polyrepo-cli 1.0.0 → 1.0.2

package/src/commands/doctor.js

@@ -1,12 +1,15 @@
+import { checkbox, confirm } from '@inquirer/prompts'
 import pc from 'picocolors'
 import { discoverRepos, inspectRepos } from '../repos.js'
 import { loadConfig } from '../loadConfig.js'
-import { run } from '../exec.js'
+import { run, git, gitAsync, ghAsync } from '../exec.js'
 import { findStaleLocalDeps } from '../crossDeps.js'
-import { heading, ok, fail, warn } from '../ui.js'
+import { isBumpBranchName } from '../config.js'
+import { pMap } from '../pMap.js'
+import { heading, ok, fail, warn, columnWidths, formatRow, promptTheme } from '../ui.js'
 import { startSpinner } from '../spinner.js'
 
-export async function doctorCommand({ configPath } = {}) {
+export async function doctorCommand({ configPath, cleanBranches = false } = {}) {
   heading('Environment')
   checkNode()
   checkGit()
@@ -28,10 +31,42 @@ export async function doctorCommand({ configPath } = {}) {
     if (dirty.length > 0) {
       warn(`${dirty.length} repo(s) have uncommitted changes: ${dirty.map((r) => r.dir).join(', ')}`)
     }
-    const offMaster = repos.filter((r) => r.branch !== 'master')
-    if (offMaster.length > 0) {
-      warn(`${offMaster.length} repo(s) are not on master: ${offMaster.map((r) => r.dir).join(', ')}`)
+    const detached = repos.filter((r) => r.branch === null)
+    if (detached.length > 0) {
+      warn(`${detached.length} repo(s) are in a detached HEAD state: ${detached.map((r) => r.dir).join(', ')}`)
     }
+    const offDefault = repos.filter((r) => r.branch !== null && r.branch !== r.defaultBranch)
+    if (offDefault.length > 0) {
+      warn(`${offDefault.length} repo(s) are not on their default branch: ${offDefault.map((r) => r.dir).join(', ')}`)
+    }
+  }
+
+  heading('Remote sync')
+  if (repos.length > 0) {
+    await checkRemoteSync(repos)
+  } else {
+    console.log(pc.dim('Skipped — no packages discovered.'))
+  }
+
+  heading('Branch sync')
+  if (repos.length > 0) {
+    await checkBranchSync(repos)
+  } else {
+    console.log(pc.dim('Skipped — no packages discovered.'))
+  }
+
+  heading('Branch protection')
+  if (repos.length > 0) {
+    await checkBranchProtection(repos)
+  } else {
+    console.log(pc.dim('Skipped — no packages discovered.'))
+  }
+
+  heading('Stale bump branches')
+  if (repos.length > 0) {
+    await checkStaleBumpBranches(repos, { cleanBranches })
+  } else {
+    console.log(pc.dim('Skipped — no packages discovered.'))
   }
 
   heading('Cross-package dependencies')
@@ -51,6 +86,237 @@ export async function doctorCommand({ configPath } = {}) {
   }
 }
 
+// Every other command trusts the locally cached `origin/HEAD` ref as the
+// fast, no-network path for "what's this repo's default branch" (see
+// detectDefaultBranchAsync in repos.js) — but git never refreshes that
+// cache on its own, so if the default branch gets renamed on GitHub after
+// a repo was cloned, every command would keep using the old name forever
+// with nothing to notice or fix it. This repairs it with `git remote
+// set-head origin --auto` wherever it's drifted — a safe, non-destructive
+// pointer refresh, not a change to any file, branch, or commit. Bundled
+// with `git remote prune origin` (same "keep local remote-tracking state
+// honest" spirit): drops local `remotes/origin/x` refs for branches
+// already deleted on GitHub — also just local bookkeeping, touches
+// nothing shared.
+async function checkRemoteSync(repos) {
+  const spinner = startSpinner(`Checking ${repos.length} package(s) against GitHub, and pruning stale remote-tracking refs...`)
+  const results = await pMap(repos, async (r) => {
+    const ghResult = await ghAsync(r.path, [
+      'repo',
+      'view',
+      '--json',
+      'defaultBranchRef',
+      '-q',
+      '.defaultBranchRef.name',
+    ])
+    const actual = ghResult.ok && ghResult.stdout ? ghResult.stdout : null
+
+    const pruneResult = await gitAsync(r.path, ['remote', 'prune', 'origin'])
+    const pruned = pruneResult.ok ? [...pruneResult.stdout.matchAll(/\[pruned\] origin\/(\S+)/g)].map((m) => m[1]) : []
+
+    return { repo: r, actual, pruned }
+  })
+  spinner.stop()
+
+  const checked = results.filter((r) => r.actual)
+  if (checked.length === 0) {
+    console.log(pc.dim('Default branch: skipped — could not reach GitHub for any package (offline, or `gh` not authenticated).'))
+  } else {
+    const drifted = checked.filter((r) => r.actual !== r.repo.defaultBranch)
+    for (const { repo, actual } of drifted) {
+      const fixResult = git(repo.path, ['remote', 'set-head', 'origin', '--auto'])
+      if (fixResult.ok) {
+        ok(`${repo.dir}: local cache said "${repo.defaultBranch}", GitHub says "${actual}" — refreshed the local cache.`)
+      } else {
+        fail(`${repo.dir}: local cache said "${repo.defaultBranch}", GitHub says "${actual}" — could not refresh it (git remote set-head failed).`)
+      }
+    }
+    if (drifted.length === 0) {
+      ok(`${checked.length} package(s) checked — local default-branch cache matches GitHub.`)
+    }
+    const uncheckedCount = repos.length - checked.length
+    if (uncheckedCount > 0) {
+      console.log(pc.dim(`  (${uncheckedCount} package(s) could not be checked against GitHub.)`))
+    }
+  }
+
+  const pruned = results.filter((r) => r.pruned.length > 0)
+  if (pruned.length > 0) {
+    for (const { repo, pruned: branches } of pruned) {
+      ok(`${repo.dir}: pruned ${branches.length} stale remote-tracking ref(s) (${branches.join(', ')}).`)
+    }
+  } else {
+    ok('No stale remote-tracking refs to prune.')
+  }
+}
+
+// Whether each repo's local default branch actually matches origin —
+// surfaced here proactively so it's known before a `switch-master` run
+// fails partway on a fast-forward it can't do, or before `bump`/`tag`
+// build a branch from a base that isn't what it looks like locally.
+async function checkBranchSync(repos) {
+  const spinner = startSpinner(`Fetching and comparing ${repos.length} package(s) against origin...`)
+  const results = await pMap(repos, async (r) => {
+    const fetchResult = await gitAsync(r.path, ['fetch', 'origin'])
+    if (!fetchResult.ok) return { repo: r, error: 'git fetch failed' }
+
+    const branch = r.defaultBranch
+    const countResult = await gitAsync(r.path, ['rev-list', '--left-right', '--count', `${branch}...origin/${branch}`])
+    if (!countResult.ok) return { repo: r, error: `no local branch "${branch}" to compare` }
+
+    const [ahead, behind] = countResult.stdout.split(/\s+/).map(Number)
+    return { repo: r, ahead, behind }
+  })
+  spinner.stop()
+
+  for (const { repo, error } of results.filter((r) => r.error)) {
+    warn(`${repo.dir}: could not check sync status (${error}).`)
+  }
+
+  const withCounts = results.filter((r) => !r.error)
+  const diverged = withCounts.filter((r) => r.ahead > 0 && r.behind > 0)
+  const behindOnly = withCounts.filter((r) => r.ahead === 0 && r.behind > 0)
+  const aheadOnly = withCounts.filter((r) => r.ahead > 0 && r.behind === 0)
+  const inSync = withCounts.filter((r) => r.ahead === 0 && r.behind === 0)
+
+  for (const { repo, ahead, behind } of diverged) {
+    warn(
+      `${repo.dir}: diverged from origin/${repo.defaultBranch} — ${ahead} local commit(s) not on origin, ${behind} commit(s) behind. A fast-forward won't work; resolve by hand.`,
+    )
+  }
+  if (behindOnly.length > 0) {
+    warn(
+      `${behindOnly.length} repo(s) are behind origin (safe to fast-forward with \`polyrepo switch-master\`): ${behindOnly
+        .map((r) => r.repo.dir)
+        .join(', ')}`,
+    )
+  }
+  if (aheadOnly.length > 0) {
+    console.log(
+      pc.dim(
+        `${aheadOnly.length} repo(s) have local commits not yet pushed to origin: ${aheadOnly.map((r) => r.repo.dir).join(', ')}`,
+      ),
+    )
+  }
+  if (inSync.length === withCounts.length && withCounts.length > 0) {
+    ok(`${inSync.length} package(s) checked — all in sync with origin.`)
+  }
+}
+
+// Not auto-fixable — enabling branch protection is a deliberate policy
+// choice (required reviewers, status checks, etc.), not something to
+// configure on someone's behalf. Just surfaces it, since this whole tool
+// assumes every managed repo requires a PR to reach its default branch.
+async function checkBranchProtection(repos) {
+  const spinner = startSpinner(`Checking ${repos.length} package(s) for branch protection...`)
+  const results = await pMap(repos, async (r) => {
+    const result = await ghAsync(r.path, ['api', `repos/{owner}/{repo}/branches/${r.defaultBranch}`, '--jq', '.protected'])
+    return result.ok && result.stdout ? { repo: r, protected: result.stdout === 'true' } : null
+  })
+  spinner.stop()
+
+  const checked = results.filter(Boolean)
+  if (checked.length === 0) {
+    console.log(pc.dim('Skipped — could not reach GitHub for any package (offline, or `gh` not authenticated).'))
+    return
+  }
+
+  const unprotected = checked.filter((r) => !r.protected)
+  for (const { repo } of unprotected) {
+    warn(`${repo.dir}: default branch "${repo.defaultBranch}" has no branch protection — pushes/merges to it aren't guarded.`)
+  }
+  if (unprotected.length === 0) {
+    ok(`${checked.length} package(s) checked — default branch is protected on all of them.`)
+  }
+
+  const uncheckedCount = repos.length - checked.length
+  if (uncheckedCount > 0) {
+    console.log(pc.dim(`  (${uncheckedCount} package(s) could not be checked against GitHub.)`))
+  }
+}
+
+// `bump` merges through a PR with --delete-branch=false (see github.js),
+// so every completed bump leaves its branch behind, locally and on
+// origin, forever. This only ever offers to delete the *local* copy —
+// deleting the one on origin is more sensitive shared state, not
+// something to fold into an opt-in local cleanup.
+async function findStaleBumpBranches(repos) {
+  const perRepo = await pMap(repos, async (r) => {
+    const branchesResult = await gitAsync(r.path, ['for-each-ref', 'refs/heads', '--format=%(refname:short)'])
+    if (!branchesResult.ok) return []
+    const candidates = branchesResult.stdout.split('\n').filter(Boolean).filter(isBumpBranchName)
+    if (candidates.length === 0) return []
+
+    const withStatus = await pMap(candidates, async (branch) => {
+      const prResult = await ghAsync(r.path, ['pr', 'list', '--head', branch, '--state', 'merged', '--json', 'number'])
+      let merged = false
+      if (prResult.ok && prResult.stdout) {
+        try {
+          merged = JSON.parse(prResult.stdout).length > 0
+        } catch {
+          merged = false
+        }
+      }
+      return { repo: r, branch, merged }
+    })
+    return withStatus.filter((b) => b.merged)
+  })
+  return perRepo.flat()
+}
+
+async function checkStaleBumpBranches(repos, { cleanBranches }) {
+  const spinner = startSpinner(`Checking ${repos.length} package(s) for leftover bump branches with a merged PR...`)
+  const stale = await findStaleBumpBranches(repos)
+  spinner.stop()
+
+  if (stale.length === 0) {
+    ok('No stale bump branches found.')
+    return
+  }
+
+  if (!cleanBranches) {
+    warn(
+      `${stale.length} stale bump branch(es) found across ${new Set(stale.map((s) => s.repo.dir)).size} package(s) — run \`polyrepo doctor --clean-branches\` to review and delete them.`,
+    )
+    return
+  }
+
+  const columns = [{ value: (s) => s.repo.dir }, { value: (s) => s.branch, style: (s, t) => pc.dim(t) }]
+  const widths = columnWidths(stale, columns)
+  const choices = stale.map((s) => ({
+    name: formatRow(s, columns, widths),
+    value: s,
+    checked: true,
+  }))
+
+  const selected = await checkbox({
+    message: 'Pick stale bump branches to delete locally (their PR is already merged):',
+    pageSize: 20,
+    theme: promptTheme,
+    choices,
+  })
+
+  if (selected.length === 0) {
+    console.log(pc.dim('Nothing selected.'))
+    return
+  }
+
+  const proceed = await confirm({
+    message: `Delete ${selected.length} local branch(es)? Only the local branch pointer goes away — the commits are already merged into the default branch.`,
+    default: true,
+  })
+  if (!proceed) {
+    console.log(pc.dim('Cancelled.'))
+    return
+  }
+
+  for (const { repo, branch } of selected) {
+    const result = git(repo.path, ['branch', '-d', branch])
+    if (result.ok) ok(`${repo.dir}: deleted local branch ${branch}.`)
+    else fail(`${repo.dir}: could not delete ${branch} (git branch -d failed — it may not be fully merged locally).`)
+  }
+}
+
 function checkNode() {
   const [major] = process.versions.node.split('.').map(Number)
   if (major >= 20) {

package/src/commands/list.js

@@ -1,6 +1,5 @@
 import pc from 'picocolors'
 import { discoverRepos, inspectRepos } from '../repos.js'
-import { MASTER_BRANCH } from '../config.js'
 import { loadConfig } from '../loadConfig.js'
 import { tagName, tagExistsAsync } from '../tags.js'
 import { releaseExistsAsync } from '../release.js'
@@ -41,7 +40,7 @@ export async function listCommand({ configPath, quick = false, showPath = false,
     {
       label: 'Branch',
       value: (r) => r.branch ?? '(detached)',
-      style: (r, text) => (r.branch === MASTER_BRANCH ? pc.dim(text) : pc.yellow(text)),
+      style: (r, text) => (r.branch === r.defaultBranch ? pc.dim(text) : pc.yellow(text)),
     },
     {
       label: 'Git',

package/src/commands/publish.js

@@ -5,19 +5,29 @@ import { loadConfig } from '../loadConfig.js'
 import { npm } from '../exec.js'
 import { fetchPublishedVersionAsync } from '../registry.js'
 import { selectPackages } from '../selectPackages.js'
+import { filterByNames } from '../filterByNames.js'
 import { pMap } from '../pMap.js'
-import { heading, stepHeading, ok, fail, columnWidths, formatRow } from '../ui.js'
+import { heading, stepHeading, ok, fail, warn, columnWidths, formatRow } from '../ui.js'
 
 export async function publishCommand({ configPath, packages, yes = false, dryRun = false } = {}) {
   const config = loadConfig({ configPath })
-  const repos = (await inspectRepos(discoverRepos(config))).filter((r) => r.version)
-  if (repos.length === 0) {
+  const allRepos = (await inspectRepos(discoverRepos(config))).filter((r) => r.version)
+  if (allRepos.length === 0) {
     console.log(pc.yellow('No repos found.'))
     return
   }
 
   heading('Publish to npm')
 
+  // Narrowed to --packages up front (a no-op when it wasn't given) — no
+  // reason to hit the registry for, or print the status of, packages
+  // nobody asked to publish.
+  const repos = filterByNames(allRepos, packages)
+  if (repos.length === 0) {
+    console.log(pc.dim('Nothing selected.'))
+    return
+  }
+
   console.log(pc.dim(`Checking ${repos.length} package(s) against the registry...`))
   // Each repo's registry lookup is a real network round trip — running them
   // all at once instead of one at a time is where this actually pays off.
@@ -34,7 +44,11 @@ export async function publishCommand({ configPath, packages, yes = false, dryRun
 
   const selected = await selectPackages({
     items: withRegistry,
-    packages,
+    // repos above is already the exact --packages match — passing those
+    // same dir names back through here just skips the checkbox (as
+    // before) without filterByNames re-warning about anything, since
+    // there's nothing left for it to not find.
+    packages: packages ? withRegistry.map((r) => r.dir) : undefined,
     message: 'Pick packages to publish:',
     buildChoice: (all) => {
       const columns = [
@@ -68,6 +82,8 @@ export async function publishCommand({ configPath, packages, yes = false, dryRun
     }
   }
 
+  if (!dryRun && !(await ensureNpmLogin())) return
+
   let index = 0
   for (const repo of selected) {
     index += 1
@@ -80,3 +96,24 @@ export async function publishCommand({ configPath, packages, yes = false, dryRun
     else ok(`Published ${repo.name}@${repo.version}${dryRun ? ' (dry run).' : '.'}`)
   }
 }
+
+// Without this, a batch of several packages would only find out about a
+// missing/expired npm login at the very end of the first `npm publish` —
+// after everything before it in the run (fetch, checkout, confirmation)
+// already succeeded. Checked once for the whole batch, not per package,
+// since npm auth isn't per-repo. `npm login` needs a real terminal — it
+// can open a browser for npm's web-based OTP flow, or prompt directly.
+async function ensureNpmLogin() {
+  if (npm('.', ['whoami'], { quiet: true }).ok) return true
+
+  warn('Not logged in to npm — running `npm login` first.')
+  npm('.', ['login'], { interactive: true })
+
+  if (npm('.', ['whoami'], { quiet: true }).ok) {
+    ok('Logged in to npm.')
+    return true
+  }
+
+  fail('npm login did not succeed — aborting before publishing anything.')
+  return false
+}

package/src/commands/release.js

@@ -6,19 +6,29 @@ import { tagName, tagExists } from '../tags.js'
 import { releaseExistsAsync, createRelease } from '../release.js'
 import { extractChangelogSection } from '../changelog.js'
 import { selectPackages } from '../selectPackages.js'
+import { filterByNames } from '../filterByNames.js'
 import { pMap } from '../pMap.js'
 import { heading, stepHeading, ok, fail, columnWidths, formatRow } from '../ui.js'
 
 export async function releaseCommand({ configPath, packages, yes = false, dryRun = false } = {}) {
   const config = loadConfig({ configPath })
-  const repos = (await inspectRepos(discoverRepos(config))).filter((r) => r.version)
-  if (repos.length === 0) {
+  const allRepos = (await inspectRepos(discoverRepos(config))).filter((r) => r.version)
+  if (allRepos.length === 0) {
     console.log(pc.yellow('No repos found.'))
     return
   }
 
   heading('GitHub releases')
 
+  // Narrowed to --packages up front (a no-op when it wasn't given) — no
+  // reason to check, or print the tag/release status of, packages nobody
+  // asked about.
+  const repos = filterByNames(allRepos, packages)
+  if (repos.length === 0) {
+    console.log(pc.dim('Nothing selected.'))
+    return
+  }
+
   console.log(pc.dim(`Checking ${repos.length} package(s) for a tag and an existing release...`))
   // A release always targets `v<local version>` — the tag `polyrepo bump`
   // creates. No tag for the current version means there's nothing to
@@ -48,7 +58,10 @@ export async function releaseCommand({ configPath, packages, yes = false, dryRun
 
   const selected = await selectPackages({
     items: withStatus,
-    packages,
+    // withStatus is already the exact --packages match — passing those
+    // same dir names back here just skips the checkbox without
+    // re-warning about anything (see publish.js for the same pattern).
+    packages: packages ? withStatus.map((r) => r.dir) : undefined,
     message: 'Pick packages to create a GitHub Release for:',
     buildChoice: (all) => {
       const columns = [

package/src/commands/switchMaster.js

@@ -1,14 +1,13 @@
 import { confirm } from '@inquirer/prompts'
 import pc from 'picocolors'
 import { discoverRepos, inspectRepos } from '../repos.js'
-import { MASTER_BRANCH } from '../config.js'
 import { loadConfig } from '../loadConfig.js'
 import { syncMaster } from '../masterSync.js'
 import { selectPackages } from '../selectPackages.js'
 import { heading, stepHeading, ok, fail, warn, columnWidths, formatRow } from '../ui.js'
 import { startSpinner } from '../spinner.js'
 
-export async function switchMasterCommand({ configPath, packages, yes = false } = {}) {
+export async function switchMasterCommand({ configPath, packages, yes = false, force = false } = {}) {
   const config = loadConfig({ configPath })
   const discovered = discoverRepos(config)
   if (discovered.length === 0) {
@@ -16,7 +15,7 @@ export async function switchMasterCommand({ configPath, packages, yes = false }
     return
   }
 
-  heading(`Switch to ${MASTER_BRANCH}`)
+  heading('Switch to default branch')
 
   const spinner = startSpinner(`Checking ${discovered.length} package(s)...`)
   const repos = await inspectRepos(discovered)
@@ -25,16 +24,21 @@ export async function switchMasterCommand({ configPath, packages, yes = false }
   const selected = await selectPackages({
     items: repos,
     packages,
-    message: 'Pick repos to switch to master and update:',
+    message: "Pick repos to switch to their default branch and update:",
     buildChoice: (all) => {
       const columns = [{ value: (r) => r.dir }]
       const widths = columnWidths(all, columns)
       return (r) => ({
         name:
           formatRow(r, columns, widths) +
-          pc.dim(`  (currently on: ${r.branch ?? '(detached)'}${r.clean ? '' : ', dirty'})`),
+          pc.dim(
+            `  (currently on: ${r.branch ?? '(detached)'}${r.clean ? '' : ', dirty'}${
+              r.branch !== r.defaultBranch ? `, default: ${r.defaultBranch}` : ''
+            })`,
+          ) +
+          (force && !r.clean ? pc.red('  will discard uncommitted changes') : ''),
         value: r,
-        checked: r.branch !== MASTER_BRANCH,
+        checked: r.branch !== r.defaultBranch,
       })
     },
   })
@@ -44,10 +48,15 @@ export async function switchMasterCommand({ configPath, packages, yes = false }
     return
   }
 
+  const dirtyCount = selected.filter((r) => !r.clean).length
+
   if (!yes) {
     const proceed = await confirm({
-      message: `Switch ${selected.length} repo(s) to ${MASTER_BRANCH} and fast-forward?`,
-      default: true,
+      message:
+        force && dirtyCount > 0
+          ? `Switch ${selected.length} repo(s) to their default branch — ${dirtyCount} of them dirty, their uncommitted changes will be permanently discarded. Continue?`
+          : `Switch ${selected.length} repo(s) to their default branch and fast-forward?`,
+      default: !force,
     })
     if (!proceed) {
       console.log(pc.dim('Cancelled.'))
@@ -60,17 +69,21 @@ export async function switchMasterCommand({ configPath, packages, yes = false }
     index += 1
     stepHeading(index, selected.length, repo.dir)
 
-    if (!repo.clean) {
+    if (!repo.clean && !force) {
       warn(`Working tree is dirty — skipping to avoid discarding local changes.`)
       continue
     }
 
-    const result = syncMaster(repo)
+    const result = syncMaster(repo, { force })
     if (!result.ok) {
       fail(result.message)
       continue
     }
 
-    ok(`Now on ${MASTER_BRANCH}, up to date with origin.`)
+    ok(
+      force && !repo.clean
+        ? `Discarded local changes — now on ${repo.defaultBranch}, matching origin.`
+        : `Now on ${repo.defaultBranch}, up to date with origin.`,
+    )
   }
 }

package/src/commands/tag.js

@@ -5,27 +5,37 @@ import { loadConfig } from '../loadConfig.js'
 import { syncMaster } from '../masterSync.js'
 import { tagName, tagExists, tagExistsAsync, createAndPushTag } from '../tags.js'
 import { selectPackages } from '../selectPackages.js'
+import { filterByNames } from '../filterByNames.js'
 import { pMap } from '../pMap.js'
 import { heading, stepHeading, ok, fail, columnWidths, formatRow } from '../ui.js'
 import { releaseOne } from './release.js'
 
 // For packages whose version was bumped outside `polyrepo bump` (or before `bump`
 // started tagging), there's no `v<version>` tag yet — `polyrepo release` refuses
-// to touch those. This puts just the tag on the current version, on
-// master's current tip, without touching the version number or opening a
-// PR — no need to bump again just to get a tag. Offers to release
-// right after, since "I just caught this package's tag up" and "I want a
-// release for it" are almost always the same reason to run this.
+// to touch those. This puts just the tag on the current version, on the
+// default branch's current tip, without touching the version number or
+// opening a PR — no need to bump again just to get a tag. Offers to
+// release right after, since "I just caught this package's tag up" and "I
+// want a release for it" are almost always the same reason to run this.
 export async function tagCommand({ configPath, packages, yes = false, dryRun = false, release = false } = {}) {
   const config = loadConfig({ configPath })
-  const repos = (await inspectRepos(discoverRepos(config))).filter((r) => r.version)
-  if (repos.length === 0) {
+  const allRepos = (await inspectRepos(discoverRepos(config))).filter((r) => r.version)
+  if (allRepos.length === 0) {
     console.log(pc.yellow('No repos found.'))
     return
   }
 
   heading('Tag current versions')
 
+  // Narrowed to --packages up front (a no-op when it wasn't given) — no
+  // reason to check, or print the tag status of, packages nobody asked
+  // about.
+  const repos = filterByNames(allRepos, packages)
+  if (repos.length === 0) {
+    console.log(pc.dim('Nothing selected.'))
+    return
+  }
+
   console.log(pc.dim(`Checking ${repos.length} package(s) for an existing tag...`))
   const withTag = await pMap(repos, async (r) => {
     const tag = tagName(r.version)
@@ -36,7 +46,10 @@ export async function tagCommand({ configPath, packages, yes = false, dryRun = f
 
   const selected = await selectPackages({
     items: withTag,
-    packages,
+    // withTag is already the exact --packages match — passing those same
+    // dir names back here just skips the checkbox without re-warning
+    // about anything (see publish.js for the same pattern).
+    packages: packages ? withTag.map((r) => r.dir) : undefined,
     message: 'Pick packages to tag at their current version:',
     buildChoice: (all) => {
       const columns = [
@@ -80,7 +93,7 @@ export async function tagCommand({ configPath, packages, yes = false, dryRun = f
       fail(syncResult.message)
       continue
     }
-    ok('master is up to date.')
+    ok(`${repo.defaultBranch} is up to date.`)
 
     // Re-checked here (not just trusting the table above) in case it
     // changed between listing and now — same reasoning as bump's

package/src/config.js

@@ -1,5 +1,14 @@
-export const MASTER_BRANCH = 'master'
-
 export function bumpBranchName(version) {
   return `${version}-version-bump`
 }
+
+// The inverse check — used by `doctor --clean-branches` to recognize a
+// leftover bump branch among a repo's local branches without knowing
+// which version it was for. Matches whatever bumpBranchName can produce:
+// a semver-ish version (optionally with a pre-release/build suffix, same
+// as bumpVersion's output) followed by "-version-bump".
+const BUMP_BRANCH_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?-version-bump$/
+
+export function isBumpBranchName(name) {
+  return BUMP_BRANCH_PATTERN.test(name)
+}

package/src/github.js

@@ -19,7 +19,7 @@ function findPr(repo, branch, state) {
 // Figures out where a previous (possibly interrupted) bump attempt for this
 // exact branch left off, so a re-run resumes instead of failing on
 // "branch already exists" or opening a duplicate PR:
-//   - 'merged'   — the PR already landed; only a local master sync is left.
+//   - 'merged'   — the PR already landed; only a local default-branch sync is left.
 //   - 'open'     — a PR exists and just needs merging.
 //   - 'branch'   — the branch was pushed but no PR was ever opened.
 //   - 'fresh'    — nothing exists yet, do the full flow.