feat: branch protection + deps caching

main.ts

@@ -169,9 +169,18 @@ export async function main(): Promise<MainResult> {
     const modes = computeModes(agentId);
     const outputSchema = resolveOutputSchema();
 
+    let defaultBranch = "main";
+    try {
+      const repoData = await gitea.request(
+        "GET /repos/{owner}/{repo}",
+        { owner: repoContext.owner, repo: repoContext.name }
+      );
+      defaultBranch = (repoData.data as { default_branch?: string }).default_branch ?? "main";
+    } catch { /* keep "main" fallback */ }
+
     toolContext = {
       agentId,
-      repo: repoContext,
+      repo: { ...repoContext, defaultBranch },
       payload,
       gitea,
       gitToken: botToken,
@@ -185,17 +194,6 @@ export async function main(): Promise<MainResult> {
       tmpdir,
     };
 
-    let defaultBranch: string | undefined;
-    try {
-      const repoData = await gitea.request(
-        "GET /repos/{owner}/{repo}",
-        { owner: repoContext.owner, repo: repoContext.name }
-      );
-      defaultBranch = (repoData.data as { default_branch?: string }).default_branch;
-    } catch {
-      defaultBranch = "main";
-    }
-
     await using mcpHttpServer = await startMcpHttpServer(toolContext, { outputSchema });
     toolContext.mcpServerUrl = mcpHttpServer.url;
     log.info(`» MCP server started at ${mcpHttpServer.url}`);
@@ -205,7 +203,7 @@ export async function main(): Promise<MainResult> {
 
     const instructions = resolveInstructions({
       payload,
-      repo: { owner: repoContext.owner, name: repoContext.name, ...(defaultBranch ? { defaultBranch } : {}) },
+      repo: { owner: repoContext.owner, name: repoContext.name, defaultBranch },
       modes,
       agentId,
       outputSchema,