BRANCH,
+		branch,
 		"--merge",
 		"--delete-branch",
 		"--match-head-commit",
 		headSha
 	], { cwd: process.cwd() });
 	if (result.exitCode !== 0) throw new FatalError(`Failed to merge PR: ${result.stderr || result.stdout || "unknown error"}`);
-	log$1.info(`Merged changesets PR and deleted branch ${VERSION_PR_BRANCH}`);
+	log$1.info(`Merged changesets PR and deleted branch ${branch}`);
 	return {
 		...outcome,
 		status: "merged"
@@ -18436,7 +18807,14 @@ const releaseMergeCommand = defineCommand({
 		const dryRun = args["dry-run"] === true;
 		const resolved = resolveConnection(process.cwd());
 		const executor = createRealExecutor$1();
-		const result = resolved.type === "forgejo" ? await mergeVersionPrForgejo(executor, resolved.conn, { dryRun }) : mergeVersionPrGitHub(executor, { dryRun });
+		const defaultBranch = readConfiguredDefaultBranch(process.cwd());
+		const result = resolved.type === "forgejo" ? await mergeVersionPrForgejo(executor, resolved.conn, {
+			dryRun,
+			defaultBranch
+		}) : mergeVersionPrGitHub(executor, {
+			dryRun,
+			defaultBranch
+		});
 		out.json(result);
 	}
 });
@@ -20896,6 +21274,102 @@ async function runHooksCheck(config) {
 	};
 }
 //#endregion
+//#region src/commands/setup-agent.ts
+const RawToolingConfigSchema = z.record(z.string(), z.unknown());
+function previousState(saved) {
+	const enabled = saved.agent?.enabled;
+	if (enabled === void 0) return "absent";
+	if (enabled === true) return "true";
+	return "false";
+}
+function withAgentEnabled(raw) {
+	const agent = RawToolingConfigSchema.safeParse(raw["agent"]);
+	const block = agent.success ? { ...agent.data } : {};
+	block["enabled"] = true;
+	return {
+		...raw,
+		agent: block
+	};
+}
+const CHANGE_ACTIONS = /* @__PURE__ */ new Set([
+	"created",
+	"updated",
+	"removed",
+	"archived"
+]);
+async function runSetupAgent(targetDir, options) {
+	const saved = loadToolingConfigStrict(targetDir);
+	if (saved === void 0) throw new FatalError(`No .tooling.json in ${targetDir}. Run bst repo:sync first to create one, so the repo's own conventions are chosen before the agent is enabled.`);
+	const previous = previousState(saved);
+	let consent = "already-enabled";
+	if (previous !== "true") {
+		const displayPath = path.join(targetDir, ".tooling.json");
+		let parsedFile;
+		try {
+			parsedFile = JSON.parse(readFileSync(displayPath, "utf8"));
+		} catch (error) {
+			throw new FatalError(`Could not read ${displayPath} as JSON: ${describeError$1(error)}`);
+		}
+		const rawFile = RawToolingConfigSchema.safeParse(parsedFile);
+		if (!rawFile.success) throw new FatalError(`Could not read ${displayPath} as a config object: ${rawFile.error.message}`);
+		const edited = withAgentEnabled(rawFile.data);
+		const content = `${JSON.stringify(edited, null, 2)}\n`;
+		parseToolingConfigStrict(content, displayPath);
+		const context = createContext(mergeWithSavedConfig(buildDefaultConfig(targetDir, {}), saved), async () => "overwrite");
+		context.ctx.write(".tooling.json", context.ctx.format(".tooling.json", content));
+		consent = "written";
+	}
+	if (consent === "written") log$1.success("Set agent.enabled to true in .tooling.json");
+	else log$1.info("agent.enabled is already true");
+	const report = await runUpdateReport(targetDir, {}, { installOutput: options.installOutput });
+	const failed = failedResults(report.results);
+	const changed = report.results.filter((result) => CHANGE_ACTIONS.has(result.action)).map((result) => ({
+		filePath: result.filePath,
+		action: result.action
+	}));
+	let status;
+	if (report.status === "stopped" || failed.length > 0) status = "failed";
+	else if (changed.length > 0) status = "changed";
+	else status = "up-to-date";
+	if (status === "failed") log$1.error("The sync failed. Fix what it reported, then run bst setup:agent again.");
+	else log$1.info("Commit these changes and land them on the default branch; the agent reads consent there within about a minute.");
+	return {
+		dir: targetDir,
+		consent,
+		previous,
+		sync: {
+			status,
+			changed,
+			failed,
+			install: report.install
+		},
+		exitCode: status === "failed" ? 1 : 0
+	};
+}
+const setupAgentCommand = defineCommand({
+	meta: {
+		name: "setup:agent",
+		description: "Enable the agent for this repository: set agent.enabled to true in .tooling.json, then run the same sync as repo:sync, which installs @bensandee/agent-cli and generates the files the agent reads. Commits nothing -- land the change on the default branch yourself."
+	},
+	args: {
+		dir: {
+			type: "positional",
+			valueHint: "dir",
+			description: "Directory to enable (default: current directory)",
+			required: false
+		},
+		json: {
+			type: "boolean",
+			description: "Output the report as JSON: dir, consent, previous, sync { status, changed, failed, install }, exitCode"
+		}
+	},
+	async run({ args }) {
+		const report = await runSetupAgent(path.resolve(args.dir ?? "."), { installOutput: args.json === true || isJsonMode() ? "capture" : "inherit" });
+		createCliOutput(args.json === true).json(report);
+		process.exitCode = report.exitCode;
+	}
+});
+//#endregion
 //#region src/commands/setup-secrets.ts
 function isCancelled(value) {
 	return clack.isCancel(value);
@@ -21840,6 +22314,7 @@ const coverageRecordCommand = defineCommand({
 			});
 			return;
 		}
+		refuseForgeDefaultMismatch(readConfiguredDefaultBranch(targetDir), processCiEventSource(), "coverage:record");
 		const summaryPath = path.join(targetDir, COVERAGE_SUMMARY_FILE);
 		if (!existsSync(summaryPath)) throw new FatalError(`${COVERAGE_SUMMARY_FILE} not found. Run \`pnpm test:coverage\` before \`coverage:record\`.`);
 		const summary = parseV8Summary(readFileSync(summaryPath, "utf-8"));
@@ -23312,6 +23787,7 @@ const healthRecordCommand = defineCommand({
 			});
 			return;
 		}
+		refuseForgeDefaultMismatch(readConfiguredDefaultBranch(targetDir), processCiEventSource(), "health:record");
 		const executor = createRealHealthExecutor(targetDir);
 		const headResult = executor.exec("git", ["rev-parse", "HEAD"], { cwd: targetDir });
 		if (headResult.exitCode !== 0) throw new FatalError(`Failed to resolve HEAD sha: ${headResult.stderr.trim()}`);
@@ -25663,58 +26139,6 @@ const issueDownloadCommand = defineCommand({
 	}
 });
 //#endregion
-//#region ../forgejo/src/issue-labels.ts
-const TimelineEntrySchema = z.object({
-	id: z.number(),
-	type: z.string(),
-	body: z.string().nullish(),
-	created_at: z.string(),
-	label: z.object({ name: z.string() }).nullish(),
-	user: z.object({ login: z.string() }).nullish()
-});
-z.array(TimelineEntrySchema).nullable();
-async function resolveLabelId(executor, conn, name, labelIds) {
-	const cached = labelIds?.get(name);
-	if (cached !== void 0) return cached;
-	const [id] = await resolveLabelIds(executor, conn, [name]);
-	if (id === void 0) throw new UnexpectedError(`Label id resolution returned nothing for "${name}"`);
-	return id;
-}
-async function addForgejoIssueLabel(executor, conn, number, name, labelIds) {
-	const id = await resolveLabelId(executor, conn, name, labelIds);
-	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels`, {
-		method: "POST",
-		headers: jsonHeaders(conn),
-		body: JSON.stringify({ labels: [id] })
-	}, { idempotent: true });
-	if (!res.ok) await throwForgejoFailure(res, {
-		verb: "add label",
-		resource: `#${String(number)}`
-	}, issueNotFoundMessage(conn, number));
-}
-async function removeForgejoIssueLabel(executor, conn, number, name, labelIds) {
-	const id = await resolveLabelId(executor, conn, name, labelIds);
-	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels/${String(id)}`, {
-		method: "DELETE",
-		headers: authHeaders$2(conn)
-	}, { idempotent: true });
-	if (!res.ok) await throwForgejoFailure(res, {
-		verb: "remove label",
-		resource: `#${String(number)}`
-	}, issueNotFoundMessage(conn, number));
-}
-async function replaceForgejoIssueLabels(executor, conn, number, labelIds) {
-	const res = await executor.fetch(`${issuesBase(conn)}/${String(number)}/labels`, {
-		method: "PUT",
-		headers: jsonHeaders(conn),
-		body: JSON.stringify({ labels: labelIds })
-	}, { idempotent: true });
-	if (!res.ok) await throwForgejoFailure(res, {
-		verb: "replace labels",
-		resource: `#${String(number)}`
-	}, issueNotFoundMessage(conn, number));
-}
-//#endregion
 //#region ../forgejo/src/issue-run-labels.ts
 async function labelIssue(resolve, request) {
 	const ref = parseIssueRef(request.ref);
@@ -26920,7 +27344,7 @@ async function runCli(config) {
 //#region src/cli-main.ts
 setLogLevel(resolveLogLevel({}));
 setForgejoLogger(log$1);
-const displayVersion = "0.90.0";
+const displayVersion = "0.91.0";
 const bstSubCommands = {
 	"repo:sync": syncCommand,
 	"checks:run": runChecksCommand,
@@ -26943,6 +27367,7 @@ const bstSubCommands = {
 	"hooks:audit": hooksAuditCommand,
 	"hooks:sync": hooksSyncCommand,
 	"setup:secrets": setupSecretsCommand,
+	"setup:agent": setupAgentCommand,
 	"webhook:send": webhookSendCommand,
 	"coverage:summary": coverageSummaryCommand,
 	"coverage:check": coverageCheckCommand,
@@ -26976,7 +27401,8 @@ const bstSubCommands = {
 	"plan:brief": planBriefCommand,
 	"plan:review-package": planReviewPackageCommand,
 	"plan:status": planStatusCommand,
-	"work:status": workStatusCommand
+	"work:status": workStatusCommand,
+	"work:start": workStartCommand
 };
 async function runBstCli(extraSubCommands = {}) {
 	await runCli({