polyrepo-cli 1.0.1 → 1.0.2

package/README.md

@@ -23,12 +23,16 @@ with `--dry-run` before anything actually changes.
 - **`prs`** — one table of every open pull request across every
   package (`gh pr list`) — useful after an interrupted `bump` run to
   see what's still waiting to be merged.
-- **`doctor`** — a one-command health check: is the environment set up
-  correctly (Node/git/gh/npm, authentication), and does any local
-  package still depend on an incompatible version of another local
-  package.
-- **`switch-master`** — fast-forward selected repos to an up-to-date
-  `master`.
+- **`doctor`** — a one-command health check: environment (Node/git/gh/npm,
+  authentication), branch health (default-branch name drift, stale
+  remote-tracking refs, divergence from origin, detached `HEAD`,
+  missing branch protection, leftover `bump` branches — with a few
+  safe, non-destructive self-repairs along the way, and
+  `--clean-branches` for an interactive local-branch cleanup), and
+  cross-package dependency drift.
+- **`switch-master`** — fast-forward selected repos to their up-to-date
+  default branch, whatever it's actually named (`master`, `main`, or
+  anything else — detected per repo, not assumed).
 - **`bump`** — bump a package's version (patch by default, or
   `--minor`/`--major`) through a branch → PR → merge, then tag the
   release. Safe to re-run if a previous attempt was interrupted
@@ -265,21 +269,77 @@ polyrepo prs
 polyrepo prs --packages vue-toast-kit,os-detect
 ```
 
-### `polyrepo doctor`
+### `polyrepo doctor [options]`
 
-A read-only health check in three sections:
+A health check in seven sections — mostly read-only diagnosis, plus a
+few small, non-destructive self-repairs:
 
 1. **Environment** — Node.js version (20+ required), whether
    `git`/`gh`/`npm` are on `PATH`, and whether `gh`/`npm` are
    authenticated (npm auth is only a warning — it's only needed for
    `publish`).
 2. **Config** — how many packages the current config actually
-   resolves to, and which repos are dirty or off `master`.
-3. **Cross-package dependencies** — the same dependency-drift check
+   resolves to, and which repos are dirty, in a detached `HEAD` state,
+   or off their default branch.
+3. **Remote sync** — two related repairs, both per-repo pointer
+   refreshes that never touch a file, branch, or commit:
+   - compares each repo's locally cached default-branch name (the
+     same value `switch-master`/`bump`/`tag` all use — see
+     `switch-master` above) against what GitHub actually reports
+     right now. Git never refreshes that local cache on its own, so
+     renaming a repo's default branch on GitHub after it was cloned
+     would otherwise go unnoticed by every other command forever —
+     wherever it's drifted, this fixes it with `git remote set-head
+     origin --auto`;
+   - runs `git remote prune origin` on every repo, dropping local
+     `remotes/origin/x` refs left over for branches already deleted
+     on GitHub (these tend to accumulate — every PR branch a `bump`
+     or manual workflow ever created and later got deleted on GitHub
+     leaves one behind locally until pruned).
+
+   Both are skipped for a repo GitHub can't be reached for (offline,
+   or `gh` not authenticated).
+4. **Branch sync** — fetches and compares each repo's local default
+   branch against `origin/<default>`: **diverged** (both ahead and
+   behind — a fast-forward won't work, needs resolving by hand),
+   **behind only** (safe to fast-forward with `switch-master`), or
+   **ahead only** (local commits not yet pushed). Surfaces this
+   before some other command trips over it mid-run instead of after.
+5. **Branch protection** — whether each repo's default branch
+   actually has GitHub branch protection enabled right now.
+   Report-only; enabling protection is a policy decision, not
+   something this fixes on your behalf.
+6. **Stale bump branches** — `bump` merges through a PR with the
+   branch intentionally left on origin (`--delete-branch=false`, see
+   `bump` above), so every completed bump leaves a local branch copy
+   behind too, forever. This reports how many local branches match
+   `<version>-version-bump` **and** already have a merged PR.
+   `--clean-branches` turns that into a checkbox — pick which ones to
+   delete locally (`git branch -d`, which refuses instead of forcing
+   if a branch somehow isn't actually fully merged locally; the
+   branch on origin is never touched, deleting that is out of scope
+   here — it's more sensitive shared state).
+7. **Cross-package dependencies** — the same dependency-drift check
    that runs at the end of `bump`, available on demand without
    bumping anything.
 
-Worth running first if any other command is behaving unexpectedly.
+Worth running first if any other command is behaving unexpectedly, any
+time you rename a default branch on GitHub, or just periodically to
+catch accumulated cruft (stale remote-tracking refs, leftover bump
+branches) before it piles up.
+
+**Options:**
+
+| Flag | What it does |
+| --- | --- |
+| `--clean-branches` | After scanning, show a checkbox of local bump branches whose PR is already merged; delete the ones you pick. |
+
+```bash
+polyrepo doctor
+
+# also review and clean up leftover local bump branches
+polyrepo doctor --clean-branches
+```
 
 ```bash
 polyrepo doctor
@@ -287,22 +347,55 @@ polyrepo doctor
 
 ### `polyrepo switch-master` (alias `sm`)
 
-1. Shows a checkbox list of every repo with its current branch; repos
-   not currently on `master` are pre-selected.
+Each repo's **default branch is detected per repo**, not assumed —
+GitHub itself defaults a new repo to `main`, and plenty of people
+rename it (`master` included), so a mixed folder of repos can easily
+have some on `master` and some on `main`. Detection prefers the
+locally cached `origin/HEAD` ref (no network — set by `git clone`),
+falls back to asking origin directly (`git ls-remote --symref`,
+read-only), then to whichever of `master`/`main` exists as a local
+branch, and finally to `main` (GitHub's own default) if nothing else
+could tell it.
+
+1. Shows a checkbox list of every repo with its current branch (and
+   its default branch, when the two differ); repos not currently on
+   their default branch are pre-selected.
 2. After confirming, for each selected repo, one at a time (each
    step's result prints immediately, not after the whole batch):
    - a dirty working tree is skipped with a warning, untouched;
-   - otherwise: `git fetch origin` → `git checkout master` →
-     `git merge --ff-only origin/master`.
-3. If local `master` has diverged from `origin/master` (fast-forward
+   - otherwise: `git fetch origin` → `git checkout <default branch>` →
+     `git merge --ff-only origin/<default branch>`.
+3. If the local default branch has diverged from origin (fast-forward
    isn't possible), that repo is reported and left alone to resolve by
-   hand — no `--force`/`reset --hard` is ever used.
+   hand.
+
+`--force` changes step 2 and 3 for every selected repo: a dirty
+working tree is no longer skipped, and each repo gets
+`git checkout -f <default branch>` + `git reset --hard
+origin/<default branch>` instead of the safe fast-forward-only merge —
+uncommitted changes to tracked files and any local-only commits on
+that branch are permanently discarded (untracked files are left
+alone, this isn't `git clean`). The checkbox marks which selected
+repos would lose changes, and the proceed confirmation says how many
+and defaults to "No" instead of "Yes" whenever `--force` would
+actually discard something.
+
+**Options:**
+
+| Flag | What it does |
+| --- | --- |
+| `--packages <a,b,c>` | Package list instead of the interactive checkbox. |
+| `--yes` | Skip the "proceed?" confirmation. |
+| `--force` | Discard uncommitted changes and local-only commits on the default branch, hard-resetting it to origin. |
 
 ```bash
 polyrepo switch-master
 
 # no checkbox, specific repos, no confirmation — for scripts
 polyrepo switch-master --packages vue-toast-kit,os-detect --yes
+
+# discard local changes on a repo you don't need anymore
+polyrepo switch-master --packages vue-toast-kit --force
 ```
 
 ### `polyrepo bump [options]`
@@ -313,15 +406,17 @@ polyrepo switch-master --packages vue-toast-kit,os-detect --yes
    the parts below it to `0`, same as any semver tool). Packages
    with a dirty working tree are marked — they'll be skipped. The
    highlighted package's description shows what's actually changed
-   since the last git tag (`git log <tag>..master`) — if that's empty,
-   there's probably nothing worth bumping. These previews are computed
-   for every package in parallel, not one at a time.
+   since the last git tag (`git log <tag>..<default branch>`) — if
+   that's empty, there's probably nothing worth bumping. These
+   previews are computed for every package in parallel, not one at a
+   time.
 2. After confirming, for each selected package, one at a time, with
    live progress:
-   1. `git fetch origin` → `git checkout master` →
-      `git merge --ff-only origin/master` (the bump branch is always
-      created from an up-to-date master, not whatever branch the repo
-      happened to be on);
+   1. `git fetch origin` → `git checkout <default branch>` →
+      `git merge --ff-only origin/<default branch>` (the bump branch
+      is always created from an up-to-date default branch — detected
+      per repo, see `switch-master` above — not whatever branch the
+      repo happened to be on);
    2. **checks the state of a previous attempt** — is there already a
       merged PR, an open PR, or just a pushed branch named
       `<new-version>-version-bump` (e.g. `1.2.10-version-bump` — the
@@ -329,8 +424,8 @@ polyrepo switch-master --packages vue-toast-kit,os-detect --yes
       different bumps never collide). Depending on what's found, it
       resumes from the right place instead of failing on "branch
       already exists" or opening a duplicate PR:
-      - **already merged** — nothing to do (master was already synced
-        in step 1), go straight to tagging;
+      - **already merged** — nothing to do (the default branch was
+        already synced in step 1), go straight to tagging;
       - **open PR exists** — merge that one, don't open a new one;
       - **branch pushed, no PR** — reuse the branch, open a PR;
       - **nothing exists** — the full flow from scratch.
@@ -344,7 +439,8 @@ polyrepo switch-master --packages vue-toast-kit,os-detect --yes
       review, not a finished changelog. Packages without a
       `CHANGELOG.md` don't get one created. Both files are committed
       together;
-   4. `gh pr create` against `master` (if there isn't one already);
+   4. `gh pr create` against the default branch (if there isn't one
+      already);
    5. with `--wait-checks`: wait for the PR's CI checks via
       `gh pr checks --watch` (with a real terminal, live-updating). No
       checks configured isn't an error — there's just nothing to wait
@@ -352,9 +448,9 @@ polyrepo switch-master --packages vue-toast-kit,os-detect --yes
       skip the merge;
    6. `gh pr merge --merge` — through a PR, not a direct push, since
       these repos require it;
-   7. `git checkout master` → `git fetch origin` →
-      `git merge --ff-only origin/master` — local master is synced to
-      the just-merged PR;
+   7. `git checkout <default branch>` → `git fetch origin` →
+      `git merge --ff-only origin/<default branch>` — local default
+      branch is synced to the just-merged PR;
    8. **git tag** `v<new-version>` (e.g. `v1.2.10`) is created and
       pushed if it doesn't already exist (idempotent, like everything
       else here — a re-run won't try to create it twice).
@@ -458,9 +554,9 @@ it again or opening a PR:
    pre-selected; already-tagged ones can still be picked manually
    (harmless — it just confirms the tag is there).
 3. After confirming, for each selected package, one at a time:
-   `git fetch`/`checkout master`/`merge --ff-only` (tags an up-to-date
-   master, same as `bump`), then creates and pushes the tag if it's
-   missing.
+   `git fetch`/`checkout <default branch>`/`merge --ff-only` (tags an
+   up-to-date default branch, same as `bump`), then creates and pushes
+   the tag if it's missing.
 4. If at least one package was actually tagged (and it wasn't a
    `--dry-run`), it asks: "Create a GitHub Release for the N
    package(s) just tagged?" — answering yes runs the same process as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polyrepo-cli",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Interactive CLI for managing a folder of local npm package repos: version bumps through a PR, npm publish, GitHub releases, and cross-package dependency drift checks — all from one tool.",
   "type": "module",
   "bin": {

package/src/changes.js

@@ -1,21 +1,21 @@
-import { MASTER_BRANCH } from './config.js'
 import { git, gitAsync } from './exec.js'
 import { pMap } from './pMap.js'
 
 const PREVIEW_LIMIT = 5
 
-// Summarizes what changed on local master since the last `v*` tag (or the
-// last few commits if there's no tag yet), so the bump checklist can show
-// whether a package actually has anything worth releasing. Reflects local
-// repo state — run `polyrepo switch-master` first if it might be stale. Run
-// through pMap across many repos at once (see describeRecentChangesForAll)
-// — this builds the bump checkbox's preview, and waiting on 3 sequential
-// git calls per repo, 17 times over, added up to a real pause before the
-// prompt even appeared.
+// Summarizes what changed on the local default branch since the last `v*`
+// tag (or the last few commits if there's no tag yet), so the bump
+// checklist can show whether a package actually has anything worth
+// releasing. Reflects local repo state — run `polyrepo switch-master`
+// first if it might be stale. Run through pMap across many repos at once
+// (see describeRecentChangesForAll) — this builds the bump checkbox's
+// preview, and waiting on 3 sequential git calls per repo, 17 times over,
+// added up to a real pause before the prompt even appeared.
 async function describeRecentChangesAsync(repo) {
-  const tagResult = await gitAsync(repo.path, ['describe', '--tags', '--abbrev=0', '--match', 'v*', MASTER_BRANCH])
+  const branch = repo.defaultBranch
+  const tagResult = await gitAsync(repo.path, ['describe', '--tags', '--abbrev=0', '--match', 'v*', branch])
   const sinceTag = tagResult.ok ? tagResult.stdout : null
-  const range = sinceTag ? `${sinceTag}..${MASTER_BRANCH}` : MASTER_BRANCH
+  const range = sinceTag ? `${sinceTag}..${branch}` : branch
 
   const [countResult, logResult] = await Promise.all([
     gitAsync(repo.path, ['rev-list', '--count', range]),
@@ -34,9 +34,9 @@ export function describeRecentChangesForAll(repos, concurrency) {
 // Uncapped commit list from the last `v*` tag to HEAD — used right before
 // committing a version bump (see bump.js) to draft a CHANGELOG.md entry, so
 // unlike describeRecentChanges (capped for a preview) this needs the whole
-// list. Uses HEAD rather than MASTER_BRANCH because it's called from
-// exactly where that matters: after checking out the bump branch, whose
-// HEAD is master's tip at that point anyway.
+// list. Uses HEAD rather than the repo's default branch because it's
+// called from exactly where that matters: after checking out the bump
+// branch, whose HEAD is the default branch's tip at that point anyway.
 export function fullCommitLinesSince(repo) {
   const tagResult = git(repo.path, ['describe', '--tags', '--abbrev=0', '--match', 'v*', 'HEAD'], { quiet: true })
   const sinceTag = tagResult.ok ? tagResult.stdout : null

package/src/commands/bump.js

@@ -2,7 +2,7 @@ import fs from 'node:fs'
 import { confirm } from '@inquirer/prompts'
 import pc from 'picocolors'
 import { discoverRepos, inspectRepos, readPackageJson } from '../repos.js'
-import { MASTER_BRANCH, bumpBranchName } from '../config.js'
+import { bumpBranchName } from '../config.js'
 import { loadConfig } from '../loadConfig.js'
 import { bumpVersion, replaceVersionInText } from '../version.js'
 import { git } from '../exec.js'
@@ -84,7 +84,7 @@ export async function bumpCommand({
 
   if (!yes) {
     const proceed = await confirm({
-      message: `Bump ${selected.length} package(s), open a PR, and merge each into ${MASTER_BRANCH}?${
+      message: `Bump ${selected.length} package(s), open a PR, and merge each into its default branch?${
         dryRun ? ' (dry run — no changes will actually be pushed)' : ''
       }`,
       default: true,
@@ -113,7 +113,7 @@ async function bumpOne(repo, { dryRun, waitChecks }) {
 
   const syncResult = syncMaster(repo)
   if (!syncResult.ok) return fail(syncResult.message)
-  ok(`${MASTER_BRANCH} is up to date.`)
+  ok(`${repo.defaultBranch} is up to date.`)
 
   const branchName = bumpBranchName(repo.newVersion)
   const state = detectBumpState(repo, branchName)
@@ -172,7 +172,7 @@ async function bumpOne(repo, { dryRun, waitChecks }) {
 
     if (state.status !== 'open') {
       const prResult = createPr(repo, {
-        base: MASTER_BRANCH,
+        base: repo.defaultBranch,
         branch: branchName,
         title: `chore: bump version to ${repo.newVersion}`,
         body: `Bump version: ${repo.version} → ${repo.newVersion}.`,
@@ -195,9 +195,9 @@ async function bumpOne(repo, { dryRun, waitChecks }) {
 
     const resyncResult = syncMaster(repo)
     if (!resyncResult.ok) return fail(resyncResult.message)
-    ok(`Local ${MASTER_BRANCH} synced to origin at ${repo.newVersion}.`)
+    ok(`Local ${repo.defaultBranch} synced to origin at ${repo.newVersion}.`)
   } else {
-    ok(`Already merged as PR #${state.pr.number} — ${MASTER_BRANCH} already has it.`)
+    ok(`Already merged as PR #${state.pr.number} — ${repo.defaultBranch} already has it.`)
   }
 
   const tag = tagName(repo.newVersion)
@@ -213,8 +213,9 @@ async function bumpOne(repo, { dryRun, waitChecks }) {
 // Reuse a local branch left over from a previous attempt if there is one,
 // otherwise track the remote branch if a previous attempt got as far as
 // pushing it, otherwise create it fresh from the current (just-synced)
-// master. Trying "reuse" first before falling back is what makes this safe
-// to call again after any partial failure without any state bookkeeping.
+// default branch. Trying "reuse" first before falling back is what makes
+// this safe to call again after any partial failure without any state
+// bookkeeping.
 function checkoutBumpBranch(repo, branchName) {
   if (git(repo.path, ['checkout', branchName], { quiet: true }).ok) {
     return { ok: true, reused: true }

package/src/commands/doctor.js

@@ -1,12 +1,15 @@
+import { checkbox, confirm } from '@inquirer/prompts'
 import pc from 'picocolors'
 import { discoverRepos, inspectRepos } from '../repos.js'
 import { loadConfig } from '../loadConfig.js'
-import { run } from '../exec.js'
+import { run, git, gitAsync, ghAsync } from '../exec.js'
 import { findStaleLocalDeps } from '../crossDeps.js'
-import { heading, ok, fail, warn } from '../ui.js'
+import { isBumpBranchName } from '../config.js'
+import { pMap } from '../pMap.js'
+import { heading, ok, fail, warn, columnWidths, formatRow, promptTheme } from '../ui.js'
 import { startSpinner } from '../spinner.js'
 
-export async function doctorCommand({ configPath } = {}) {
+export async function doctorCommand({ configPath, cleanBranches = false } = {}) {
   heading('Environment')
   checkNode()
   checkGit()
@@ -28,10 +31,42 @@ export async function doctorCommand({ configPath } = {}) {
     if (dirty.length > 0) {
       warn(`${dirty.length} repo(s) have uncommitted changes: ${dirty.map((r) => r.dir).join(', ')}`)
     }
-    const offMaster = repos.filter((r) => r.branch !== 'master')
-    if (offMaster.length > 0) {
-      warn(`${offMaster.length} repo(s) are not on master: ${offMaster.map((r) => r.dir).join(', ')}`)
+    const detached = repos.filter((r) => r.branch === null)
+    if (detached.length > 0) {
+      warn(`${detached.length} repo(s) are in a detached HEAD state: ${detached.map((r) => r.dir).join(', ')}`)
     }
+    const offDefault = repos.filter((r) => r.branch !== null && r.branch !== r.defaultBranch)
+    if (offDefault.length > 0) {
+      warn(`${offDefault.length} repo(s) are not on their default branch: ${offDefault.map((r) => r.dir).join(', ')}`)
+    }
+  }
+
+  heading('Remote sync')
+  if (repos.length > 0) {
+    await checkRemoteSync(repos)
+  } else {
+    console.log(pc.dim('Skipped — no packages discovered.'))
+  }
+
+  heading('Branch sync')
+  if (repos.length > 0) {
+    await checkBranchSync(repos)
+  } else {
+    console.log(pc.dim('Skipped — no packages discovered.'))
+  }
+
+  heading('Branch protection')
+  if (repos.length > 0) {
+    await checkBranchProtection(repos)
+  } else {
+    console.log(pc.dim('Skipped — no packages discovered.'))
+  }
+
+  heading('Stale bump branches')
+  if (repos.length > 0) {
+    await checkStaleBumpBranches(repos, { cleanBranches })
+  } else {
+    console.log(pc.dim('Skipped — no packages discovered.'))
   }
 
   heading('Cross-package dependencies')
@@ -51,6 +86,237 @@ export async function doctorCommand({ configPath } = {}) {
   }
 }
 
+// Every other command trusts the locally cached `origin/HEAD` ref as the
+// fast, no-network path for "what's this repo's default branch" (see
+// detectDefaultBranchAsync in repos.js) — but git never refreshes that
+// cache on its own, so if the default branch gets renamed on GitHub after
+// a repo was cloned, every command would keep using the old name forever
+// with nothing to notice or fix it. This repairs it with `git remote
+// set-head origin --auto` wherever it's drifted — a safe, non-destructive
+// pointer refresh, not a change to any file, branch, or commit. Bundled
+// with `git remote prune origin` (same "keep local remote-tracking state
+// honest" spirit): drops local `remotes/origin/x` refs for branches
+// already deleted on GitHub — also just local bookkeeping, touches
+// nothing shared.
+async function checkRemoteSync(repos) {
+  const spinner = startSpinner(`Checking ${repos.length} package(s) against GitHub, and pruning stale remote-tracking refs...`)
+  const results = await pMap(repos, async (r) => {
+    const ghResult = await ghAsync(r.path, [
+      'repo',
+      'view',
+      '--json',
+      'defaultBranchRef',
+      '-q',
+      '.defaultBranchRef.name',
+    ])
+    const actual = ghResult.ok && ghResult.stdout ? ghResult.stdout : null
+
+    const pruneResult = await gitAsync(r.path, ['remote', 'prune', 'origin'])
+    const pruned = pruneResult.ok ? [...pruneResult.stdout.matchAll(/\[pruned\] origin\/(\S+)/g)].map((m) => m[1]) : []
+
+    return { repo: r, actual, pruned }
+  })
+  spinner.stop()
+
+  const checked = results.filter((r) => r.actual)
+  if (checked.length === 0) {
+    console.log(pc.dim('Default branch: skipped — could not reach GitHub for any package (offline, or `gh` not authenticated).'))
+  } else {
+    const drifted = checked.filter((r) => r.actual !== r.repo.defaultBranch)
+    for (const { repo, actual } of drifted) {
+      const fixResult = git(repo.path, ['remote', 'set-head', 'origin', '--auto'])
+      if (fixResult.ok) {
+        ok(`${repo.dir}: local cache said "${repo.defaultBranch}", GitHub says "${actual}" — refreshed the local cache.`)
+      } else {
+        fail(`${repo.dir}: local cache said "${repo.defaultBranch}", GitHub says "${actual}" — could not refresh it (git remote set-head failed).`)
+      }
+    }
+    if (drifted.length === 0) {
+      ok(`${checked.length} package(s) checked — local default-branch cache matches GitHub.`)
+    }
+    const uncheckedCount = repos.length - checked.length
+    if (uncheckedCount > 0) {
+      console.log(pc.dim(`  (${uncheckedCount} package(s) could not be checked against GitHub.)`))
+    }
+  }
+
+  const pruned = results.filter((r) => r.pruned.length > 0)
+  if (pruned.length > 0) {
+    for (const { repo, pruned: branches } of pruned) {
+      ok(`${repo.dir}: pruned ${branches.length} stale remote-tracking ref(s) (${branches.join(', ')}).`)
+    }
+  } else {
+    ok('No stale remote-tracking refs to prune.')
+  }
+}
+
+// Whether each repo's local default branch actually matches origin —
+// surfaced here proactively so it's known before a `switch-master` run
+// fails partway on a fast-forward it can't do, or before `bump`/`tag`
+// build a branch from a base that isn't what it looks like locally.
+async function checkBranchSync(repos) {
+  const spinner = startSpinner(`Fetching and comparing ${repos.length} package(s) against origin...`)
+  const results = await pMap(repos, async (r) => {
+    const fetchResult = await gitAsync(r.path, ['fetch', 'origin'])
+    if (!fetchResult.ok) return { repo: r, error: 'git fetch failed' }
+
+    const branch = r.defaultBranch
+    const countResult = await gitAsync(r.path, ['rev-list', '--left-right', '--count', `${branch}...origin/${branch}`])
+    if (!countResult.ok) return { repo: r, error: `no local branch "${branch}" to compare` }
+
+    const [ahead, behind] = countResult.stdout.split(/\s+/).map(Number)
+    return { repo: r, ahead, behind }
+  })
+  spinner.stop()
+
+  for (const { repo, error } of results.filter((r) => r.error)) {
+    warn(`${repo.dir}: could not check sync status (${error}).`)
+  }
+
+  const withCounts = results.filter((r) => !r.error)
+  const diverged = withCounts.filter((r) => r.ahead > 0 && r.behind > 0)
+  const behindOnly = withCounts.filter((r) => r.ahead === 0 && r.behind > 0)
+  const aheadOnly = withCounts.filter((r) => r.ahead > 0 && r.behind === 0)
+  const inSync = withCounts.filter((r) => r.ahead === 0 && r.behind === 0)
+
+  for (const { repo, ahead, behind } of diverged) {
+    warn(
+      `${repo.dir}: diverged from origin/${repo.defaultBranch} — ${ahead} local commit(s) not on origin, ${behind} commit(s) behind. A fast-forward won't work; resolve by hand.`,
+    )
+  }
+  if (behindOnly.length > 0) {
+    warn(
+      `${behindOnly.length} repo(s) are behind origin (safe to fast-forward with \`polyrepo switch-master\`): ${behindOnly
+        .map((r) => r.repo.dir)
+        .join(', ')}`,
+    )
+  }
+  if (aheadOnly.length > 0) {
+    console.log(
+      pc.dim(
+        `${aheadOnly.length} repo(s) have local commits not yet pushed to origin: ${aheadOnly.map((r) => r.repo.dir).join(', ')}`,
+      ),
+    )
+  }
+  if (inSync.length === withCounts.length && withCounts.length > 0) {
+    ok(`${inSync.length} package(s) checked — all in sync with origin.`)
+  }
+}
+
+// Not auto-fixable — enabling branch protection is a deliberate policy
+// choice (required reviewers, status checks, etc.), not something to
+// configure on someone's behalf. Just surfaces it, since this whole tool
+// assumes every managed repo requires a PR to reach its default branch.
+async function checkBranchProtection(repos) {
+  const spinner = startSpinner(`Checking ${repos.length} package(s) for branch protection...`)
+  const results = await pMap(repos, async (r) => {
+    const result = await ghAsync(r.path, ['api', `repos/{owner}/{repo}/branches/${r.defaultBranch}`, '--jq', '.protected'])
+    return result.ok && result.stdout ? { repo: r, protected: result.stdout === 'true' } : null
+  })
+  spinner.stop()
+
+  const checked = results.filter(Boolean)
+  if (checked.length === 0) {
+    console.log(pc.dim('Skipped — could not reach GitHub for any package (offline, or `gh` not authenticated).'))
+    return
+  }
+
+  const unprotected = checked.filter((r) => !r.protected)
+  for (const { repo } of unprotected) {
+    warn(`${repo.dir}: default branch "${repo.defaultBranch}" has no branch protection — pushes/merges to it aren't guarded.`)
+  }
+  if (unprotected.length === 0) {
+    ok(`${checked.length} package(s) checked — default branch is protected on all of them.`)
+  }
+
+  const uncheckedCount = repos.length - checked.length
+  if (uncheckedCount > 0) {
+    console.log(pc.dim(`  (${uncheckedCount} package(s) could not be checked against GitHub.)`))
+  }
+}
+
+// `bump` merges through a PR with --delete-branch=false (see github.js),
+// so every completed bump leaves its branch behind, locally and on
+// origin, forever. This only ever offers to delete the *local* copy —
+// deleting the one on origin is more sensitive shared state, not
+// something to fold into an opt-in local cleanup.
+async function findStaleBumpBranches(repos) {
+  const perRepo = await pMap(repos, async (r) => {
+    const branchesResult = await gitAsync(r.path, ['for-each-ref', 'refs/heads', '--format=%(refname:short)'])
+    if (!branchesResult.ok) return []
+    const candidates = branchesResult.stdout.split('\n').filter(Boolean).filter(isBumpBranchName)
+    if (candidates.length === 0) return []
+
+    const withStatus = await pMap(candidates, async (branch) => {
+      const prResult = await ghAsync(r.path, ['pr', 'list', '--head', branch, '--state', 'merged', '--json', 'number'])
+      let merged = false
+      if (prResult.ok && prResult.stdout) {
+        try {
+          merged = JSON.parse(prResult.stdout).length > 0
+        } catch {
+          merged = false
+        }
+      }
+      return { repo: r, branch, merged }
+    })
+    return withStatus.filter((b) => b.merged)
+  })
+  return perRepo.flat()
+}
+
+async function checkStaleBumpBranches(repos, { cleanBranches }) {
+  const spinner = startSpinner(`Checking ${repos.length} package(s) for leftover bump branches with a merged PR...`)
+  const stale = await findStaleBumpBranches(repos)
+  spinner.stop()
+
+  if (stale.length === 0) {
+    ok('No stale bump branches found.')
+    return
+  }
+
+  if (!cleanBranches) {
+    warn(
+      `${stale.length} stale bump branch(es) found across ${new Set(stale.map((s) => s.repo.dir)).size} package(s) — run \`polyrepo doctor --clean-branches\` to review and delete them.`,
+    )
+    return
+  }
+
+  const columns = [{ value: (s) => s.repo.dir }, { value: (s) => s.branch, style: (s, t) => pc.dim(t) }]
+  const widths = columnWidths(stale, columns)
+  const choices = stale.map((s) => ({
+    name: formatRow(s, columns, widths),
+    value: s,
+    checked: true,
+  }))
+
+  const selected = await checkbox({
+    message: 'Pick stale bump branches to delete locally (their PR is already merged):',
+    pageSize: 20,
+    theme: promptTheme,
+    choices,
+  })
+
+  if (selected.length === 0) {
+    console.log(pc.dim('Nothing selected.'))
+    return
+  }
+
+  const proceed = await confirm({
+    message: `Delete ${selected.length} local branch(es)? Only the local branch pointer goes away — the commits are already merged into the default branch.`,
+    default: true,
+  })
+  if (!proceed) {
+    console.log(pc.dim('Cancelled.'))
+    return
+  }
+
+  for (const { repo, branch } of selected) {
+    const result = git(repo.path, ['branch', '-d', branch])
+    if (result.ok) ok(`${repo.dir}: deleted local branch ${branch}.`)
+    else fail(`${repo.dir}: could not delete ${branch} (git branch -d failed — it may not be fully merged locally).`)
+  }
+}
+
 function checkNode() {
   const [major] = process.versions.node.split('.').map(Number)
   if (major >= 20) {

package/src/commands/list.js

@@ -1,6 +1,5 @@
 import pc from 'picocolors'
 import { discoverRepos, inspectRepos } from '../repos.js'
-import { MASTER_BRANCH } from '../config.js'
 import { loadConfig } from '../loadConfig.js'
 import { tagName, tagExistsAsync } from '../tags.js'
 import { releaseExistsAsync } from '../release.js'
@@ -41,7 +40,7 @@ export async function listCommand({ configPath, quick = false, showPath = false,
     {
       label: 'Branch',
       value: (r) => r.branch ?? '(detached)',
-      style: (r, text) => (r.branch === MASTER_BRANCH ? pc.dim(text) : pc.yellow(text)),
+      style: (r, text) => (r.branch === r.defaultBranch ? pc.dim(text) : pc.yellow(text)),
     },
     {
       label: 'Git',

package/src/commands/switchMaster.js

@@ -1,14 +1,13 @@
 import { confirm } from '@inquirer/prompts'
 import pc from 'picocolors'
 import { discoverRepos, inspectRepos } from '../repos.js'
-import { MASTER_BRANCH } from '../config.js'
 import { loadConfig } from '../loadConfig.js'
 import { syncMaster } from '../masterSync.js'
 import { selectPackages } from '../selectPackages.js'
 import { heading, stepHeading, ok, fail, warn, columnWidths, formatRow } from '../ui.js'
 import { startSpinner } from '../spinner.js'
 
-export async function switchMasterCommand({ configPath, packages, yes = false } = {}) {
+export async function switchMasterCommand({ configPath, packages, yes = false, force = false } = {}) {
   const config = loadConfig({ configPath })
   const discovered = discoverRepos(config)
   if (discovered.length === 0) {
@@ -16,7 +15,7 @@ export async function switchMasterCommand({ configPath, packages, yes = false }
     return
   }
 
-  heading(`Switch to ${MASTER_BRANCH}`)
+  heading('Switch to default branch')
 
   const spinner = startSpinner(`Checking ${discovered.length} package(s)...`)
   const repos = await inspectRepos(discovered)
@@ -25,16 +24,21 @@ export async function switchMasterCommand({ configPath, packages, yes = false }
   const selected = await selectPackages({
     items: repos,
     packages,
-    message: 'Pick repos to switch to master and update:',
+    message: "Pick repos to switch to their default branch and update:",
     buildChoice: (all) => {
       const columns = [{ value: (r) => r.dir }]
       const widths = columnWidths(all, columns)
       return (r) => ({
         name:
           formatRow(r, columns, widths) +
-          pc.dim(`  (currently on: ${r.branch ?? '(detached)'}${r.clean ? '' : ', dirty'})`),
+          pc.dim(
+            `  (currently on: ${r.branch ?? '(detached)'}${r.clean ? '' : ', dirty'}${
+              r.branch !== r.defaultBranch ? `, default: ${r.defaultBranch}` : ''
+            })`,
+          ) +
+          (force && !r.clean ? pc.red('  will discard uncommitted changes') : ''),
         value: r,
-        checked: r.branch !== MASTER_BRANCH,
+        checked: r.branch !== r.defaultBranch,
       })
     },
   })
@@ -44,10 +48,15 @@ export async function switchMasterCommand({ configPath, packages, yes = false }
     return
   }
 
+  const dirtyCount = selected.filter((r) => !r.clean).length
+
   if (!yes) {
     const proceed = await confirm({
-      message: `Switch ${selected.length} repo(s) to ${MASTER_BRANCH} and fast-forward?`,
-      default: true,
+      message:
+        force && dirtyCount > 0
+          ? `Switch ${selected.length} repo(s) to their default branch — ${dirtyCount} of them dirty, their uncommitted changes will be permanently discarded. Continue?`
+          : `Switch ${selected.length} repo(s) to their default branch and fast-forward?`,
+      default: !force,
     })
     if (!proceed) {
       console.log(pc.dim('Cancelled.'))
@@ -60,17 +69,21 @@ export async function switchMasterCommand({ configPath, packages, yes = false }
     index += 1
     stepHeading(index, selected.length, repo.dir)
 
-    if (!repo.clean) {
+    if (!repo.clean && !force) {
       warn(`Working tree is dirty — skipping to avoid discarding local changes.`)
       continue
     }
 
-    const result = syncMaster(repo)
+    const result = syncMaster(repo, { force })
     if (!result.ok) {
       fail(result.message)
       continue
     }
 
-    ok(`Now on ${MASTER_BRANCH}, up to date with origin.`)
+    ok(
+      force && !repo.clean
+        ? `Discarded local changes — now on ${repo.defaultBranch}, matching origin.`
+        : `Now on ${repo.defaultBranch}, up to date with origin.`,
+    )
   }
 }

package/src/commands/tag.js

@@ -12,11 +12,11 @@ import { releaseOne } from './release.js'
 
 // For packages whose version was bumped outside `polyrepo bump` (or before `bump`
 // started tagging), there's no `v<version>` tag yet — `polyrepo release` refuses
-// to touch those. This puts just the tag on the current version, on
-// master's current tip, without touching the version number or opening a
-// PR — no need to bump again just to get a tag. Offers to release
-// right after, since "I just caught this package's tag up" and "I want a
-// release for it" are almost always the same reason to run this.
+// to touch those. This puts just the tag on the current version, on the
+// default branch's current tip, without touching the version number or
+// opening a PR — no need to bump again just to get a tag. Offers to
+// release right after, since "I just caught this package's tag up" and "I
+// want a release for it" are almost always the same reason to run this.
 export async function tagCommand({ configPath, packages, yes = false, dryRun = false, release = false } = {}) {
   const config = loadConfig({ configPath })
   const allRepos = (await inspectRepos(discoverRepos(config))).filter((r) => r.version)
@@ -93,7 +93,7 @@ export async function tagCommand({ configPath, packages, yes = false, dryRun = f
       fail(syncResult.message)
       continue
     }
-    ok('master is up to date.')
+    ok(`${repo.defaultBranch} is up to date.`)
 
     // Re-checked here (not just trusting the table above) in case it
     // changed between listing and now — same reasoning as bump's

package/src/config.js

@@ -1,5 +1,14 @@
-export const MASTER_BRANCH = 'master'
-
 export function bumpBranchName(version) {
   return `${version}-version-bump`
 }
+
+// The inverse check — used by `doctor --clean-branches` to recognize a
+// leftover bump branch among a repo's local branches without knowing
+// which version it was for. Matches whatever bumpBranchName can produce:
+// a semver-ish version (optionally with a pre-release/build suffix, same
+// as bumpVersion's output) followed by "-version-bump".
+const BUMP_BRANCH_PATTERN = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?-version-bump$/
+
+export function isBumpBranchName(name) {
+  return BUMP_BRANCH_PATTERN.test(name)
+}

package/src/github.js

@@ -19,7 +19,7 @@ function findPr(repo, branch, state) {
 // Figures out where a previous (possibly interrupted) bump attempt for this
 // exact branch left off, so a re-run resumes instead of failing on
 // "branch already exists" or opening a duplicate PR:
-//   - 'merged'   — the PR already landed; only a local master sync is left.
+//   - 'merged'   — the PR already landed; only a local default-branch sync is left.
 //   - 'open'     — a PR exists and just needs merging.
 //   - 'branch'   — the branch was pushed but no PR was ever opened.
 //   - 'fresh'    — nothing exists yet, do the full flow.

package/src/index.js

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { Command } from 'commander'
 import pc from 'picocolors'
 import { listCommand } from './commands/list.js'
@@ -14,6 +17,12 @@ import { outdatedCommand } from './commands/outdated.js'
 import { prsCommand } from './commands/prs.js'
 import { cloneCommand } from './commands/clone.js'
 
+// Read once from package.json rather than a literal string here — the two
+// silently drifted apart before (this file said 1.0.0 while package.json
+// had already moved to 1.0.1).
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const { version: CLI_VERSION } = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'))
+
 const program = new Command()
 
 const PACKAGES_OPTION = [
@@ -85,9 +94,9 @@ function wrapText(text, width) {
 program
   .name('polyrepo')
   .description(
-    'Manage local npm package repos: pick which directories to scan (setup), clone missing ones from GitHub (clone), see their state (list), outdated dependencies (outdated), or open PRs (prs), run a health check (doctor), keep them on an up-to-date master (switch-master), release a version through a PR (bump), publish to npm (publish), tag an already-current version (tag), create GitHub Releases (release), or run any command across every repo (exec).',
+    'Manage local npm package repos: pick which directories to scan (setup), clone missing ones from GitHub (clone), see their state (list), outdated dependencies (outdated), or open PRs (prs), run a health check (doctor), keep them on an up-to-date default branch (switch-master), release a version through a PR (bump), publish to npm (publish), tag an already-current version (tag), create GitHub Releases (release), or run any command across every repo (exec).',
   )
-  .version('1.0.0')
+  .version(CLI_VERSION)
   .option(
     '--config <path>',
     'Path to a polyrepo.config.json listing roots/packages to scan (default: polyrepo.config.json next to this CLI).',
@@ -115,7 +124,7 @@ Examples:
   $ polyrepo list                               Show version + branch for every package
   $ polyrepo outdated                           Show outdated dependencies across every package
   $ polyrepo prs                                List open pull requests across every package
-  $ polyrepo switch-master                      Update selected repos to the latest master
+  $ polyrepo switch-master                      Update selected repos to their latest default branch
   $ polyrepo bump --dry-run                     Preview a version bump, nothing is pushed
   $ polyrepo bump --minor --packages a,b --yes  Bump specific packages' minor version, non-interactively
   $ polyrepo publish                            Publish packages that are ahead of the registry
@@ -285,41 +294,101 @@ Examples:
 
 program
   .command('doctor')
-  .description('Check environment (node/git/gh/npm, auth), config, and cross-package dependency drift.')
+  .description('Check environment, config, branch health, and dependency drift — with a few safe self-repairs.')
+  .option(
+    '--clean-branches',
+    'After scanning, show a checkbox of local bump branches whose PR is already merged, and delete the ones you pick.',
+  )
   .addHelpText(
     'after',
     `
-Read-only. Three sections: Environment (is Node.js new enough, are git/gh/npm
-on PATH and authenticated), Config (does polyrepo.config.json resolve to any
-packages, which repos are dirty or off master), and Cross-package
-dependencies (does any local package's dependencies/devDependencies/
-peerDependencies range no longer match another local package's current
-version — e.g. after a \`bump\` that package's own package.json wasn't
-updated for). Run this first if any other command is behaving strangely.
+Seven sections. Most are read-only diagnosis; three include a small,
+non-destructive self-repair:
+
+  Environment           Node.js version, git/gh/npm on PATH and authenticated.
+  Config                how many packages the config resolves to; which are
+                        dirty, in a detached HEAD state, or off their
+                        default branch.
+  Remote sync           compares each repo's locally cached default-branch
+                        name against what GitHub reports right now — git
+                        never refreshes that cache on its own, so a rename
+                        on GitHub would otherwise go unnoticed by every
+                        other command forever; drifted ones are fixed with
+                        \`git remote set-head origin --auto\`. Also runs
+                        \`git remote prune origin\` on every repo, dropping
+                        local refs for branches already deleted on GitHub.
+                        Both are pointer-only fixes — no file, branch, or
+                        commit is ever touched.
+  Branch sync           fetches and compares each repo's local default
+                        branch against origin: diverged (needs manual
+                        resolution), behind only (safe to fast-forward with
+                        \`switch-master\`), or ahead only (unpushed local
+                        commits) — surfaced before a command trips over it.
+  Branch protection     whether each repo's default branch actually has
+                        GitHub branch protection enabled. Report-only —
+                        enabling protection is a policy choice, not
+                        something to set on your behalf.
+  Stale bump branches   \`bump\` merges through a PR with the branch left on
+                        origin (see \`bump\` above), so a local copy sticks
+                        around too. Reports how many have an already-merged
+                        PR; \`--clean-branches\` turns that into a checkbox
+                        to delete the local ones you pick (\`git branch -d\`
+                        — never the branch on origin, and refuses instead
+                        of forcing if a branch isn't actually fully merged
+                        locally).
+  Cross-package deps    does any local package's dependency range no longer
+                        match another local package's current version.
+
+Run this first if any other command is behaving strangely, and any time
+you rename a branch on GitHub or want to check for accumulated cruft.
 
 Examples:
   $ polyrepo doctor
+  $ polyrepo doctor --clean-branches
 `,
   )
-  .action(() => doctorCommand({ configPath: program.opts().config }))
+  .action((opts) =>
+    doctorCommand({
+      configPath: program.opts().config,
+      cleanBranches: Boolean(opts.cleanBranches),
+    }),
+  )
 
 program
   .command('switch-master')
   .alias('sm')
-  .description('Pick repos and switch each to an up-to-date master.')
+  .description('Pick repos and switch each to its up-to-date default branch.')
   .option(...PACKAGES_OPTION)
   .option(...YES_OPTION)
+  .option(
+    '--force',
+    "Discard uncommitted changes and any local-only commits on a repo's default branch, hard-resetting it to match origin.",
+  )
   .addHelpText(
     'after',
     `
-For each selected repo: fetch, checkout master, fast-forward-only merge.
-A repo with uncommitted changes is skipped with a warning, never touched.
-If local master has diverged from origin (fast-forward impossible), that
-repo is reported and left alone for you to resolve by hand.
+Each repo's default branch is detected per repo (from origin — GitHub
+defaults new repos to "main", but plenty of people rename it, "master"
+included, so this never assumes one name for every repo). For each
+selected repo: fetch, checkout its default branch, fast-forward-only
+merge. A repo with uncommitted changes is skipped with a warning, never
+touched. If the local default branch has diverged from origin
+(fast-forward impossible), that repo is reported and left alone for you
+to resolve by hand.
+
+--force changes this: dirty repos are no longer skipped, and every
+selected repo gets \`git checkout -f <default branch>\` + \`git reset --hard
+origin/<default branch>\` instead of the safe fast-forward-only merge —
+uncommitted changes to tracked files and any local-only commits on that
+branch are permanently discarded (untracked files are left alone, this
+isn't \`git clean\`). The proceed confirmation says how many selected
+repos are dirty and defaults to "No" when --force would actually discard
+something.
 
 Examples:
   $ polyrepo switch-master
   $ polyrepo sm --packages vue-toast-kit,os-detect --yes
+  $ polyrepo sm --packages vue-toast-kit --force   Discard its local changes and hard-reset to origin
 `,
   )
   .action((opts) =>
@@ -327,12 +396,13 @@ Examples:
       configPath: program.opts().config,
       packages: opts.packages ? opts.packages.split(',') : undefined,
       yes: Boolean(opts.yes),
+      force: Boolean(opts.force),
     }),
   )
 
 program
   .command('bump')
-  .description('Pick packages, bump their version (patch by default), PR, merge to master, and tag.')
+  .description('Pick packages, bump their version (patch by default), PR, merge to the default branch, and tag.')
   .option('--dry-run', 'Print every step without pushing, opening, merging, or tagging anything for real.')
   .option('--minor', 'Bump the minor version instead of patch (e.g. 1.2.9 → 1.3.0).')
   .option('--major', 'Bump the major version instead of patch (e.g. 1.2.9 → 2.0.0).')
@@ -421,9 +491,10 @@ program
     `
 For a package whose version was bumped some other way (not through
 \`polyrepo bump\`, or before it started tagging) — puts the \`v<version>\` tag on
-master's current tip, no version change and no PR, so \`polyrepo release\` has
-something to work from. Re-syncs master first for each package, same as
-\`bump\` does. Already-tagged packages are shown but unchecked by default
+its default branch's current tip, no version change and no PR, so
+\`polyrepo release\` has something to work from. Re-syncs the default branch
+first for each package, same as \`bump\` does. Already-tagged packages are
+shown but unchecked by default
 (picking one anyway just confirms the tag is there, harmless). After
 tagging, asks whether to create a GitHub Release right away for whatever
 was just tagged (same as running \`polyrepo release\` for exactly those

package/src/masterSync.js

@@ -1,18 +1,35 @@
-import { MASTER_BRANCH } from './config.js'
 import { git } from './exec.js'
 
-// fetch → checkout master → fast-forward-only merge. Always run for real
-// (never skipped under --dry-run) since it's read-only/reversible and
-// downstream logic needs an accurate picture of where master actually is.
-export function syncMaster(repo) {
+// fetch → checkout the repo's default branch → fast-forward-only merge.
+// Always run for real (never skipped under --dry-run) since it's
+// read-only/reversible and downstream logic needs an accurate picture of
+// where the default branch actually is. Uses `repo.defaultBranch`
+// (detected per repo — see repos.js's detectDefaultBranchAsync) rather
+// than assuming "master", since that isn't universal.
+//
+// `force: true` (only `switch-master --force` sets this) trades the safe
+// fast-forward-only merge for `checkout -f` + `reset --hard` — it discards
+// any uncommitted changes to tracked files and any local commits the
+// default branch has that origin doesn't, unconditionally. Untracked
+// files are left alone (this isn't `git clean`). Callers that don't pass
+// it keep the original safe behavior — bump/tag rely on that, they never
+// force.
+export function syncMaster(repo, { force = false } = {}) {
+  const branch = repo.defaultBranch
   if (!git(repo.path, ['fetch', 'origin']).ok) {
     return { ok: false, message: 'git fetch origin failed.' }
   }
-  if (!git(repo.path, ['checkout', MASTER_BRANCH]).ok) {
-    return { ok: false, message: `git checkout ${MASTER_BRANCH} failed.` }
+  if (!git(repo.path, ['checkout', ...(force ? ['-f'] : []), branch]).ok) {
+    return { ok: false, message: `git checkout ${branch} failed.` }
   }
-  if (!git(repo.path, ['merge', '--ff-only', `origin/${MASTER_BRANCH}`]).ok) {
-    return { ok: false, message: `Local ${MASTER_BRANCH} has diverged from origin — resolve manually.` }
+  if (force) {
+    if (!git(repo.path, ['reset', '--hard', `origin/${branch}`]).ok) {
+      return { ok: false, message: `git reset --hard origin/${branch} failed.` }
+    }
+    return { ok: true }
+  }
+  if (!git(repo.path, ['merge', '--ff-only', `origin/${branch}`]).ok) {
+    return { ok: false, message: `Local ${branch} has diverged from origin — resolve manually.` }
   }
   return { ok: true }
 }

package/src/repos.js

@@ -16,6 +16,44 @@ function toEntry(dirPath) {
   }
 }
 
+// GitHub itself defaults a new repo to "main", and plenty of people rename
+// it back to "master" (or something else) — there's no one right answer,
+// so this is only the last resort once nothing else could tell us.
+const FALLBACK_DEFAULT_BRANCH = 'main'
+
+async function readCachedOriginHead(repo) {
+  const result = await gitAsync(repo.path, ['symbolic-ref', 'refs/remotes/origin/HEAD'])
+  if (!result.ok || !result.stdout) return null
+  const match = result.stdout.match(/^refs\/remotes\/origin\/(.+)$/)
+  return match ? match[1] : null
+}
+
+// Detected once per repo (cached alongside branch/clean below) rather than
+// assumed — a mixed folder of repos can easily have some on "master" and
+// some on "main". In order:
+//   1. the locally cached origin/HEAD ref — set by `git clone` (or a prior
+//      `git remote set-head`), no network needed, the common case;
+//   2. otherwise ask origin directly, read-only (`git ls-remote --symref`
+//      doesn't write any local ref, unlike `git remote set-head --auto`);
+//   3. offline or no working origin — guess from whichever of
+//      master/main actually exists as a local branch;
+//   4. still nothing to go on — GitHub's own default, "main".
+export async function detectDefaultBranchAsync(repo) {
+  const cached = await readCachedOriginHead(repo)
+  if (cached) return cached
+
+  const remoteHead = await gitAsync(repo.path, ['ls-remote', '--symref', 'origin', 'HEAD'])
+  const remoteMatch = remoteHead.ok && remoteHead.stdout.match(/^ref:\s*refs\/heads\/(\S+)\s+HEAD/m)
+  if (remoteMatch) return remoteMatch[1]
+
+  for (const candidate of ['master', 'main']) {
+    const exists = await gitAsync(repo.path, ['show-ref', '--verify', '--quiet', `refs/heads/${candidate}`])
+    if (exists.ok) return candidate
+  }
+
+  return FALLBACK_DEFAULT_BRANCH
+}
+
 // `config.roots` — folders whose direct subdirectories are packages (the
 // original C:\work\NPM-style layout). `config.packages` — individual
 // package folders given directly, for a one-off repo that doesn't live
@@ -76,18 +114,19 @@ export function readPackageJson(repo) {
 }
 
 // Full snapshot used everywhere a package list is shown: name, version,
-// current branch, and whether the working tree has uncommitted changes.
-// The two git calls per repo run concurrently across repos (see pMap)
-// instead of one repo waiting on the last.
+// current branch, its default branch, and whether the working tree has
+// uncommitted changes. The git calls per repo run concurrently across
+// repos (see pMap) instead of one repo waiting on the last.
 export async function inspectRepoAsync(repo) {
   const pkg = readPackageJson(repo)
-  const [branchResult, statusResult] = await Promise.all([
+  const [branchResult, statusResult, defaultBranch] = await Promise.all([
     gitAsync(repo.path, ['branch', '--show-current']),
     gitAsync(repo.path, ['status', '--porcelain']),
+    detectDefaultBranchAsync(repo),
   ])
   const branch = branchResult.ok ? branchResult.stdout || null : null
   const clean = statusResult.ok && statusResult.stdout === ''
-  return { ...repo, ...pkg, branch, clean }
+  return { ...repo, ...pkg, branch, clean, defaultBranch }
 }
 
 export function inspectRepos(repos, concurrency) {

package/test/config.test.js

@@ -0,0 +1,22 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { bumpBranchName, isBumpBranchName } from '../src/config.js'
+
+test('isBumpBranchName recognizes what bumpBranchName produces', () => {
+  assert.equal(isBumpBranchName(bumpBranchName('1.2.10')), true)
+  assert.equal(isBumpBranchName(bumpBranchName('0.0.1')), true)
+  assert.equal(isBumpBranchName(bumpBranchName('10.20.30')), true)
+})
+
+test('isBumpBranchName recognizes a pre-release/build suffix', () => {
+  assert.equal(isBumpBranchName('1.2.10-beta.1-version-bump'), true)
+  assert.equal(isBumpBranchName('1.2.10+build.5-version-bump'), true)
+})
+
+test('isBumpBranchName rejects unrelated branch names', () => {
+  assert.equal(isBumpBranchName('main'), false)
+  assert.equal(isBumpBranchName('feature/add-thing'), false)
+  assert.equal(isBumpBranchName('1.2.10-version-bump-extra'), false)
+  assert.equal(isBumpBranchName('version-bump'), false)
+  assert.equal(isBumpBranchName('v1.2.10-version-bump'), false)
+})