@devrouter/cli 0.0.34 → 0.0.36

package/dist/devrouter.js

@@ -156,6 +156,8 @@ apps:
     # to target a per-workspace devcontainer alias \u2014 substituted with the resolved
     # workspace token at runtime. See "Workspace isolation" below. Do NOT put
     # \${WORKSPACE} in \`host\` (rejected); the host is auto-namespaced.
+    # Managed \`ensure\` requires every HTTP/TCP upstream to begin with the exact
+    # resolved workspace/project alias prefix before DevPod or route mutation.
     #
     # proxy + tcp (front a DB in an externally-managed container, e.g. a
     # devcontainer's Postgres on devnet) \u2014 no per-DB host port:
@@ -239,11 +241,14 @@ Config-level \`envMap\` on dependency references aliases per-dep vars to app-exp
 Run several worktrees of one repo in parallel without host/route collisions. A **workspace token** spans the DevPod id, devrouter routes, \`\${WORKSPACE}\` proxy upstreams, and devcontainer aliases.
 
 - **Identity**: each managed linked worktree stores a local token in Git metadata plus a durable owner record in the repository's Git common directory. The record survives linked-worktree removal and binds the exact path to its DevPod ID. First use reuses an exact-path DevPod or derives a sanitized branch/path slug. Later flags or \`DEVROUTER_WORKSPACE\` may repeat the identity but cannot rename it. Ambiguous identities fail closed. The primary checkout remains non-namespaced.
-- **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
+- **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed \`ensure\` rejects every HTTP/TCP proxy upstream outside that exact alias namespace before it mutates DevPod or routes. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: managed scaffolds list the base compose file, then \`\${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}\`; custom repositories may keep another default overlay. Selecting \`.devcontainer/docker-compose.devrouter.yml\` for linked worktrees must pass \`WORKSPACE\` and \`DEVROUTER_WORKSPACE\` across the combined base/overlay config and bind-mount \`\${DEVROUTER_GIT_COMMON_DIR}\` to the same absolute app-container path. The app exposes \`\${WORKSPACE}-app\`; the proxy uses \`upstream: \${WORKSPACE}-app:<port>\`.
-- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive and \`exec . -- <command...>\` runs one-shot commands only in the exact running DevPod. \`workspace up\` creates linked worktrees; destructive \`workspace down/gc\` remains ledger-scoped. Dirty or locked full down fails before side effects.
-- **Cleanup**: owner status is \`present\`, \`missing\`, \`locked\`, or \`conflict\`. \`workspace gc\` is a dry-run report; \`--yes\` deletes only exact ledger-owned missing/prunable resources and their records. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
+- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running DevPod. Never substitute raw \`devpod up\`, \`stop\`, or \`delete\`: they bypass devrouter's machine-global ownership lock. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects.
+- **Managed process identity**: \`ensure\` executes an exact captured adapter snapshot. Default reuse includes command argv, workspace, and adapter SHA-256. Set \`DEVROUTER_PROCESS_FINGERPRINT_ENV\` only to comma-separated non-secret environment names whose values affect runtime identity; secret-like names are rejected and raw values are never persisted.
+- **Route state**: the versioned Traefik dynamic file is authoritative for both metadata and rendering. JSON is a compatibility mirror; valid headerless generations migrate automatically, while corrupt canonical metadata fails closed.
+- **Cleanup**: \`workspace cleanup --repo . --inactive-for 30d --json\` is a report-only, no-\`--yes\` report for managed linked workspaces. It joins ownership (\`present|missing|locked|conflict\`), DevPod registration, runtime (\`running|stopped|busy|not-found|absent|unknown\`), checkout, route, advisory activity, and integration evidence without mutating DevPod, routes, ownership, Git, Docker, applications, worktrees, or branches. Local DevPod list/status checks always run; \`--check-merged\` alone enables read-only origin and matching GitHub/GitLab checks. Treat \`not-found\` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit \`gc\`/\`down\` can remove exact stale registration only after expected-ID \`NotFound\` proof and ownership revalidation. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
+- **Sizing**: \`--measure-size\` adds per-workspace storage consumption to that report and stays read-only, but it walks each worktree and runs \`docker ps\` / \`docker inspect --size\`, so leave it off when you only need the evidence states. Each row reports reclaimable \`worktree\` and \`containerWritable\` bytes, non-reclaimable \`imageShared\` bytes, and a \`reclaimable\` total of the first two. \`imageShared\` covers image layers shared with other containers and overlaps across rows, so never sum it. Attribution is the workspace's own app container; sibling compose services such as a database are excluded. Any untrustworthy figure reports \`unknown\` with a reason rather than zero, and a workspace with no container reports a measured \`0\`.
 - **Boundary**: workspace commands require Git. Normal config, app, status, and doctor flows remain usable from a \`.devrouter.yml\` folder without \`.git\`.
 
 ## Secret manager interop (Infisical/Doppler)
@@ -295,7 +300,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter upgrade [version] [--repo .]\`: list upgrade targets or print target Agent Adaptation Prompt
 - \`devrouter setup --yes [--repo .] [--json]\`: first-run machine setup plus structured diagnostics
 - \`devrouter ensure [path] [--open] [--json]\`: canonical startup/reconciliation for primary and linked checkouts
-- \`devrouter stop [path] [--json]\`: stop the exact DevPod and remove exact routes without deleting data
+- \`devrouter stop [path] [--delete] [--json]\`: stop the exact DevPod and remove exact routes; \`--delete\` explicitly deletes its ownership-proven data without removing the checkout
 - \`devrouter exec [path] -- <command...>\`: literal one-shot command inside the exact running DevPod
 - \`devrouter up\` / \`devrouter down\`: start/stop shared Traefik router
 - \`devrouter status\`: router/container/network/TLS health
@@ -319,6 +324,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]\`: create a worktree and start/prove it unless create-only mode is requested
 - \`devrouter workspace ensure [path] [--open] [--json]\`: compatibility alias of \`devrouter ensure\`
 - \`devrouter workspace ls [--json]\`: list ownership, Git, DevPod, route, path, and branch evidence
+- \`devrouter workspace cleanup [--repo .] [--inactive-for 30d] [--check-merged] [--measure-size] [--json]\`: report-only cleanup evidence and exact guarded suggestions; no \`--yes\` or apply mode
 - \`devrouter workspace stop <workspace|branch>\`: stop DevPod and routes; preserve checkout, owner record, and data
 - \`devrouter workspace down <workspace|branch> [--keep-worktree]\`: delete runtime/routes and optionally remove the clean worktree and record
 - \`devrouter workspace gc [--json] [--yes]\`: report missing owners by default; apply exact eligible cleanup with \`--yes\`
@@ -721,6 +727,51 @@ var init_capabilities = __esm({
   }
 });
 
+// src/core/atomic-file.ts
+function fsyncDirectory(directory) {
+  const handle = import_node_fs3.default.openSync(directory, "r");
+  try {
+    import_node_fs3.default.fsyncSync(handle);
+  } finally {
+    import_node_fs3.default.closeSync(handle);
+  }
+}
+function writeFileAtomically(filePath, contents) {
+  const directory = import_node_path3.default.dirname(filePath);
+  import_node_fs3.default.mkdirSync(directory, { recursive: true });
+  const temporaryPath = import_node_path3.default.join(
+    directory,
+    `.${import_node_path3.default.basename(filePath)}.${process.pid}.${(0, import_node_crypto.randomUUID)()}.tmp`
+  );
+  let temporaryHandle;
+  try {
+    temporaryHandle = import_node_fs3.default.openSync(temporaryPath, "wx", 384);
+    import_node_fs3.default.writeFileSync(temporaryHandle, contents, "utf-8");
+    import_node_fs3.default.fsyncSync(temporaryHandle);
+    import_node_fs3.default.closeSync(temporaryHandle);
+    temporaryHandle = void 0;
+    import_node_fs3.default.renameSync(temporaryPath, filePath);
+    fsyncDirectory(directory);
+  } catch (error) {
+    if (temporaryHandle !== void 0) import_node_fs3.default.closeSync(temporaryHandle);
+    try {
+      import_node_fs3.default.unlinkSync(temporaryPath);
+    } catch (cleanupError) {
+      if (cleanupError.code !== "ENOENT") throw cleanupError;
+    }
+    throw error;
+  }
+}
+var import_node_crypto, import_node_fs3, import_node_path3;
+var init_atomic_file = __esm({
+  "src/core/atomic-file.ts"() {
+    "use strict";
+    import_node_crypto = require("crypto");
+    import_node_fs3 = __toESM(require("fs"));
+    import_node_path3 = __toESM(require("path"));
+  }
+});
+
 // src/core/file-lock.ts
 function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -732,17 +783,56 @@ function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function processBirthIdentity(pid) {
+  try {
+    const stat = import_node_fs4.default.readFileSync(`/proc/${pid}/stat`, "utf-8");
+    const commandEnd = stat.lastIndexOf(")");
+    if (commandEnd >= 0) {
+      const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
+      const startTime = fields[19];
+      if (startTime) return `proc:${startTime}`;
+    }
   } catch {
-    return false;
+  }
+  const result = (0, import_node_child_process2.spawnSync)("ps", ["-o", "lstart=", "-o", "command=", "-p", String(pid)], {
+    encoding: "utf-8",
+    env: { ...process.env, LC_ALL: "C" }
+  });
+  const startedAt = result.status === 0 ? result.stdout.trim().replace(/\s+/g, " ") : "";
+  return startedAt ? `ps:${(0, import_node_crypto2.createHash)("sha256").update(startedAt).digest("hex")}` : void 0;
+}
+function parseLockOwner(value) {
+  const fields = value.split(":");
+  const pid = Number(fields[0]);
+  if (!Number.isInteger(pid) || pid <= 0) return void 0;
+  if (fields.length !== 3 || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(fields[2])) {
+    return { pid };
+  }
+  try {
+    const processBirth = Buffer.from(fields[1], "base64url").toString("utf-8");
+    const canonical = Buffer.from(processBirth).toString("base64url");
+    return canonical === fields[1] && /^(proc|ps):/.test(processBirth) ? { pid, processBirth } : { pid };
+  } catch {
+    return { pid };
   }
 }
+function isLockOwnerLive(owner) {
+  if (!isProcessAlive(owner.pid)) return false;
+  if (!owner.processBirth) return true;
+  const currentBirth = processBirthIdentity(owner.pid);
+  return currentBirth === void 0 || currentBirth === owner.processBirth;
+}
 function sameFile(left, right) {
   return left.dev === right.dev && left.ino === right.ino;
 }
 function tryReclaimStaleLock(lockPath, staleLinkPath) {
   let fd;
   try {
-    fd = import_node_fs3.default.openSync(lockPath, "r");
+    fd = import_node_fs4.default.openSync(lockPath, "r");
   } catch (error) {
     if (error.code === "ENOENT") {
       return { kind: "retry" };
@@ -750,17 +840,16 @@ function tryReclaimStaleLock(lockPath, staleLinkPath) {
     throw error;
   }
   try {
-    const owner = import_node_fs3.default.readFileSync(fd, "utf-8").trim();
-    const ownerPid = Number(owner.split(":", 1)[0]);
-    if (isProcessAlive(ownerPid)) {
-      return { kind: "live", pid: ownerPid };
+    const owner = parseLockOwner(import_node_fs4.default.readFileSync(fd, "utf-8").trim());
+    if (owner && isLockOwnerLive(owner)) {
+      return { kind: "live", pid: owner.pid };
     }
-    const staleStat = import_node_fs3.default.fstatSync(fd);
+    const staleStat = import_node_fs4.default.fstatSync(fd);
     if (staleStat.nlink !== 1) {
       return { kind: "retry" };
     }
     try {
-      import_node_fs3.default.linkSync(lockPath, staleLinkPath);
+      import_node_fs4.default.linkSync(lockPath, staleLinkPath);
     } catch (error) {
       if (error.code === "ENOENT") {
         return { kind: "retry" };
@@ -770,7 +859,7 @@ function tryReclaimStaleLock(lockPath, staleLinkPath) {
     try {
       let currentStat;
       try {
-        currentStat = import_node_fs3.default.statSync(lockPath);
+        currentStat = import_node_fs4.default.statSync(lockPath);
       } catch (error) {
         if (error.code === "ENOENT") {
           return { kind: "retry" };
@@ -780,27 +869,32 @@ function tryReclaimStaleLock(lockPath, staleLinkPath) {
       if (!sameFile(staleStat, currentStat) || currentStat.nlink !== 2) {
         return { kind: "retry" };
       }
-      import_node_fs3.default.rmSync(lockPath);
+      import_node_fs4.default.rmSync(lockPath);
       return { kind: "reclaimed" };
     } finally {
-      import_node_fs3.default.rmSync(staleLinkPath, { force: true });
+      import_node_fs4.default.rmSync(staleLinkPath, { force: true });
     }
   } finally {
-    import_node_fs3.default.closeSync(fd);
+    import_node_fs4.default.closeSync(fd);
   }
 }
 function acquireFileLock(lockPath, options) {
-  const owner = `${process.pid}:${(0, import_node_crypto.randomUUID)()}`;
-  const candidatePath = `${lockPath}.${owner}.candidate`;
+  const processBirth = processBirthIdentity(process.pid);
+  if (!processBirth) {
+    throw new Error(`could not determine process identity for ${options.activity} lock`);
+  }
+  const ownerId = (0, import_node_crypto2.randomUUID)();
+  const owner = `${process.pid}:${Buffer.from(processBirth).toString("base64url")}:${ownerId}`;
+  const candidatePath = `${lockPath}.${process.pid}.${ownerId}.candidate`;
   const staleLinkPath = `${candidatePath}.stale`;
   const deadline = Date.now() + (options.waitMs ?? 0);
   let reclaimAttempts = 0;
-  import_node_fs3.default.writeFileSync(candidatePath, `${owner}
+  import_node_fs4.default.writeFileSync(candidatePath, `${owner}
 `, { encoding: "utf-8", flag: "wx" });
   try {
     for (; ; ) {
       try {
-        import_node_fs3.default.linkSync(candidatePath, lockPath);
+        import_node_fs4.default.linkSync(candidatePath, lockPath);
         return owner;
       } catch (error) {
         if (error.code !== "EEXIST") {
@@ -828,14 +922,14 @@ function acquireFileLock(lockPath, options) {
       }
     }
   } finally {
-    import_node_fs3.default.rmSync(candidatePath, { force: true });
-    import_node_fs3.default.rmSync(staleLinkPath, { force: true });
+    import_node_fs4.default.rmSync(candidatePath, { force: true });
+    import_node_fs4.default.rmSync(staleLinkPath, { force: true });
   }
 }
 function releaseFileLock(lockPath, owner) {
   try {
-    if (import_node_fs3.default.readFileSync(lockPath, "utf-8").trim() === owner) {
-      import_node_fs3.default.rmSync(lockPath);
+    if (import_node_fs4.default.readFileSync(lockPath, "utf-8").trim() === owner) {
+      import_node_fs4.default.rmSync(lockPath);
     }
   } catch (error) {
     if (error.code !== "ENOENT") {
@@ -859,20 +953,21 @@ async function withFileLock(lockPath, options, operation) {
     releaseFileLock(lockPath, owner);
   }
 }
-var import_node_crypto, import_node_fs3;
+var import_node_child_process2, import_node_crypto2, import_node_fs4;
 var init_file_lock = __esm({
   "src/core/file-lock.ts"() {
     "use strict";
-    import_node_crypto = require("crypto");
-    import_node_fs3 = __toESM(require("fs"));
+    import_node_child_process2 = require("child_process");
+    import_node_crypto2 = require("crypto");
+    import_node_fs4 = __toESM(require("fs"));
   }
 });
 
 // src/core/workspace.ts
 function comparableWorkspacePath(filePath) {
-  const resolved = import_node_path3.default.resolve(filePath);
+  const resolved = import_node_path4.default.resolve(filePath);
   try {
-    return import_node_fs4.default.realpathSync.native(resolved);
+    return import_node_fs5.default.realpathSync.native(resolved);
   } catch {
     return resolved;
   }
@@ -885,10 +980,10 @@ function wsFromBranch(branch) {
   return slug.length > 0 ? slug : void 0;
 }
 function isLinkedWorktree(repoPath) {
-  const gitPath = import_node_path3.default.join(repoPath, ".git");
+  const gitPath = import_node_path4.default.join(repoPath, ".git");
   let stat;
   try {
-    stat = import_node_fs4.default.statSync(gitPath);
+    stat = import_node_fs5.default.statSync(gitPath);
   } catch {
     return false;
   }
@@ -897,7 +992,7 @@ function isLinkedWorktree(repoPath) {
   }
   let content;
   try {
-    content = import_node_fs4.default.readFileSync(gitPath, "utf-8");
+    content = import_node_fs5.default.readFileSync(gitPath, "utf-8");
   } catch {
     return false;
   }
@@ -909,10 +1004,10 @@ function isLinkedWorktree(repoPath) {
   return /(^|\/)worktrees\//.test(gitdir);
 }
 function gitMetadataDir(repoPath) {
-  const gitPath = import_node_path3.default.join(repoPath, ".git");
+  const gitPath = import_node_path4.default.join(repoPath, ".git");
   let stat;
   try {
-    stat = import_node_fs4.default.statSync(gitPath);
+    stat = import_node_fs5.default.statSync(gitPath);
   } catch {
     return void 0;
   }
@@ -922,11 +1017,11 @@ function gitMetadataDir(repoPath) {
   if (!stat.isFile()) {
     return void 0;
   }
-  const match = import_node_fs4.default.readFileSync(gitPath, "utf-8").match(/^gitdir:\s*(.+)$/m);
+  const match = import_node_fs5.default.readFileSync(gitPath, "utf-8").match(/^gitdir:\s*(.+)$/m);
   if (!match) {
     return void 0;
   }
-  return import_node_path3.default.resolve(repoPath, match[1].trim());
+  return import_node_path4.default.resolve(repoPath, match[1].trim());
 }
 function validatePersistedWorkspace(value) {
   const workspace = value.trim();
@@ -940,9 +1035,9 @@ function readPersistedWorkspace(repoPath) {
   if (!gitDir) {
     return void 0;
   }
-  const metadataPath = import_node_path3.default.join(gitDir, WORKSPACE_METADATA_FILE);
+  const metadataPath = import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE);
   try {
-    return validatePersistedWorkspace(import_node_fs4.default.readFileSync(metadataPath, "utf-8"));
+    return validatePersistedWorkspace(import_node_fs5.default.readFileSync(metadataPath, "utf-8"));
   } catch (error) {
     if (error.code === "ENOENT") {
       return void 0;
@@ -965,7 +1060,7 @@ function persistWorkspace(repoPath, value) {
   if (!gitDir) {
     throw new Error(`cannot persist workspace identity: '${repoPath}' is not a Git checkout`);
   }
-  import_node_fs4.default.writeFileSync(import_node_path3.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
+  import_node_fs5.default.writeFileSync(import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
 `, "utf-8");
   return workspace;
 }
@@ -974,7 +1069,7 @@ async function withWorkspaceLifecycleLock(repoPath, operation) {
   if (!gitDir) {
     throw new Error(`cannot lock workspace lifecycle: '${repoPath}' is not a Git checkout`);
   }
-  const lockPath = import_node_path3.default.join(gitDir, WORKSPACE_LOCK_FILE);
+  const lockPath = import_node_path4.default.join(gitDir, WORKSPACE_LOCK_FILE);
   return withFileLock(
     lockPath,
     { activity: "workspace lifecycle", target: `'${repoPath}'` },
@@ -982,7 +1077,7 @@ async function withWorkspaceLifecycleLock(repoPath, operation) {
   );
 }
 function currentBranch(repoPath) {
-  const result = (0, import_node_child_process2.spawnSync)("git", ["-C", repoPath, "rev-parse", "--abbrev-ref", "HEAD"], {
+  const result = (0, import_node_child_process3.spawnSync)("git", ["-C", repoPath, "rev-parse", "--abbrev-ref", "HEAD"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -1002,7 +1097,7 @@ function deriveLinkedWorktreeWorkspace(repoPath, linkedWorktreeBranch) {
     return void 0;
   }
   const branch = currentBranch(repoPath);
-  return wsFromBranch(branch ?? import_node_path3.default.basename(import_node_path3.default.resolve(repoPath)));
+  return wsFromBranch(branch ?? import_node_path4.default.basename(import_node_path4.default.resolve(repoPath)));
 }
 function resolveWorktreeWorkspace(repoPath, linkedWorktreeBranch) {
   return readPersistedWorkspace(repoPath) ?? deriveLinkedWorktreeWorkspace(repoPath, linkedWorktreeBranch);
@@ -1025,13 +1120,13 @@ function resolveWorkspace(repoPath, override) {
   }
   return deriveLinkedWorktreeWorkspace(repoPath);
 }
-var import_node_child_process2, import_node_fs4, import_node_path3, MAX_WORKSPACE_LENGTH, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
+var import_node_child_process3, import_node_fs5, import_node_path4, MAX_WORKSPACE_LENGTH, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
 var init_workspace = __esm({
   "src/core/workspace.ts"() {
     "use strict";
-    import_node_child_process2 = require("child_process");
-    import_node_fs4 = __toESM(require("fs"));
-    import_node_path3 = __toESM(require("path"));
+    import_node_child_process3 = require("child_process");
+    import_node_fs5 = __toESM(require("fs"));
+    import_node_path4 = __toESM(require("path"));
     init_file_lock();
     MAX_WORKSPACE_LENGTH = 32;
     WORKSPACE_METADATA_FILE = "devrouter-workspace";
@@ -1151,64 +1246,218 @@ function buildHostRoutesDocument(routes, tlsEnabled) {
   }
   return document;
 }
-function writeHostRoutesDynamicFile(routes, tlsEnabled) {
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateRouteState(value, source) {
+  if (!Array.isArray(value)) {
+    throw new Error(`${source} must contain a route array.`);
+  }
+  const routes = value.map((item, index) => {
+    if (!isRecord(item)) {
+      throw new Error(`${source} route ${index} must be an object.`);
+    }
+    for (const key of ["id", "name", "host", "repoPath", "createdAt", "updatedAt"]) {
+      if (typeof item[key] !== "string" || item[key].length === 0) {
+        throw new Error(`${source} route ${index} has an invalid '${key}'.`);
+      }
+    }
+    if (!Number.isInteger(item.port) || Number(item.port) < 1 || Number(item.port) > 65535) {
+      throw new Error(`${source} route ${index} has an invalid 'port'.`);
+    }
+    if (item.mode !== "run" && item.mode !== "attach" && item.mode !== "proxy") {
+      throw new Error(`${source} route ${index} has an invalid 'mode'.`);
+    }
+    if (item.protocol !== void 0 && item.protocol !== "http" && item.protocol !== "tcp") {
+      throw new Error(`${source} route ${index} has an invalid 'protocol'.`);
+    }
+    for (const key of ["tcpProtocol", "upstreamHost", "command", "workspace"]) {
+      if (item[key] !== void 0 && typeof item[key] !== "string") {
+        throw new Error(`${source} route ${index} has an invalid '${key}'.`);
+      }
+    }
+    if (item.pid !== void 0 && (!Number.isInteger(item.pid) || Number(item.pid) <= 0)) {
+      throw new Error(`${source} route ${index} has an invalid 'pid'.`);
+    }
+    const route = item;
+    if (route.id !== buildHostRouteId(route.repoPath, route.name)) {
+      throw new Error(`${source} route ${index} has an inconsistent 'id'.`);
+    }
+    return route;
+  });
+  const ids = /* @__PURE__ */ new Set();
+  const hosts = /* @__PURE__ */ new Set();
+  for (const route of routes) {
+    if (ids.has(route.id)) {
+      throw new Error(`${source} contains duplicate route id '${route.id}'.`);
+    }
+    if (hosts.has(route.host)) {
+      throw new Error(`${source} contains duplicate route host '${route.host}'.`);
+    }
+    ids.add(route.id);
+    hosts.add(route.host);
+  }
+  return routes;
+}
+function renderCompatibilityState(routes) {
+  return `${JSON.stringify(routes, null, 2)}
+`;
+}
+function renderCanonicalState(routes, tlsEnabled) {
+  const metadata = { version: 1, tlsEnabled, routes };
+  const encoded = Buffer.from(JSON.stringify(metadata), "utf-8").toString("base64url");
   const document = buildHostRoutesDocument(routes, tlsEnabled);
-  import_node_fs5.default.writeFileSync(TRAEFIK_HOST_ROUTES_FILE, import_yaml.default.stringify(document, { lineWidth: 0 }), "utf-8");
+  return `${ROUTE_METADATA_PREFIX}${encoded}
+${import_yaml.default.stringify(document, { lineWidth: 0 })}`;
 }
-function ensureHostRouteStorage() {
-  import_node_fs5.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  import_node_fs5.default.mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });
-  if (!import_node_fs5.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
-    import_node_fs5.default.writeFileSync(
-      TRAEFIK_HOST_ROUTES_FILE,
-      import_yaml.default.stringify({ http: { routers: {}, services: {} } }, { lineWidth: 0 }),
-      "utf-8"
+function writeRouteGeneration(routes, tlsEnabled) {
+  writeFileAtomically(HOST_ROUTES_STATE_FILE, renderCompatibilityState(routes));
+  writeFileAtomically(TRAEFIK_HOST_ROUTES_FILE, renderCanonicalState(routes, tlsEnabled));
+}
+function readCompatibilityState() {
+  let raw;
+  try {
+    raw = import_node_fs6.default.readFileSync(HOST_ROUTES_STATE_FILE, "utf-8");
+  } catch (error) {
+    throw new Error(
+      `Could not read the compatibility host-route state: ${error.message}`
     );
   }
-  if (!import_node_fs5.default.existsSync(HOST_ROUTES_STATE_FILE)) {
-    import_node_fs5.default.writeFileSync(HOST_ROUTES_STATE_FILE, "[]\n", "utf-8");
+  try {
+    return validateRouteState(JSON.parse(raw), "Compatibility host-route state");
+  } catch (error) {
+    throw new Error(`Invalid compatibility host-route state: ${error.message}`);
+  }
+}
+function parseCanonicalState(raw) {
+  const firstNewline = raw.indexOf("\n");
+  const firstLine2 = firstNewline === -1 ? raw : raw.slice(0, firstNewline);
+  if (!firstLine2.startsWith(ROUTE_METADATA_PREFIX)) {
+    if (firstLine2.startsWith(ROUTE_METADATA_FAMILY_PREFIX)) {
+      throw new Error(`Unsupported or malformed host-route metadata header '${firstLine2}'.`);
+    }
+    return { kind: "legacy" };
+  }
+  const encoded = firstLine2.slice(ROUTE_METADATA_PREFIX.length);
+  if (!/^[a-zA-Z0-9_-]+$/.test(encoded)) {
+    throw new Error("Host-route metadata header is not valid base64url.");
+  }
+  let metadataValue;
+  try {
+    const decoded = Buffer.from(encoded, "base64url");
+    if (decoded.toString("base64url") !== encoded) {
+      throw new Error("non-canonical base64url encoding");
+    }
+    metadataValue = JSON.parse(decoded.toString("utf-8"));
+  } catch (error) {
+    throw new Error(`Host-route metadata header is invalid: ${error.message}`);
+  }
+  if (!isRecord(metadataValue) || metadataValue.version !== 1) {
+    throw new Error("Host-route metadata header has an unsupported version.");
+  }
+  if (typeof metadataValue.tlsEnabled !== "boolean") {
+    throw new Error("Host-route metadata header has an invalid TLS state.");
+  }
+  const routes = validateRouteState(metadataValue.routes, "Canonical host-route metadata");
+  const metadata = {
+    version: 1,
+    tlsEnabled: metadataValue.tlsEnabled,
+    routes
+  };
+  let document;
+  try {
+    document = import_yaml.default.parse(firstNewline === -1 ? "" : raw.slice(firstNewline + 1));
+  } catch (error) {
+    throw new Error(`Canonical host-route document is invalid: ${error.message}`);
+  }
+  const expectedDocument = buildHostRoutesDocument(routes, metadata.tlsEnabled);
+  if (!(0, import_node_util.isDeepStrictEqual)(document, expectedDocument)) {
+    throw new Error("Canonical host-route document does not match its metadata.");
   }
+  return { kind: "canonical", metadata };
+}
+function ensureHostRouteStorage() {
+  import_node_fs6.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs6.default.mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });
 }
 function writeState(routes) {
   ensureHostRouteStorage();
-  import_node_fs5.default.writeFileSync(HOST_ROUTES_STATE_FILE, `${JSON.stringify(routes, null, 2)}
-`, "utf-8");
-  writeHostRoutesDynamicFile(routes, isTLSEnabled());
+  writeRouteGeneration(routes, isTLSEnabled());
 }
 function withStateLock(fn) {
   ensureHostRouteStorage();
   return withFileLockSync(STATE_LOCK_FILE, { activity: "host route update", waitMs: 5e3 }, fn);
 }
 function refreshHostRoutesDynamicFile() {
-  const routes = listHostRouteState();
-  writeHostRoutesDynamicFile(routes, isTLSEnabled());
+  withStateLock(() => {
+    const routes = readHostRouteStateLocked();
+    writeState(routes);
+  });
 }
-function listHostRouteState() {
+function readHostRouteStateLocked() {
   ensureHostRouteStorage();
-  if (!import_node_fs5.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+  if (!import_node_fs6.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
+    if (import_node_fs6.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+      const routes = readCompatibilityState();
+      writeRouteGeneration(routes, isTLSEnabled());
+      return routes;
+    }
+    writeRouteGeneration([], isTLSEnabled());
     return [];
   }
-  try {
-    const raw = import_node_fs5.default.readFileSync(HOST_ROUTES_STATE_FILE, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed)) {
+  const raw = import_node_fs6.default.readFileSync(TRAEFIK_HOST_ROUTES_FILE, "utf-8");
+  const canonical = parseCanonicalState(raw);
+  if (canonical.kind === "legacy") {
+    if (!import_node_fs6.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+      throw new Error(
+        "Headerless host-route document requires a valid compatibility state file for migration."
+      );
+    }
+    const routes = readCompatibilityState();
+    writeRouteGeneration(routes, isTLSEnabled());
+    return routes;
+  }
+  let mirrorMatches = false;
+  if (import_node_fs6.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+    try {
+      mirrorMatches = (0, import_node_util.isDeepStrictEqual)(readCompatibilityState(), canonical.metadata.routes);
+    } catch {
+      mirrorMatches = false;
+    }
+  }
+  if (!mirrorMatches) {
+    writeFileAtomically(
+      HOST_ROUTES_STATE_FILE,
+      renderCompatibilityState(canonical.metadata.routes)
+    );
+  }
+  return canonical.metadata.routes;
+}
+function readHostRouteStateReadOnly() {
+  if (!import_node_fs6.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
+    if (!import_node_fs6.default.existsSync(HOST_ROUTES_STATE_FILE)) {
       return [];
     }
-    return parsed.filter((item) => item && typeof item === "object").map((item) => item);
-  } catch (err) {
-    const error = err;
-    if (error.code !== "ENOENT") {
-      process.stderr.write(
-        `Warning: devrouter host routes state file is corrupted or unreadable (${error.message}). Recreating route state.
-`
+    return readCompatibilityState();
+  }
+  const raw = import_node_fs6.default.readFileSync(TRAEFIK_HOST_ROUTES_FILE, "utf-8");
+  const canonical = parseCanonicalState(raw);
+  if (canonical.kind === "legacy") {
+    if (!import_node_fs6.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+      throw new Error(
+        "Headerless host-route document requires a valid compatibility state file for inspection."
       );
     }
-    return [];
+    return readCompatibilityState();
   }
+  return canonical.metadata.routes;
+}
+function listHostRouteState() {
+  return withStateLock(readHostRouteStateLocked);
 }
 function upsertHostRoute(input2) {
   return withStateLock(() => {
-    const routes = listHostRouteState();
+    const routes = readHostRouteStateLocked();
     const id = buildHostRouteId(input2.repoPath, input2.name);
     const existing = routes.find((route) => route.id === id);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1225,7 +1474,7 @@ function replaceHostRoutesForRepo(repoPath, inputs) {
     if (inputs.some((input2) => !sameWorkspacePath(input2.repoPath, repoPath))) {
       throw new Error(`Route replacement contains an entry outside '${repoPath}'.`);
     }
-    const routes = listHostRouteState();
+    const routes = readHostRouteStateLocked();
     const remaining = routes.filter((route) => !sameWorkspacePath(route.repoPath, repoPath));
     const names = /* @__PURE__ */ new Set();
     const hosts = /* @__PURE__ */ new Set();
@@ -1263,7 +1512,7 @@ function replaceHostRoutesForRepo(repoPath, inputs) {
 }
 function removeHostRouteById(id) {
   return withStateLock(() => {
-    const routes = listHostRouteState();
+    const routes = readHostRouteStateLocked();
     const next = routes.filter((route) => route.id !== id);
     if (next.length === routes.length) {
       return false;
@@ -1274,7 +1523,7 @@ function removeHostRouteById(id) {
 }
 function removeHostRoutesWhere(predicate) {
   return withStateLock(() => {
-    const routes = listHostRouteState();
+    const routes = readHostRouteStateLocked();
     const removed = routes.filter(predicate);
     if (removed.length === 0) {
       return [];
@@ -1296,7 +1545,7 @@ function listHostRoutes(tlsEnabled) {
       protocol: isTcp ? `tcp/${tcpProtocol}` : "http",
       appName: route.name,
       serviceName: route.name,
-      projectName: import_node_path4.default.basename(route.repoPath),
+      projectName: import_node_path5.default.basename(route.repoPath),
       hosts: [route.host],
       // TCP routes are reached via an SNI-aware client on the shared protocol
       // port; surface a protocol-scheme URL rather than http(s)://.
@@ -1311,13 +1560,15 @@ function listHostRoutes(tlsEnabled) {
     };
   });
 }
-var import_node_fs5, import_node_path4, import_yaml, LOOPBACK_HOSTS, UPSTREAM_RE, TCP_TLS_ALPN_PROTOCOLS, STATE_LOCK_FILE;
+var import_node_fs6, import_node_path5, import_node_util, import_yaml, LOOPBACK_HOSTS, UPSTREAM_RE, TCP_TLS_ALPN_PROTOCOLS, ROUTE_METADATA_PREFIX, ROUTE_METADATA_FAMILY_PREFIX, STATE_LOCK_FILE;
 var init_host_routes = __esm({
   "src/core/host-routes.ts"() {
     "use strict";
-    import_node_fs5 = __toESM(require("fs"));
-    import_node_path4 = __toESM(require("path"));
+    import_node_fs6 = __toESM(require("fs"));
+    import_node_path5 = __toESM(require("path"));
+    import_node_util = require("util");
     import_yaml = __toESM(require("yaml"));
+    init_atomic_file();
     init_file_lock();
     init_router();
     init_workspace();
@@ -1326,6 +1577,8 @@ var init_host_routes = __esm({
     TCP_TLS_ALPN_PROTOCOLS = {
       postgres: ["postgresql"]
     };
+    ROUTE_METADATA_PREFIX = "# devrouter-routes-v1: ";
+    ROUTE_METADATA_FAMILY_PREFIX = "# devrouter-routes-";
     STATE_LOCK_FILE = `${HOST_ROUTES_STATE_FILE}.lock`;
   }
 });
@@ -1753,10 +2006,10 @@ function renderConfig(config) {
   return import_yaml2.default.stringify(config, { lineWidth: 0 });
 }
 function readConfigDocument(configPath) {
-  return (0, import_yaml2.parseDocument)(import_node_fs6.default.readFileSync(configPath, "utf-8"));
+  return (0, import_yaml2.parseDocument)(import_node_fs7.default.readFileSync(configPath, "utf-8"));
 }
 function writeConfigDocument(configPath, doc) {
-  import_node_fs6.default.writeFileSync(configPath, doc.toString({ lineWidth: 0 }), "utf-8");
+  import_node_fs7.default.writeFileSync(configPath, doc.toString({ lineWidth: 0 }), "utf-8");
 }
 function getOrCreateAppsSeq(doc) {
   const apps = doc.get("apps", true);
@@ -1778,25 +2031,25 @@ function appToNodeValue(app) {
   return value;
 }
 function resolveRepoPath(repoPath) {
-  return import_node_path5.default.resolve(repoPath ?? process.cwd());
+  return import_node_path6.default.resolve(repoPath ?? process.cwd());
 }
 function getRepoConfigPath(repoPath) {
-  return import_node_path5.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
+  return import_node_path6.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
 }
 function loadRepoConfig(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
-  if (!import_node_fs6.default.existsSync(configPath)) {
+  if (!import_node_fs7.default.existsSync(configPath)) {
     throw new Error(
       `Missing ${CONFIG_FILE_NAME} in ${resolvedRepoPath}. Run 'dev repo init --repo ${resolvedRepoPath}' first.`
     );
   }
-  const raw = import_node_fs6.default.readFileSync(configPath, "utf-8");
+  const raw = import_node_fs7.default.readFileSync(configPath, "utf-8");
   const parsed = import_yaml2.default.parse(raw);
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.34" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.36" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -1813,7 +2066,7 @@ function loadRepoConfig(repoPath) {
 function initRepoConfig(repoPath, options = {}) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
-  if (import_node_fs6.default.existsSync(configPath)) {
+  if (import_node_fs7.default.existsSync(configPath)) {
     return { repoPath: resolvedRepoPath, configPath, created: false };
   }
   if (options.devrouterVersion !== void 0 && !DEVROUTER_VERSION_RE.test(options.devrouterVersion)) {
@@ -1829,11 +2082,11 @@ function initRepoConfig(repoPath, options = {}) {
       }
     } : {},
     project: {
-      name: import_node_path5.default.basename(resolvedRepoPath)
+      name: import_node_path6.default.basename(resolvedRepoPath)
     },
     apps: []
   };
-  import_node_fs6.default.writeFileSync(configPath, renderConfig(initialConfig), "utf-8");
+  import_node_fs7.default.writeFileSync(configPath, renderConfig(initialConfig), "utf-8");
   return { repoPath: resolvedRepoPath, configPath, created: true };
 }
 function buildAppFromOptions(options) {
@@ -2058,7 +2311,7 @@ function namespaceHost(host, workspace) {
   return `${base}.${workspace}${suffix}`;
 }
 function applyWorkspace(config, workspace, repoPath) {
-  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path5.default.basename(import_node_path5.default.resolve(repoPath))) ?? "app";
+  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path6.default.basename(import_node_path6.default.resolve(repoPath))) ?? "app";
   const substitutionToken = workspace ?? defaultToken;
   const next = structuredClone(config);
   for (const app of next.apps) {
@@ -2133,12 +2386,12 @@ function resolveAppDependencies(config, app) {
   }
   return results;
 }
-var import_node_fs6, import_node_path5, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY;
+var import_node_fs7, import_node_path6, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY;
 var init_repo_config = __esm({
   "src/core/repo-config.ts"() {
     "use strict";
-    import_node_fs6 = __toESM(require("fs"));
-    import_node_path5 = __toESM(require("path"));
+    import_node_fs7 = __toESM(require("fs"));
+    import_node_path6 = __toESM(require("path"));
     import_yaml2 = __toESM(require("yaml"));
     init_capabilities();
     init_host_routes();
@@ -2205,6 +2458,7 @@ function buildOnboardingPrompt(options = {}) {
     "- Shared Traefik router owns host ports 80 (HTTP), 443 (HTTPS), and 5432 (Postgres TCP).",
     "- Per-repo source of truth is REPO_PATH/.devrouter.yml only.",
     "- Global generated/runtime artifacts are managed under ~/.config/devrouter (do not edit these manually).",
+    "- Managed DevPod lifecycle uses devrouter ensure/stop/workspace commands; raw devpod mutations bypass exact checkout ownership checks.",
     "",
     "Inputs:",
     `- REPO_PATH=${repoPath}`,
@@ -2248,6 +2502,7 @@ function buildOnboardingPrompt(options = {}) {
     "- if kind=app and runtime=proxy:",
     '  - upstream: "host:port" (an already-running port, e.g. a devcontainer published on 127.0.0.1:3000, or a container reachable by name on a shared Docker network such as `derivatives-db:5432`)',
     `  - upstream may use the \`${WORKSPACE_PLACEHOLDER}\` placeholder (e.g. \`${WORKSPACE_PLACEHOLDER}-app:3000\`) to target a per-workspace devcontainer alias; it is substituted with the resolved workspace token at runtime and re-validated. Do NOT put \`${WORKSPACE_PLACEHOLDER}\` in \`host\` (rejected) \u2014 the host is auto-namespaced.`,
+    "  - managed `devrouter ensure` requires every HTTP/TCP proxy upstream to begin with the exact resolved workspace/project alias prefix before it mutates DevPod or routes",
     "  - protocol=http registers an HTTP route; protocol=tcp registers a TLS-SNI TCP route and additionally requires tcpProtocol",
     "  - do not set hostRun/docker/dependencies (proxy only registers a route to the upstream)",
     "  - loopback hosts (localhost/127.0.0.1/0.0.0.0) are rewritten to host.docker.internal for Traefik",
@@ -2298,10 +2553,13 @@ function buildOnboardingPrompt(options = {}) {
     "Workspace isolation (parallel git worktrees / agents):",
     `- A "workspace token" lets several worktrees of one repo run in parallel without host/route collisions. Each managed linked worktree has a local Git token plus a durable owner record in the repository's Git common directory spanning the DevPod id, devrouter routes, the \`${WORKSPACE_PLACEHOLDER}\` proxy upstream, and devcontainer aliases.`,
     "- The owner record survives linked-worktree removal and binds the exact path to its DevPod ID. First use reuses an exact-path DevPod or derives a sanitized branch/path identity. Later flags or `DEVROUTER_WORKSPACE` may repeat but cannot rename it. Ambiguous identities fail closed. The primary checkout stays non-namespaced.",
-    `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
+    `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
-    "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause and `devrouter exec . -- <command...>` for container commands. `workspace up` creates linked worktrees; destructive down/GC remains ledger-scoped.",
+    "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod mutations; they bypass the machine-global ownership lock. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
+    "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates DevPod, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, DevPod registration, runtime (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. DevPod `lastUsed` remains advisory.",
+    '- `--measure-size` adds per-workspace storage consumption and stays read-only, but walks each worktree and runs `docker ps` / `docker inspect --size`, so leave it off for a quick report. Each row reports `worktree` and `containerWritable` bytes, which are reclaimable; `imageShared` bytes, which are not, because those image layers are shared with other containers and overlap across rows; and `reclaimable`, the sum of the reclaimable fields. Never add `imageShared` across rows. Any figure that cannot be trusted reports `{"status": "unknown", "reason": ...}` rather than zero, and a workspace with no container reports a measured `0`.',
     "- Workspace commands require Git. Normal config, app, status, and doctor flows work from a `.devrouter.yml` folder without `.git`. Git has no worktree-removal hook; use `workspace ls`, doctor, or dry-run GC after out-of-band removal.",
     "- devcontainer integration: `devcontainer.json` lists the base compose file then `${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}`. The default overlay contains `services: {}`; `.devcontainer/docker-compose.devrouter.yml` passes `WORKSPACE` and `DEVROUTER_WORKSPACE` into the app and bind-mounts `${DEVROUTER_GIT_COMMON_DIR}` to the same absolute app-container path. Ensure proves exact DevPod ownership, overlay/Git mounts, env, aliases, health, Git, HTTP route reachability, and unique running TCP upstream ownership before success.",
     "",
@@ -2465,8 +2723,8 @@ var init_ai_prompt = __esm({
         purpose: "Canonical startup and proof for an exact primary or linked checkout; atomically publishes routes after readiness."
       },
       {
-        command: "devrouter stop [path] [--json]",
-        purpose: "Stop the exact checkout DevPod and routes without deleting checkout data."
+        command: "devrouter stop [path] [--delete] [--json]",
+        purpose: "Stop the exact checkout DevPod and routes; --delete explicitly deletes the ownership-proven DevPod without removing the checkout."
       },
       {
         command: "devrouter exec [path] -- <command...>",
@@ -2484,6 +2742,10 @@ var init_ai_prompt = __esm({
         command: "devrouter workspace ls [--json]",
         purpose: "List owner, Git, DevPod, route, path, and branch evidence for managed workspaces."
       },
+      {
+        command: "devrouter workspace cleanup [--repo <path>] [--inactive-for 30d] [--check-merged] [--measure-size] [--json]",
+        purpose: "Report-only evidence for managed linked workspaces; activity is advisory, --check-merged alone enables read-only origin/forge checks, and no --yes/apply path exists."
+      },
       {
         command: "devrouter workspace stop <workspace|branch>",
         purpose: "Stop the exact DevPod and remove exact routes while preserving the worktree, owner record, and data."
@@ -2567,6 +2829,90 @@ function printJSON(value) {
   process.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 }
+function printWorkspaceCleanupReport(report) {
+  process.stdout.write("Workspace cleanup report (read-only)\n");
+  process.stdout.write(
+    `${renderTable(
+      ["FIELD", "VALUE"],
+      [
+        ["Repo path", report.repoPath],
+        ["Generated", report.generatedAt],
+        ["Inactive threshold", report.inactiveFor],
+        ["Cutoff", report.cutoff],
+        ["Merged check", report.checkMerged ? "enabled" : "disabled"],
+        ["Size measurement", report.measureSize ? "enabled" : "disabled"],
+        ["Managed workspaces", String(report.workspaces.length)]
+      ]
+    )}
+`
+  );
+  if (report.workspaces.length === 0) {
+    process.stdout.write("\nNo managed linked workspaces found.\n");
+    return;
+  }
+  for (const row of report.workspaces) {
+    process.stdout.write(`
+Workspace: ${row.workspace}
+`);
+    process.stdout.write(
+      `${renderTable(
+        ["FIELD", "VALUE"],
+        [
+          ["Branch", row.branch ?? "-"],
+          ["Repo", row.repo],
+          ["Worktree", row.worktreePath],
+          ["DevPod", `${row.devpodId} (${row.provider})`],
+          ["Runtime", row.runtime],
+          ["Ownership", row.ownership],
+          ["Checkout", row.checkout],
+          ["Route", row.route],
+          ["Activity", row.activity],
+          ["Cutoff", row.cutoff],
+          ["Latest activity", row.latestTimestamp ?? "-"],
+          ["Contributing evidence", row.contributingEvidence.join(", ") || "-"],
+          [
+            "Activity evidence",
+            row.activityEvidence.map(
+              (entry) => `${entry.source}=${entry.status}${entry.timestamp ? `@${entry.timestamp}` : ""}`
+            ).join(", ")
+          ],
+          ["Integration", row.integration],
+          ["Eligible actions", row.eligibleActions.join("; ") || "none"],
+          [
+            "Suggestions",
+            row.suggestions.map((suggestion) => `${suggestion.command} (${suggestion.reason})`).join("; ") || "none"
+          ],
+          ["Reasons", row.reasons.join(" | ") || "none"],
+          ...row.consumption ? [
+            ["Reclaimable total", formatCleanupSize(row.consumption.reclaimable)],
+            ["  worktree files", formatCleanupSize(row.consumption.worktree)],
+            ["  container writable", formatCleanupSize(row.consumption.containerWritable)],
+            [
+              "Shared image layers",
+              // The qualifier describes a size, so it is dropped when there
+              // is no size to qualify: "unknown (reason) (not reclaimable)"
+              // reads as two competing answers to the same question.
+              row.consumption.imageShared.status === "measured" ? `${formatCleanupSize(row.consumption.imageShared)} (not reclaimable)` : formatCleanupSize(row.consumption.imageShared)
+            ]
+          ] : []
+        ]
+      )}
+`
+    );
+  }
+}
+function formatCleanupSize(size) {
+  if (size.status === "unknown") {
+    return `unknown (${size.reason})`;
+  }
+  let value = size.bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < BINARY_SIZE_UNITS.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return unit === 0 ? `${value} B` : `${value.toFixed(1)} ${BINARY_SIZE_UNITS[unit]}`;
+}
 function printStatus(status) {
   const rows = [
     ["Docker context", status.dockerContext],
@@ -2770,11 +3116,13 @@ function printSetupReport(report) {
     }
   }
 }
+var BINARY_SIZE_UNITS;
 var init_output = __esm({
   "src/core/output.ts"() {
     "use strict";
     init_table();
     init_timeago();
+    BINARY_SIZE_UNITS = ["B", "KiB", "MiB", "GiB", "TiB"];
   }
 });
 
@@ -2883,11 +3231,11 @@ function extractCurrentVersionFromRepoConfig(repoPath) {
   };
 }
 function readPromptDirectory(promptDirPath) {
-  if (!import_node_fs7.default.existsSync(promptDirPath)) {
+  if (!import_node_fs8.default.existsSync(promptDirPath)) {
     throw new Error(`Missing ${UPGRADE_PROMPTS_DIR} directory at ${promptDirPath}.`);
   }
   const releases = [];
-  const files = import_node_fs7.default.readdirSync(promptDirPath, { withFileTypes: true });
+  const files = import_node_fs8.default.readdirSync(promptDirPath, { withFileTypes: true });
   for (const file of files) {
     if (!file.isFile() || !file.name.endsWith(".md")) {
       continue;
@@ -2897,8 +3245,8 @@ function readPromptDirectory(promptDirPath) {
       continue;
     }
     const version = normalizeVersion(basename);
-    const promptPath = import_node_path6.default.join(promptDirPath, file.name);
-    const prompt = import_node_fs7.default.readFileSync(promptPath, "utf-8").trim();
+    const promptPath = import_node_path7.default.join(promptDirPath, file.name);
+    const prompt = import_node_fs8.default.readFileSync(promptPath, "utf-8").trim();
     releases.push({ version, prompt, promptPath });
   }
   const deduped = /* @__PURE__ */ new Map();
@@ -2919,19 +3267,19 @@ function listAvailableUpgradeTargets(currentVersion, releases) {
 }
 function resolvePromptDirectory(explicitPath) {
   if (explicitPath) {
-    return import_node_path6.default.resolve(explicitPath);
+    return import_node_path7.default.resolve(explicitPath);
   }
-  const entryFile = process.argv[1] ? import_node_path6.default.resolve(process.argv[1]) : __filename;
-  const entryDir = import_node_path6.default.dirname(entryFile);
-  const resolvedEntryDir = import_node_fs7.default.existsSync(entryFile) ? import_node_path6.default.dirname(import_node_fs7.default.realpathSync(entryFile)) : entryDir;
+  const entryFile = process.argv[1] ? import_node_path7.default.resolve(process.argv[1]) : __filename;
+  const entryDir = import_node_path7.default.dirname(entryFile);
+  const resolvedEntryDir = import_node_fs8.default.existsSync(entryFile) ? import_node_path7.default.dirname(import_node_fs8.default.realpathSync(entryFile)) : entryDir;
   const candidates = [
-    import_node_path6.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path6.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path6.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path6.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
-    import_node_path6.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
+    import_node_path7.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path7.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path7.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path7.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
+    import_node_path7.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
   ];
-  const existing = candidates.find((candidate) => import_node_fs7.default.existsSync(candidate));
+  const existing = candidates.find((candidate) => import_node_fs8.default.existsSync(candidate));
   return existing ?? candidates[0];
 }
 function loadUpgradeCatalog(options = {}) {
@@ -2947,12 +3295,12 @@ function loadUpgradeCatalog(options = {}) {
     releases
   };
 }
-var import_node_fs7, import_node_path6, SEMVER_RE, UPGRADE_PROMPTS_DIR;
+var import_node_fs8, import_node_path7, SEMVER_RE, UPGRADE_PROMPTS_DIR;
 var init_upgrade = __esm({
   "src/core/upgrade.ts"() {
     "use strict";
-    import_node_fs7 = __toESM(require("fs"));
-    import_node_path6 = __toESM(require("path"));
+    import_node_fs8 = __toESM(require("fs"));
+    import_node_path7 = __toESM(require("path"));
     init_repo_config();
     SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
     UPGRADE_PROMPTS_DIR = "upgrade-prompts";
@@ -3052,7 +3400,7 @@ async function getDockerodeConstructor() {
   return dockerodeConstructorPromise;
 }
 function runDockerContextCommand(args) {
-  const result = (0, import_node_child_process3.spawnSync)("docker", ["context", ...args], {
+  const result = (0, import_node_child_process4.spawnSync)("docker", ["context", ...args], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -3065,7 +3413,7 @@ function getCurrentDockerContext() {
   return runDockerContextCommand(["show"]);
 }
 function getDockerHostFromContext(context) {
-  const result = (0, import_node_child_process3.spawnSync)(
+  const result = (0, import_node_child_process4.spawnSync)(
     "docker",
     ["context", "inspect", context, "--format", "{{ .Endpoints.docker.Host }}"],
     { encoding: "utf-8" }
@@ -3133,15 +3481,177 @@ async function networkExists(name) {
     return false;
   }
 }
-var import_node_child_process3, dockerodeConstructorPromise;
+var import_node_child_process4, dockerodeConstructorPromise;
 var init_docker = __esm({
   "src/core/docker.ts"() {
     "use strict";
-    import_node_child_process3 = require("child_process");
+    import_node_child_process4 = require("child_process");
     dockerodeConstructorPromise = null;
   }
 });
 
+// src/core/managed-post-start.ts
+function renderDeliveryScript(targetPath) {
+  if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
+    throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
+  }
+  const temporaryPrefix = import_node_path8.default.posix.basename(targetPath);
+  return `set -eu
+umask 077
+runtime_root=/tmp/devrouter
+runtime_bin="$runtime_root/bin"
+target="${targetPath}"
+if [ -L "$runtime_root" ] || [ -L "$runtime_bin" ]; then
+  echo "Refusing symlinked devrouter runtime path." >&2
+  exit 1
+fi
+mkdir -p "$runtime_bin"
+chmod 700 "$runtime_root" "$runtime_bin"
+temporary="$(mktemp "$runtime_bin/.${temporaryPrefix}.XXXXXX")"
+trap 'rm -f "$temporary"' EXIT
+cat > "$temporary"
+chmod 700 "$temporary"
+mv -f "$temporary" "$target"
+trap - EXIT
+`;
+}
+function commandFailure(result) {
+  return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
+}
+function deliverRuntimeFile(containerId, targetPath, contents, label) {
+  const result = (0, import_node_child_process5.spawnSync)(
+    "docker",
+    ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
+    { input: contents, encoding: "utf-8" }
+  );
+  if (result.status !== 0) {
+    const details = commandFailure(result);
+    throw new Error(`Could not deliver ${label}${details ? `: ${details}` : "."}`);
+  }
+}
+function readRegularFileBytes(filePath) {
+  if (!import_node_fs9.default.existsSync(filePath) || !import_node_fs9.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs9.default.readFileSync(filePath);
+}
+function readRegularFile(filePath) {
+  return readRegularFileBytes(filePath)?.toString("utf-8");
+}
+function adapterFingerprint(adapter) {
+  return (0, import_node_crypto3.createHash)("sha256").update(adapter).digest("hex");
+}
+function resolveProcessHelperPath() {
+  const candidates = [
+    import_node_path8.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path8.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+  ];
+  const helperPath = candidates.find((candidate) => import_node_fs9.default.existsSync(candidate));
+  if (!helperPath) {
+    throw new Error("Could not locate the packaged devrouter-process helper.");
+  }
+  return helperPath;
+}
+function resolveManagedPostStartPlan(repoPath) {
+  const adapterPath = import_node_path8.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterBytes = readRegularFileBytes(adapterPath);
+  const adapterText = adapterBytes?.toString("utf-8");
+  const dockerfilePath = import_node_path8.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path8.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfile = readRegularFile(dockerfilePath) ?? "";
+  const devcontainer = readRegularFile(devcontainerPath) ?? "";
+  const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
+    (value) => value.includes("DEVROUTER_PROCESS_HELPER") || value.includes("devrouter-process")
+  );
+  if (adapterBytes === void 0) {
+    if (devrouterPattern) {
+      throw new Error(
+        "Devrouter lifecycle wiring is incomplete: add the managed post-start adapter or remove the stale devrouter-process references."
+      );
+    }
+    return { kind: "unmanaged" };
+  }
+  const adapter = adapterBytes.toString("utf-8");
+  if (!adapter.includes(MANAGED_MARKER)) {
+    if (devrouterPattern) {
+      throw new Error(
+        "Devrouter-looking post-start adapter is missing the 'devrouter:managed devcontainer' marker. Regenerate or migrate the devcontainer, then retry devrouter ensure."
+      );
+    }
+    return { kind: "unmanaged" };
+  }
+  if (adapter.includes("DEVROUTER_PROCESS_HELPER")) {
+    return {
+      kind: "runtime",
+      adapterPath: MANAGED_ADAPTER_PATH,
+      adapterSha256: adapterFingerprint(adapterBytes),
+      adapterContents: adapterBytes
+    };
+  }
+  if (dockerfile.includes("devrouter-process") && devcontainer.includes("postStartCommand")) {
+    return { kind: "legacy" };
+  }
+  throw new Error(
+    "Managed post-start must use DEVROUTER_PROCESS_HELPER before removing the legacy image helper and postStartCommand. Regenerate or migrate the devcontainer, then retry devrouter ensure."
+  );
+}
+function runManagedPostStart(options) {
+  if (options.plan.kind !== "runtime") return;
+  const helper = import_node_fs9.default.readFileSync(resolveProcessHelperPath());
+  deliverRuntimeFile(
+    options.container.id,
+    RUNTIME_HELPER_PATH,
+    helper,
+    "the managed process helper"
+  );
+  const runtimeAdapterPath = `/tmp/devrouter/bin/managed-post-start-${options.plan.adapterSha256}`;
+  deliverRuntimeFile(
+    options.container.id,
+    runtimeAdapterPath,
+    options.plan.adapterContents,
+    "the managed post-start adapter"
+  );
+  const started = (0, import_node_child_process5.spawnSync)(
+    "docker",
+    [
+      "exec",
+      "--workdir",
+      options.container.workspacePath,
+      "--env",
+      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
+      "--env",
+      `DEVROUTER_PROCESS_ADAPTER_SHA256=${options.plan.adapterSha256}`,
+      options.container.id,
+      "bash",
+      "-c",
+      ADAPTER_WRAPPER,
+      options.plan.adapterPath,
+      runtimeAdapterPath
+    ],
+    { stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit" }
+  );
+  if (started.status !== 0) {
+    const details = commandFailure(started);
+    throw new Error(`Managed post-start failed${details ? `: ${details}` : "."}`);
+  }
+}
+var import_node_child_process5, import_node_crypto3, import_node_fs9, import_node_path8, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
+var init_managed_post_start = __esm({
+  "src/core/managed-post-start.ts"() {
+    "use strict";
+    import_node_child_process5 = require("child_process");
+    import_node_crypto3 = require("crypto");
+    import_node_fs9 = __toESM(require("fs"));
+    import_node_path8 = __toESM(require("path"));
+    MANAGED_MARKER = "devrouter:managed devcontainer";
+    MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
+    RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
+    ADAPTER_WRAPPER = `adapter_snapshot="$1"
+shift
+readonly DEVROUTER_PROCESS_HELPER DEVROUTER_PROCESS_ADAPTER_SHA256
+source "$adapter_snapshot"
+`;
+  }
+});
+
 // src/core/devcontainer-diagnostics.ts
 function asRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -3196,7 +3706,7 @@ function isLoopbackHost(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "host.docker.internal";
 }
 function inspectCompose(composeFile, _workspace) {
-  if (!import_node_fs8.default.existsSync(composeFile)) {
+  if (!import_node_fs10.default.existsSync(composeFile)) {
     return {
       aliases: [],
       publishedPorts: [],
@@ -3205,7 +3715,7 @@ function inspectCompose(composeFile, _workspace) {
     };
   }
   try {
-    const raw = import_node_fs8.default.readFileSync(composeFile, "utf-8");
+    const raw = import_node_fs10.default.readFileSync(composeFile, "utf-8");
     const parsed = import_yaml3.default.parse(raw);
     const root = asRecord(parsed);
     const services = asRecord(root?.services);
@@ -3262,11 +3772,11 @@ function routedProxyApps(config) {
   );
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path7.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs8.default.existsSync(devcontainerDir)) {
+  const devcontainerDir = import_node_path9.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs10.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path7.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path9.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -3293,9 +3803,9 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path7.default.join(devcontainerDir, "Dockerfile");
-  const dockerfileExists = import_node_fs8.default.existsSync(dockerfilePath);
-  const dockerfile = dockerfileExists ? import_node_fs8.default.readFileSync(dockerfilePath, "utf-8") : "";
+  const dockerfilePath = import_node_path9.default.join(devcontainerDir, "Dockerfile");
+  const dockerfileExists = import_node_fs10.default.existsSync(dockerfilePath);
+  const dockerfile = dockerfileExists ? import_node_fs10.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
     (artifact) => dockerfile.includes(artifact)
   );
@@ -3306,6 +3816,23 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: devrouterArtifacts.length > 0 ? `artifacts=${devrouterArtifacts.join(", ")}` : void 0,
     suggestion: !dockerfileExists ? "Inspect the consumer image definition and keep devrouter package/helper installation out of it." : devrouterArtifacts.length > 0 ? "Remove devrouter package/helper installation from the Dockerfile; devrouter ensure delivers the helper at runtime." : void 0
   });
+  try {
+    const managedPostStart = resolveManagedPostStartPlan(repoPath);
+    checks.push({
+      id: "repo.devcontainer.managed-post-start",
+      level: managedPostStart.kind === "legacy" ? "warn" : "ok",
+      summary: managedPostStart.kind === "runtime" ? "Managed post-start uses runtime helper delivery with an exact adapter fingerprint." : managedPostStart.kind === "legacy" ? "Managed post-start still uses the legacy image-installed helper contract." : "No devrouter-managed post-start contract is configured.",
+      suggestion: managedPostStart.kind === "legacy" ? "Regenerate or migrate the devcontainer to runtime helper delivery." : void 0
+    });
+  } catch (error) {
+    checks.push({
+      id: "repo.devcontainer.managed-post-start",
+      level: "error",
+      summary: "Devrouter lifecycle wiring is incomplete or ambiguous.",
+      details: error instanceof Error ? error.message : String(error),
+      suggestion: "Regenerate or migrate the managed devcontainer, or remove devrouter-specific wiring from a truly custom devcontainer."
+    });
+  }
   if (!config) {
     checks.push({
       id: "repo.devcontainer.upstream-alias-match",
@@ -3333,30 +3860,31 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs8, import_node_path7, import_yaml3;
+var import_node_fs10, import_node_path9, import_yaml3;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
-    import_node_fs8 = __toESM(require("fs"));
-    import_node_path7 = __toESM(require("path"));
+    import_node_fs10 = __toESM(require("fs"));
+    import_node_path9 = __toESM(require("path"));
     import_yaml3 = __toESM(require("yaml"));
+    init_managed_post_start();
   }
 });
 
 // src/core/paths.ts
 function assertPathWithinRepo(filePath, repoRoot, label) {
-  const resolvedRoot = import_node_path8.default.resolve(repoRoot);
-  const resolved = import_node_path8.default.resolve(repoRoot, filePath);
-  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path8.default.sep)) {
+  const resolvedRoot = import_node_path10.default.resolve(repoRoot);
+  const resolved = import_node_path10.default.resolve(repoRoot, filePath);
+  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path10.default.sep)) {
     throw new Error(`${label} path '${filePath}' escapes the repository root.`);
   }
   return resolved;
 }
-var import_node_path8;
+var import_node_path10;
 var init_paths = __esm({
   "src/core/paths.ts"() {
     "use strict";
-    import_node_path8 = __toESM(require("path"));
+    import_node_path10 = __toESM(require("path"));
   }
 });
 
@@ -3441,11 +3969,11 @@ function reconcileRouteRunConflict(repoPath, app) {
     }
   }
 }
-var import_node_fs9;
+var import_node_fs11;
 var init_route_state = __esm({
   "src/core/route-state.ts"() {
     "use strict";
-    import_node_fs9 = __toESM(require("fs"));
+    import_node_fs11 = __toESM(require("fs"));
     init_host_routes();
     init_workspace();
   }
@@ -3620,7 +4148,7 @@ function toRepoStatus(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
   const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
-  const configExists = import_node_fs10.default.existsSync(configPath);
+  const configExists = import_node_fs12.default.existsSync(configPath);
   if (!explicitRepo && !configExists) {
     return void 0;
   }
@@ -3747,11 +4275,11 @@ async function collectRouterStatus(repoPath) {
     }
   };
 }
-var import_node_fs10;
+var import_node_fs12;
 var init_status = __esm({
   "src/core/status.ts"() {
     "use strict";
-    import_node_fs10 = __toESM(require("fs"));
+    import_node_fs12 = __toESM(require("fs"));
     init_docker();
     init_repo_config();
     init_router();
@@ -3760,7 +4288,7 @@ var init_status = __esm({
 
 // src/core/tls.ts
 function runOrThrow(command, args) {
-  const result = (0, import_node_child_process4.spawnSync)(command, args, {
+  const result = (0, import_node_child_process6.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -3770,7 +4298,7 @@ function runOrThrow(command, args) {
   return result.stdout.trim();
 }
 function commandExists(command) {
-  const result = (0, import_node_child_process4.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
+  const result = (0, import_node_child_process6.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
   return result.status === 0;
 }
 function ensureMkcert() {
@@ -3788,8 +4316,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path9.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs11.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path11.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs13.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -3822,7 +4350,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto2.X509Certificate(pem);
+  const certificate = new import_node_crypto4.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -3855,10 +4383,10 @@ function findUncoveredCertificateHosts(requiredHosts, certificateHosts) {
   );
 }
 function readCurrentCertificateHosts() {
-  if (!import_node_fs11.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs13.default.existsSync(CERT_FILE)) {
     return [];
   }
-  const pem = import_node_fs11.default.readFileSync(CERT_FILE, "utf-8");
+  const pem = import_node_fs13.default.readFileSync(CERT_FILE, "utf-8");
   return parseCertificateDnsHosts(pem);
 }
 function currentCertificateHostsOrEmpty() {
@@ -3947,14 +4475,14 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process4, import_node_crypto2, import_node_fs11, import_node_path9, DEFAULT_TLS_CERT_HOSTS;
+var import_node_child_process6, import_node_crypto4, import_node_fs13, import_node_path11, DEFAULT_TLS_CERT_HOSTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
-    import_node_child_process4 = require("child_process");
-    import_node_crypto2 = require("crypto");
-    import_node_fs11 = __toESM(require("fs"));
-    import_node_path9 = __toESM(require("path"));
+    import_node_child_process6 = require("child_process");
+    import_node_crypto4 = require("crypto");
+    import_node_fs13 = __toESM(require("fs"));
+    import_node_path11 = __toESM(require("path"));
     init_docker();
     init_host_routes();
     init_router();
@@ -3970,7 +4498,7 @@ function outputFromResult(result) {
   return output2.length > 0 ? output2 : void 0;
 }
 function runTool(command, args = []) {
-  const result = (0, import_node_child_process5.spawnSync)(command, args, {
+  const result = (0, import_node_child_process7.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.error) {
@@ -4027,12 +4555,12 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path10.default.join(repoPath, "package.json");
-  if (!import_node_fs12.default.existsSync(packagePath)) {
+  const packagePath = import_node_path12.default.join(repoPath, "package.json");
+  if (!import_node_fs14.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs12.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs14.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -4127,19 +4655,21 @@ function buildGlobalToolChecks(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process5, import_node_fs12, import_node_path10;
+var import_node_child_process7, import_node_fs14, import_node_path12;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
-    import_node_child_process5 = require("child_process");
-    import_node_fs12 = __toESM(require("fs"));
-    import_node_path10 = __toESM(require("path"));
+    import_node_child_process7 = require("child_process");
+    import_node_fs14 = __toESM(require("fs"));
+    import_node_path12 = __toESM(require("path"));
   }
 });
 
 // src/core/devpod-workspaces.ts
 function listDevpodWorkspaces() {
-  const result = (0, import_node_child_process6.spawnSync)("devpod", ["list", "--output", "json"], { encoding: "utf-8" });
+  const result = (0, import_node_child_process8.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
+    encoding: "utf-8"
+  });
   if (result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
@@ -4158,8 +4688,49 @@ function listDevpodWorkspaces() {
     if (typeof candidate.id !== "string" || !candidate.source || typeof candidate.source.localFolder !== "string") {
       throw new Error("devpod list returned a workspace without id/source.localFolder.");
     }
-    return candidate;
+    const workspace = {
+      id: candidate.id,
+      source: { localFolder: candidate.source.localFolder }
+    };
+    if ("lastUsed" in candidate) {
+      if (typeof candidate.lastUsed === "string") {
+        workspace.lastUsed = candidate.lastUsed;
+      } else {
+        workspace.lastUsedMalformed = true;
+      }
+    }
+    return workspace;
+  });
+}
+function parseDevpodRuntimeStatus(output2, expectedId) {
+  let parsed;
+  try {
+    parsed = JSON.parse(output2);
+  } catch {
+    return "unknown";
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.id !== expectedId) {
+    return "unknown";
+  }
+  switch (parsed.state) {
+    case "Running":
+      return "running";
+    case "Stopped":
+      return "stopped";
+    case "Busy":
+      return "busy";
+    case "NotFound":
+      return "not-found";
+    default:
+      return "unknown";
+  }
+}
+function inspectDevpodRuntimeStatus(devpodId) {
+  const result = (0, import_node_child_process8.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
+    encoding: "utf-8"
   });
+  if (result.status !== 0 || result.error) return "unknown";
+  return parseDevpodRuntimeStatus(result.stdout, devpodId);
 }
 function inspectDevpodWorkspaceOwnership(workspaces, devpodId, worktreePath) {
   const idOwners = workspaces.filter((workspace) => workspace.id === devpodId);
@@ -4188,23 +4759,159 @@ function selectDevpodWorkspace(workspaces, repoPath) {
   }
   return matches[0];
 }
-function runDevpodWorkspaceAction(action2, devpodId) {
-  const args = action2 === "delete" ? [action2, devpodId, "--ignore-not-found"] : [action2, devpodId];
-  const result = (0, import_node_child_process6.spawnSync)("devpod", args, { encoding: "utf-8" });
-  if (result.status !== 0) {
-    const detail = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(`devpod ${action2} failed for '${devpodId}': ${detail || "unknown error"}`);
-  }
-}
-var import_node_child_process6;
+var import_node_child_process8;
 var init_devpod_workspaces = __esm({
   "src/core/devpod-workspaces.ts"() {
     "use strict";
-    import_node_child_process6 = require("child_process");
+    import_node_child_process8 = require("child_process");
     init_workspace();
   }
 });
 
+// src/core/devpod-mutation.ts
+function withMutationLock(activity, target, operation) {
+  import_node_fs15.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLockSync(
+    DEVPOD_MUTATION_LOCK_FILE,
+    { activity, target: `'${target}'`, waitMs: DEVPOD_MUTATION_WAIT_MS },
+    operation
+  );
+}
+function commandFailure2(result) {
+  return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+}
+function runDevpodAction(action2, devpodId, force = false) {
+  const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
+  const result = (0, import_node_child_process9.spawnSync)("devpod", args, { encoding: "utf-8" });
+  if (result.status !== 0) {
+    throw new Error(
+      `devpod ${action2}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
+    );
+  }
+}
+function inspectExactOwnership(devpodId, worktreePath) {
+  const ownership = inspectDevpodWorkspaceOwnership(listDevpodWorkspaces(), devpodId, worktreePath);
+  if (ownership.status === "conflict") throw new Error(ownership.reason);
+  return ownership;
+}
+function mutateOwnedDevpodWorkspace(action2, devpodId, worktreePath) {
+  return withMutationLock(`DevPod ${action2}`, worktreePath, () => {
+    const before = inspectExactOwnership(devpodId, worktreePath);
+    if (before.status === "absent") return { status: "absent" };
+    runDevpodAction(action2, devpodId);
+    let after = inspectExactOwnership(devpodId, worktreePath);
+    if (action2 === "stop" && after.status !== "owned") {
+      throw new Error(`DevPod '${devpodId}' no longer owns '${worktreePath}' after provider stop.`);
+    }
+    if (action2 === "delete" && after.status === "owned") {
+      const runtime = inspectDevpodRuntimeStatus(devpodId);
+      if (runtime !== "not-found") {
+        throw new Error(
+          `DevPod '${devpodId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
+        );
+      }
+      after = inspectExactOwnership(devpodId, worktreePath);
+      if (after.status === "owned") {
+        runDevpodAction("delete", devpodId, true);
+        after = inspectExactOwnership(devpodId, worktreePath);
+      }
+      if (after.status !== "absent") {
+        throw new Error(
+          `DevPod '${devpodId}' still owns '${worktreePath}' after forced provider delete.`
+        );
+      }
+    }
+    return { status: "changed" };
+  });
+}
+function stopOwnedDevpodWorkspace(devpodId, worktreePath) {
+  return mutateOwnedDevpodWorkspace("stop", devpodId, worktreePath);
+}
+function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
+  return mutateOwnedDevpodWorkspace("delete", devpodId, worktreePath);
+}
+function startDevpodWorkspace(options) {
+  const activity = options.recreate ? "DevPod recreate" : "DevPod start";
+  return withMutationLock(activity, options.repoPath, () => {
+    const workspaces = listDevpodWorkspaces();
+    let devpodId = options.devpodId ?? selectDevpodWorkspace(workspaces, options.repoPath)?.id;
+    if (devpodId) {
+      const before = inspectDevpodWorkspaceOwnership(workspaces, devpodId, options.repoPath);
+      if (before.status === "conflict") throw new Error(before.reason);
+      if (options.recreate && before.status !== "owned") {
+        throw new Error(`Cannot recreate DevPod '${devpodId}' without one exact owner.`);
+      }
+    } else if (options.recreate) {
+      throw new Error("Cannot recreate a DevPod before its exact id is known.");
+    }
+    const args = ["up", options.repoPath];
+    if (devpodId) args.push("--id", devpodId);
+    args.push("--open-ide=false");
+    if (options.workspace) {
+      args.push(
+        "--workspace-env",
+        `WORKSPACE=${options.workspace.token}`,
+        "--workspace-env",
+        `DEVROUTER_WORKSPACE=${options.workspace.token}`
+      );
+    }
+    if (options.recreate) args.push("--recreate");
+    const env = { ...process.env };
+    if (options.workspace) {
+      env.WORKSPACE = options.workspace.token;
+      env.DEVROUTER_WORKSPACE = options.workspace.token;
+      env.DEVROUTER_GIT_COMMON_DIR = options.workspace.gitCommonDir;
+      env.DEVCONTAINER_COMPOSE_OVERLAY = "docker-compose.devrouter.yml";
+    } else {
+      delete env.WORKSPACE;
+      delete env.DEVROUTER_WORKSPACE;
+      delete env.DEVROUTER_GIT_COMMON_DIR;
+      delete env.DEVCONTAINER_COMPOSE_OVERLAY;
+    }
+    const result = (0, import_node_child_process9.spawnSync)("devpod", args, {
+      stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
+      env
+    });
+    if (result.status !== 0) {
+      throw new Error(`devpod up failed for '${devpodId ?? options.repoPath}'.`);
+    }
+    try {
+      const attached = listDevpodWorkspaces();
+      devpodId ??= selectDevpodWorkspace(attached, options.repoPath)?.id;
+      if (!devpodId) {
+        throw new Error(`DevPod did not attach '${options.repoPath}' after startup.`);
+      }
+      const ownership = inspectDevpodWorkspaceOwnership(attached, devpodId, options.repoPath);
+      if (ownership.status === "conflict") throw new Error(ownership.reason);
+      if (ownership.status !== "owned") {
+        throw new Error(
+          `DevPod did not attach '${options.repoPath}' as '${devpodId}' after startup.`
+        );
+      }
+      return devpodId;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new DevpodStartPostconditionError(message);
+    }
+  });
+}
+var import_node_child_process9, import_node_fs15, import_node_path13, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
+var init_devpod_mutation = __esm({
+  "src/core/devpod-mutation.ts"() {
+    "use strict";
+    import_node_child_process9 = require("child_process");
+    import_node_fs15 = __toESM(require("fs"));
+    import_node_path13 = __toESM(require("path"));
+    init_devpod_workspaces();
+    init_file_lock();
+    init_router();
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path13.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_WAIT_MS = 6e4;
+    DevpodStartPostconditionError = class extends Error {
+    };
+  }
+});
+
 // src/core/workspace-ownership.ts
 function commandError(command, repoPath, stderr) {
   return new Error(
@@ -4212,18 +4919,20 @@ function commandError(command, repoPath, stderr) {
   );
 }
 function resolveGitCommonDir(repoPath) {
-  const result = (0, import_node_child_process7.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
-    encoding: "utf-8"
+  const result = (0, import_node_child_process10.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
+    encoding: "utf-8",
+    env: READ_ONLY_GIT_ENV
   });
   const output2 = result.stdout.trim();
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path11.default.isAbsolute(output2) ? output2 : import_node_path11.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path14.default.isAbsolute(output2) ? output2 : import_node_path14.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
-  const result = (0, import_node_child_process7.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
-    encoding: "utf-8"
+  const result = (0, import_node_child_process10.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
+    encoding: "utf-8",
+    env: READ_ONLY_GIT_ENV
   });
   const output2 = result.stdout.trim();
   if (result.status !== 0 || !output2) {
@@ -4232,8 +4941,9 @@ function resolveGitTopLevel(repoPath) {
   return comparableWorkspacePath(output2);
 }
 function listGitWorktrees(repoPath) {
-  const result = (0, import_node_child_process7.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
-    encoding: "utf-8"
+  const result = (0, import_node_child_process10.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
+    encoding: "utf-8",
+    env: READ_ONLY_GIT_ENV
   });
   if (result.status !== 0) {
     throw commandError("git worktree list", repoPath, result.stderr);
@@ -4268,7 +4978,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path11.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path14.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -4296,7 +5006,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path11.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path14.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -4316,7 +5026,7 @@ function validateRecord(value, expectedWorkspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs13.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs16.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -4332,7 +5042,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs13.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs16.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -4340,14 +5050,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path11.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path14.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path11.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path14.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record2) => record2.workspace === workspace);
@@ -4378,23 +5088,14 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
     createdAt: existing?.createdAt ?? validateTimestamp(now, "createdAt"),
     updatedAt: validateTimestamp(now, "updatedAt")
   };
-  const tempPath = `${filePath}.${process.pid}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
-  try {
-    import_node_fs13.default.writeFileSync(tempPath, `${JSON.stringify(record, null, 2)}
-`, {
-      encoding: "utf-8",
-      flag: "wx"
-    });
-    import_node_fs13.default.renameSync(tempPath, filePath);
-  } finally {
-    import_node_fs13.default.rmSync(tempPath, { force: true });
-  }
+  writeFileAtomically(filePath, `${JSON.stringify(record, null, 2)}
+`);
   return record;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path11.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path14.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs13.default.rmSync(filePath);
+    import_node_fs16.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -4405,7 +5106,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path11.default.join(
+  const filePath = import_node_path14.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -4417,14 +5118,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs13.default.rmSync(filePath);
+  import_node_fs16.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs13.default.mkdirSync(directory, { recursive: true });
+  import_node_fs16.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path11.default.join(directory, ".lock"),
+    import_node_path14.default.join(directory, ".lock"),
     { activity: "workspace ownership transaction", target: `'${repoPath}'`, waitMs: 5e3 },
     () => operation({
       list: () => listWorkspaceOwnershipInDirectory(directory),
@@ -4455,7 +5156,7 @@ function inspectWorkspaceOwnership(record, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs13.default.existsSync(record.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs16.default.existsSync(record.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -4479,19 +5180,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process7, import_node_crypto3, import_node_fs13, import_node_path11, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process10, import_node_fs16, import_node_path14, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
-    import_node_child_process7 = require("child_process");
-    import_node_crypto3 = require("crypto");
-    import_node_fs13 = __toESM(require("fs"));
-    import_node_path11 = __toESM(require("path"));
+    import_node_child_process10 = require("child_process");
+    import_node_fs16 = __toESM(require("fs"));
+    import_node_path14 = __toESM(require("path"));
+    init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
+    READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path11.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path14.default.join("devrouter", "workspaces");
   }
 });
 
@@ -4505,10 +5207,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path12.default.join(comparableRepo, "trees") + import_node_path12.default.sep;
+  const localRoot = import_node_path15.default.join(comparableRepo, "trees") + import_node_path15.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path12.default.basename(comparableRepo)}-`;
-  return import_node_path12.default.dirname(comparableWorktree) === import_node_path12.default.dirname(comparableRepo) && import_node_path12.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path15.default.basename(comparableRepo)}-`;
+  return import_node_path15.default.dirname(comparableWorktree) === import_node_path15.default.dirname(comparableRepo) && import_node_path15.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -4636,17 +5338,6 @@ function revalidateCandidate(candidate, repoPath, transaction) {
     }
   };
 }
-function recheckDevpodOwnership(record) {
-  const ownership = inspectDevpodWorkspaceOwnership(
-    listDevpodWorkspaces(),
-    record.devpodId,
-    record.worktreePath
-  );
-  if (ownership.status === "conflict") {
-    throw new Error(ownership.reason);
-  }
-  return ownership.status;
-}
 function failedAction(resource, error) {
   return {
     resource,
@@ -4676,8 +5367,8 @@ function applyCandidate(candidate, repoPath) {
       const actions = [];
       let devpodStatus;
       try {
-        devpodStatus = recheckDevpodOwnership(record);
-        if (devpodStatus === "owned") runDevpodWorkspaceAction("delete", record.devpodId);
+        const mutation = deleteOwnedDevpodWorkspace(record.devpodId, record.worktreePath);
+        devpodStatus = mutation.status === "changed" ? "owned" : "absent";
       } catch (error) {
         return { ...fresh, actions: [failedAction("devpod", error)] };
       }
@@ -4762,11 +5453,12 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path12;
+var import_node_path15;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path12 = __toESM(require("path"));
+    import_node_path15 = __toESM(require("path"));
+    init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -4835,11 +5527,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs14.default.existsSync(absolutePath)) {
+      if (!import_node_fs17.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs14.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs17.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml4.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -5102,7 +5794,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.34" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.36" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -5132,9 +5824,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path13.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path16.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs14.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs17.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -5177,8 +5869,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path13.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs14.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path16.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs17.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -5322,12 +6014,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs14, import_node_path13, import_yaml4, POSTGRES_DEFAULTS;
+var import_node_fs17, import_node_path16, import_yaml4, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs14 = __toESM(require("fs"));
-    import_node_path13 = __toESM(require("path"));
+    import_node_fs17 = __toESM(require("fs"));
+    import_node_path16 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -5585,12 +6277,12 @@ function parseSsPortListeners(stdout, port) {
   return listeners;
 }
 function findPortListeners(port) {
-  const result = (0, import_node_child_process8.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+  const result = (0, import_node_child_process11.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process8.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process11.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsPortListeners(ssResult.stdout, port);
       }
@@ -5619,11 +6311,11 @@ function findPortListeners(port) {
     };
   });
 }
-var import_node_child_process8;
+var import_node_child_process11;
 var init_ports = __esm({
   "src/util/ports.ts"() {
     "use strict";
-    import_node_child_process8 = require("child_process");
+    import_node_child_process11 = require("child_process");
   }
 });
 
@@ -5679,20 +6371,26 @@ var init_up = __esm({
 });
 
 // src/core/devpod-environment.ts
-function inspectWorkspaceContainers() {
-  const listed = (0, import_node_child_process9.spawnSync)("docker", ["ps", "-a", "--format", "{{.ID}}"], {
-    encoding: "utf-8"
-  });
-  if (listed.status !== 0) {
-    throw new Error(
-      `docker ps failed: ${(listed.stderr || listed.stdout || "unknown error").trim()}`
-    );
+function inspectWorkspaceContainers(options) {
+  let ids = options?.ids;
+  if (!ids) {
+    const listed = (0, import_node_child_process12.spawnSync)("docker", ["ps", "-a", "--format", "{{.ID}}"], {
+      encoding: "utf-8"
+    });
+    if (listed.status !== 0) {
+      throw new Error(
+        `docker ps failed: ${(listed.stderr || listed.stdout || listed.error?.message || "unknown error").trim()}`
+      );
+    }
+    ids = listed.stdout.split(/\r?\n/).map((id) => id.trim()).filter(Boolean);
   }
-  const ids = listed.stdout.split(/\r?\n/).map((id) => id.trim()).filter(Boolean);
   if (ids.length === 0) return [];
-  const inspected = (0, import_node_child_process9.spawnSync)("docker", ["inspect", "--format", SAFE_INSPECT_TEMPLATE, ...ids], {
-    encoding: "utf-8"
-  });
+  const template = options?.withSize ? SIZE_INSPECT_TEMPLATE : SAFE_INSPECT_TEMPLATE;
+  const inspected = (0, import_node_child_process12.spawnSync)(
+    "docker",
+    ["inspect", ...options?.withSize ? ["--size"] : [], "--format", template, ...ids],
+    { encoding: "utf-8" }
+  );
   if (inspected.status !== 0) {
     throw new Error(
       `docker inspect failed: ${(inspected.stderr || inspected.stdout || "unknown error").trim()}`
@@ -5703,7 +6401,7 @@ function inspectWorkspaceContainers() {
 function workspaceAppContainers(containers, repoPath) {
   return containers.filter((container) => {
     const workingDir = container.labels["com.docker.compose.project.working_dir"];
-    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path14.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
+    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path17.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
       (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
     );
   });
@@ -5726,14 +6424,18 @@ function resolveRunningWorkspaceContainer(repoPath) {
   }
   return { id: container.id, workspacePath: repoMount.Destination };
 }
-var import_node_child_process9, import_node_path14, SAFE_INSPECT_TEMPLATE;
+var import_node_child_process12, import_node_path17, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
 var init_devpod_environment = __esm({
   "src/core/devpod-environment.ts"() {
     "use strict";
-    import_node_child_process9 = require("child_process");
-    import_node_path14 = __toESM(require("path"));
+    import_node_child_process12 = require("child_process");
+    import_node_path17 = __toESM(require("path"));
     init_workspace();
     SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
+    SIZE_INSPECT_TEMPLATE = SAFE_INSPECT_TEMPLATE.replace(
+      /}$/,
+      ',"sizeRw":{{json (index . "SizeRw")}},"sizeRootFs":{{json (index . "SizeRootFs")}}}'
+    );
   }
 });
 
@@ -5758,124 +6460,23 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", getMkcertRootCAPath({ repoPath: options.repoPath }));
   }
   args.push(url);
-  const result = (0, import_node_child_process10.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process13.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
   const details = ok ? `HTTP ${status}` : [status === void 0 ? void 0 : `HTTP ${status}`, result.stderr?.trim()].filter(Boolean).join(": ") || `curl exited with status ${result.status ?? "unknown"}`;
   return { ok, status, details };
 }
-var import_node_child_process10;
+var import_node_child_process13;
 var init_http_route_probe = __esm({
   "src/core/http-route-probe.ts"() {
     "use strict";
-    import_node_child_process10 = require("child_process");
+    import_node_child_process13 = require("child_process");
     init_router();
     init_tls();
   }
 });
 
-// src/core/managed-post-start.ts
-function commandFailure(result) {
-  return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
-}
-function readRegularFile(filePath) {
-  if (!import_node_fs15.default.existsSync(filePath) || !import_node_fs15.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs15.default.readFileSync(filePath, "utf-8");
-}
-function resolveProcessHelperPath() {
-  const candidates = [
-    import_node_path15.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path15.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
-  ];
-  const helperPath = candidates.find((candidate) => import_node_fs15.default.existsSync(candidate));
-  if (!helperPath) {
-    throw new Error("Could not locate the packaged devrouter-process helper.");
-  }
-  return helperPath;
-}
-function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path15.default.join(repoPath, MANAGED_ADAPTER_PATH);
-  const adapter = readRegularFile(adapterPath);
-  if (adapter === void 0) return { kind: "unmanaged" };
-  if (!adapter.includes(MANAGED_MARKER)) return { kind: "unmanaged" };
-  if (adapter.includes("DEVROUTER_PROCESS_HELPER")) {
-    return { kind: "runtime", adapterPath: MANAGED_ADAPTER_PATH };
-  }
-  const dockerfilePath = import_node_path15.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path15.default.join(repoPath, ".devcontainer", "devcontainer.json");
-  const dockerfile = readRegularFile(dockerfilePath) ?? "";
-  const devcontainer = readRegularFile(devcontainerPath) ?? "";
-  if (dockerfile.includes("devrouter-process") && devcontainer.includes("postStartCommand")) {
-    return { kind: "legacy" };
-  }
-  throw new Error(
-    "Managed post-start must use DEVROUTER_PROCESS_HELPER before removing the legacy image helper and postStartCommand. Regenerate or migrate the devcontainer, then retry devrouter ensure."
-  );
-}
-function runManagedPostStart(options) {
-  if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs15.default.readFileSync(resolveProcessHelperPath());
-  const delivered = (0, import_node_child_process11.spawnSync)(
-    "docker",
-    ["exec", "-i", options.container.id, "sh", "-c", DELIVERY_SCRIPT],
-    { input: helper, encoding: "utf-8" }
-  );
-  if (delivered.status !== 0) {
-    const details = commandFailure(delivered);
-    throw new Error(
-      `Could not deliver the managed process helper${details ? `: ${details}` : "."}`
-    );
-  }
-  const started = (0, import_node_child_process11.spawnSync)(
-    "docker",
-    [
-      "exec",
-      "--workdir",
-      options.container.workspacePath,
-      "--env",
-      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
-      options.container.id,
-      "bash",
-      options.plan.adapterPath
-    ],
-    { stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit" }
-  );
-  if (started.status !== 0) {
-    const details = commandFailure(started);
-    throw new Error(`Managed post-start failed${details ? `: ${details}` : "."}`);
-  }
-}
-var import_node_child_process11, import_node_fs15, import_node_path15, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, DELIVERY_SCRIPT;
-var init_managed_post_start = __esm({
-  "src/core/managed-post-start.ts"() {
-    "use strict";
-    import_node_child_process11 = require("child_process");
-    import_node_fs15 = __toESM(require("fs"));
-    import_node_path15 = __toESM(require("path"));
-    MANAGED_MARKER = "devrouter:managed devcontainer";
-    MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
-    RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
-    DELIVERY_SCRIPT = `set -eu
-umask 077
-runtime_root=/tmp/devrouter
-runtime_bin="$runtime_root/bin"
-if [ -L "$runtime_root" ] || [ -L "$runtime_bin" ]; then
-  echo "Refusing symlinked devrouter runtime path." >&2
-  exit 1
-fi
-mkdir -p "$runtime_bin"
-chmod 700 "$runtime_root" "$runtime_bin"
-temporary="$(mktemp "$runtime_bin/.devrouter-process.XXXXXX")"
-trap 'rm -f "$temporary"' EXIT
-cat > "$temporary"
-chmod 700 "$temporary"
-mv -f "$temporary" "${RUNTIME_HELPER_PATH}"
-trap - EXIT
-`;
-  }
-});
-
 // src/core/route-publication.ts
 function routedAppsFromConfig(config) {
   return config.apps.filter((app) => app.kind !== "dependency");
@@ -5949,11 +6550,11 @@ var init_route_publication = __esm({
 // src/core/workspace-ensure.ts
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path16.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path18.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path16.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path18.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -6027,7 +6628,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process12.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process14.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8" }
@@ -6037,7 +6638,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process12.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process14.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8" }
@@ -6048,7 +6649,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process12.spawnSync)(
+      const gitCheck = (0, import_node_child_process14.spawnSync)(
         "docker",
         [
           "exec",
@@ -6135,63 +6736,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs16.default.statSync(import_node_path16.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs18.default.statSync(import_node_path18.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
-function startDevpod(repoPath, target, recreate = false, quiet = false) {
-  const args = ["up", repoPath];
-  if (target.devpodId) {
-    args.push("--id", target.devpodId);
-  }
-  args.push("--open-ide=false");
-  if (target.kind === "linked") {
-    args.push(
-      "--workspace-env",
-      `WORKSPACE=${target.workspace}`,
-      "--workspace-env",
-      `DEVROUTER_WORKSPACE=${target.workspace}`
-    );
-  }
-  if (recreate) {
-    if (!target.devpodId) {
-      throw new Error("Cannot recreate a DevPod before its exact id is known.");
-    }
-    args.push("--recreate");
-  }
-  const env = { ...process.env };
-  if (target.kind === "linked") {
-    env.WORKSPACE = target.workspace;
-    env.DEVROUTER_WORKSPACE = target.workspace;
-    env.DEVROUTER_GIT_COMMON_DIR = target.gitCommonDir;
-    env.DEVCONTAINER_COMPOSE_OVERLAY = DEVCONTAINER_OVERLAY;
-  } else {
-    delete env.WORKSPACE;
-    delete env.DEVROUTER_WORKSPACE;
-    delete env.DEVROUTER_GIT_COMMON_DIR;
-    delete env.DEVCONTAINER_COMPOSE_OVERLAY;
-  }
-  const result = (0, import_node_child_process12.spawnSync)("devpod", args, {
-    stdio: quiet ? ["inherit", 2, "inherit"] : "inherit",
-    env
-  });
-  if (result.status !== 0) {
-    throw new Error(`devpod up failed for '${target.devpodId ?? repoPath}'.`);
-  }
-}
-function assertDevpodAttachment(repoPath, expectedId) {
-  const attached = selectDevpodWorkspace(listDevpodWorkspaces(), repoPath);
-  if (!attached || expectedId && attached.id !== expectedId) {
-    throw new Error(
-      `DevPod did not attach '${repoPath}'${expectedId ? ` as '${expectedId}'` : ""} after startup.`
-    );
-  }
-  return attached.id;
-}
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process12.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process14.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -6221,8 +6773,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path16.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs16.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path18.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs18.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -6233,16 +6785,16 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       );
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path16.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path18.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
-        if (app.protocol === "tcp" && !parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
+        if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
           throw new Error(
-            `TCP app '${app.name}' must use a ${owner}-owned upstream beginning with '${aliasPrefix}-'.`
+            `Proxy app '${app.name}' must use a ${owner}-owned upstream beginning with '${aliasPrefix}-'.`
           );
         }
       }
-      const upstreamHosts = parsedUpstreams.map((upstream) => upstream.host).filter((host) => host.startsWith(`${aliasPrefix}-`));
+      const upstreamHosts = parsedUpstreams.map((upstream) => upstream.host);
       const ownership = target.kind === "linked" ? {
         workspace: target.workspace,
         worktreePath: repoPath,
@@ -6254,9 +6806,25 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const currentTarget = () => target.kind === "linked" ? target : { ...target, devpodId };
       const startAndProveAttachment = (recreate = false) => {
-        startDevpod(repoPath, currentTarget(), recreate, options.quiet);
-        environmentStarted = true;
-        devpodId = assertDevpodAttachment(repoPath, devpodId);
+        const requestedTarget = currentTarget();
+        try {
+          devpodId = startDevpodWorkspace({
+            repoPath,
+            devpodId: requestedTarget.devpodId,
+            recreate,
+            quiet: options.quiet,
+            ...requestedTarget.kind === "linked" ? {
+              workspace: {
+                token: requestedTarget.workspace,
+                gitCommonDir: requestedTarget.gitCommonDir
+              }
+            } : {}
+          });
+          environmentStarted = true;
+        } catch (error) {
+          if (error instanceof DevpodStartPostconditionError) environmentStarted = true;
+          throw error;
+        }
         if (ownership) {
           writeWorkspaceOwnership(repoPath, ownership);
         }
@@ -6357,14 +6925,15 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
   });
 }
-var import_node_child_process12, import_node_fs16, import_node_path16, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
+var import_node_child_process14, import_node_fs18, import_node_path18, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process12 = require("child_process");
-    import_node_fs16 = __toESM(require("fs"));
-    import_node_path16 = __toESM(require("path"));
+    import_node_child_process14 = require("child_process");
+    import_node_fs18 = __toESM(require("fs"));
+    import_node_path18 = __toESM(require("path"));
     init_devpod_environment();
+    init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
     init_http_route_probe();
@@ -6438,20 +7007,20 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path17.default.join(mainRepo, "trees", ws);
+  return import_node_path19.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process13.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process15.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path17.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path17.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path19.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path19.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path17.default.join(import_node_path17.default.dirname(mainRepo), `${import_node_path17.default.basename(mainRepo)}-${ws}`);
+  return import_node_path19.default.join(import_node_path19.default.dirname(mainRepo), `${import_node_path19.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -6543,7 +7112,7 @@ function resolveWorkspaceTarget(mainRepo, target, worktrees, records) {
 function worktreeForRecord(worktrees, record) {
   return worktrees.find((candidate) => sameWorkspacePath(candidate.path, record.worktreePath));
 }
-function devpodForTarget(target, worktrees, devpods) {
+function assertDevpodTargetSafe(target, worktrees, devpods) {
   if (target.record) {
     const status = inspectWorkspaceOwnership(target.record, worktrees, devpods);
     if (status.ownerStatus === "conflict") {
@@ -6551,26 +7120,25 @@ function devpodForTarget(target, worktrees, devpods) {
         `Workspace '${target.workspace}' ownership conflicts with live Git or DevPod evidence; no resources were changed.`
       );
     }
-    return status.devpodStatus === "owned" ? devpods.find((devpod) => devpod.id === target.record?.devpodId) : void 0;
+    return;
   }
   const devpodId = target.workspace;
   const ownership = inspectDevpodWorkspaceOwnership(devpods, devpodId, target.worktreePath);
   if (ownership.status === "conflict") {
     throw new Error(ownership.reason);
   }
-  return ownership.status === "owned" ? ownership.workspace : void 0;
 }
 function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs17.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs19.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
     );
   }
-  const status = (0, import_node_child_process13.spawnSync)(
+  const status = (0, import_node_child_process15.spawnSync)(
     "git",
     ["-C", target.worktreePath, "status", "--porcelain", "--untracked-files=normal"],
     { encoding: "utf-8" }
@@ -6591,8 +7159,8 @@ async function workspaceUp(branch, opts = {}) {
   if (!ws) {
     throw new Error(`Branch '${branch}' does not yield a valid workspace token.`);
   }
-  const worktreePath = opts.path ? import_node_path17.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
-  if (import_node_fs17.default.existsSync(worktreePath)) {
+  const worktreePath = opts.path ? import_node_path19.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
+  if (import_node_fs19.default.existsSync(worktreePath)) {
     const registered = listGitWorktrees(mainRepo).find(
       (worktree) => sameWorkspacePath(worktree.path, worktreePath)
     );
@@ -6610,11 +7178,11 @@ async function workspaceUp(branch, opts = {}) {
     if (!opts.path) {
       assertDefaultWorktreeRootIgnored(mainRepo);
     }
-    const add = (0, import_node_child_process13.spawnSync)("git", ["-C", mainRepo, "worktree", "add", worktreePath, branch], {
+    const add = (0, import_node_child_process15.spawnSync)("git", ["-C", mainRepo, "worktree", "add", worktreePath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process13.spawnSync)(
+      const addNew = (0, import_node_child_process15.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, worktreePath],
         {
@@ -6685,10 +7253,9 @@ function workspaceLs(repoPath) {
 }
 function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = false) {
   const devpods = listDevpodWorkspaces();
-  const devpod = devpodForTarget(resolved, worktrees, devpods);
-  if (devpod) {
-    runDevpodWorkspaceAction(action2 === "stop" ? "stop" : "delete", devpod.id);
-  }
+  assertDevpodTargetSafe(resolved, worktrees, devpods);
+  const devpodId = resolved.record?.devpodId ?? resolved.workspace;
+  const mutation = action2 === "stop" ? stopOwnedDevpodWorkspace(devpodId, resolved.worktreePath) : deleteOwnedDevpodWorkspace(devpodId, resolved.worktreePath);
   const routes = removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
   if (!quiet) {
     process.stdout.write(
@@ -6697,9 +7264,9 @@ function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = false) {
     );
   }
   return {
-    ...devpod ? { devpodId: devpod.id } : {},
+    ...mutation.status === "changed" ? { devpodId } : {},
     freedRoutes: routes.length,
-    providerChanged: Boolean(devpod),
+    providerChanged: mutation.status === "changed",
     workspace: resolved.workspace
   };
 }
@@ -6713,10 +7280,15 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     if (removeWorktree) {
       assertFullDownPreflight(mainRepo, resolved);
     }
-    const result = mutateWorkspaceRuntime(action2, resolved, worktrees, opts.quiet);
+    const result = mutateWorkspaceRuntime(
+      action2 === "stop" ? "stop" : "delete",
+      resolved,
+      worktrees,
+      opts.quiet
+    );
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs17.default.existsSync(resolved.worktreePath)) {
-        const rm = (0, import_node_child_process13.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs19.default.existsSync(resolved.worktreePath)) {
+        const rm = (0, import_node_child_process15.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -6734,9 +7306,9 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs17.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs19.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
 }
-async function workspaceStopOwnedPath(worktreePath, opts = {}) {
+async function mutateWorkspaceOwnedPath(action2, worktreePath, opts = {}) {
   const mainRepo = resolveRepoPath(opts.repoPath);
   return withWorkspaceLifecycleLock(worktreePath, async () => {
     const worktrees = identifyGitWorktrees(mainRepo);
@@ -6754,22 +7326,29 @@ async function workspaceStopOwnedPath(worktreePath, opts = {}) {
       worktree: worktreeForRecord(worktrees, record),
       record
     };
-    return mutateWorkspaceRuntime("stop", resolved, worktrees, opts.quiet);
+    return mutateWorkspaceRuntime(action2, resolved, worktrees, opts.quiet);
   });
 }
+async function workspaceStopOwnedPath(worktreePath, opts = {}) {
+  return mutateWorkspaceOwnedPath("stop", worktreePath, opts);
+}
+async function workspaceDeleteOwnedPath(worktreePath, opts = {}) {
+  return mutateWorkspaceOwnedPath("delete", worktreePath, opts);
+}
 async function workspaceStop(target, opts = {}) {
   return runWorkspaceLifecycle("stop", target, opts);
 }
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process13, import_node_fs17, import_node_path17;
+var import_node_child_process15, import_node_fs19, import_node_path19;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process13 = require("child_process");
-    import_node_fs17 = __toESM(require("fs"));
-    import_node_path17 = __toESM(require("path"));
+    import_node_child_process15 = require("child_process");
+    import_node_fs19 = __toESM(require("fs"));
+    import_node_path19 = __toESM(require("path"));
+    init_devpod_mutation();
     init_devpod_workspaces();
     init_repo_config();
     init_route_state();
@@ -6780,7 +7359,7 @@ var init_workspace_lifecycle = __esm({
 });
 
 // src/core/environment-stop.ts
-async function environmentStop(repoPath) {
+async function environmentStop(repoPath, options = {}) {
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
   if (linked && !workspace) {
@@ -6799,25 +7378,27 @@ async function environmentStop(repoPath) {
       if (!mainRepo) {
         throw new Error(`Could not resolve the primary checkout for '${repoPath}'.`);
       }
-      const result = await workspaceStopOwnedPath(record.worktreePath, {
-        quiet: true,
-        repoPath: mainRepo
-      });
+      const result = await (options.delete ? workspaceDeleteOwnedPath : workspaceStopOwnedPath)(
+        record.worktreePath,
+        {
+          quiet: true,
+          repoPath: mainRepo
+        }
+      );
       return {
         kind: "linked",
         repoPath,
         workspace: result.workspace,
         ...result.devpodId ? { devpodId: result.devpodId } : {},
-        stopped: result.providerChanged,
+        stopped: !options.delete && result.providerChanged,
+        ...options.delete ? { deleted: result.providerChanged } : {},
         freedRoutes: result.freedRoutes
       };
     }
   }
   return withWorkspaceLifecycleLock(repoPath, async () => {
     const devpod = selectDevpodWorkspace(listDevpodWorkspaces(), repoPath);
-    if (devpod) {
-      runDevpodWorkspaceAction("stop", devpod.id);
-    }
+    const mutation = devpod ? options.delete ? deleteOwnedDevpodWorkspace(devpod.id, repoPath) : stopOwnedDevpodWorkspace(devpod.id, repoPath) : { status: "absent" };
     const removedRoutes = removeHostRoutesWhere(
       (route) => sameWorkspacePath(route.repoPath, repoPath)
     );
@@ -6825,8 +7406,9 @@ async function environmentStop(repoPath) {
       kind: linked ? "linked" : "primary",
       repoPath,
       ...workspace ? { workspace } : {},
-      ...devpod ? { devpodId: devpod.id } : {},
-      stopped: Boolean(devpod),
+      ...mutation.status === "changed" && devpod ? { devpodId: devpod.id } : {},
+      stopped: !options.delete && mutation.status === "changed",
+      ...options.delete ? { deleted: mutation.status === "changed" } : {},
       freedRoutes: removedRoutes.length
     };
   });
@@ -6834,6 +7416,7 @@ async function environmentStop(repoPath) {
 var init_environment_stop = __esm({
   "src/core/environment-stop.ts"() {
     "use strict";
+    init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
     init_workspace();
@@ -6849,19 +7432,19 @@ __export(stop_exports, {
 });
 async function runStopCommand(options) {
   const repoPath = resolveGitCheckoutPath(options.path);
-  const result = await environmentStop(repoPath);
+  const result = await environmentStop(repoPath, { delete: options.delete });
   if (options.json) {
     process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
     return;
   }
   const label = result.kind === "primary" ? "Primary checkout" : `Workspace '${result.workspace}'`;
-  if (!result.stopped && result.freedRoutes === 0) {
+  if (!result.stopped && !result.deleted && result.freedRoutes === 0) {
     process.stdout.write(`${label} is already stopped; no routes needed removal.
 `);
     return;
   }
-  const provider = result.stopped ? `Stopped DevPod '${result.devpodId}'. ` : "";
+  const provider = result.deleted ? `Deleted DevPod '${result.devpodId}'. ` : result.stopped ? `Stopped DevPod '${result.devpodId}'. ` : "";
   process.stdout.write(
     `${provider}Freed ${result.freedRoutes} route(s) for ${label.toLowerCase()}.
 `
@@ -6891,7 +7474,7 @@ function ensureGuidance(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process14.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process16.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -6929,7 +7512,7 @@ async function devpodExec(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto4.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto5.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -6947,7 +7530,7 @@ async function devpodExec(repoPath, command) {
       wrappedCommand
     ];
     return new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process14.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+      const child = (0, import_node_child_process16.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       let pending = Buffer.alloc(0);
       let statusBytes = Buffer.alloc(0);
       let readingStatus = false;
@@ -7006,12 +7589,12 @@ async function devpodExec(repoPath, command) {
     });
   });
 }
-var import_node_child_process14, import_node_crypto4, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
+var import_node_child_process16, import_node_crypto5, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
 var init_devpod_exec = __esm({
   "src/core/devpod-exec.ts"() {
     "use strict";
-    import_node_child_process14 = require("child_process");
-    import_node_crypto4 = require("crypto");
+    import_node_child_process16 = require("child_process");
+    import_node_crypto5 = require("crypto");
     init_devpod_environment();
     init_devpod_workspaces();
     init_workspace();
@@ -7195,7 +7778,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process15.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process17.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -7203,11 +7786,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process15;
+var import_node_child_process17;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process15 = require("child_process");
+    import_node_child_process17 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -7230,7 +7813,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process16.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process18.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -7244,17 +7827,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process16.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process18.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process16;
+var import_node_child_process18;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process16 = require("child_process");
+    import_node_child_process18 = require("child_process");
     init_docker();
     init_router();
   }
@@ -7294,17 +7877,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs18.default.existsSync(filePath)) {
+  if (!import_node_fs20.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs18.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs20.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path18.default.relative(repoPath, filePath) || ".";
+  return import_node_path20.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -7345,7 +7928,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs18.default.existsSync(import_node_path18.default.join(repoPath, fileName))) {
+    if (import_node_fs20.default.existsSync(import_node_path20.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -7360,9 +7943,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path18.default.join(repoPath, ".nvmrc");
-  if (import_node_fs18.default.existsSync(nvmrc)) {
-    const version = import_node_fs18.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path20.default.join(repoPath, ".nvmrc");
+  if (import_node_fs20.default.existsSync(nvmrc)) {
+    const version = import_node_fs20.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -7423,7 +8006,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path18.default.isAbsolute(fileName) && !import_node_path18.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path20.default.isAbsolute(fileName) && !import_node_path20.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -7441,7 +8024,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs18.default.existsSync(import_node_path18.default.join(repoPath, fileName))
+    (fileName) => import_node_fs20.default.existsSync(import_node_path20.default.join(repoPath, fileName))
   );
 }
 function stringArray(value) {
@@ -7479,7 +8062,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml5.default.parse(import_node_fs18.default.readFileSync(import_node_path18.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml5.default.parse(import_node_fs20.default.readFileSync(import_node_path20.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -7514,8 +8097,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs18.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs18.default.readFileSync(import_node_path18.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs20.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs20.default.readFileSync(import_node_path20.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -7529,18 +8112,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path18.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs18.default.existsSync(dir)) {
+  const dir = import_node_path20.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs20.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs18.default.readdirSync(dir).filter((fileName) => import_node_fs18.default.statSync(import_node_path18.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs20.default.readdirSync(dir).filter((fileName) => import_node_fs20.default.statSync(import_node_path20.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs18.default.existsSync(configPath)) {
+  if (!import_node_fs20.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -7584,15 +8167,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs18.default.existsSync(import_node_path18.default.join(repoPath, fileName))) {
+    if (import_node_fs20.default.existsSync(import_node_path20.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path18.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs18.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs18.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path18.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs18.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path20.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs20.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs20.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path20.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs20.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -7635,7 +8218,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path18.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path20.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -7654,12 +8237,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs18, import_node_path18, import_yaml5;
+var import_node_fs20, import_node_path20, import_yaml5;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs18 = __toESM(require("fs"));
-    import_node_path18 = __toESM(require("path"));
+    import_node_fs20 = __toESM(require("fs"));
+    import_node_path20 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -7764,7 +8347,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs19.default.existsSync(import_node_path19.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs21.default.existsSync(import_node_path21.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -7983,12 +8566,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs19, import_node_path19;
+var import_node_fs21, import_node_path21;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs19 = __toESM(require("fs"));
-    import_node_path19 = __toESM(require("path"));
+    import_node_fs21 = __toESM(require("fs"));
+    import_node_path21 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -8284,7 +8867,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path20.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path22.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -8329,8 +8912,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path20.default.join(repoPath, file.relativePath);
-  if (!import_node_fs20.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path22.default.join(repoPath, file.relativePath);
+  if (!import_node_fs22.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -8338,7 +8921,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs20.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs22.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -8395,11 +8978,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path20.default.join(repoPath, file.relativePath);
-  import_node_fs20.default.mkdirSync(import_node_path20.default.dirname(absolutePath), { recursive: true });
-  import_node_fs20.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path22.default.join(repoPath, file.relativePath);
+  import_node_fs22.default.mkdirSync(import_node_path22.default.dirname(absolutePath), { recursive: true });
+  import_node_fs22.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs20.default.chmodSync(absolutePath, 493);
+    import_node_fs22.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -8437,12 +9020,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs20, import_node_path20, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs22, import_node_path22, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs20 = __toESM(require("fs"));
-    import_node_path20 = __toESM(require("path"));
+    import_node_fs22 = __toESM(require("fs"));
+    import_node_path22 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -8833,7 +9416,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto5.createHash)("sha1").update(import_node_path21.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto6.createHash)("sha1").update(import_node_path23.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -8912,11 +9495,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path21.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs21.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path21.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path23.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs23.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path23.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs21.default.writeFileSync(overlayPath, import_yaml6.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs23.default.writeFileSync(overlayPath, import_yaml6.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -8930,7 +9513,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process17.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -8958,7 +9541,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process17.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -8984,7 +9567,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process17.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -9010,7 +9593,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process17.spawnSync)("docker", args, {
+  (0, import_node_child_process19.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -9022,7 +9605,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process17.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -9036,14 +9619,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process17, import_node_crypto5, import_node_fs21, import_node_path21, import_yaml6;
+var import_node_child_process19, import_node_crypto6, import_node_fs23, import_node_path23, import_yaml6;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process17 = require("child_process");
-    import_node_crypto5 = require("crypto");
-    import_node_fs21 = __toESM(require("fs"));
-    import_node_path21 = __toESM(require("path"));
+    import_node_child_process19 = require("child_process");
+    import_node_crypto6 = require("crypto");
+    import_node_fs23 = __toESM(require("fs"));
+    import_node_path23 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -9133,7 +9716,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process18.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process20.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -9244,12 +9827,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process18.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process20.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process18.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process20.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -9308,7 +9891,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process18.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process20.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -9676,7 +10259,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process18.spawn)(wrapped, {
+        child = (0, import_node_child_process20.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -9690,7 +10273,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process18.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process20.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -9698,7 +10281,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process18.spawn)(options.command[0], {
+      child = (0, import_node_child_process20.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -9706,7 +10289,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process18.spawn)(command, args, {
+      child = (0, import_node_child_process20.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -9727,11 +10310,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process18, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process20, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process18 = require("child_process");
+    import_node_child_process20 = require("child_process");
     import_node_net = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -9859,9 +10442,847 @@ var init_tls2 = __esm({
   }
 });
 
+// src/core/workspace-consumption.ts
+function measureWorktreeConsumption(worktreePath, options) {
+  const deadlineMs = options?.deadlineMs ?? DEFAULT_DEADLINE_MS;
+  const startedAt = Date.now();
+  let rootStat;
+  try {
+    rootStat = import_node_fs24.default.lstatSync(worktreePath);
+  } catch (error) {
+    return { status: "unknown", reason: describeError(error, worktreePath) };
+  }
+  let rootEntries;
+  try {
+    rootEntries = import_node_fs24.default.readdirSync(worktreePath, { withFileTypes: true });
+  } catch (error) {
+    return { status: "unknown", reason: describeError(error, worktreePath) };
+  }
+  const seenInodes = /* @__PURE__ */ new Set();
+  let bytes = 0;
+  let timedOut = false;
+  let unreadableReason = null;
+  const accumulate = (stat) => {
+    if (stat.nlink > 1) {
+      const key = `${stat.dev}:${stat.ino}`;
+      if (seenInodes.has(key)) return;
+      seenInodes.add(key);
+    }
+    bytes += stat.blocks * BLOCK_SIZE_BYTES;
+  };
+  const deadlineExceeded = () => Date.now() - startedAt >= deadlineMs;
+  accumulate(rootStat);
+  const stack = [{ dirPath: worktreePath, entries: rootEntries }];
+  while (stack.length > 0 && !timedOut && !unreadableReason) {
+    const { dirPath, entries } = stack.pop();
+    for (const entry of entries) {
+      if (deadlineExceeded()) {
+        timedOut = true;
+        break;
+      }
+      const entryPath = import_node_path24.default.join(dirPath, entry.name);
+      let entryStat;
+      try {
+        entryStat = import_node_fs24.default.lstatSync(entryPath);
+      } catch (error) {
+        if (error?.code === "ENOENT") continue;
+        unreadableReason = describeIncompleteWalk(error);
+        break;
+      }
+      accumulate(entryStat);
+      if (!entryStat.isDirectory()) continue;
+      let childEntries;
+      try {
+        childEntries = import_node_fs24.default.readdirSync(entryPath, { withFileTypes: true });
+      } catch (error) {
+        unreadableReason = describeIncompleteWalk(error);
+        break;
+      }
+      stack.push({ dirPath: entryPath, entries: childEntries });
+    }
+  }
+  if (timedOut) {
+    return { status: "unknown", reason: `exceeded deadline of ${deadlineMs}ms` };
+  }
+  if (unreadableReason) {
+    return { status: "unknown", reason: unreadableReason };
+  }
+  return { status: "measured", bytes };
+}
+function describeIncompleteWalk(error) {
+  return `could not read every path inside the worktree: ${error?.message ?? String(error)}`;
+}
+function measureContainerConsumption(worktreePaths, dependencies) {
+  const byWorktree = /* @__PURE__ */ new Map();
+  if (worktreePaths.length === 0) return byWorktree;
+  const inspect = dependencies?.inspect ?? inspectWorkspaceContainers;
+  const containers = inspect();
+  const attributedIds = /* @__PURE__ */ new Set();
+  for (const worktreePath of worktreePaths) {
+    for (const container of workspaceAppContainers(containers, worktreePath)) {
+      attributedIds.add(container.id);
+    }
+  }
+  const sized = attributedIds.size === 0 ? [] : inspect({ withSize: true, ids: Array.from(attributedIds) });
+  for (const worktreePath of worktreePaths) {
+    byWorktree.set(worktreePath, summarizeContainers(workspaceAppContainers(sized, worktreePath)));
+  }
+  return byWorktree;
+}
+function summarizeContainers(containers) {
+  let writable = 0;
+  let shared = 0;
+  for (const container of containers) {
+    const { sizeRw, sizeRootFs } = container;
+    if (typeof sizeRw !== "number" || typeof sizeRootFs !== "number" || !Number.isFinite(sizeRw) || !Number.isFinite(sizeRootFs) || sizeRootFs < sizeRw) {
+      const unknown = {
+        status: "unknown",
+        reason: `container ${container.id.slice(0, 12)} reported no usable size`
+      };
+      return { containerWritable: unknown, imageShared: unknown };
+    }
+    writable += sizeRw;
+    shared += sizeRootFs - sizeRw;
+  }
+  return {
+    containerWritable: { status: "measured", bytes: writable },
+    imageShared: { status: "measured", bytes: shared }
+  };
+}
+function describeError(error, worktreePath) {
+  const code = error?.code;
+  if (code === "ENOENT") return `worktree path '${worktreePath}' does not exist`;
+  if (code === "EACCES" || code === "EPERM") {
+    return `permission denied reading worktree path '${worktreePath}'`;
+  }
+  return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
+}
+var import_node_fs24, import_node_path24, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var init_workspace_consumption = __esm({
+  "src/core/workspace-consumption.ts"() {
+    "use strict";
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path24 = __toESM(require("path"));
+    init_devpod_environment();
+    DEFAULT_DEADLINE_MS = 1e4;
+    BLOCK_SIZE_BYTES = 512;
+  }
+});
+
+// src/core/workspace-cleanup.ts
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isSha(value) {
+  return typeof value === "string" && /^[0-9a-f]{40,64}$/i.test(value);
+}
+function parseTimestamp(value) {
+  if (typeof value !== "string") return void 0;
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) ? timestamp : void 0;
+}
+function validTimestamp(value) {
+  return parseTimestamp(value) !== void 0;
+}
+function successfulOutput(result) {
+  if (result.status !== 0 || result.error) return void 0;
+  const output2 = result.stdout.trim();
+  return output2.length > 0 ? output2 : void 0;
+}
+function gitOutput(repoPath, args, commandRunner) {
+  return successfulOutput(commandRunner("git", ["-C", repoPath, ...args]));
+}
+function quoteCommandArg(value) {
+  return /^[a-zA-Z0-9_./:@+-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function workspaceCommand(repoPath, args, beforeRepo = [], afterRepo = []) {
+  return [
+    "devrouter",
+    "workspace",
+    ...args,
+    ...beforeRepo,
+    "--repo",
+    quoteCommandArg(repoPath),
+    ...afterRepo
+  ].join(" ");
+}
+function parseInactiveFor(value = DEFAULT_INACTIVE_FOR) {
+  const match = /^(?<amount>[1-9]\d*)(?<unit>[smhdw])$/.exec(value);
+  if (!match?.groups) {
+    throw new Error(
+      "--inactive-for must be a positive integer followed by s, m, h, d, or w (for example 30d)."
+    );
+  }
+  const amount = Number(match.groups.amount);
+  const multiplier = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 }[match.groups.unit];
+  const seconds = amount * multiplier;
+  if (!Number.isSafeInteger(seconds)) {
+    throw new Error("--inactive-for is too large.");
+  }
+  return { input: value, seconds };
+}
+function evaluateWorkspaceActivity(evidence, cutoff) {
+  const cutoffTime = parseTimestamp(cutoff);
+  if (cutoffTime === void 0) {
+    throw new Error(`Invalid activity cutoff '${cutoff}'.`);
+  }
+  const validEvidence = evidence.filter(
+    (entry) => entry.status === "valid" && validTimestamp(entry.timestamp)
+  );
+  const latestTime = validEvidence.reduce(
+    (latest, entry) => Math.max(
+      latest ?? Number.NEGATIVE_INFINITY,
+      parseTimestamp(entry.timestamp) ?? Number.NEGATIVE_INFINITY
+    ),
+    void 0
+  );
+  const latestTimestamp = latestTime === void 0 ? null : validEvidence.find((entry) => parseTimestamp(entry.timestamp) === latestTime)?.timestamp ?? null;
+  const contributingEvidence = ACTIVITY_SOURCES.filter(
+    (source) => validEvidence.some(
+      (entry) => entry.source === source && parseTimestamp(entry.timestamp) === latestTime
+    )
+  );
+  let status = "unknown";
+  if (latestTime !== void 0) {
+    if (latestTime >= cutoffTime) {
+      status = "recent";
+    } else if (validEvidence.length > 0 && evidence.every(
+      (entry) => entry.status === "valid" || entry.status === "not-applicable" || entry.status === "missing"
+    )) {
+      status = "quiet";
+    }
+  }
+  return {
+    status,
+    latestTimestamp,
+    contributingEvidence,
+    evidence: evidence.slice().sort(
+      (left, right) => ACTIVITY_SOURCES.indexOf(left.source) - ACTIVITY_SOURCES.indexOf(right.source)
+    )
+  };
+}
+function readGitSnapshot(worktree, commandRunner) {
+  const comparablePath = comparableWorkspacePath(worktree.path);
+  if (worktree.prunable || !import_node_fs25.default.existsSync(comparablePath)) {
+    return { worktree, checkout: "missing", head: null, committerDate: null };
+  }
+  const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
+  if (!head) {
+    return { worktree, checkout: "unknown", head: null, committerDate: null };
+  }
+  const committerDate = gitOutput(comparablePath, ["show", "-s", "--format=%cI", "HEAD"], commandRunner) ?? null;
+  const statusResult = commandRunner("git", [
+    "-C",
+    comparablePath,
+    "status",
+    "--porcelain=v1",
+    "--untracked-files=normal"
+  ]);
+  const checkout = worktree.branch === void 0 ? "detached" : statusResult.status !== 0 || statusResult.error ? "unknown" : statusResult.stdout.trim().length > 0 ? "dirty" : "clean";
+  return { worktree, checkout, head, committerDate };
+}
+function parseRemoteIdentity(value) {
+  const normalized = value.trim();
+  let host;
+  let project;
+  const scp = /^git@([^:]+):(.+)$/.exec(normalized);
+  if (scp) {
+    host = scp[1];
+    project = scp[2];
+  } else {
+    try {
+      const url = new URL(normalized);
+      if (url.protocol !== "https:" && url.protocol !== "ssh:") return void 0;
+      host = url.hostname;
+      project = url.pathname.replace(/^\/+/, "");
+    } catch {
+      return void 0;
+    }
+  }
+  project = project.replace(/\.git$/, "").replace(/\/+$/, "");
+  if (!host || !project || project.includes("..") || project.includes(" ")) return void 0;
+  const lowerHost = host.toLowerCase();
+  if (lowerHost === "github.com" && /^[^/]+\/[^/]+$/.test(project)) {
+    return { provider: "github", host: lowerHost, project };
+  }
+  if (lowerHost === "gitlab.com") {
+    return { provider: "gitlab", host: lowerHost, project };
+  }
+  return void 0;
+}
+function parseGitHubChanges(value, project, branch) {
+  if (!Array.isArray(value)) return void 0;
+  const changes = [];
+  for (const item of value) {
+    if (!isRecord2(item)) return void 0;
+    const repository = isRecord2(item.repository) ? item.repository.nameWithOwner : void 0;
+    const headRepository = isRecord2(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
+    if (repository !== project || headRepository !== project || item.headRefName !== branch || !isSha(item.headRefOid) || typeof item.baseRefName !== "string") {
+      continue;
+    }
+    const merged = item.state === "MERGED" && validTimestamp(item.mergedAt);
+    const mergeCommit = isRecord2(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
+    const baseSha = isSha(item.baseRefOid) ? item.baseRefOid : void 0;
+    changes.push({
+      sourceBranch: branch,
+      sourceHeadSha: item.headRefOid,
+      targetBranch: item.baseRefName,
+      ...baseSha ? { baseSha } : {},
+      ...mergeCommit ? { mergeCommitSha: mergeCommit } : {},
+      merged
+    });
+  }
+  return changes;
+}
+function parseGitLabChanges(value, _project, branch) {
+  if (!Array.isArray(value)) return void 0;
+  const changes = [];
+  for (const item of value) {
+    if (!isRecord2(item)) return void 0;
+    const sourceProjectId = item.source_project_id;
+    const targetProjectId = item.target_project_id;
+    const sameProject = typeof sourceProjectId === "number" && typeof targetProjectId === "number" && sourceProjectId === targetProjectId;
+    if (!sameProject || item.source_branch !== branch || !isSha(item.sha) || typeof item.target_branch !== "string") {
+      continue;
+    }
+    const diffRefs = isRecord2(item.diff_refs) ? item.diff_refs : void 0;
+    const mergeCommitSha = isSha(item.merge_commit_sha) ? item.merge_commit_sha : void 0;
+    const baseSha = diffRefs && isSha(diffRefs.base_sha) ? diffRefs.base_sha : void 0;
+    changes.push({
+      sourceBranch: branch,
+      sourceHeadSha: item.sha,
+      targetBranch: item.target_branch,
+      ...baseSha ? { baseSha } : {},
+      ...mergeCommitSha ? { mergeCommitSha } : {},
+      merged: item.state === "merged" && validTimestamp(item.merged_at)
+    });
+  }
+  return changes;
+}
+function patchIdForRange(repoPath, baseSha, headSha, commandRunner) {
+  const diff = commandRunner("git", [
+    "-C",
+    repoPath,
+    "diff",
+    "--no-ext-diff",
+    "--binary",
+    baseSha,
+    headSha
+  ]);
+  if (diff.status !== 0 || diff.error || diff.stdout.length === 0) return void 0;
+  const result = commandRunner("git", ["patch-id", "--stable"], diff.stdout);
+  if (result.status !== 0 || result.error) return void 0;
+  const match = /^([0-9a-f]{40,64})\s+(?:-|[0-9a-f]{40,64})$/i.exec(result.stdout.trim());
+  return match?.[1];
+}
+function hasUniqueSourceCommit(repoPath, baseSha, headSha, commandRunner) {
+  const result = gitOutput(
+    repoPath,
+    ["rev-list", "--no-merges", "--reverse", `${baseSha}..${headSha}`],
+    commandRunner
+  );
+  if (!result) return false;
+  const commits = result.split(/\r?\n/).map((sha) => sha.trim()).filter((sha) => sha.length > 0);
+  return commits.length > 0 && commits.every(isSha) && new Set(commits).size > 0;
+}
+function hasVerifiedCommonBase(repoPath, baseSha, headSha, commandRunner) {
+  const result = commandRunner("git", [
+    "-C",
+    repoPath,
+    "merge-base",
+    "--is-ancestor",
+    baseSha,
+    headSha
+  ]);
+  return result.status === 0 && !result.error;
+}
+function parseTargetBranch(output2) {
+  if (!output2) return void 0;
+  const value = output2.trim();
+  return value.startsWith("origin/") && value.length > "origin/".length ? value.slice("origin/".length) : void 0;
+}
+function parseRemoteDefaultTarget(output2) {
+  if (!output2) return void 0;
+  const match = /^ref:\s+refs\/heads\/([^\s]+)\s+HEAD$/m.exec(output2);
+  return match?.[1];
+}
+function inspectWorkspaceIntegration(repoPath, snapshot, branch, checkMerged, commandRunner) {
+  if (!checkMerged) return { status: "not-verified", reason: "Merged checks were not requested." };
+  if (!snapshot.head || !branch || snapshot.checkout === "missing" || snapshot.checkout === "unknown") {
+    return { status: "unknown", reason: "Current HEAD or branch evidence is unavailable." };
+  }
+  const originUrl = gitOutput(repoPath, ["config", "--get", "remote.origin.url"], commandRunner);
+  const identity = originUrl ? parseRemoteIdentity(originUrl) : void 0;
+  if (!identity) {
+    return { status: "unknown", reason: "The origin is missing or uses an unsupported forge." };
+  }
+  const localTargetBranch = parseTargetBranch(
+    gitOutput(
+      repoPath,
+      ["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"],
+      commandRunner
+    )
+  );
+  const remoteTargetBranch = parseRemoteDefaultTarget(
+    successfulOutput(
+      commandRunner("git", ["-C", repoPath, "ls-remote", "--symref", "origin", "HEAD"])
+    )
+  );
+  if (!remoteTargetBranch || localTargetBranch && localTargetBranch !== remoteTargetBranch) {
+    return {
+      status: "unknown",
+      reason: "The origin default target is missing, stale, or unavailable."
+    };
+  }
+  const targetBranch = remoteTargetBranch;
+  const localTargetSha = gitOutput(
+    repoPath,
+    ["rev-parse", "--verify", `refs/remotes/origin/${targetBranch}`],
+    commandRunner
+  );
+  const remoteTargetOutput = successfulOutput(
+    commandRunner("git", ["-C", repoPath, "ls-remote", "origin", `refs/heads/${targetBranch}`])
+  );
+  const remoteTargetSha = remoteTargetOutput?.split(/\s+/)[0];
+  if (!isSha(localTargetSha) || !isSha(remoteTargetSha) || localTargetSha !== remoteTargetSha) {
+    return { status: "unknown", reason: "The origin target is missing, stale, or unavailable." };
+  }
+  const sourceRemoteOutput = successfulOutput(
+    commandRunner("git", ["-C", repoPath, "ls-remote", "origin", `refs/heads/${branch}`])
+  );
+  const sourceRemoteSha = sourceRemoteOutput?.split(/\s+/)[0];
+  if (!isSha(sourceRemoteSha)) {
+    return {
+      status: "unknown",
+      reason: "The workspace source branch is missing or unavailable on origin."
+    };
+  }
+  const forgeChanges = [];
+  const forgeCommand = identity.provider === "github" ? [
+    "pr",
+    "list",
+    "--repo",
+    identity.project,
+    "--state",
+    "all",
+    "--head",
+    branch,
+    "--json",
+    "headRefName,headRefOid,baseRefName,baseRefOid,state,mergedAt,repository,headRepository,mergeCommit"
+  ] : [
+    "mr",
+    "list",
+    "--repo",
+    identity.project,
+    "--all",
+    "--source-branch",
+    branch,
+    "--output",
+    "json"
+  ];
+  const forge = commandRunner(identity.provider === "github" ? "gh" : "glab", forgeCommand);
+  if (forge.status !== 0 || forge.error) {
+    return { status: "unknown", reason: "The forge query was unavailable or unauthenticated." };
+  }
+  try {
+    const parsed = JSON.parse(forge.stdout);
+    const changes = identity.provider === "github" ? parseGitHubChanges(parsed, identity.project, branch) : parseGitLabChanges(parsed, identity.project, branch);
+    if (!changes) {
+      return { status: "unknown", reason: "The forge response was malformed." };
+    }
+    forgeChanges.push(...changes);
+  } catch {
+    return { status: "unknown", reason: "The forge response was malformed." };
+  }
+  const mergedExact = forgeChanges.find(
+    (change) => change.merged && change.targetBranch === targetBranch && change.sourceHeadSha.toLowerCase() === snapshot.head?.toLowerCase() && change.sourceHeadSha.toLowerCase() === sourceRemoteSha.toLowerCase()
+  );
+  if (mergedExact)
+    return {
+      status: "merged-exact",
+      headSha: snapshot.head,
+      reason: "Merged source head exactly matches current HEAD."
+    };
+  const worktreePath = snapshot.worktree.path;
+  const ancestry = commandRunner("git", [
+    "-C",
+    worktreePath,
+    "merge-base",
+    "--is-ancestor",
+    snapshot.head,
+    remoteTargetSha
+  ]);
+  if (ancestry.status === 0 && !ancestry.error) {
+    return {
+      status: "on-target",
+      headSha: snapshot.head,
+      reason: "Current HEAD is an ancestor of the verified-fresh origin target."
+    };
+  }
+  if (ancestry.status !== 1 || ancestry.error) {
+    return { status: "unknown", reason: "Target ancestry could not be verified." };
+  }
+  for (const change of forgeChanges.filter(
+    (candidate) => candidate.merged && candidate.targetBranch === targetBranch && candidate.sourceHeadSha.toLowerCase() !== snapshot.head?.toLowerCase()
+  )) {
+    if (change.sourceHeadSha.toLowerCase() !== sourceRemoteSha?.toLowerCase()) continue;
+    if (change.baseSha && change.mergeCommitSha && hasVerifiedCommonBase(worktreePath, change.baseSha, snapshot.head, commandRunner) && hasVerifiedCommonBase(worktreePath, change.baseSha, change.mergeCommitSha, commandRunner) && hasUniqueSourceCommit(worktreePath, change.baseSha, snapshot.head, commandRunner)) {
+      const currentPatchId = patchIdForRange(
+        worktreePath,
+        change.baseSha,
+        snapshot.head,
+        commandRunner
+      );
+      const mergedPatchId = patchIdForRange(
+        worktreePath,
+        change.baseSha,
+        change.mergeCommitSha,
+        commandRunner
+      );
+      if (!currentPatchId || !mergedPatchId || currentPatchId !== mergedPatchId) continue;
+      return {
+        status: "patch-equivalent",
+        headSha: snapshot.head,
+        reason: "All source changes have an equivalent merged patch."
+      };
+    }
+  }
+  return {
+    status: "not-verified",
+    reason: "Fresh target and forge evidence did not prove integration."
+  };
+}
+function routeStatus(record, routes) {
+  if (!routes) return "unknown";
+  const matchingPath = routes.filter(
+    (route) => sameWorkspacePath(route.repoPath, record.worktreePath)
+  );
+  if (matchingPath.length === 0) return "absent";
+  return matchingPath.every((route) => route.workspace === record.workspace) ? "owned" : "conflict";
+}
+function buildActivityEvidence(record, providerStatus, provider, routeEntries, git) {
+  const providerEvidence = providerStatus === "unknown" || providerStatus === "conflict" ? { source: "devpod.lastUsed", status: "unavailable" } : providerStatus === "absent" ? { source: "devpod.lastUsed", status: "not-applicable" } : provider?.lastUsedMalformed ? { source: "devpod.lastUsed", status: "malformed" } : provider?.lastUsed ? validTimestamp(provider.lastUsed) ? { source: "devpod.lastUsed", status: "valid", timestamp: provider.lastUsed } : { source: "devpod.lastUsed", status: "malformed" } : { source: "devpod.lastUsed", status: "missing" };
+  const routeTimestamps = routeEntries?.map((route) => route.updatedAt) ?? [];
+  const malformedRoute = routeTimestamps.some((timestamp) => !validTimestamp(timestamp));
+  const newestRoute = routeTimestamps.filter(validTimestamp).sort((left, right) => (parseTimestamp(right) ?? 0) - (parseTimestamp(left) ?? 0))[0];
+  const routeEvidence = !routeEntries ? { source: "route.updatedAt", status: "unavailable" } : routeEntries.length === 0 ? { source: "route.updatedAt", status: "not-applicable" } : malformedRoute ? { source: "route.updatedAt", status: "malformed" } : newestRoute ? { source: "route.updatedAt", status: "valid", timestamp: newestRoute } : { source: "route.updatedAt", status: "malformed" };
+  const ownerEvidence = validTimestamp(record.updatedAt) ? { source: "ownership.updatedAt", status: "valid", timestamp: record.updatedAt } : { source: "ownership.updatedAt", status: "malformed" };
+  const gitEvidence = git.checkout === "missing" ? { source: "git.headCommitterDate", status: "not-applicable" } : git.committerDate && validTimestamp(git.committerDate) ? { source: "git.headCommitterDate", status: "valid", timestamp: git.committerDate } : git.checkout === "unknown" ? { source: "git.headCommitterDate", status: "unavailable" } : { source: "git.headCommitterDate", status: "malformed" };
+  return [providerEvidence, routeEvidence, ownerEvidence, gitEvidence];
+}
+function buildSuggestions(repoPath, record, ownership, provider, runtime, checkout, route, activity, integration, worktree, checkMerged) {
+  const reasons = [];
+  const eligibleActions = [];
+  const suggestions = [];
+  const gcCommand = workspaceCommand(repoPath, ["gc"], [], ["--yes"]);
+  const keepCommand = workspaceCommand(repoPath, ["down", record.workspace], ["--keep-worktree"]);
+  const downCommand = workspaceCommand(repoPath, ["down", record.workspace]);
+  const routeSafe = route === "owned" || route === "absent";
+  const checkoutSafe = checkout === "clean" && !worktree?.locked;
+  const providerSafe = provider === "owned";
+  const runtimeSafe = runtime === "running" || runtime === "stopped" || runtime === "not-found";
+  if (ownership === "missing") {
+    if ((provider === "absent" || provider === "owned" && runtimeSafe) && routeSafe) {
+      eligibleActions.push(gcCommand);
+      suggestions.push({
+        command: gcCommand,
+        reason: "The exact ownership record is missing from live Git registration; GC will revalidate before deleting eligible runtime evidence."
+      });
+    } else {
+      reasons.push(
+        `GC suggestion suppressed because provider=${provider}, runtime=${runtime}, or route=${route} is not independently safe.`
+      );
+    }
+    return { eligibleActions, suggestions, reasons };
+  }
+  if (ownership !== "present")
+    reasons.push(`Destructive suggestions require ownership=present (found ${ownership}).`);
+  if (!providerSafe)
+    reasons.push(
+      `Destructive suggestions require an exact owned DevPod (found provider=${provider}).`
+    );
+  if (!runtimeSafe)
+    reasons.push(
+      `Destructive suggestions require an actionable DevPod runtime (found runtime=${runtime}).`
+    );
+  if (!routeSafe)
+    reasons.push(
+      `Destructive suggestions require non-conflicting route evidence (found route=${route}).`
+    );
+  if (checkout === "dirty")
+    reasons.push("Checkout is dirty; destructive workspace down is blocked.");
+  if (checkout === "missing")
+    reasons.push("Checkout is missing; the report cannot authorize full down.");
+  if (checkout === "detached")
+    reasons.push("Checkout is detached; branch identity is not safe for destructive advice.");
+  if (checkout === "unknown")
+    reasons.push("Checkout state is unknown; destructive advice is suppressed.");
+  if (worktree?.locked)
+    reasons.push("Git worktree is locked; destructive workspace down is blocked.");
+  if (!providerSafe || !runtimeSafe || !routeSafe || !checkoutSafe || ownership !== "present") {
+    return { eligibleActions, suggestions, reasons };
+  }
+  if (integration.status === "merged-exact" && integration.headSha) {
+    eligibleActions.push(downCommand);
+    suggestions.push({
+      command: downCommand,
+      reason: "Current HEAD is the exact source head of a same-repository merged change; workspace down still revalidates cleanliness, locks, and ownership before deleting runtime and the linked worktree."
+    });
+    return { eligibleActions, suggestions, reasons };
+  }
+  if (integration.status === "patch-equivalent")
+    reasons.push("Patch-equivalent integration is advisory and never authorizes full removal.");
+  if (integration.status === "unknown" || integration.status === "not-verified")
+    reasons.push(`Integration is ${integration.status}; full removal is not suggested.`);
+  const activityCleanupAllowed = !checkMerged || integration.status === "on-target" || integration.status === "merged-exact";
+  if (!activityCleanupAllowed) {
+    reasons.push(
+      "Cleanup is not suggested because the requested integration check did not provide a verified target or exact merge."
+    );
+    return { eligibleActions, suggestions, reasons };
+  }
+  if (activity === "quiet") {
+    eligibleActions.push(keepCommand);
+    suggestions.push({
+      command: keepCommand,
+      reason: "Managed workspace has no recent trustworthy activity; this deletes DevPod/runtime data and preserves the worktree and owner record."
+    });
+  } else if (activity === "recent") {
+    reasons.push("Recent trustworthy activity vetoes a quiet-workspace suggestion.");
+  } else {
+    reasons.push("Activity is unknown; a quiet-workspace suggestion is suppressed.");
+  }
+  return { eligibleActions, suggestions, reasons };
+}
+function buildRow(repoPath, record, worktrees, devpods, routes, snapshot, cutoff, checkMerged, commandRunner, inspectOwnershipFn, inspectIntegrationFn, inspectRuntimeFn) {
+  const ownershipEvidence = inspectOwnershipFn(record, worktrees, devpods);
+  const providerOwnership = devpods?.find(
+    (devpod) => devpod.id === record.devpodId && sameWorkspacePath(devpod.source.localFolder, record.worktreePath)
+  );
+  const matchingRoutes = routes?.filter(
+    (route) => sameWorkspacePath(route.repoPath, record.worktreePath)
+  );
+  const activity = evaluateWorkspaceActivity(
+    buildActivityEvidence(
+      record,
+      ownershipEvidence.devpodStatus,
+      providerOwnership,
+      matchingRoutes,
+      snapshot
+    ),
+    cutoff
+  );
+  const branch = snapshot.checkout === "detached" ? null : snapshot.worktree.branch ?? record.branch;
+  const integration = inspectIntegrationFn?.(repoPath, snapshot, branch, checkMerged) ?? inspectWorkspaceIntegration(repoPath, snapshot, branch, checkMerged, commandRunner);
+  const runtime = ownershipEvidence.devpodStatus === "absent" ? "absent" : ownershipEvidence.devpodStatus === "owned" ? (() => {
+    try {
+      return inspectRuntimeFn(record.devpodId);
+    } catch {
+      return "unknown";
+    }
+  })() : "unknown";
+  const suggestions = buildSuggestions(
+    repoPath,
+    record,
+    ownershipEvidence.ownerStatus,
+    ownershipEvidence.devpodStatus,
+    runtime,
+    snapshot.checkout,
+    routeStatus(record, routes),
+    activity.status,
+    integration,
+    snapshot.worktree,
+    checkMerged
+  );
+  const reasons = [
+    `ownership=${ownershipEvidence.ownerStatus}`,
+    `provider=${ownershipEvidence.devpodStatus}`,
+    `runtime=${runtime}`,
+    `checkout=${snapshot.checkout}`,
+    `route=${routeStatus(record, routes)}`,
+    `activity=${activity.status}`,
+    `integration=${integration.status}`,
+    ...integration.reason ? [integration.reason] : [],
+    ...suggestions.reasons
+  ];
+  return {
+    schemaVersion: 2,
+    workspace: record.workspace,
+    branch,
+    repo: repoPath,
+    worktreePath: record.worktreePath,
+    devpodId: record.devpodId,
+    ownership: ownershipEvidence.ownerStatus,
+    provider: ownershipEvidence.devpodStatus,
+    runtime,
+    checkout: snapshot.checkout,
+    route: routeStatus(record, routes),
+    activity: activity.status,
+    cutoff,
+    latestTimestamp: activity.latestTimestamp,
+    contributingEvidence: activity.contributingEvidence,
+    activityEvidence: activity.evidence,
+    integration: integration.status,
+    eligibleActions: suggestions.eligibleActions,
+    suggestions: suggestions.suggestions,
+    reasons: Array.from(new Set(reasons))
+  };
+}
+function deriveReclaimable(worktree, containerWritable) {
+  if (worktree.status === "unknown") {
+    return worktree;
+  }
+  if (containerWritable.status === "unknown") {
+    return containerWritable;
+  }
+  return { status: "measured", bytes: worktree.bytes + containerWritable.bytes };
+}
+function collectConsumption(worktreePath, measureWorktreeFn, containers) {
+  let worktree;
+  try {
+    worktree = measureWorktreeFn(worktreePath);
+  } catch (error) {
+    worktree = {
+      status: "unknown",
+      reason: `worktree measurement failed: ${describeCause(error)}`
+    };
+  }
+  const docker = containers.get(worktreePath) ?? unknownContainers("attribution not collected");
+  return {
+    worktree,
+    containerWritable: docker.containerWritable,
+    imageShared: docker.imageShared,
+    reclaimable: deriveReclaimable(worktree, docker.containerWritable)
+  };
+}
+function unknownContainers(reason) {
+  return {
+    containerWritable: { status: "unknown", reason },
+    imageShared: { status: "unknown", reason }
+  };
+}
+function describeCause(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
+  const repoPath = resolveRepoPath(options.repo);
+  const commandRunner = dependencies.commandRunner ?? defaultCommandRunner;
+  const duration = parseInactiveFor(options.inactiveFor);
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const cutoff = new Date(now.getTime() - duration.seconds * 1e3).toISOString();
+  const worktrees = (dependencies.listWorktrees ?? listGitWorktrees)(repoPath);
+  const records = (dependencies.listOwnership ?? listWorkspaceOwnership)(repoPath);
+  let devpods;
+  try {
+    devpods = (dependencies.listDevpods ?? listDevpodWorkspaces)();
+  } catch {
+    devpods = void 0;
+  }
+  let routes;
+  try {
+    routes = (dependencies.readRoutes ?? readHostRouteStateReadOnly)();
+  } catch {
+    routes = void 0;
+  }
+  const measureSize = Boolean(options.measureSize);
+  const measureWorktreeFn = dependencies.measureWorktree ?? measureWorktreeConsumption;
+  const measureContainersFn = dependencies.measureContainers ?? measureContainerConsumption;
+  let containers = /* @__PURE__ */ new Map();
+  if (measureSize) {
+    const worktreePaths = records.map((record) => record.worktreePath);
+    try {
+      containers = measureContainersFn(worktreePaths);
+    } catch (error) {
+      const reason = `container measurement failed: ${describeCause(error)}`;
+      containers = new Map(worktreePaths.map((path24) => [path24, unknownContainers(reason)]));
+    }
+  }
+  const rows = records.map((record) => {
+    const worktree = worktrees.find(
+      (candidate) => sameWorkspacePath(candidate.path, record.worktreePath)
+    );
+    const snapshot = (dependencies.readGitSnapshot ?? ((candidate) => readGitSnapshot(candidate, commandRunner)))(
+      worktree ?? {
+        path: record.worktreePath,
+        branch: record.branch ?? void 0,
+        locked: false,
+        prunable: true
+      }
+    );
+    const row = buildRow(
+      repoPath,
+      record,
+      worktrees,
+      devpods,
+      routes,
+      snapshot,
+      cutoff,
+      Boolean(options.checkMerged),
+      commandRunner,
+      dependencies.inspectOwnership ?? ((recordValue, worktreeValues, devpodValues) => {
+        const status = inspectWorkspaceOwnership(recordValue, worktreeValues, devpodValues);
+        return { ownerStatus: status.ownerStatus, devpodStatus: status.devpodStatus };
+      }),
+      dependencies.inspectIntegration,
+      dependencies.inspectDevpodRuntime ?? inspectDevpodRuntimeStatus
+    );
+    return measureSize ? {
+      ...row,
+      consumption: collectConsumption(record.worktreePath, measureWorktreeFn, containers)
+    } : row;
+  }).sort((left, right) => left.workspace.localeCompare(right.workspace));
+  return {
+    schemaVersion: 2,
+    generatedAt: now.toISOString(),
+    repoPath,
+    inactiveFor: duration.input,
+    cutoff,
+    checkMerged: Boolean(options.checkMerged),
+    measureSize,
+    workspaces: rows
+  };
+}
+var import_node_child_process21, import_node_fs25, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var init_workspace_cleanup = __esm({
+  "src/core/workspace-cleanup.ts"() {
+    "use strict";
+    import_node_child_process21 = require("child_process");
+    import_node_fs25 = __toESM(require("fs"));
+    init_devpod_workspaces();
+    init_host_routes();
+    init_repo_config();
+    init_workspace();
+    init_workspace_consumption();
+    init_workspace_ownership();
+    DEFAULT_INACTIVE_FOR = "30d";
+    READ_ONLY_GIT_ENV2 = { ...process.env, GIT_OPTIONAL_LOCKS: "0", LC_ALL: "C" };
+    ACTIVITY_SOURCES = [
+      "devpod.lastUsed",
+      "route.updatedAt",
+      "ownership.updatedAt",
+      "git.headCommitterDate"
+    ];
+    defaultCommandRunner = (command, args, input2) => {
+      const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
+      const result = (0, import_node_child_process21.spawnSync)(command, args, {
+        encoding: "utf-8",
+        env: environment,
+        ...input2 === void 0 ? {} : { input: input2 }
+      });
+      return {
+        status: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        ...result.error ? { error: result.error } : {}
+      };
+    };
+  }
+});
+
 // src/commands/workspace.ts
 var workspace_exports = {};
 __export(workspace_exports, {
+  runWorkspaceCleanupCommand: () => runWorkspaceCleanupCommand,
   runWorkspaceDownCommand: () => runWorkspaceDownCommand,
   runWorkspaceGcCommand: () => runWorkspaceGcCommand,
   runWorkspaceLsCommand: () => runWorkspaceLsCommand,
@@ -9909,6 +11330,15 @@ function runWorkspaceLsCommand(options) {
     );
   }
 }
+function runWorkspaceCleanupCommand(options) {
+  const repoPath = resolveGitWorkspaceRepo(options.repo);
+  const report = buildWorkspaceCleanupReport({ ...options, repo: repoPath });
+  if (options.json) {
+    printJSON(report);
+    return;
+  }
+  printWorkspaceCleanupReport(report);
+}
 async function runWorkspaceDownCommand(target, options) {
   const repoPath = resolveGitWorkspaceRepo(options.repo);
   await workspaceDown(target, {
@@ -9947,7 +11377,9 @@ function runWorkspaceGcCommand(options) {
 var init_workspace2 = __esm({
   "src/commands/workspace.ts"() {
     "use strict";
+    init_output();
     init_repo_config();
+    init_workspace_cleanup();
     init_workspace_gc();
     init_workspace_lifecycle();
     init_workspace_ownership();
@@ -9992,7 +11424,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.34" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.36" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -10053,11 +11485,15 @@ program.command("ensure").description("Start and prove a primary or linked check
     });
   })
 );
-program.command("stop").description("Stop one checkout's exact DevPod and free its routes without deleting data").argument("[path]", "Git checkout path (defaults to current directory)").option("--json", "Output JSON").action(
+program.command("stop").description("Stop one checkout's exact DevPod and free its routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--json", "Output JSON").option("--delete", "Delete the exact DevPod instead of preserving its data").action(
   withErrorHandling(async (repoPath, _options, command) => {
     const options = command.opts();
     const { runStopCommand: runStopCommand2 } = await Promise.resolve().then(() => (init_stop(), stop_exports));
-    await runStopCommand2({ path: repoPath, json: Boolean(options.json) });
+    await runStopCommand2({
+      path: repoPath,
+      delete: Boolean(options.delete),
+      json: Boolean(options.json)
+    });
   })
 );
 program.command("exec").description("Run one literal command inside the exact checkout's running DevPod").argument("[args...]", "[path] -- <command...>").allowUnknownOption(true).action(
@@ -10227,8 +11663,8 @@ tlsCommand.command("install").description("Install mkcert certs and enable HTTPS
     await runTLSInstallCommand2();
   })
 );
-var workspaceCommand = program.command("workspace").description("Spin up / list / tear down isolated worktree+devcontainer workspaces");
-workspaceCommand.command("up").description(
+var workspaceCommand2 = program.command("workspace").description("Spin up / list / tear down isolated worktree+devcontainer workspaces");
+workspaceCommand2.command("up").description(
   "Create a worktree for <branch>, bring up its devpod, and register namespaced routes"
 ).argument("<branch>", "Git branch to base the workspace on").option("--path <dir>", "Worktree directory (default: <repo>/trees/<workspace>)").option("--no-devpod", "Only create the worktree; do not start the environment or change routes").option("--open", "Open the namespaced routes after registering").option("--repo <path>", "Main repository path (defaults to current directory)").action(
   withErrorHandling(async (branch, _options, command) => {
@@ -10242,7 +11678,7 @@ workspaceCommand.command("up").description(
     });
   })
 );
-workspaceCommand.command("ensure").description("Start and prove a primary or linked checkout's DevPod, upstreams, and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+workspaceCommand2.command("ensure").description("Start and prove a primary or linked checkout's DevPod, upstreams, and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(
     async (worktreePath, _options, command) => {
       const options = command.opts();
@@ -10255,28 +11691,41 @@ workspaceCommand.command("ensure").description("Start and prove a primary or lin
     }
   )
 );
-workspaceCommand.command("ls").description("List git worktrees with their workspace token and active route count").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").action(
+workspaceCommand2.command("ls").description("List git worktrees with their workspace token and active route count").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").action(
   withErrorHandling(async (_options, command) => {
     const options = command.opts();
     const { runWorkspaceLsCommand: runWorkspaceLsCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
     runWorkspaceLsCommand2(options);
   })
 );
-workspaceCommand.command("gc").description("Report or clean missing ledger-owned workspace resources").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").option("--yes", "Delete eligible DevPod, route, and ownership resources").action(
+workspaceCommand2.command("cleanup").description("Report managed workspace activity, identity, checkout, and integration evidence").option("--repo <path>", "Main repository path (defaults to current directory)").option("--inactive-for <duration>", "Inactive threshold using Ns, Nm, Nh, Nd, or Nw", "30d").option("--check-merged", "Enable read-only origin and GitHub/GitLab integration checks").option("--measure-size", "Measure per-workspace storage consumption (slower, still read-only)").option("--json", "Output the stable cleanup report as JSON").action(
+  withErrorHandling(async (_options, command) => {
+    const options = command.opts();
+    const { runWorkspaceCleanupCommand: runWorkspaceCleanupCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
+    runWorkspaceCleanupCommand2({
+      repo: options.repo,
+      inactiveFor: options.inactiveFor,
+      checkMerged: Boolean(options.checkMerged),
+      measureSize: Boolean(options.measureSize),
+      json: Boolean(options.json)
+    });
+  })
+);
+workspaceCommand2.command("gc").description("Report or clean missing ledger-owned workspace resources").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").option("--yes", "Delete eligible DevPod, route, and ownership resources").action(
   withErrorHandling(async (_options, command) => {
     const options = command.opts();
     const { runWorkspaceGcCommand: runWorkspaceGcCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
     runWorkspaceGcCommand2(options);
   })
 );
-workspaceCommand.command("stop").description("Stop a workspace's DevPod and free routes while preserving its worktree and data").argument("<workspace>", "Workspace token or live branch name").option("--repo <path>", "Main repository path (defaults to current directory)").action(
+workspaceCommand2.command("stop").description("Stop a workspace's DevPod and free routes while preserving its worktree and data").argument("<workspace>", "Workspace token or live branch name").option("--repo <path>", "Main repository path (defaults to current directory)").action(
   withErrorHandling(async (target, _options, command) => {
     const options = command.opts();
     const { runWorkspaceStopCommand: runWorkspaceStopCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
     await runWorkspaceStopCommand2(target, options);
   })
 );
-workspaceCommand.command("down").description("Delete a workspace's DevPod and routes, then remove its clean Git worktree").argument("<workspace>", "Workspace token or live branch name").option("--keep-worktree", "Delete runtime resources but preserve the Git worktree and record").option("--repo <path>", "Main repository path (defaults to current directory)").action(
+workspaceCommand2.command("down").description("Delete a workspace's DevPod and routes, then remove its clean Git worktree").argument("<workspace>", "Workspace token or live branch name").option("--keep-worktree", "Delete runtime resources but preserve the Git worktree and record").option("--repo <path>", "Main repository path (defaults to current directory)").action(
   withErrorHandling(async (target, _options, command) => {
     const options = command.opts();
     const { runWorkspaceDownCommand: runWorkspaceDownCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));