@devrouter/cli 0.0.23 → 0.0.24

package/dist/{dev.js → devrouter.js}

@@ -158,32 +158,32 @@ This folder is managed by the devrouter CLI.
 
 ## Commands
 
-- dev init [--write-agents] [--write-skill] [--with-linear]
-- dev -V [--repo <path>] (installed/local version + next upgrade)
-- dev upgrade [version] [--repo <path>]
-- dev setup --yes [--repo <path>] [--json]
-- dev up
-- dev down
-- dev status
-- dev doctor
-- dev ls
-- dev open <name>
-- dev logs [-f] [--tail N]
-- dev repo init
-- dev repo inspect [--repo <path>] [--json]
-- dev repo devcontainer write [--repo <path>] [--dry-run] [--yes] [--json]
-- dev repo devcontainer verify [--repo <path>] [--live] [--yes] [--json]
-- dev repo agents [--with-linear]
-- dev app add --name <name> --host <host.localhost> --protocol <http|tcp> --runtime <host|docker>
-- dev app run <name>
-- dev app exec <name> [--shell] [--env <env>] -- <command>
-- dev app ls
-- dev app rm <name>
-- dev tls install
+- devrouter init [--write-agents] [--write-skill] [--with-linear]
+- devrouter -V [--repo <path>] (installed/local version + next upgrade)
+- devrouter upgrade [version] [--repo <path>]
+- devrouter setup --yes [--repo <path>] [--json]
+- devrouter up
+- devrouter down
+- devrouter status
+- devrouter doctor
+- devrouter ls
+- devrouter open <name>
+- devrouter logs [-f] [--tail N]
+- devrouter repo init
+- devrouter repo inspect [--repo <path>] [--json]
+- devrouter repo devcontainer write [--repo <path>] [--dry-run] [--yes] [--json]
+- devrouter repo devcontainer verify [--repo <path>] [--live] [--yes] [--json]
+- devrouter repo agents [--with-linear]
+- devrouter app add --name <name> --host <host.localhost> --protocol <http|tcp> --runtime <host|docker>
+- devrouter app run <name>
+- devrouter app exec <name> [--shell] [--env <env>] -- <command>
+- devrouter app ls
+- devrouter app rm <name>
+- devrouter tls install
 
 ## Troubleshooting
 
-If dev up fails with port conflicts on 80/443 (or TCP protocol ports), run:
+If devrouter up fails with port conflicts on 80/443 (or TCP protocol ports), run:
 
 - lsof -nP -iTCP:80 -sTCP:LISTEN
 - lsof -nP -iTCP:443 -sTCP:LISTEN
@@ -552,7 +552,14 @@ function listHostRouteState() {
       return [];
     }
     return parsed.filter((item) => item && typeof item === "object").map((item) => item);
-  } catch {
+  } catch (err) {
+    const error = err;
+    if (error.code !== "ENOENT") {
+      process.stderr.write(
+        `Warning: devrouter host routes state file is corrupted or unreadable (${error.message}). Recreating route state.
+`
+      );
+    }
     return [];
   }
 }
@@ -1536,7 +1543,7 @@ function buildOnboardingPrompt(options = {}) {
     "",
     "Top-level .devrouter.yml schema:",
     "- version: 1 (required)",
-    "- devrouter.version: semantic version string (recommended; required for `dev -V`/`dev upgrade`)",
+    "- devrouter.version: semantic version string (recommended; required for `devrouter -V`/`devrouter upgrade`)",
     "- project.name: string (optional)",
     `- secretManager.command: string (optional; SM command including trailing \`--\` boundary; supports \`${SECRET_MANAGER_ENV_PLACEHOLDER}\` template placeholder)`,
     `- secretManager.defaultEnv: string (optional; fallback env for \`${SECRET_MANAGER_ENV_PLACEHOLDER}\` template; required when command contains \`${SECRET_MANAGER_ENV_PLACEHOLDER}\`)`,
@@ -1603,20 +1610,20 @@ function buildOnboardingPrompt(options = {}) {
     '- Example healthcheck for postgres: `test: ["CMD-SHELL", "pg_isready -U <user> -d <db>"]` with `interval: 5s`, `timeout: 3s`, `retries: 20`.',
     "",
     "Runtime behavior to account for:",
-    "- Docker dependencies can be auto-started by dev app run.",
-    "- dev app run waits for Docker dependencies to become healthy before starting the host or docker app.",
-    "- Docker dependencies are automatically stopped when a host app exits (Ctrl+C or error); docker app services remain running until explicit cleanup (`docker compose down`, `dev down`, or equivalent).",
+    "- Docker dependencies can be auto-started by devrouter app run.",
+    "- devrouter app run waits for Docker dependencies to become healthy before starting the host or docker app.",
+    "- Docker dependencies are automatically stopped when a host app exits (Ctrl+C or error); docker app services remain running until explicit cleanup (`docker compose down`, `devrouter down`, or equivalent).",
     "- Recent dependency logs (last 20 lines) are printed after dependencies start.",
     "- Host-runtime dependencies are NOT auto-started in v1 (must be started manually).",
-    "- kind=dependency entries are dependency-only: they do not create routes and cannot be direct targets for `dev app run`, `dev app exec`, or `dev open`.",
+    "- kind=dependency entries are dependency-only: they do not create routes and cannot be direct targets for `devrouter app run`, `devrouter app exec`, or `devrouter open`.",
     "- kind=dependency services are started/stopped as declared in compose (no Traefik labels added, no env/port injection).",
     `- For TCP dependencies of host apps, devrouter publishes a random host port and injects per-dep deterministic vars: \`{PREFIX}_HOST=localhost\`, \`{PREFIX}_PORT=<port>\`, \`{PREFIX}_URL\` (protocol-specific), \`{PREFIX}_SHADOW_URL\` (postgres only). \`{PREFIX} = dep.name.toUpperCase().replace(/-/g, "_")\`.`,
     "- Config-level `envMap` on dependency references aliases per-dep vars to app-expected names. Example: `envMap: { DATABASE_URL: DB_URL }` maps per-dep `DB_URL` to `DATABASE_URL` in the app process.",
     "- If the repo's Postgres docker-compose service uses different credentials than the injected defaults (`prisma:prisma`), flag this to the user and recommend aligning the compose env vars or using `envMap` aliasing.",
     "- Postgres multiplexing on shared :5432 requires TLS/SNI (useful for psql 17+, pgAdmin, not standard app clients).",
-    "- When TLS is enabled, `dev app run` and `dev app exec` auto-refresh cert SAN coverage for configured repo hosts before startup.",
+    "- When TLS is enabled, `devrouter app run` and `devrouter app exec` auto-refresh cert SAN coverage for configured repo hosts before startup.",
     "- For TCP/Postgres, standard app frameworks should use the injected port env vars; only direct-TLS-capable tools should use sslmode=require on :5432.",
-    "- `dev app exec <name> -- <command>` starts dependencies as needed, resolves env vars, and runs a one-shot command with the resolved env. Exec stops only dependencies started by that invocation (already-running dependencies stay running). If ownership detection fails, exec leaves selected dependencies running to avoid non-owned teardown. Exec preserves argv semantics by default (`shell: false`) and supports explicit shell mode via `--shell` when needed.",
+    "- `devrouter app exec <name> -- <command>` starts dependencies as needed, resolves env vars, and runs a one-shot command with the resolved env. Exec stops only dependencies started by that invocation (already-running dependencies stay running). If ownership detection fails, exec leaves selected dependencies running to avoid non-owned teardown. Exec preserves argv semantics by default (`shell: false`) and supports explicit shell mode via `--shell` when needed.",
     "- `envMap` on dependency references (config-level) aliases per-dep vars after dependency env resolution. `envMap` fails fast when source var is missing.",
     "",
     "Workspace isolation (parallel git worktrees / agents):",
@@ -1624,11 +1631,11 @@ function buildOnboardingPrompt(options = {}) {
     "- Token resolution precedence: `--workspace <slug>` flag > `DEVROUTER_WORKSPACE` env var > auto-derived from a linked git worktree branch (sanitized: lowercase, non-alphanumeric \u2192 `-`, capped at 32 chars) > none. The primary checkout resolves to no token and routes exactly as before (fully back-compatible).",
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
-    "- Lifecycle: `dev workspace up <branch>` (create worktree + devpod + routes), `dev workspace ls` (list worktrees/tokens/route counts), `dev workspace down <workspace|branch>` (free routes + stop devpod + remove worktree). `dev doctor` reports orphaned workspace proxy routes whose worktree dir was removed without `dev workspace down`.",
+    "- Lifecycle: `devrouter workspace up <branch>` (create worktree + devpod + routes), `devrouter workspace ls` (list worktrees/tokens/route counts), `devrouter workspace down <workspace|branch>` (free routes + stop devpod + remove worktree). `devrouter doctor` reports orphaned workspace proxy routes whose worktree dir was removed without `devrouter workspace down`.",
     `- devcontainer integration: the devcontainer compose service exposes a devnet alias \`${WORKSPACE_PLACEHOLDER}-app\` (default \`WORKSPACE=<project>\` in \`devcontainer.env\`), and the proxy app uses \`upstream: ${WORKSPACE_PLACEHOLDER}-app:<port>\`. Spinning up workspace \`feat-a\` \u2192 alias \`feat-a-app\`, host \`app.feat-a.localhost\`.`,
     "",
     "Secret Manager Integration (config-based):",
-    "- Optional top-level `secretManager.command` in `.devrouter.yml` wraps `dev app run` and `dev app exec` commands with the SM command and re-applies devrouter-injected dep env vars after the SM boundary via `env KEY=VAL` prefix.",
+    "- Optional top-level `secretManager.command` in `.devrouter.yml` wraps `devrouter app run` and `devrouter app exec` commands with the SM command and re-applies devrouter-injected dep env vars after the SM boundary via `env KEY=VAL` prefix.",
     `- Example config: \`secretManager: { command: "infisical run --env ${SECRET_MANAGER_ENV_PLACEHOLDER} --", defaultEnv: "dev" }\`.`,
     `- \`${SECRET_MANAGER_ENV_PLACEHOLDER}\` template placeholder in \`secretManager.command\` is resolved at runtime. \`defaultEnv\` provides the fallback; \`--env\` CLI flag overrides it.`,
     "- When configured, the effective command becomes: `<secretManager.command> env {PREFIX}_URL=<val> ... <user-command>`.",
@@ -1641,40 +1648,40 @@ function buildOnboardingPrompt(options = {}) {
     "- Secret managers may also define DB variables. Do not assume secret-manager precedence. Confirm the effective values in the command process before migrate/seed.",
     "- For apps that require legacy names like `DATABASE_URL`, use config-level `envMap` on the dependency reference: `envMap: { DATABASE_URL: DB_URL }`.",
     "- Avoid pre-wrapper DB assignments such as `DATABASE_URI=... <wrapper> run -- ...`; wrapper-managed env may override those values.",
-    "- `dev doctor --repo <REPO_PATH>` warns on risky pre-wrapper DB assignments before `run --` for host apps that depend on postgres.",
-    "- With TLS enabled, `dev doctor --repo <REPO_PATH>` also warns on cert SAN mismatches for configured hosts (`repo.tls-host-coverage`).",
-    "- Robust one-shot migrate example (argv-safe, no nested shell quoting): `dev app exec <name> --repo <REPO_PATH> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload migrate`.",
-    "- Robust one-shot seed example: `dev app exec <name> --repo <REPO_PATH> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload seed`.",
-    "- Environment probe/debug example (run before migrations): `dev app exec <name> --repo <REPO_PATH> --yes -- printenv DB_URL DB_HOST DB_PORT DB_SHADOW_URL`.",
+    "- `devrouter doctor --repo <REPO_PATH>` warns on risky pre-wrapper DB assignments before `run --` for host apps that depend on postgres.",
+    "- With TLS enabled, `devrouter doctor --repo <REPO_PATH>` also warns on cert SAN mismatches for configured hosts (`repo.tls-host-coverage`).",
+    "- Robust one-shot migrate example (argv-safe, no nested shell quoting): `devrouter app exec <name> --repo <REPO_PATH> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload migrate`.",
+    "- Robust one-shot seed example: `devrouter app exec <name> --repo <REPO_PATH> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload seed`.",
+    "- Environment probe/debug example (run before migrations): `devrouter app exec <name> --repo <REPO_PATH> --yes -- printenv DB_URL DB_HOST DB_PORT DB_SHADOW_URL`.",
     "- Use `--shell` only when shell expansion is required; it must receive exactly one command string after `--`.",
     "- Warning: Do not run migration/seed until env probe confirms expected DB variables and values.",
     "",
     "Required workflow:",
-    "1) Run `dev setup --yes --json` for devrouter-owned machine state; use `dev doctor --repo <REPO_PATH> --json` to diagnose missing prerequisites without mutation.",
-    "2) Run `dev repo inspect --repo <REPO_PATH> --json` before editing files.",
-    "3) For the supported Node/pnpm/Postgres devcontainer shape, run `dev repo devcontainer write --repo <REPO_PATH> --dry-run --json`, review the plan, then run `dev repo devcontainer write --repo <REPO_PATH> --yes`.",
+    "1) Run `devrouter setup --yes --json` for devrouter-owned machine state; use `devrouter doctor --repo <REPO_PATH> --json` to diagnose missing prerequisites without mutation.",
+    "2) Run `devrouter repo inspect --repo <REPO_PATH> --json` before editing files.",
+    "3) For the supported Node/pnpm/Postgres devcontainer shape, run `devrouter repo devcontainer write --repo <REPO_PATH> --dry-run --json`, review the plan, then run `devrouter repo devcontainer write --repo <REPO_PATH> --yes`.",
     "4) For unsupported shapes or custom existing files, make minimal manual edits and explain the assumptions.",
-    "5) Verify static evidence with `dev repo devcontainer verify --repo <REPO_PATH> --json`; after the devcontainer is running, use `dev repo devcontainer verify --repo <REPO_PATH> --live --yes --json` for route probes.",
+    "5) Verify static evidence with `devrouter repo devcontainer verify --repo <REPO_PATH> --json`; after the devcontainer is running, use `devrouter repo devcontainer verify --repo <REPO_PATH> --live --yes --json` for route probes.",
     "6) Keep edits minimal, explicit, and idempotent. Do not modify unrelated services.",
     "7) If required info is missing or ambiguous, stop and ask targeted questions.",
     "",
     "Validation commands to run/report for the devcontainer path:",
-    "- dev setup --yes --json",
-    "- dev doctor --repo <REPO_PATH> --json",
-    "- dev repo inspect --repo <REPO_PATH> --json",
-    "- dev repo devcontainer write --repo <REPO_PATH> --dry-run --json",
-    "- dev repo devcontainer write --repo <REPO_PATH> --yes",
-    "- dev repo devcontainer verify --repo <REPO_PATH> --json",
-    "- After `devpod up <REPO_PATH>`: dev repo devcontainer verify --repo <REPO_PATH> --live --yes --json",
+    "- devrouter setup --yes --json",
+    "- devrouter doctor --repo <REPO_PATH> --json",
+    "- devrouter repo inspect --repo <REPO_PATH> --json",
+    "- devrouter repo devcontainer write --repo <REPO_PATH> --dry-run --json",
+    "- devrouter repo devcontainer write --repo <REPO_PATH> --yes",
+    "- devrouter repo devcontainer verify --repo <REPO_PATH> --json",
+    "- After `devpod up <REPO_PATH>`: devrouter repo devcontainer verify --repo <REPO_PATH> --live --yes --json",
     "",
     "Validation commands to run/report for host/docker runtime apps:",
-    "- dev setup --yes --json",
-    "- dev doctor --repo <REPO_PATH> --json",
-    "- dev app ls --repo <REPO_PATH>",
-    "- For each entry (when safe): dev app run <name> --repo <REPO_PATH> --yes",
-    "- Run one-shot commands with dep env: dev app exec <name> --repo <REPO_PATH> --yes -- <command>",
-    "- Probe effective env before migration/seed: dev app exec <name> --repo <REPO_PATH> --yes -- printenv DB_URL DB_HOST DB_PORT DB_SHADOW_URL",
-    "- dev ls",
+    "- devrouter setup --yes --json",
+    "- devrouter doctor --repo <REPO_PATH> --json",
+    "- devrouter app ls --repo <REPO_PATH>",
+    "- For each entry (when safe): devrouter app run <name> --repo <REPO_PATH> --yes",
+    "- Run one-shot commands with dep env: devrouter app exec <name> --repo <REPO_PATH> --yes -- <command>",
+    "- Probe effective env before migration/seed: devrouter app exec <name> --repo <REPO_PATH> --yes -- printenv DB_URL DB_HOST DB_PORT DB_SHADOW_URL",
+    "- devrouter ls",
     "- For HTTP entries: curl -I http://<host>",
     '- For TCP postgres entries: provide connection hint (example: psql "... sslmode=require")',
     "",
@@ -1687,8 +1694,8 @@ function buildOnboardingPrompt(options = {}) {
     "6) Unresolved questions/risks (if any).",
     "7) Definition-of-done checklist status:",
     "   - .devrouter.yml exists and validates",
-    "   - dev app ls matches expected entries",
-    "   - dev ls exposes expected endpoints",
+    "   - devrouter app ls matches expected entries",
+    "   - devrouter ls exposes expected endpoints",
     "   - HTTP routes reachable",
     "   - TCP Postgres route configured with TLS requirement noted",
     ...withLinear ? [
@@ -1705,9 +1712,9 @@ function buildOnboardingPrompt(options = {}) {
       "- While implementing Linear-tracked work, set issue status at session start and at each phase transition.",
       "- Post progress comments at meaningful checkpoints during implementation (not only at the end).",
       "- Before ending a session, post a final recap comment with completed work, remaining work, risks, and next step, then re-check status/comment freshness.",
-      "- Optional bootstrap commands for repo artifacts: `dev init --repo <REPO_PATH> --with-linear --write-agents --write-skill` or `dev repo agents --repo <REPO_PATH> --with-linear`.",
-      "- If the repository uses devrouter, keep `.devrouter.yml` metadata `devrouter.version` updated and run `dev -V` to verify installed/local versions plus the next target.",
-      "- Resolve adaptation prompts with `dev upgrade` (list targets) and `dev upgrade <version>` (target prompt), sourced from `upgrade-prompts/<version>.md` in the devrouter release."
+      "- Optional bootstrap commands for repo artifacts: `devrouter init --repo <REPO_PATH> --with-linear --write-agents --write-skill` or `devrouter repo agents --repo <REPO_PATH> --with-linear`.",
+      "- If the repository uses devrouter, keep `.devrouter.yml` metadata `devrouter.version` updated and run `devrouter -V` to verify installed/local versions plus the next target.",
+      "- Resolve adaptation prompts with `devrouter upgrade` (list targets) and `devrouter upgrade <version>` (target prompt), sourced from `upgrade-prompts/<version>.md` in the devrouter release."
     ] : [],
     "",
     renderCommandIntentSection()
@@ -1721,93 +1728,93 @@ var init_ai_prompt = __esm({
     init_repo_config();
     COMMAND_INTENTS = [
       {
-        command: "dev init [--with-linear]",
+        command: "devrouter init [--with-linear]",
         purpose: "Print the AI onboarding prompt template for a repository (non-mutating by default)."
       },
       {
-        command: "dev -V",
+        command: "devrouter -V",
         purpose: "Show installed CLI version, local repo version, and next upgrade target."
       },
       {
-        command: "dev upgrade [version]",
+        command: "devrouter upgrade [version]",
         purpose: "Show upgrade targets from .devrouter.yml devrouter.version and print target adaptation prompt."
       },
       {
-        command: "dev setup",
+        command: "devrouter setup",
         purpose: "Run first-time devrouter machine setup and report structured diagnostics."
       },
       {
-        command: "dev up",
+        command: "devrouter up",
         purpose: "Start shared Traefik and ensure the shared devnet network."
       },
-      { command: "dev down", purpose: "Stop the shared Traefik router stack." },
+      { command: "devrouter down", purpose: "Stop the shared Traefik router stack." },
       {
-        command: "dev status",
+        command: "devrouter status",
         purpose: "Show router/container/network/TLS health and bound ports."
       },
       {
-        command: "dev doctor",
+        command: "devrouter doctor",
         purpose: "Run deep diagnostics across global router state and repo config."
       },
       {
-        command: "dev ls",
+        command: "devrouter ls",
         purpose: "List active HTTP and TCP routes resolved by devrouter."
       },
       {
-        command: "dev open <name>",
+        command: "devrouter open <name>",
         purpose: "Open HTTP routes or print connection hints for TCP routes (match app/service/host)."
       },
       {
-        command: "dev tls install",
+        command: "devrouter tls install",
         purpose: "Install mkcert certs and enable TLS/HTTPS for local routing."
       },
       {
-        command: "dev repo init",
+        command: "devrouter repo init",
         purpose: "Create `.devrouter.yml` in a target repository."
       },
       {
-        command: "dev repo inspect",
+        command: "devrouter repo inspect",
         purpose: "Inspect package, scripts, compose services, env names, devcontainer, devrouter config, and agent guidance for onboarding."
       },
       {
-        command: "dev repo devcontainer write",
+        command: "devrouter repo devcontainer write",
         purpose: "Dry-run or write conservative managed Node/pnpm/Postgres devcontainer/devrouter scaffold files."
       },
       {
-        command: "dev repo devcontainer verify",
+        command: "devrouter repo devcontainer verify",
         purpose: "Emit static onboarding evidence, or live route probes with --live --yes."
       },
       {
-        command: "dev app add",
+        command: "devrouter app add",
         purpose: "Add or update one app entry in `.devrouter.yml`."
       },
-      { command: "dev app ls", purpose: "List app entries from `.devrouter.yml`." },
+      { command: "devrouter app ls", purpose: "List app entries from `.devrouter.yml`." },
       {
-        command: "dev app run [--env <env>]",
+        command: "devrouter app run [--env <env>]",
         purpose: "Run one configured app and reconcile its route at runtime (--env overrides SM defaultEnv)."
       },
       {
-        command: "dev app exec [--shell] [--env <env>]",
+        command: "devrouter app exec [--shell] [--env <env>]",
         purpose: "Run a one-shot command with resolved dependency env vars (env aliasing via config-level envMap)."
       },
       {
-        command: "dev app rm [--keep-config]",
+        command: "devrouter app rm [--keep-config]",
         purpose: "Remove one app entry from `.devrouter.yml` and free its route. `--keep-config` frees only the live route/hostname (e.g. to release one claimed by another repo) and leaves the config file untouched."
       },
       {
-        command: "dev repo agents [--with-linear]",
+        command: "devrouter repo agents [--with-linear]",
         purpose: "Write/update devrouter section in the repo's AGENTS.md and optionally add Linear workflow assets."
       },
       {
-        command: "dev workspace up <branch> [--path <dir>] [--no-devpod] [--open]",
+        command: "devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]",
         purpose: "Create a git worktree for <branch>, bring up its devpod (`devpod up --id <ws>`), and register workspace-namespaced routes."
       },
       {
-        command: "dev workspace ls [--json]",
+        command: "devrouter workspace ls [--json]",
         purpose: "List git worktrees with their resolved workspace token and active route count."
       },
       {
-        command: "dev workspace down <workspace|branch> [--keep-worktree] [--keep-devpod]",
+        command: "devrouter workspace down <workspace|branch> [--keep-worktree] [--keep-devpod]",
         purpose: "Free a workspace's routes, stop its devpod, and remove its worktree (routes are freed by state-file workspace tag, no config load)."
       }
     ];
@@ -1827,11 +1834,11 @@ function buildDevrouterSection() {
     `\`${DEVROUTER_SKILL_REL_PATH}\``,
     "",
     "Quick validation sequence:",
-    "- `dev up`",
-    "- `dev tls install` (required when repo defines tcp/postgres apps)",
-    "- `dev app ls --repo .`",
-    "- `dev app run <host-app> --repo . --yes`",
-    "- `dev ls`"
+    "- `devrouter up`",
+    "- `devrouter tls install` (required when repo defines tcp/postgres apps)",
+    "- `devrouter app ls --repo .`",
+    "- `devrouter app run <host-app> --repo . --yes`",
+    "- `devrouter ls`"
   ].join("\n");
 }
 function buildLinearWorkflowSection() {
@@ -1859,8 +1866,8 @@ function buildLinearWorkflowSection() {
     "- Re-check status and comment freshness toward/at session end before stopping.",
     "",
     "Bootstrap commands:",
-    "- `dev init --with-linear --write-agents --write-skill`",
-    "- `dev repo agents --with-linear`"
+    "- `devrouter init --with-linear --write-agents --write-skill`",
+    "- `devrouter repo agents --with-linear`"
   ].join("\n");
 }
 function yamlQuote(value) {
@@ -2034,7 +2041,7 @@ Local dev routing via a shared Traefik reverse proxy. Provides stable \`*.localh
 \`\`\`yaml
 version: 1
 devrouter:
-  version: <semver> # required for dev -V / dev upgrade
+  version: <semver> # required for devrouter -V / devrouter upgrade
 project:
   name: <string> # optional
 apps:
@@ -2067,7 +2074,7 @@ apps:
     #   protocol: tcp
     #   tcpProtocol: postgres        # selects shared entrypoint :5432
     #   upstream: <db-alias>:5432    # devnet alias of the DB container
-    # Requires \`dev tls install\` (SNI is read from the TLS ClientHello). Connect
+    # Requires \`devrouter tls install\` (SNI is read from the TLS ClientHello). Connect
     # with direct-SSL so the ClientHello carries SNI, e.g.:
     #   psql "host=db.<app>.localhost port=5432 sslmode=require sslnegotiation=direct ..."
 
@@ -2102,7 +2109,7 @@ Validation rules:
 
 - \`kind=app\`: \`host\` must end with \`.localhost\`
 - \`kind=app\`: \`runtime=host\` supports \`protocol=http\` only
-- \`kind=app\`: \`runtime=proxy\` supports \`protocol=http\` or \`protocol=tcp\`, requires \`upstream\` (\`host:port\`), and forbids \`hostRun\`/\`docker\`/\`dependencies\` (it only registers a route to an externally-managed upstream). \`protocol=tcp\` additionally requires \`tcpProtocol\` and TLS (\`dev tls install\`)
+- \`kind=app\`: \`runtime=proxy\` supports \`protocol=http\` or \`protocol=tcp\`, requires \`upstream\` (\`host:port\`), and forbids \`hostRun\`/\`docker\`/\`dependencies\` (it only registers a route to an externally-managed upstream). \`protocol=tcp\` additionally requires \`tcpProtocol\` and TLS (\`devrouter tls install\`)
 - \`kind=app\`: \`protocol=tcp\` requires \`runtime=docker\` (devrouter-managed container) or \`runtime=proxy\` (externally-managed upstream), plus a supported \`tcpProtocol\` (postgres/redis/mariadb/mysql)
 - \`kind=dependency\`: must use \`runtime=docker\` and does not allow routed fields (\`host\`/\`protocol\`/\`tcpProtocol\`/\`hostRun\`/\`docker.internalPort\`/\`docker.router\`)
 - Unknown keys rejected (strict schema)
@@ -2126,7 +2133,7 @@ healthcheck:
 
 ## Env var injection
 
-When a host app depends on a TCP Docker service, \`dev app run\` and \`dev app exec\` inject per-dep deterministic vars (where \`{PREFIX} = dep.name.toUpperCase().replace(/-/g, "_")\`):
+When a host app depends on a TCP Docker service, \`devrouter app run\` and \`devrouter app exec\` inject per-dep deterministic vars (where \`{PREFIX} = dep.name.toUpperCase().replace(/-/g, "_")\`):
 
 | Variable                | Value                                                       |
 | ----------------------- | ----------------------------------------------------------- |
@@ -2147,7 +2154,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: the devcontainer compose service exposes a devnet alias \`\${WORKSPACE}-app\` (default \`WORKSPACE=<project>\` in \`devcontainer.env\`); the proxy app uses \`upstream: \${WORKSPACE}-app:<port>\`. Workspace \`feat-a\` \u2192 alias \`feat-a-app\`, host \`app.feat-a.localhost\`.
-- **Lifecycle**: \`dev workspace up <branch>\` (create worktree + devpod + routes), \`dev workspace ls\` (list worktrees/tokens/route counts), \`dev workspace down <workspace|branch>\` (free routes by state-file workspace tag + stop devpod + remove worktree). \`dev doctor\` reports orphaned workspace proxy routes whose worktree dir was removed without \`dev workspace down\`.
+- **Lifecycle**: \`devrouter workspace up <branch>\` (create worktree + devpod + routes), \`devrouter workspace ls\` (list worktrees/tokens/route counts), \`devrouter workspace down <workspace|branch>\` (free routes by state-file workspace tag + stop devpod + remove worktree). \`devrouter doctor\` reports orphaned workspace proxy routes whose worktree dir was removed without \`devrouter workspace down\`.
 
 ## Secret manager interop (Infisical/Doppler)
 
@@ -2171,31 +2178,31 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
   \`\`\`
 - Prefer argv-safe command forms. Do not wrap \`infisical run\` or \`doppler run\` in \`sh -lc\` unless shell expansion is strictly required.
 - Canonical Infisical migrate command:
-  \`dev app exec <app> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload migrate\`
+  \`devrouter app exec <app> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload migrate\`
 - Canonical env probe command (run before migrate/seed):
-  \`dev app exec <app> --yes -- printenv DB_URL DB_HOST DB_PORT DB_SHADOW_URL\`
+  \`devrouter app exec <app> --yes -- printenv DB_URL DB_HOST DB_PORT DB_SHADOW_URL\`
 - Canonical Doppler migrate command:
-  \`dev app exec <app> --yes -- doppler run -- pnpm payload migrate\`
+  \`devrouter app exec <app> --yes -- doppler run -- pnpm payload migrate\`
 - Precedence best practice: avoid defining per-dep var names in Infisical/Doppler when you expect devrouter local DB injection.
 - Precedence best practice: store remote/prod URLs under non-conflicting names (for example \`PROD_DATABASE_URL\`) and map intentionally via \`envMap\`.
 - Precedence best practice: if secret manager must define DB vars, run the env probe and verify values before any migration/seed.
-- Use \`dev app exec --shell -- "<single command string>"\` only when shell expansion is required.
+- Use \`devrouter app exec --shell -- "<single command string>"\` only when shell expansion is required.
 - \`envMap\` fails fast when source var is missing so migrations do not run with partial mapping.
 
 ## Upgrade handling (required)
 
 - Keep \`.devrouter.yml\` metadata \`devrouter.version\` aligned with the currently applied devrouter release.
-- Verify versions with \`dev -V\` (shows installed CLI version, local repo version, and next upgrade target).
-- Use \`dev upgrade\` to list available upgrade targets and \`dev upgrade <version>\` to print that target's Agent Adaptation Prompt from \`upgrade-prompts/<version>.md\`.
+- Verify versions with \`devrouter -V\` (shows installed CLI version, local repo version, and next upgrade target).
+- Use \`devrouter upgrade\` to list available upgrade targets and \`devrouter upgrade <version>\` to print that target's Agent Adaptation Prompt from \`upgrade-prompts/<version>.md\`.
 - Do not assume user-provided instructions include all required adaptation steps.
-- After upgrading the CLI in a dependent repo, refresh discoverability artifacts with \`dev repo agents\` (or \`dev init --write-agents --write-skill\`).
-- Re-run validation after upgrade: \`dev doctor --repo .\`, \`dev app ls --repo .\`, one representative \`dev app exec\` flow, and \`dev ls\`.
+- After upgrading the CLI in a dependent repo, refresh discoverability artifacts with \`devrouter repo agents\` (or \`devrouter init --write-agents --write-skill\`).
+- Re-run validation after upgrade: \`devrouter doctor --repo .\`, \`devrouter app ls --repo .\`, one representative \`devrouter app exec\` flow, and \`devrouter ls\`.
 
 ## Optional Linear workflow bootstrap
 
 - To add Linear task-management workflow assets to a repo, run:
-  - \`dev init --with-linear --write-agents --write-skill\`, or
-  - \`dev repo agents --with-linear\`
+  - \`devrouter init --with-linear --write-agents --write-skill\`, or
+  - \`devrouter repo agents --with-linear\`
 - This writes \`.agents/skills/linear-workflow/SKILL.md\` and reference templates, plus an idempotent AGENTS section.
 - On AGENTS write flows, devrouter asks for minimal Linear mapping (workspace/team/project) and stores it in a managed AGENTS block:
   - \`<!-- devrouter-linear-workflow-config:start -->\`
@@ -2204,65 +2211,65 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 
 ## Commands
 
-- \`dev init [--write-agents] [--write-skill] [--with-linear]\`: print AI onboarding prompt (non-mutating by default)
-- \`dev -V [--repo .]\`: show installed CLI version, local repo version, and next upgrade target
-- \`dev upgrade [version] [--repo .]\`: list upgrade targets or print target Agent Adaptation Prompt
-- \`dev setup --yes [--repo .] [--json]\`: first-run machine setup plus structured diagnostics
-- \`dev up\` / \`dev down\`: start/stop shared Traefik router
-- \`dev status\`: router/container/network/TLS health
-- \`dev doctor [--repo .]\`: deep diagnostics (global + repo)
-- \`dev ls\`: list active HTTP + TCP routes
-- \`dev open <name>\`: open HTTP route or print TCP connection hint (matches app name, then service/container/host identities)
-- \`dev logs [-f]\`: Traefik access logs
-- \`dev tls install\`: install mkcert certs, enable HTTPS + TCP/SNI
-- \`dev repo init\`: create \`.devrouter.yml\`
-- \`dev repo inspect [--json]\`: inspect package, scripts, compose services, env names, devcontainer, devrouter config, and agent guidance for onboarding
-- \`dev repo devcontainer write --dry-run --json\`: plan conservative Node/pnpm/Postgres devcontainer/devrouter scaffold files without writing
-- \`dev repo devcontainer write --yes\`: write managed Node/pnpm/Postgres devcontainer/devrouter scaffold files when no custom-file conflicts exist
-- \`dev repo devcontainer verify --json\`: emit read-only onboarding evidence for PRs
-- \`dev repo devcontainer verify --live --yes --json\`: register proxy routes and probe HTTP routes after the devcontainer is running
-- \`dev repo agents [--with-linear]\`: write devrouter section in AGENTS.md + install this skill (and optional Linear workflow assets)
-- \`dev app add\`: add/update app entry in \`.devrouter.yml\`
-- \`dev app ls\`: list app entries
-- \`dev app run <name> [--env <env>] [--workspace <slug>]\`: run app with dependency lifecycle (--env overrides SM defaultEnv; --workspace overrides the per-workspace token)
-- \`dev app exec <name> [--shell] [--env <env>] [--workspace <slug>] -- <cmd>\`: one-shot command with resolved dep env
-- \`dev app rm <name> [--keep-config]\`: remove app entry (\`--keep-config\` frees only the live route/hostname, leaves \`.devrouter.yml\` untouched)
-- \`dev workspace up <branch> [--path <dir>] [--no-devpod] [--open]\`: create a worktree + devpod + namespaced routes
-- \`dev workspace ls [--json]\`: list git worktrees with workspace token + route count
-- \`dev workspace down <workspace|branch> [--keep-worktree] [--keep-devpod]\`: free routes + stop devpod + remove worktree
+- \`devrouter init [--write-agents] [--write-skill] [--with-linear]\`: print AI onboarding prompt (non-mutating by default)
+- \`devrouter -V [--repo .]\`: show installed CLI version, local repo version, and next upgrade target
+- \`devrouter upgrade [version] [--repo .]\`: list upgrade targets or print target Agent Adaptation Prompt
+- \`devrouter setup --yes [--repo .] [--json]\`: first-run machine setup plus structured diagnostics
+- \`devrouter up\` / \`devrouter down\`: start/stop shared Traefik router
+- \`devrouter status\`: router/container/network/TLS health
+- \`devrouter doctor [--repo .]\`: deep diagnostics (global + repo)
+- \`devrouter ls\`: list active HTTP + TCP routes
+- \`devrouter open <name>\`: open HTTP route or print TCP connection hint (matches app name, then service/container/host identities)
+- \`devrouter logs [-f]\`: Traefik access logs
+- \`devrouter tls install\`: install mkcert certs, enable HTTPS + TCP/SNI
+- \`devrouter repo init\`: create \`.devrouter.yml\`
+- \`devrouter repo inspect [--json]\`: inspect package, scripts, compose services, env names, devcontainer, devrouter config, and agent guidance for onboarding
+- \`devrouter repo devcontainer write --dry-run --json\`: plan conservative Node/pnpm/Postgres devcontainer/devrouter scaffold files without writing
+- \`devrouter repo devcontainer write --yes\`: write managed Node/pnpm/Postgres devcontainer/devrouter scaffold files when no custom-file conflicts exist
+- \`devrouter repo devcontainer verify --json\`: emit read-only onboarding evidence for PRs
+- \`devrouter repo devcontainer verify --live --yes --json\`: register proxy routes and probe HTTP routes after the devcontainer is running
+- \`devrouter repo agents [--with-linear]\`: write devrouter section in AGENTS.md + install this skill (and optional Linear workflow assets)
+- \`devrouter app add\`: add/update app entry in \`.devrouter.yml\`
+- \`devrouter app ls\`: list app entries
+- \`devrouter app run <name> [--env <env>] [--workspace <slug>]\`: run app with dependency lifecycle (--env overrides SM defaultEnv; --workspace overrides the per-workspace token)
+- \`devrouter app exec <name> [--shell] [--env <env>] [--workspace <slug>] -- <cmd>\`: one-shot command with resolved dep env
+- \`devrouter app rm <name> [--keep-config]\`: remove app entry (\`--keep-config\` frees only the live route/hostname, leaves \`.devrouter.yml\` untouched)
+- \`devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]\`: create a worktree + devpod + namespaced routes
+- \`devrouter workspace ls [--json]\`: list git worktrees with workspace token + route count
+- \`devrouter workspace down <workspace|branch> [--keep-worktree] [--keep-devpod]\`: free routes + stop devpod + remove worktree
 
 ## Validation workflow
 
 For devcontainer onboarding:
 
-1. \`dev setup --repo . --yes --json\`
-2. \`dev doctor --repo . --json\`
-3. \`dev repo inspect --repo . --json\`
-4. \`dev repo devcontainer write --repo . --dry-run --json\`
-5. \`dev repo devcontainer write --repo . --yes\`
-6. \`dev repo devcontainer verify --repo . --json\`
+1. \`devrouter setup --repo . --yes --json\`
+2. \`devrouter doctor --repo . --json\`
+3. \`devrouter repo inspect --repo . --json\`
+4. \`devrouter repo devcontainer write --repo . --dry-run --json\`
+5. \`devrouter repo devcontainer write --repo . --yes\`
+6. \`devrouter repo devcontainer verify --repo . --json\`
 7. Start the devcontainer, for example \`devpod up .\`
-8. \`dev repo devcontainer verify --repo . --live --yes --json\`
+8. \`devrouter repo devcontainer verify --repo . --live --yes --json\`
 
 For existing host/docker runtime apps:
 
-1. \`dev setup --repo . --yes\`
-2. \`dev doctor --repo .\`
-3. \`dev app ls --repo .\`
-4. \`dev app run <host-app> --repo . --yes\`
-5. \`dev ls\`
+1. \`devrouter setup --repo . --yes\`
+2. \`devrouter doctor --repo .\`
+3. \`devrouter app ls --repo .\`
+4. \`devrouter app run <host-app> --repo . --yes\`
+5. \`devrouter ls\`
 6. \`curl -I https://<host>.localhost\`
-7. For TCP/Postgres, use \`dev open <name>\` for the connection hint.
+7. For TCP/Postgres, use \`devrouter open <name>\` for the connection hint.
 
 ## Runtime behavior notes
 
-- \`dev app run\` auto-starts Docker dependencies and waits for health. Host app runs stop auto-started docker deps on exit; docker app runs leave target services running until explicit cleanup.
+- \`devrouter app run\` auto-starts Docker dependencies and waits for health. Host app runs stop auto-started docker deps on exit; docker app runs leave target services running until explicit cleanup.
 - Host-runtime dependencies are NOT auto-started (v1).
-- \`kind=dependency\` entries do not create routes and cannot be direct targets for \`dev app run\`, \`dev app exec\`, or \`dev open\`.
+- \`kind=dependency\` entries do not create routes and cannot be direct targets for \`devrouter app run\`, \`devrouter app exec\`, or \`devrouter open\`.
 - \`kind=dependency\` services start as declared in compose (no Traefik label wiring, no random port publishing, no injected env vars).
-- Postgres on shared \`:5432\` requires TLS/SNI (\`dev tls install\`). Standard app clients should use the injected random port instead.
-- \`dev app exec\` follows the same dep lifecycle for one-shot commands and preserves argv semantics by default (\`shell: false\`).
-- \`dev app exec --shell\` is explicit and requires exactly one command string after \`--\`.
+- Postgres on shared \`:5432\` requires TLS/SNI (\`devrouter tls install\`). Standard app clients should use the injected random port instead.
+- \`devrouter app exec\` follows the same dep lifecycle for one-shot commands and preserves argv semantics by default (\`shell: false\`).
+- \`devrouter app exec --shell\` is explicit and requires exactly one command string after \`--\`.
 - Secret-manager overlap caveat: if Infisical/Doppler defines DB vars too, probe effective env (\`printenv DB_URL DB_HOST DB_PORT\`) before migrate/seed.
 `;
     LINEAR_WORKFLOW_SKILL_CONTENT = `---
@@ -2314,7 +2321,7 @@ When working on Linear-tracked issues, this is required:
 
 ## Devrouter-specific note
 
-If the repository uses devrouter, use \`dev upgrade\` to resolve the required Agent Adaptation Prompt for the target version before major changes (prompt files are versioned under \`upgrade-prompts/<version>.md\`).
+If the repository uses devrouter, use \`devrouter upgrade\` to resolve the required Agent Adaptation Prompt for the target version before major changes (prompt files are versioned under \`upgrade-prompts/<version>.md\`).
 `;
     LINEAR_ISSUE_TEMPLATE_CONTENT = `# Linear Issue Template
 
@@ -2976,7 +2983,7 @@ function printUpgradeTargets(currentVersion, availableTargets) {
     process.stdout.write(`- ${release.version}${suffix}
 `);
   }
-  process.stdout.write("\nRun `dev upgrade <version>` to print the Agent Adaptation Prompt for a target version.\n");
+  process.stdout.write("\nRun `devrouter upgrade <version>` to print the Agent Adaptation Prompt for a target version.\n");
 }
 async function runUpgradeCommand(options, deps = {}) {
   const catalog = loadUpgradeCatalog({
@@ -3153,13 +3160,11 @@ function commandExists(command) {
   return result.status === 0;
 }
 function ensureMkcert() {
-  if (commandExists("mkcert")) {
-    return;
-  }
-  if (!commandExists("brew")) {
-    throw new Error("mkcert is missing and Homebrew is not available.");
+  if (!commandExists("mkcert")) {
+    throw new Error(
+      "mkcert is not installed. Please install it to use TLS features (e.g., 'brew install mkcert' or via your package manager)."
+    );
   }
-  runOrThrow("brew", ["install", "mkcert"]);
 }
 function normalizeHost(host) {
   return host.trim().toLowerCase();
@@ -3885,7 +3890,7 @@ function buildGlobalToolChecks(repoPath) {
     level: compose.ok ? "ok" : "error",
     summary: compose.ok ? "Docker Compose v2 is reachable." : "Docker Compose v2 is not reachable.",
     details: firstLine(compose.output) ?? compose.error,
-    suggestion: compose.ok ? void 0 : "Install/start Docker with Compose v2, then run: dev setup --yes"
+    suggestion: compose.ok ? void 0 : "Install/start Docker with Compose v2, then run: devrouter setup --yes"
   });
   const mkcert = runTool("mkcert", ["-version"]);
   const brew = runTool("brew", ["--version"]);
@@ -3894,7 +3899,7 @@ function buildGlobalToolChecks(repoPath) {
     level: mkcert.ok ? "ok" : "warn",
     summary: mkcert.ok ? "mkcert is installed." : "mkcert is not installed.",
     details: mkcert.ok ? firstLine(mkcert.output) : mkcert.error,
-    suggestion: mkcert.ok ? void 0 : brew.ok ? "Install mkcert: brew install mkcert" : "Install mkcert for local HTTPS, then run: dev setup --yes"
+    suggestion: mkcert.ok ? void 0 : brew.ok ? "Install mkcert: brew install mkcert" : "Install mkcert for local HTTPS, then run: devrouter setup --yes"
   });
   const devpod = runTool("devpod", ["version"]);
   checks.push({
@@ -4670,7 +4675,7 @@ async function runSetup(options = {}) {
     actions.push(action("failed", {
       id: "setup.confirmation",
       summary: "Setup requires --yes before mutating devrouter-owned machine state.",
-      suggestion: "Run: dev setup --yes"
+      suggestion: "Run: devrouter setup --yes"
     }));
     const doctor2 = await buildDoctorReport({ repo: options.repo });
     const partialReport2 = { actions, checks: doctor2.checks };
@@ -4699,7 +4704,7 @@ async function runSetup(options = {}) {
       id: "global.router-files",
       summary: "Failed to ensure global router files.",
       details: message,
-      suggestion: "Check write access to ~/.config/devrouter, then run: dev setup --yes"
+      suggestion: "Check write access to ~/.config/devrouter, then run: devrouter setup --yes"
     }));
   }
   try {
@@ -4715,7 +4720,7 @@ async function runSetup(options = {}) {
       id: "global.devnet",
       summary: "Failed to ensure shared Docker network devnet.",
       details: message,
-      suggestion: "Start Docker and verify Docker context, then run: dev setup --yes"
+      suggestion: "Start Docker and verify Docker context, then run: devrouter setup --yes"
     }));
   }
   try {
@@ -4731,7 +4736,7 @@ async function runSetup(options = {}) {
       id: "global.router-stack",
       summary: "Failed to start shared Traefik router.",
       details: message,
-      suggestion: "Resolve Docker/port conflicts on 80, 443, or 5432, then run: dev setup --yes"
+      suggestion: "Resolve Docker/port conflicts on 80, 443, or 5432, then run: devrouter setup --yes"
     }));
   }
   const mkcert = runTool("mkcert", ["-version"]);
@@ -4740,7 +4745,7 @@ async function runSetup(options = {}) {
       id: "global.tls",
       summary: "Skipped TLS setup because mkcert is not installed.",
       details: mkcert.error,
-      suggestion: "Install mkcert, then run: dev setup --yes"
+      suggestion: "Install mkcert, then run: devrouter setup --yes"
     }));
   } else {
     try {
@@ -4756,7 +4761,7 @@ async function runSetup(options = {}) {
         id: "global.tls",
         summary: "Failed to install local TLS certificates.",
         details: message,
-        suggestion: "Run: dev tls install"
+        suggestion: "Run: devrouter tls install"
       }));
     }
   }
@@ -4811,10 +4816,46 @@ var init_setup2 = __esm({
 });
 
 // src/util/ports.ts
+function parseSsPortListeners(stdout, port) {
+  const listeners = [];
+  const lines = stdout.split(/\r?\n/);
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 4) continue;
+    const localAddr = parts[3];
+    const colonIdx = localAddr.lastIndexOf(":");
+    if (colonIdx === -1) continue;
+    const linePort = Number(localAddr.slice(colonIdx + 1));
+    if (linePort !== port) continue;
+    const usersCol = parts.slice(5).join(" ");
+    const pidMatch = /pid=(\d+)/.exec(usersCol);
+    const cmdMatch = /"([^"]+)"/.exec(usersCol);
+    const command = cmdMatch ? cmdMatch[1] : "?";
+    const pid = pidMatch ? pidMatch[1] : "?";
+    listeners.push({
+      port,
+      command,
+      pid,
+      user: "?",
+      address: localAddr
+    });
+  }
+  return listeners;
+}
 function findPortListeners(port) {
   const result = (0, import_node_child_process6.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
+  if (result.error && result.error.code === "ENOENT") {
+    if (process.platform === "linux") {
+      const ssResult = (0, import_node_child_process6.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      if (ssResult.status === 0 && ssResult.stdout) {
+        return parseSsPortListeners(ssResult.stdout, port);
+      }
+    }
+    return [];
+  }
   if (result.status !== 0 || !result.stdout.trim()) {
     return [];
   }
@@ -5784,10 +5825,10 @@ function renderReadme(projectName) {
 Use this repo through the devcontainer, with devrouter providing stable local routes.
 
 \`\`\`bash
-dev setup --yes
+devrouter setup --yes
 devpod up .
-dev app run app --repo . --yes
-dev app run db --repo . --yes
+devrouter app run app --repo . --yes
+devrouter app run db --repo . --yes
 \`\`\`
 
 - App: https://${projectName}.localhost
@@ -5797,19 +5838,19 @@ dev app run db --repo . --yes
 function postWriteNextSteps(repoPath) {
   const quotedRepoPath = shellSingleQuote(repoPath);
   return [
-    `Run: dev setup --repo ${quotedRepoPath} --yes`,
+    `Run: devrouter setup --repo ${quotedRepoPath} --yes`,
     `Run: cd ${quotedRepoPath} && devpod up .`,
-    `Run: dev app run app --repo ${quotedRepoPath} --yes`,
-    `Run: dev app run db --repo ${quotedRepoPath} --yes`,
-    `Optional: dev repo agents --repo ${quotedRepoPath}`
+    `Run: devrouter app run app --repo ${quotedRepoPath} --yes`,
+    `Run: devrouter app run db --repo ${quotedRepoPath} --yes`,
+    `Optional: devrouter repo agents --repo ${quotedRepoPath}`
   ];
 }
 function issueNextSteps(issues) {
   const steps = issues.filter((issue) => issue.level === "error").map((issue) => issue.suggestion).filter((suggestion) => Boolean(suggestion));
   if (steps.length > 0) {
-    return [...steps, "Re-run: dev repo devcontainer write --dry-run --json"];
+    return [...steps, "Re-run: devrouter repo devcontainer write --dry-run --json"];
   }
-  return ["Resolve reported errors, then re-run: dev repo devcontainer write --dry-run --json"];
+  return ["Resolve reported errors, then re-run: devrouter repo devcontainer write --dry-run --json"];
 }
 function packageManagerIssues(repo) {
   if (!repo.packageManager) {
@@ -5919,7 +5960,7 @@ function buildPlan(repoPath, dryRun, version) {
   filePlans.push({
     path: "AGENTS.md",
     action: "suggest",
-    reason: "run dev repo agents after reviewing the scaffold"
+    reason: "run devrouter repo agents after reviewing the scaffold"
   });
   return {
     files,
@@ -5930,7 +5971,7 @@ function buildPlan(repoPath, dryRun, version) {
       dryRun,
       files: filePlans,
       issues,
-      nextSteps: issues.some((issue) => issue.level === "error") ? issueNextSteps(issues) : dryRun ? [`Review this plan, then run: dev repo devcontainer write --repo ${shellSingleQuote(repoPath)} --yes`] : postWriteNextSteps(repoPath)
+      nextSteps: issues.some((issue) => issue.level === "error") ? issueNextSteps(issues) : dryRun ? [`Review this plan, then run: devrouter repo devcontainer write --repo ${shellSingleQuote(repoPath)} --yes`] : postWriteNextSteps(repoPath)
     }
   };
 }
@@ -5958,10 +5999,10 @@ function writeDevcontainer(options = {}) {
           id: "repo.devcontainer.confirmation",
           level: "error",
           summary: "Writing devcontainer files requires --yes.",
-          suggestion: `Run: dev repo devcontainer write --repo ${shellSingleQuote(repoPath)} --yes`
+          suggestion: `Run: devrouter repo devcontainer write --repo ${shellSingleQuote(repoPath)} --yes`
         }
       ],
-      nextSteps: [`Run: dev repo devcontainer write --repo ${shellSingleQuote(repoPath)} --yes`]
+      nextSteps: [`Run: devrouter repo devcontainer write --repo ${shellSingleQuote(repoPath)} --yes`]
     };
   }
   for (const file of files) {
@@ -6093,7 +6134,7 @@ function requiredFileChecks(repoPath) {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
     summary: missing.length === 0 ? "Required devcontainer/devrouter files are present." : `Missing required devcontainer/devrouter file(s): ${missing.join(", ")}.`,
-    suggestion: missing.length === 0 ? void 0 : "Run: dev repo devcontainer write --dry-run --json"
+    suggestion: missing.length === 0 ? void 0 : "Run: devrouter repo devcontainer write --dry-run --json"
   };
 }
 function proxyConfigCheck(apps) {
@@ -6101,7 +6142,7 @@ function proxyConfigCheck(apps) {
     id: "repo.devcontainer.verify-proxy-apps",
     level: apps.length > 0 ? "ok" : "error",
     summary: apps.length > 0 ? `Found ${apps.length} proxy app(s) for devcontainer routing.` : "No proxy app entries found for devcontainer routing.",
-    suggestion: apps.length > 0 ? void 0 : "Add runtime: proxy app entries to .devrouter.yml or run: dev repo devcontainer write --dry-run --json"
+    suggestion: apps.length > 0 ? void 0 : "Add runtime: proxy app entries to .devrouter.yml or run: devrouter repo devcontainer write --dry-run --json"
   };
 }
 function workspaceTemplateCheck(apps) {
@@ -6144,7 +6185,7 @@ function doctorGateCheck(doctor) {
     level: blocking.length === 0 ? "ok" : "error",
     summary: blocking.length === 0 ? "Doctor has no blocking devcontainer diagnostics." : `Doctor reported ${blocking.length} blocking devcontainer diagnostic(s).`,
     details: blocking.length > 0 ? blocking.map((check) => check.id).join(", ") : void 0,
-    suggestion: blocking.length > 0 ? "Run: dev doctor --repo <path> --json" : void 0
+    suggestion: blocking.length > 0 ? "Run: devrouter doctor --repo <path> --json" : void 0
   };
 }
 function routeUrl2(host) {
@@ -6167,7 +6208,7 @@ function registerProxyRoute(repoPath, app, workspace) {
   const { port, upstreamHost: upstreamHost2 } = parseUpstream(app.upstream);
   if (app.protocol === "tcp" && !isTLSEnabled()) {
     throw new Error(
-      `App "${app.name}" is a TCP proxy route, which requires TLS (SNI). Run \`dev tls install\` first.`
+      `App "${app.name}" is a TCP proxy route, which requires TLS (SNI). Run \`devrouter tls install\` first.`
     );
   }
   if (app.protocol === "tcp") {
@@ -6199,7 +6240,7 @@ async function liveChecks(repoPath, yes) {
           id: "repo.devcontainer.verify-live-confirmation",
           level: "error",
           summary: "Live devcontainer verification requires --yes.",
-          suggestion: "Run: dev repo devcontainer verify --live --yes --json"
+          suggestion: "Run: devrouter repo devcontainer verify --live --yes --json"
         }
       ]
     };
@@ -6216,7 +6257,7 @@ async function liveChecks(repoPath, yes) {
           level: "error",
           summary: "Could not load runtime config for live verification.",
           details: error instanceof Error ? error.message : String(error),
-          suggestion: "Fix .devrouter.yml and re-run: dev repo devcontainer verify --live --yes --json"
+          suggestion: "Fix .devrouter.yml and re-run: devrouter repo devcontainer verify --live --yes --json"
         }
       ]
     };
@@ -6268,7 +6309,7 @@ async function liveChecks(repoPath, yes) {
         level: "error",
         summary: `Could not register proxy route '${app.name}'.`,
         details: message,
-        suggestion: "Run: dev setup --yes, start the devcontainer, then retry live verification."
+        suggestion: "Run: devrouter setup --yes, start the devcontainer, then retry live verification."
       });
     }
   }
@@ -6294,7 +6335,7 @@ async function verifyDevcontainer(options = {}) {
       level: "error",
       summary: "Could not load .devrouter.yml for devcontainer verification.",
       details: error instanceof Error ? error.message : String(error),
-      suggestion: "Fix .devrouter.yml and re-run: dev repo devcontainer verify --json"
+      suggestion: "Fix .devrouter.yml and re-run: devrouter repo devcontainer verify --json"
     });
   }
   let liveRoutes;
@@ -7025,6 +7066,35 @@ function parseListeningPorts(outputText) {
   }
   return Array.from(ports.values()).sort((a, b) => a - b);
 }
+function parseSsListeningPorts(stdout, targetPids) {
+  const ports = /* @__PURE__ */ new Set();
+  const lines = stdout.split(/\r?\n/);
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let matchedPid = false;
+    for (const pid of targetPids) {
+      if (line.includes(`pid=${pid}`)) {
+        matchedPid = true;
+        break;
+      }
+    }
+    if (!matchedPid) {
+      continue;
+    }
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 4) continue;
+    const localAddr = parts[3];
+    const colonIdx = localAddr.lastIndexOf(":");
+    if (colonIdx !== -1) {
+      const portStr = localAddr.slice(colonIdx + 1);
+      const port = Number(portStr);
+      if (Number.isInteger(port) && port > 0) {
+        ports.add(port);
+      }
+    }
+  }
+  return Array.from(ports.values()).sort((a, b) => a - b);
+}
 function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
@@ -7034,6 +7104,15 @@ function detectListeningPorts(pids) {
     ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")],
     { encoding: "utf-8" }
   );
+  if (result.error && result.error.code === "ENOENT") {
+    if (process.platform === "linux") {
+      const ssResult = (0, import_node_child_process11.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      if (ssResult.status === 0 && ssResult.stdout) {
+        return parseSsListeningPorts(ssResult.stdout, new Set(pids));
+      }
+    }
+    return [];
+  }
   if (result.status !== 0) {
     return [];
   }
@@ -7670,7 +7749,11 @@ async function workspaceUp(branch, opts = {}) {
   if (!opts.noDevpod && hasDevpod()) {
     const dp = (0, import_node_child_process12.spawnSync)("devpod", ["up", worktreePath, "--id", ws, "--open-ide=false"], {
       stdio: "inherit",
-      env: { ...process.env, WORKSPACE: ws }
+      env: {
+        ...process.env,
+        WORKSPACE: ws,
+        DEVCONTAINER_COMPOSE_OVERLAY: "docker-compose.devrouter.yml"
+      }
     });
     if (dp.status !== 0) {
       process.stderr.write(`Warning: 'devpod up' failed; continuing with route registration.
@@ -7854,7 +7937,7 @@ async function runVersionCommand(options, deps = {}) {
 `);
   process.stdout.write(`All upgrade targets: ${availableTargets.map((entry) => entry.version).join(", ")}
 `);
-  process.stdout.write(`Run: dev upgrade ${next.version}
+  process.stdout.write(`Run: devrouter upgrade ${next.version}
 `);
 }
 var init_version = __esm({
@@ -7866,7 +7949,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.23" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.24" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -7881,7 +7964,7 @@ function withErrorHandling(action2) {
   };
 }
 var program = new import_commander.Command();
-program.name("dev").description("Local dev router CLI for stable .localhost routing across repositories").showSuggestionAfterError(true).showHelpAfterError();
+program.name("devrouter").description("Local dev router CLI for stable .localhost routing across repositories").showSuggestionAfterError(true).showHelpAfterError();
 program.command("init").description("Print an AI onboarding prompt template for adapting a repository to devrouter").option("--repo <path>", "Repository path to embed in the prompt (defaults to current directory)").option("--entries-json <json>", "Optional JSON array of app entries to embed in the prompt").option("--json", "Output prompt and command intents as JSON").option("--write-agents", "Write/update devrouter section in AGENTS.md").option("--write-skill", "Write .agents/skills/devrouter/SKILL.md").option("--with-linear", "Include optional Linear workflow guidance/artifacts when writing").action(withErrorHandling(async (options) => {
   const { runInitCommand: runInitCommand2 } = await Promise.resolve().then(() => (init_init(), init_exports));
   await runInitCommand2(options);