diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5a87902b..765d2322 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,15 +10,15 @@ on:
 jobs:
   format:
     runs-on: ubuntu-latest
-    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
-    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
+    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
+    if: (github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          # For pull_request_target, explicitly checkout the PR head
+          # For pull_request_target, explicitly checkout the PR head (for security)
+          # For regular pull_request and workflow_dispatch, checkout action uses defaults
           ref: ${{ github.event.pull_request.head.sha }}
-          # Only checkout PR code if it's from the same repo (safe for release-please)
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
@@ -35,15 +35,15 @@ jobs:
 
   lint:
     runs-on: ubuntu-latest
-    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
-    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
+    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
+    if: (github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          # For pull_request_target, explicitly checkout the PR head
+          # For pull_request_target, explicitly checkout the PR head (for security)
+          # For regular pull_request and workflow_dispatch, checkout action uses defaults
           ref: ${{ github.event.pull_request.head.sha }}
-          # Only checkout PR code if it's from the same repo (safe for release-please)
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
@@ -60,15 +60,15 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
-    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
-    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
+    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
+    if: (github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          # For pull_request_target, explicitly checkout the PR head
+          # For pull_request_target, explicitly checkout the PR head (for security)
+          # For regular pull_request and workflow_dispatch, checkout action uses defaults
           ref: ${{ github.event.pull_request.head.sha }}
-          # Only checkout PR code if it's from the same repo (safe for release-please)
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
@@ -86,15 +86,15 @@ jobs:
   test:
     runs-on: ubuntu-latest
     needs: build
-    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
-    if: github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
+    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
+    if: (github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
-          # For pull_request_target, explicitly checkout the PR head
+          # For pull_request_target, explicitly checkout the PR head (for security)
+          # For regular pull_request and workflow_dispatch, checkout action uses defaults
           ref: ${{ github.event.pull_request.head.sha }}
-          # Only checkout PR code if it's from the same repo (safe for release-please)
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup Node.js
@@ -120,8 +120,8 @@ jobs:
   ready-to-merge:
     runs-on: ubuntu-latest
     needs: [format, lint, build, test]
-    # Only run from pull_request_target if it's a release-please branch, otherwise skip (to avoid duplicate runs)
-    if: always() && (github.event_name == 'pull_request' || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch')
+    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
+    if: always() && ((github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch')
     steps:
       - name: Check all jobs passed
         run: |
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index cceffce8..01c79d95 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -33,19 +33,18 @@ jobs:
             mcp
             devbox
             blueprint
+            main
             snapshot
             config
             auth
-            ui
             deps
           # Ensure the subject starts with a lowercase letter
           subjectPattern: ^(?![A-Z]).+$
           subjectPatternError: |
             The subject "{subject}" found in the pull request title "{title}"
             should start with a lowercase letter.
-            
+
             Examples:
             - feat: add new devbox command
             - fix(cli): resolve argument parsing issue
             - docs: update README with usage examples
-