@devrouter/cli 0.0.35 → 0.0.37

package/dist/devrouter.js

@@ -247,7 +247,8 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running DevPod. Never substitute raw \`devpod up\`, \`stop\`, or \`delete\`: they bypass devrouter's machine-global ownership lock. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects.
 - **Managed process identity**: \`ensure\` executes an exact captured adapter snapshot. Default reuse includes command argv, workspace, and adapter SHA-256. Set \`DEVROUTER_PROCESS_FINGERPRINT_ENV\` only to comma-separated non-secret environment names whose values affect runtime identity; secret-like names are rejected and raw values are never persisted.
 - **Route state**: the versioned Traefik dynamic file is authoritative for both metadata and rendering. JSON is a compatibility mirror; valid headerless generations migrate automatically, while corrupt canonical metadata fails closed.
-- **Cleanup**: owner status is \`present\`, \`missing\`, \`locked\`, or \`conflict\`. \`workspace gc\` is a dry-run report; \`--yes\` deletes only exact ledger-owned missing/prunable resources and their records. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
+- **Cleanup**: \`workspace cleanup --repo . --inactive-for 30d --json\` is a report-only, no-\`--yes\` report for managed linked workspaces. It joins ownership (\`present|missing|locked|conflict\`), DevPod registration, runtime (\`running|stopped|busy|not-found|absent|unknown\`), checkout, route, advisory activity, and integration evidence without mutating DevPod, routes, ownership, Git, Docker, applications, worktrees, or branches. Local DevPod list/status checks always run; \`--check-merged\` alone enables read-only origin and matching GitHub/GitLab checks. Treat \`not-found\` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit \`gc\`/\`down\` can remove exact stale registration only after expected-ID \`NotFound\` proof and ownership revalidation. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
+- **Sizing**: \`--measure-size\` adds per-workspace storage consumption to that report and stays read-only, but it walks each worktree and runs \`docker ps\` / \`docker inspect --size\`, so leave it off when you only need the evidence states. Each row reports reclaimable \`worktree\` and \`containerWritable\` bytes, non-reclaimable \`imageShared\` bytes, and a \`reclaimable\` total of the first two. \`imageShared\` covers image layers shared with other containers and overlaps across rows, so never sum it. Attribution is the workspace's own app container; sibling compose services such as a database are excluded. Any untrustworthy figure reports \`unknown\` with a reason rather than zero, and a workspace with no container reports a measured \`0\`.
 - **Boundary**: workspace commands require Git. Normal config, app, status, and doctor flows remain usable from a \`.devrouter.yml\` folder without \`.git\`.
 
 ## Secret manager interop (Infisical/Doppler)
@@ -323,6 +324,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]\`: create a worktree and start/prove it unless create-only mode is requested
 - \`devrouter workspace ensure [path] [--open] [--json]\`: compatibility alias of \`devrouter ensure\`
 - \`devrouter workspace ls [--json]\`: list ownership, Git, DevPod, route, path, and branch evidence
+- \`devrouter workspace cleanup [--repo .] [--inactive-for 30d] [--check-merged] [--measure-size] [--json]\`: report-only cleanup evidence and exact guarded suggestions; no \`--yes\` or apply mode
 - \`devrouter workspace stop <workspace|branch>\`: stop DevPod and routes; preserve checkout, owner record, and data
 - \`devrouter workspace down <workspace|branch> [--keep-worktree]\`: delete runtime/routes and optionally remove the clean worktree and record
 - \`devrouter workspace gc [--json] [--yes]\`: report missing owners by default; apply exact eligible cleanup with \`--yes\`
@@ -1431,6 +1433,25 @@ function readHostRouteStateLocked() {
   }
   return canonical.metadata.routes;
 }
+function readHostRouteStateReadOnly() {
+  if (!import_node_fs6.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
+    if (!import_node_fs6.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+      return [];
+    }
+    return readCompatibilityState();
+  }
+  const raw = import_node_fs6.default.readFileSync(TRAEFIK_HOST_ROUTES_FILE, "utf-8");
+  const canonical = parseCanonicalState(raw);
+  if (canonical.kind === "legacy") {
+    if (!import_node_fs6.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+      throw new Error(
+        "Headerless host-route document requires a valid compatibility state file for inspection."
+      );
+    }
+    return readCompatibilityState();
+  }
+  return canonical.metadata.routes;
+}
 function listHostRouteState() {
   return withStateLock(readHostRouteStateLocked);
 }
@@ -2028,7 +2049,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.35" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.37" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -2537,6 +2558,8 @@ function buildOnboardingPrompt(options = {}) {
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod mutations; they bypass the machine-global ownership lock. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
+    "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates DevPod, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, DevPod registration, runtime (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. DevPod `lastUsed` remains advisory.",
+    '- `--measure-size` adds per-workspace storage consumption and stays read-only, but walks each worktree and runs `docker ps` / `docker inspect --size`, so leave it off for a quick report. Each row reports `worktree` and `containerWritable` bytes, which are reclaimable; `imageShared` bytes, which are not, because those image layers are shared with other containers and overlap across rows; and `reclaimable`, the sum of the reclaimable fields. Never add `imageShared` across rows. Any figure that cannot be trusted reports `{"status": "unknown", "reason": ...}` rather than zero, and a workspace with no container reports a measured `0`.',
     "- Workspace commands require Git. Normal config, app, status, and doctor flows work from a `.devrouter.yml` folder without `.git`. Git has no worktree-removal hook; use `workspace ls`, doctor, or dry-run GC after out-of-band removal.",
     "- devcontainer integration: `devcontainer.json` lists the base compose file then `${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}`. The default overlay contains `services: {}`; `.devcontainer/docker-compose.devrouter.yml` passes `WORKSPACE` and `DEVROUTER_WORKSPACE` into the app and bind-mounts `${DEVROUTER_GIT_COMMON_DIR}` to the same absolute app-container path. Ensure proves exact DevPod ownership, overlay/Git mounts, env, aliases, health, Git, HTTP route reachability, and unique running TCP upstream ownership before success.",
     "",
@@ -2719,6 +2742,10 @@ var init_ai_prompt = __esm({
         command: "devrouter workspace ls [--json]",
         purpose: "List owner, Git, DevPod, route, path, and branch evidence for managed workspaces."
       },
+      {
+        command: "devrouter workspace cleanup [--repo <path>] [--inactive-for 30d] [--check-merged] [--measure-size] [--json]",
+        purpose: "Report-only evidence for managed linked workspaces; activity is advisory, --check-merged alone enables read-only origin/forge checks, and no --yes/apply path exists."
+      },
       {
         command: "devrouter workspace stop <workspace|branch>",
         purpose: "Stop the exact DevPod and remove exact routes while preserving the worktree, owner record, and data."
@@ -2802,6 +2829,90 @@ function printJSON(value) {
   process.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 }
+function printWorkspaceCleanupReport(report) {
+  process.stdout.write("Workspace cleanup report (read-only)\n");
+  process.stdout.write(
+    `${renderTable(
+      ["FIELD", "VALUE"],
+      [
+        ["Repo path", report.repoPath],
+        ["Generated", report.generatedAt],
+        ["Inactive threshold", report.inactiveFor],
+        ["Cutoff", report.cutoff],
+        ["Merged check", report.checkMerged ? "enabled" : "disabled"],
+        ["Size measurement", report.measureSize ? "enabled" : "disabled"],
+        ["Managed workspaces", String(report.workspaces.length)]
+      ]
+    )}
+`
+  );
+  if (report.workspaces.length === 0) {
+    process.stdout.write("\nNo managed linked workspaces found.\n");
+    return;
+  }
+  for (const row of report.workspaces) {
+    process.stdout.write(`
+Workspace: ${row.workspace}
+`);
+    process.stdout.write(
+      `${renderTable(
+        ["FIELD", "VALUE"],
+        [
+          ["Branch", row.branch ?? "-"],
+          ["Repo", row.repo],
+          ["Worktree", row.worktreePath],
+          ["DevPod", `${row.devpodId} (${row.provider})`],
+          ["Runtime", row.runtime],
+          ["Ownership", row.ownership],
+          ["Checkout", row.checkout],
+          ["Route", row.route],
+          ["Activity", row.activity],
+          ["Cutoff", row.cutoff],
+          ["Latest activity", row.latestTimestamp ?? "-"],
+          ["Contributing evidence", row.contributingEvidence.join(", ") || "-"],
+          [
+            "Activity evidence",
+            row.activityEvidence.map(
+              (entry) => `${entry.source}=${entry.status}${entry.timestamp ? `@${entry.timestamp}` : ""}`
+            ).join(", ")
+          ],
+          ["Integration", row.integration],
+          ["Eligible actions", row.eligibleActions.join("; ") || "none"],
+          [
+            "Suggestions",
+            row.suggestions.map((suggestion) => `${suggestion.command} (${suggestion.reason})`).join("; ") || "none"
+          ],
+          ["Reasons", row.reasons.join(" | ") || "none"],
+          ...row.consumption ? [
+            ["Reclaimable total", formatCleanupSize(row.consumption.reclaimable)],
+            ["  worktree files", formatCleanupSize(row.consumption.worktree)],
+            ["  container writable", formatCleanupSize(row.consumption.containerWritable)],
+            [
+              "Shared image layers",
+              // The qualifier describes a size, so it is dropped when there
+              // is no size to qualify: "unknown (reason) (not reclaimable)"
+              // reads as two competing answers to the same question.
+              row.consumption.imageShared.status === "measured" ? `${formatCleanupSize(row.consumption.imageShared)} (not reclaimable)` : formatCleanupSize(row.consumption.imageShared)
+            ]
+          ] : []
+        ]
+      )}
+`
+    );
+  }
+}
+function formatCleanupSize(size) {
+  if (size.status === "unknown") {
+    return `unknown (${size.reason})`;
+  }
+  let value = size.bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < BINARY_SIZE_UNITS.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return unit === 0 ? `${value} B` : `${value.toFixed(1)} ${BINARY_SIZE_UNITS[unit]}`;
+}
 function printStatus(status) {
   const rows = [
     ["Docker context", status.dockerContext],
@@ -3005,11 +3116,13 @@ function printSetupReport(report) {
     }
   }
 }
+var BINARY_SIZE_UNITS;
 var init_output = __esm({
   "src/core/output.ts"() {
     "use strict";
     init_table();
     init_timeago();
+    BINARY_SIZE_UNITS = ["B", "KiB", "MiB", "GiB", "TiB"];
   }
 });
 
@@ -4554,7 +4667,9 @@ var init_tool_diagnostics = __esm({
 
 // src/core/devpod-workspaces.ts
 function listDevpodWorkspaces() {
-  const result = (0, import_node_child_process8.spawnSync)("devpod", ["list", "--output", "json"], { encoding: "utf-8" });
+  const result = (0, import_node_child_process8.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
+    encoding: "utf-8"
+  });
   if (result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
@@ -4573,9 +4688,50 @@ function listDevpodWorkspaces() {
     if (typeof candidate.id !== "string" || !candidate.source || typeof candidate.source.localFolder !== "string") {
       throw new Error("devpod list returned a workspace without id/source.localFolder.");
     }
-    return candidate;
+    const workspace = {
+      id: candidate.id,
+      source: { localFolder: candidate.source.localFolder }
+    };
+    if ("lastUsed" in candidate) {
+      if (typeof candidate.lastUsed === "string") {
+        workspace.lastUsed = candidate.lastUsed;
+      } else {
+        workspace.lastUsedMalformed = true;
+      }
+    }
+    return workspace;
   });
 }
+function parseDevpodRuntimeStatus(output2, expectedId) {
+  let parsed;
+  try {
+    parsed = JSON.parse(output2);
+  } catch {
+    return "unknown";
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.id !== expectedId) {
+    return "unknown";
+  }
+  switch (parsed.state) {
+    case "Running":
+      return "running";
+    case "Stopped":
+      return "stopped";
+    case "Busy":
+      return "busy";
+    case "NotFound":
+      return "not-found";
+    default:
+      return "unknown";
+  }
+}
+function inspectDevpodRuntimeStatus(devpodId) {
+  const result = (0, import_node_child_process8.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
+    encoding: "utf-8"
+  });
+  if (result.status !== 0 || result.error) return "unknown";
+  return parseDevpodRuntimeStatus(result.stdout, devpodId);
+}
 function inspectDevpodWorkspaceOwnership(workspaces, devpodId, worktreePath) {
   const idOwners = workspaces.filter((workspace) => workspace.id === devpodId);
   const pathOwners = workspaces.filter(
@@ -4624,28 +4780,46 @@ function withMutationLock(activity, target, operation) {
 function commandFailure2(result) {
   return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
 }
-function runDevpodAction(action2, devpodId) {
-  const args = action2 === "delete" ? [action2, devpodId, "--ignore-not-found"] : [action2, devpodId];
+function runDevpodAction(action2, devpodId, force = false) {
+  const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
   const result = (0, import_node_child_process9.spawnSync)("devpod", args, { encoding: "utf-8" });
   if (result.status !== 0) {
     throw new Error(
-      `devpod ${action2} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
+      `devpod ${action2}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
     );
   }
 }
+function inspectExactOwnership(devpodId, worktreePath) {
+  const ownership = inspectDevpodWorkspaceOwnership(listDevpodWorkspaces(), devpodId, worktreePath);
+  if (ownership.status === "conflict") throw new Error(ownership.reason);
+  return ownership;
+}
 function mutateOwnedDevpodWorkspace(action2, devpodId, worktreePath) {
   return withMutationLock(`DevPod ${action2}`, worktreePath, () => {
-    const before = inspectDevpodWorkspaceOwnership(listDevpodWorkspaces(), devpodId, worktreePath);
-    if (before.status === "conflict") throw new Error(before.reason);
+    const before = inspectExactOwnership(devpodId, worktreePath);
     if (before.status === "absent") return { status: "absent" };
     runDevpodAction(action2, devpodId);
-    const after = inspectDevpodWorkspaceOwnership(listDevpodWorkspaces(), devpodId, worktreePath);
-    if (after.status === "conflict") throw new Error(after.reason);
+    let after = inspectExactOwnership(devpodId, worktreePath);
     if (action2 === "stop" && after.status !== "owned") {
       throw new Error(`DevPod '${devpodId}' no longer owns '${worktreePath}' after provider stop.`);
     }
-    if (action2 === "delete" && after.status !== "absent") {
-      throw new Error(`DevPod '${devpodId}' still owns '${worktreePath}' after provider delete.`);
+    if (action2 === "delete" && after.status === "owned") {
+      const runtime = inspectDevpodRuntimeStatus(devpodId);
+      if (runtime !== "not-found") {
+        throw new Error(
+          `DevPod '${devpodId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
+        );
+      }
+      after = inspectExactOwnership(devpodId, worktreePath);
+      if (after.status === "owned") {
+        runDevpodAction("delete", devpodId, true);
+        after = inspectExactOwnership(devpodId, worktreePath);
+      }
+      if (after.status !== "absent") {
+        throw new Error(
+          `DevPod '${devpodId}' still owns '${worktreePath}' after forced provider delete.`
+        );
+      }
     }
     return { status: "changed" };
   });
@@ -4746,7 +4920,8 @@ function commandError(command, repoPath, stderr) {
 }
 function resolveGitCommonDir(repoPath) {
   const result = (0, import_node_child_process10.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
-    encoding: "utf-8"
+    encoding: "utf-8",
+    env: READ_ONLY_GIT_ENV
   });
   const output2 = result.stdout.trim();
   if (result.status !== 0 || !output2) {
@@ -4756,7 +4931,8 @@ function resolveGitCommonDir(repoPath) {
 }
 function resolveGitTopLevel(repoPath) {
   const result = (0, import_node_child_process10.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
-    encoding: "utf-8"
+    encoding: "utf-8",
+    env: READ_ONLY_GIT_ENV
   });
   const output2 = result.stdout.trim();
   if (result.status !== 0 || !output2) {
@@ -4766,7 +4942,8 @@ function resolveGitTopLevel(repoPath) {
 }
 function listGitWorktrees(repoPath) {
   const result = (0, import_node_child_process10.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
-    encoding: "utf-8"
+    encoding: "utf-8",
+    env: READ_ONLY_GIT_ENV
   });
   if (result.status !== 0) {
     throw commandError("git worktree list", repoPath, result.stderr);
@@ -5003,7 +5180,7 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process10, import_node_fs16, import_node_path14, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process10, import_node_fs16, import_node_path14, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
@@ -5014,6 +5191,7 @@ var init_workspace_ownership = __esm({
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
+    READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
     OWNERSHIP_DIR = import_node_path14.default.join("devrouter", "workspaces");
   }
@@ -5616,7 +5794,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.35" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.37" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -6193,20 +6371,26 @@ var init_up = __esm({
 });
 
 // src/core/devpod-environment.ts
-function inspectWorkspaceContainers() {
-  const listed = (0, import_node_child_process12.spawnSync)("docker", ["ps", "-a", "--format", "{{.ID}}"], {
-    encoding: "utf-8"
-  });
-  if (listed.status !== 0) {
-    throw new Error(
-      `docker ps failed: ${(listed.stderr || listed.stdout || "unknown error").trim()}`
-    );
+function inspectWorkspaceContainers(options) {
+  let ids = options?.ids;
+  if (!ids) {
+    const listed = (0, import_node_child_process12.spawnSync)("docker", ["ps", "-a", "--format", "{{.ID}}"], {
+      encoding: "utf-8"
+    });
+    if (listed.status !== 0) {
+      throw new Error(
+        `docker ps failed: ${(listed.stderr || listed.stdout || listed.error?.message || "unknown error").trim()}`
+      );
+    }
+    ids = listed.stdout.split(/\r?\n/).map((id) => id.trim()).filter(Boolean);
   }
-  const ids = listed.stdout.split(/\r?\n/).map((id) => id.trim()).filter(Boolean);
   if (ids.length === 0) return [];
-  const inspected = (0, import_node_child_process12.spawnSync)("docker", ["inspect", "--format", SAFE_INSPECT_TEMPLATE, ...ids], {
-    encoding: "utf-8"
-  });
+  const template = options?.withSize ? SIZE_INSPECT_TEMPLATE : SAFE_INSPECT_TEMPLATE;
+  const inspected = (0, import_node_child_process12.spawnSync)(
+    "docker",
+    ["inspect", ...options?.withSize ? ["--size"] : [], "--format", template, ...ids],
+    { encoding: "utf-8" }
+  );
   if (inspected.status !== 0) {
     throw new Error(
       `docker inspect failed: ${(inspected.stderr || inspected.stdout || "unknown error").trim()}`
@@ -6240,7 +6424,7 @@ function resolveRunningWorkspaceContainer(repoPath) {
   }
   return { id: container.id, workspacePath: repoMount.Destination };
 }
-var import_node_child_process12, import_node_path17, SAFE_INSPECT_TEMPLATE;
+var import_node_child_process12, import_node_path17, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
 var init_devpod_environment = __esm({
   "src/core/devpod-environment.ts"() {
     "use strict";
@@ -6248,6 +6432,10 @@ var init_devpod_environment = __esm({
     import_node_path17 = __toESM(require("path"));
     init_workspace();
     SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
+    SIZE_INSPECT_TEMPLATE = SAFE_INSPECT_TEMPLATE.replace(
+      /}$/,
+      ',"sizeRw":{{json (index . "SizeRw")}},"sizeRootFs":{{json (index . "SizeRootFs")}}}'
+    );
   }
 });
 
@@ -6269,7 +6457,8 @@ function probeHttpRoute(host, options = {}) {
     String(options.maxTimeSeconds ?? 5)
   ];
   if (tlsEnabled) {
-    args.push("--cacert", getMkcertRootCAPath({ repoPath: options.repoPath }));
+    getMkcertRootCAPath({ repoPath: options.repoPath });
+    args.push("--cacert", CERT_FILE);
   }
   args.push(url);
   const result = (0, import_node_child_process13.spawnSync)("curl", args, { encoding: "utf-8" });
@@ -10254,9 +10443,847 @@ var init_tls2 = __esm({
   }
 });
 
+// src/core/workspace-consumption.ts
+function measureWorktreeConsumption(worktreePath, options) {
+  const deadlineMs = options?.deadlineMs ?? DEFAULT_DEADLINE_MS;
+  const startedAt = Date.now();
+  let rootStat;
+  try {
+    rootStat = import_node_fs24.default.lstatSync(worktreePath);
+  } catch (error) {
+    return { status: "unknown", reason: describeError(error, worktreePath) };
+  }
+  let rootEntries;
+  try {
+    rootEntries = import_node_fs24.default.readdirSync(worktreePath, { withFileTypes: true });
+  } catch (error) {
+    return { status: "unknown", reason: describeError(error, worktreePath) };
+  }
+  const seenInodes = /* @__PURE__ */ new Set();
+  let bytes = 0;
+  let timedOut = false;
+  let unreadableReason = null;
+  const accumulate = (stat) => {
+    if (stat.nlink > 1) {
+      const key = `${stat.dev}:${stat.ino}`;
+      if (seenInodes.has(key)) return;
+      seenInodes.add(key);
+    }
+    bytes += stat.blocks * BLOCK_SIZE_BYTES;
+  };
+  const deadlineExceeded = () => Date.now() - startedAt >= deadlineMs;
+  accumulate(rootStat);
+  const stack = [{ dirPath: worktreePath, entries: rootEntries }];
+  while (stack.length > 0 && !timedOut && !unreadableReason) {
+    const { dirPath, entries } = stack.pop();
+    for (const entry of entries) {
+      if (deadlineExceeded()) {
+        timedOut = true;
+        break;
+      }
+      const entryPath = import_node_path24.default.join(dirPath, entry.name);
+      let entryStat;
+      try {
+        entryStat = import_node_fs24.default.lstatSync(entryPath);
+      } catch (error) {
+        if (error?.code === "ENOENT") continue;
+        unreadableReason = describeIncompleteWalk(error);
+        break;
+      }
+      accumulate(entryStat);
+      if (!entryStat.isDirectory()) continue;
+      let childEntries;
+      try {
+        childEntries = import_node_fs24.default.readdirSync(entryPath, { withFileTypes: true });
+      } catch (error) {
+        unreadableReason = describeIncompleteWalk(error);
+        break;
+      }
+      stack.push({ dirPath: entryPath, entries: childEntries });
+    }
+  }
+  if (timedOut) {
+    return { status: "unknown", reason: `exceeded deadline of ${deadlineMs}ms` };
+  }
+  if (unreadableReason) {
+    return { status: "unknown", reason: unreadableReason };
+  }
+  return { status: "measured", bytes };
+}
+function describeIncompleteWalk(error) {
+  return `could not read every path inside the worktree: ${error?.message ?? String(error)}`;
+}
+function measureContainerConsumption(worktreePaths, dependencies) {
+  const byWorktree = /* @__PURE__ */ new Map();
+  if (worktreePaths.length === 0) return byWorktree;
+  const inspect = dependencies?.inspect ?? inspectWorkspaceContainers;
+  const containers = inspect();
+  const attributedIds = /* @__PURE__ */ new Set();
+  for (const worktreePath of worktreePaths) {
+    for (const container of workspaceAppContainers(containers, worktreePath)) {
+      attributedIds.add(container.id);
+    }
+  }
+  const sized = attributedIds.size === 0 ? [] : inspect({ withSize: true, ids: Array.from(attributedIds) });
+  for (const worktreePath of worktreePaths) {
+    byWorktree.set(worktreePath, summarizeContainers(workspaceAppContainers(sized, worktreePath)));
+  }
+  return byWorktree;
+}
+function summarizeContainers(containers) {
+  let writable = 0;
+  let shared = 0;
+  for (const container of containers) {
+    const { sizeRw, sizeRootFs } = container;
+    if (typeof sizeRw !== "number" || typeof sizeRootFs !== "number" || !Number.isFinite(sizeRw) || !Number.isFinite(sizeRootFs) || sizeRootFs < sizeRw) {
+      const unknown = {
+        status: "unknown",
+        reason: `container ${container.id.slice(0, 12)} reported no usable size`
+      };
+      return { containerWritable: unknown, imageShared: unknown };
+    }
+    writable += sizeRw;
+    shared += sizeRootFs - sizeRw;
+  }
+  return {
+    containerWritable: { status: "measured", bytes: writable },
+    imageShared: { status: "measured", bytes: shared }
+  };
+}
+function describeError(error, worktreePath) {
+  const code = error?.code;
+  if (code === "ENOENT") return `worktree path '${worktreePath}' does not exist`;
+  if (code === "EACCES" || code === "EPERM") {
+    return `permission denied reading worktree path '${worktreePath}'`;
+  }
+  return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
+}
+var import_node_fs24, import_node_path24, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var init_workspace_consumption = __esm({
+  "src/core/workspace-consumption.ts"() {
+    "use strict";
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path24 = __toESM(require("path"));
+    init_devpod_environment();
+    DEFAULT_DEADLINE_MS = 1e4;
+    BLOCK_SIZE_BYTES = 512;
+  }
+});
+
+// src/core/workspace-cleanup.ts
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isSha(value) {
+  return typeof value === "string" && /^[0-9a-f]{40,64}$/i.test(value);
+}
+function parseTimestamp(value) {
+  if (typeof value !== "string") return void 0;
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) ? timestamp : void 0;
+}
+function validTimestamp(value) {
+  return parseTimestamp(value) !== void 0;
+}
+function successfulOutput(result) {
+  if (result.status !== 0 || result.error) return void 0;
+  const output2 = result.stdout.trim();
+  return output2.length > 0 ? output2 : void 0;
+}
+function gitOutput(repoPath, args, commandRunner) {
+  return successfulOutput(commandRunner("git", ["-C", repoPath, ...args]));
+}
+function quoteCommandArg(value) {
+  return /^[a-zA-Z0-9_./:@+-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function workspaceCommand(repoPath, args, beforeRepo = [], afterRepo = []) {
+  return [
+    "devrouter",
+    "workspace",
+    ...args,
+    ...beforeRepo,
+    "--repo",
+    quoteCommandArg(repoPath),
+    ...afterRepo
+  ].join(" ");
+}
+function parseInactiveFor(value = DEFAULT_INACTIVE_FOR) {
+  const match = /^(?<amount>[1-9]\d*)(?<unit>[smhdw])$/.exec(value);
+  if (!match?.groups) {
+    throw new Error(
+      "--inactive-for must be a positive integer followed by s, m, h, d, or w (for example 30d)."
+    );
+  }
+  const amount = Number(match.groups.amount);
+  const multiplier = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 }[match.groups.unit];
+  const seconds = amount * multiplier;
+  if (!Number.isSafeInteger(seconds)) {
+    throw new Error("--inactive-for is too large.");
+  }
+  return { input: value, seconds };
+}
+function evaluateWorkspaceActivity(evidence, cutoff) {
+  const cutoffTime = parseTimestamp(cutoff);
+  if (cutoffTime === void 0) {
+    throw new Error(`Invalid activity cutoff '${cutoff}'.`);
+  }
+  const validEvidence = evidence.filter(
+    (entry) => entry.status === "valid" && validTimestamp(entry.timestamp)
+  );
+  const latestTime = validEvidence.reduce(
+    (latest, entry) => Math.max(
+      latest ?? Number.NEGATIVE_INFINITY,
+      parseTimestamp(entry.timestamp) ?? Number.NEGATIVE_INFINITY
+    ),
+    void 0
+  );
+  const latestTimestamp = latestTime === void 0 ? null : validEvidence.find((entry) => parseTimestamp(entry.timestamp) === latestTime)?.timestamp ?? null;
+  const contributingEvidence = ACTIVITY_SOURCES.filter(
+    (source) => validEvidence.some(
+      (entry) => entry.source === source && parseTimestamp(entry.timestamp) === latestTime
+    )
+  );
+  let status = "unknown";
+  if (latestTime !== void 0) {
+    if (latestTime >= cutoffTime) {
+      status = "recent";
+    } else if (validEvidence.length > 0 && evidence.every(
+      (entry) => entry.status === "valid" || entry.status === "not-applicable" || entry.status === "missing"
+    )) {
+      status = "quiet";
+    }
+  }
+  return {
+    status,
+    latestTimestamp,
+    contributingEvidence,
+    evidence: evidence.slice().sort(
+      (left, right) => ACTIVITY_SOURCES.indexOf(left.source) - ACTIVITY_SOURCES.indexOf(right.source)
+    )
+  };
+}
+function readGitSnapshot(worktree, commandRunner) {
+  const comparablePath = comparableWorkspacePath(worktree.path);
+  if (worktree.prunable || !import_node_fs25.default.existsSync(comparablePath)) {
+    return { worktree, checkout: "missing", head: null, committerDate: null };
+  }
+  const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
+  if (!head) {
+    return { worktree, checkout: "unknown", head: null, committerDate: null };
+  }
+  const committerDate = gitOutput(comparablePath, ["show", "-s", "--format=%cI", "HEAD"], commandRunner) ?? null;
+  const statusResult = commandRunner("git", [
+    "-C",
+    comparablePath,
+    "status",
+    "--porcelain=v1",
+    "--untracked-files=normal"
+  ]);
+  const checkout = worktree.branch === void 0 ? "detached" : statusResult.status !== 0 || statusResult.error ? "unknown" : statusResult.stdout.trim().length > 0 ? "dirty" : "clean";
+  return { worktree, checkout, head, committerDate };
+}
+function parseRemoteIdentity(value) {
+  const normalized = value.trim();
+  let host;
+  let project;
+  const scp = /^git@([^:]+):(.+)$/.exec(normalized);
+  if (scp) {
+    host = scp[1];
+    project = scp[2];
+  } else {
+    try {
+      const url = new URL(normalized);
+      if (url.protocol !== "https:" && url.protocol !== "ssh:") return void 0;
+      host = url.hostname;
+      project = url.pathname.replace(/^\/+/, "");
+    } catch {
+      return void 0;
+    }
+  }
+  project = project.replace(/\.git$/, "").replace(/\/+$/, "");
+  if (!host || !project || project.includes("..") || project.includes(" ")) return void 0;
+  const lowerHost = host.toLowerCase();
+  if (lowerHost === "github.com" && /^[^/]+\/[^/]+$/.test(project)) {
+    return { provider: "github", host: lowerHost, project };
+  }
+  if (lowerHost === "gitlab.com") {
+    return { provider: "gitlab", host: lowerHost, project };
+  }
+  return void 0;
+}
+function parseGitHubChanges(value, project, branch) {
+  if (!Array.isArray(value)) return void 0;
+  const changes = [];
+  for (const item of value) {
+    if (!isRecord2(item)) return void 0;
+    const repository = isRecord2(item.repository) ? item.repository.nameWithOwner : void 0;
+    const headRepository = isRecord2(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
+    if (repository !== project || headRepository !== project || item.headRefName !== branch || !isSha(item.headRefOid) || typeof item.baseRefName !== "string") {
+      continue;
+    }
+    const merged = item.state === "MERGED" && validTimestamp(item.mergedAt);
+    const mergeCommit = isRecord2(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
+    const baseSha = isSha(item.baseRefOid) ? item.baseRefOid : void 0;
+    changes.push({
+      sourceBranch: branch,
+      sourceHeadSha: item.headRefOid,
+      targetBranch: item.baseRefName,
+      ...baseSha ? { baseSha } : {},
+      ...mergeCommit ? { mergeCommitSha: mergeCommit } : {},
+      merged
+    });
+  }
+  return changes;
+}
+function parseGitLabChanges(value, _project, branch) {
+  if (!Array.isArray(value)) return void 0;
+  const changes = [];
+  for (const item of value) {
+    if (!isRecord2(item)) return void 0;
+    const sourceProjectId = item.source_project_id;
+    const targetProjectId = item.target_project_id;
+    const sameProject = typeof sourceProjectId === "number" && typeof targetProjectId === "number" && sourceProjectId === targetProjectId;
+    if (!sameProject || item.source_branch !== branch || !isSha(item.sha) || typeof item.target_branch !== "string") {
+      continue;
+    }
+    const diffRefs = isRecord2(item.diff_refs) ? item.diff_refs : void 0;
+    const mergeCommitSha = isSha(item.merge_commit_sha) ? item.merge_commit_sha : void 0;
+    const baseSha = diffRefs && isSha(diffRefs.base_sha) ? diffRefs.base_sha : void 0;
+    changes.push({
+      sourceBranch: branch,
+      sourceHeadSha: item.sha,
+      targetBranch: item.target_branch,
+      ...baseSha ? { baseSha } : {},
+      ...mergeCommitSha ? { mergeCommitSha } : {},
+      merged: item.state === "merged" && validTimestamp(item.merged_at)
+    });
+  }
+  return changes;
+}
+function patchIdForRange(repoPath, baseSha, headSha, commandRunner) {
+  const diff = commandRunner("git", [
+    "-C",
+    repoPath,
+    "diff",
+    "--no-ext-diff",
+    "--binary",
+    baseSha,
+    headSha
+  ]);
+  if (diff.status !== 0 || diff.error || diff.stdout.length === 0) return void 0;
+  const result = commandRunner("git", ["patch-id", "--stable"], diff.stdout);
+  if (result.status !== 0 || result.error) return void 0;
+  const match = /^([0-9a-f]{40,64})\s+(?:-|[0-9a-f]{40,64})$/i.exec(result.stdout.trim());
+  return match?.[1];
+}
+function hasUniqueSourceCommit(repoPath, baseSha, headSha, commandRunner) {
+  const result = gitOutput(
+    repoPath,
+    ["rev-list", "--no-merges", "--reverse", `${baseSha}..${headSha}`],
+    commandRunner
+  );
+  if (!result) return false;
+  const commits = result.split(/\r?\n/).map((sha) => sha.trim()).filter((sha) => sha.length > 0);
+  return commits.length > 0 && commits.every(isSha) && new Set(commits).size > 0;
+}
+function hasVerifiedCommonBase(repoPath, baseSha, headSha, commandRunner) {
+  const result = commandRunner("git", [
+    "-C",
+    repoPath,
+    "merge-base",
+    "--is-ancestor",
+    baseSha,
+    headSha
+  ]);
+  return result.status === 0 && !result.error;
+}
+function parseTargetBranch(output2) {
+  if (!output2) return void 0;
+  const value = output2.trim();
+  return value.startsWith("origin/") && value.length > "origin/".length ? value.slice("origin/".length) : void 0;
+}
+function parseRemoteDefaultTarget(output2) {
+  if (!output2) return void 0;
+  const match = /^ref:\s+refs\/heads\/([^\s]+)\s+HEAD$/m.exec(output2);
+  return match?.[1];
+}
+function inspectWorkspaceIntegration(repoPath, snapshot, branch, checkMerged, commandRunner) {
+  if (!checkMerged) return { status: "not-verified", reason: "Merged checks were not requested." };
+  if (!snapshot.head || !branch || snapshot.checkout === "missing" || snapshot.checkout === "unknown") {
+    return { status: "unknown", reason: "Current HEAD or branch evidence is unavailable." };
+  }
+  const originUrl = gitOutput(repoPath, ["config", "--get", "remote.origin.url"], commandRunner);
+  const identity = originUrl ? parseRemoteIdentity(originUrl) : void 0;
+  if (!identity) {
+    return { status: "unknown", reason: "The origin is missing or uses an unsupported forge." };
+  }
+  const localTargetBranch = parseTargetBranch(
+    gitOutput(
+      repoPath,
+      ["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"],
+      commandRunner
+    )
+  );
+  const remoteTargetBranch = parseRemoteDefaultTarget(
+    successfulOutput(
+      commandRunner("git", ["-C", repoPath, "ls-remote", "--symref", "origin", "HEAD"])
+    )
+  );
+  if (!remoteTargetBranch || localTargetBranch && localTargetBranch !== remoteTargetBranch) {
+    return {
+      status: "unknown",
+      reason: "The origin default target is missing, stale, or unavailable."
+    };
+  }
+  const targetBranch = remoteTargetBranch;
+  const localTargetSha = gitOutput(
+    repoPath,
+    ["rev-parse", "--verify", `refs/remotes/origin/${targetBranch}`],
+    commandRunner
+  );
+  const remoteTargetOutput = successfulOutput(
+    commandRunner("git", ["-C", repoPath, "ls-remote", "origin", `refs/heads/${targetBranch}`])
+  );
+  const remoteTargetSha = remoteTargetOutput?.split(/\s+/)[0];
+  if (!isSha(localTargetSha) || !isSha(remoteTargetSha) || localTargetSha !== remoteTargetSha) {
+    return { status: "unknown", reason: "The origin target is missing, stale, or unavailable." };
+  }
+  const sourceRemoteOutput = successfulOutput(
+    commandRunner("git", ["-C", repoPath, "ls-remote", "origin", `refs/heads/${branch}`])
+  );
+  const sourceRemoteSha = sourceRemoteOutput?.split(/\s+/)[0];
+  if (!isSha(sourceRemoteSha)) {
+    return {
+      status: "unknown",
+      reason: "The workspace source branch is missing or unavailable on origin."
+    };
+  }
+  const forgeChanges = [];
+  const forgeCommand = identity.provider === "github" ? [
+    "pr",
+    "list",
+    "--repo",
+    identity.project,
+    "--state",
+    "all",
+    "--head",
+    branch,
+    "--json",
+    "headRefName,headRefOid,baseRefName,baseRefOid,state,mergedAt,repository,headRepository,mergeCommit"
+  ] : [
+    "mr",
+    "list",
+    "--repo",
+    identity.project,
+    "--all",
+    "--source-branch",
+    branch,
+    "--output",
+    "json"
+  ];
+  const forge = commandRunner(identity.provider === "github" ? "gh" : "glab", forgeCommand);
+  if (forge.status !== 0 || forge.error) {
+    return { status: "unknown", reason: "The forge query was unavailable or unauthenticated." };
+  }
+  try {
+    const parsed = JSON.parse(forge.stdout);
+    const changes = identity.provider === "github" ? parseGitHubChanges(parsed, identity.project, branch) : parseGitLabChanges(parsed, identity.project, branch);
+    if (!changes) {
+      return { status: "unknown", reason: "The forge response was malformed." };
+    }
+    forgeChanges.push(...changes);
+  } catch {
+    return { status: "unknown", reason: "The forge response was malformed." };
+  }
+  const mergedExact = forgeChanges.find(
+    (change) => change.merged && change.targetBranch === targetBranch && change.sourceHeadSha.toLowerCase() === snapshot.head?.toLowerCase() && change.sourceHeadSha.toLowerCase() === sourceRemoteSha.toLowerCase()
+  );
+  if (mergedExact)
+    return {
+      status: "merged-exact",
+      headSha: snapshot.head,
+      reason: "Merged source head exactly matches current HEAD."
+    };
+  const worktreePath = snapshot.worktree.path;
+  const ancestry = commandRunner("git", [
+    "-C",
+    worktreePath,
+    "merge-base",
+    "--is-ancestor",
+    snapshot.head,
+    remoteTargetSha
+  ]);
+  if (ancestry.status === 0 && !ancestry.error) {
+    return {
+      status: "on-target",
+      headSha: snapshot.head,
+      reason: "Current HEAD is an ancestor of the verified-fresh origin target."
+    };
+  }
+  if (ancestry.status !== 1 || ancestry.error) {
+    return { status: "unknown", reason: "Target ancestry could not be verified." };
+  }
+  for (const change of forgeChanges.filter(
+    (candidate) => candidate.merged && candidate.targetBranch === targetBranch && candidate.sourceHeadSha.toLowerCase() !== snapshot.head?.toLowerCase()
+  )) {
+    if (change.sourceHeadSha.toLowerCase() !== sourceRemoteSha?.toLowerCase()) continue;
+    if (change.baseSha && change.mergeCommitSha && hasVerifiedCommonBase(worktreePath, change.baseSha, snapshot.head, commandRunner) && hasVerifiedCommonBase(worktreePath, change.baseSha, change.mergeCommitSha, commandRunner) && hasUniqueSourceCommit(worktreePath, change.baseSha, snapshot.head, commandRunner)) {
+      const currentPatchId = patchIdForRange(
+        worktreePath,
+        change.baseSha,
+        snapshot.head,
+        commandRunner
+      );
+      const mergedPatchId = patchIdForRange(
+        worktreePath,
+        change.baseSha,
+        change.mergeCommitSha,
+        commandRunner
+      );
+      if (!currentPatchId || !mergedPatchId || currentPatchId !== mergedPatchId) continue;
+      return {
+        status: "patch-equivalent",
+        headSha: snapshot.head,
+        reason: "All source changes have an equivalent merged patch."
+      };
+    }
+  }
+  return {
+    status: "not-verified",
+    reason: "Fresh target and forge evidence did not prove integration."
+  };
+}
+function routeStatus(record, routes) {
+  if (!routes) return "unknown";
+  const matchingPath = routes.filter(
+    (route) => sameWorkspacePath(route.repoPath, record.worktreePath)
+  );
+  if (matchingPath.length === 0) return "absent";
+  return matchingPath.every((route) => route.workspace === record.workspace) ? "owned" : "conflict";
+}
+function buildActivityEvidence(record, providerStatus, provider, routeEntries, git) {
+  const providerEvidence = providerStatus === "unknown" || providerStatus === "conflict" ? { source: "devpod.lastUsed", status: "unavailable" } : providerStatus === "absent" ? { source: "devpod.lastUsed", status: "not-applicable" } : provider?.lastUsedMalformed ? { source: "devpod.lastUsed", status: "malformed" } : provider?.lastUsed ? validTimestamp(provider.lastUsed) ? { source: "devpod.lastUsed", status: "valid", timestamp: provider.lastUsed } : { source: "devpod.lastUsed", status: "malformed" } : { source: "devpod.lastUsed", status: "missing" };
+  const routeTimestamps = routeEntries?.map((route) => route.updatedAt) ?? [];
+  const malformedRoute = routeTimestamps.some((timestamp) => !validTimestamp(timestamp));
+  const newestRoute = routeTimestamps.filter(validTimestamp).sort((left, right) => (parseTimestamp(right) ?? 0) - (parseTimestamp(left) ?? 0))[0];
+  const routeEvidence = !routeEntries ? { source: "route.updatedAt", status: "unavailable" } : routeEntries.length === 0 ? { source: "route.updatedAt", status: "not-applicable" } : malformedRoute ? { source: "route.updatedAt", status: "malformed" } : newestRoute ? { source: "route.updatedAt", status: "valid", timestamp: newestRoute } : { source: "route.updatedAt", status: "malformed" };
+  const ownerEvidence = validTimestamp(record.updatedAt) ? { source: "ownership.updatedAt", status: "valid", timestamp: record.updatedAt } : { source: "ownership.updatedAt", status: "malformed" };
+  const gitEvidence = git.checkout === "missing" ? { source: "git.headCommitterDate", status: "not-applicable" } : git.committerDate && validTimestamp(git.committerDate) ? { source: "git.headCommitterDate", status: "valid", timestamp: git.committerDate } : git.checkout === "unknown" ? { source: "git.headCommitterDate", status: "unavailable" } : { source: "git.headCommitterDate", status: "malformed" };
+  return [providerEvidence, routeEvidence, ownerEvidence, gitEvidence];
+}
+function buildSuggestions(repoPath, record, ownership, provider, runtime, checkout, route, activity, integration, worktree, checkMerged) {
+  const reasons = [];
+  const eligibleActions = [];
+  const suggestions = [];
+  const gcCommand = workspaceCommand(repoPath, ["gc"], [], ["--yes"]);
+  const keepCommand = workspaceCommand(repoPath, ["down", record.workspace], ["--keep-worktree"]);
+  const downCommand = workspaceCommand(repoPath, ["down", record.workspace]);
+  const routeSafe = route === "owned" || route === "absent";
+  const checkoutSafe = checkout === "clean" && !worktree?.locked;
+  const providerSafe = provider === "owned";
+  const runtimeSafe = runtime === "running" || runtime === "stopped" || runtime === "not-found";
+  if (ownership === "missing") {
+    if ((provider === "absent" || provider === "owned" && runtimeSafe) && routeSafe) {
+      eligibleActions.push(gcCommand);
+      suggestions.push({
+        command: gcCommand,
+        reason: "The exact ownership record is missing from live Git registration; GC will revalidate before deleting eligible runtime evidence."
+      });
+    } else {
+      reasons.push(
+        `GC suggestion suppressed because provider=${provider}, runtime=${runtime}, or route=${route} is not independently safe.`
+      );
+    }
+    return { eligibleActions, suggestions, reasons };
+  }
+  if (ownership !== "present")
+    reasons.push(`Destructive suggestions require ownership=present (found ${ownership}).`);
+  if (!providerSafe)
+    reasons.push(
+      `Destructive suggestions require an exact owned DevPod (found provider=${provider}).`
+    );
+  if (!runtimeSafe)
+    reasons.push(
+      `Destructive suggestions require an actionable DevPod runtime (found runtime=${runtime}).`
+    );
+  if (!routeSafe)
+    reasons.push(
+      `Destructive suggestions require non-conflicting route evidence (found route=${route}).`
+    );
+  if (checkout === "dirty")
+    reasons.push("Checkout is dirty; destructive workspace down is blocked.");
+  if (checkout === "missing")
+    reasons.push("Checkout is missing; the report cannot authorize full down.");
+  if (checkout === "detached")
+    reasons.push("Checkout is detached; branch identity is not safe for destructive advice.");
+  if (checkout === "unknown")
+    reasons.push("Checkout state is unknown; destructive advice is suppressed.");
+  if (worktree?.locked)
+    reasons.push("Git worktree is locked; destructive workspace down is blocked.");
+  if (!providerSafe || !runtimeSafe || !routeSafe || !checkoutSafe || ownership !== "present") {
+    return { eligibleActions, suggestions, reasons };
+  }
+  if (integration.status === "merged-exact" && integration.headSha) {
+    eligibleActions.push(downCommand);
+    suggestions.push({
+      command: downCommand,
+      reason: "Current HEAD is the exact source head of a same-repository merged change; workspace down still revalidates cleanliness, locks, and ownership before deleting runtime and the linked worktree."
+    });
+    return { eligibleActions, suggestions, reasons };
+  }
+  if (integration.status === "patch-equivalent")
+    reasons.push("Patch-equivalent integration is advisory and never authorizes full removal.");
+  if (integration.status === "unknown" || integration.status === "not-verified")
+    reasons.push(`Integration is ${integration.status}; full removal is not suggested.`);
+  const activityCleanupAllowed = !checkMerged || integration.status === "on-target" || integration.status === "merged-exact";
+  if (!activityCleanupAllowed) {
+    reasons.push(
+      "Cleanup is not suggested because the requested integration check did not provide a verified target or exact merge."
+    );
+    return { eligibleActions, suggestions, reasons };
+  }
+  if (activity === "quiet") {
+    eligibleActions.push(keepCommand);
+    suggestions.push({
+      command: keepCommand,
+      reason: "Managed workspace has no recent trustworthy activity; this deletes DevPod/runtime data and preserves the worktree and owner record."
+    });
+  } else if (activity === "recent") {
+    reasons.push("Recent trustworthy activity vetoes a quiet-workspace suggestion.");
+  } else {
+    reasons.push("Activity is unknown; a quiet-workspace suggestion is suppressed.");
+  }
+  return { eligibleActions, suggestions, reasons };
+}
+function buildRow(repoPath, record, worktrees, devpods, routes, snapshot, cutoff, checkMerged, commandRunner, inspectOwnershipFn, inspectIntegrationFn, inspectRuntimeFn) {
+  const ownershipEvidence = inspectOwnershipFn(record, worktrees, devpods);
+  const providerOwnership = devpods?.find(
+    (devpod) => devpod.id === record.devpodId && sameWorkspacePath(devpod.source.localFolder, record.worktreePath)
+  );
+  const matchingRoutes = routes?.filter(
+    (route) => sameWorkspacePath(route.repoPath, record.worktreePath)
+  );
+  const activity = evaluateWorkspaceActivity(
+    buildActivityEvidence(
+      record,
+      ownershipEvidence.devpodStatus,
+      providerOwnership,
+      matchingRoutes,
+      snapshot
+    ),
+    cutoff
+  );
+  const branch = snapshot.checkout === "detached" ? null : snapshot.worktree.branch ?? record.branch;
+  const integration = inspectIntegrationFn?.(repoPath, snapshot, branch, checkMerged) ?? inspectWorkspaceIntegration(repoPath, snapshot, branch, checkMerged, commandRunner);
+  const runtime = ownershipEvidence.devpodStatus === "absent" ? "absent" : ownershipEvidence.devpodStatus === "owned" ? (() => {
+    try {
+      return inspectRuntimeFn(record.devpodId);
+    } catch {
+      return "unknown";
+    }
+  })() : "unknown";
+  const suggestions = buildSuggestions(
+    repoPath,
+    record,
+    ownershipEvidence.ownerStatus,
+    ownershipEvidence.devpodStatus,
+    runtime,
+    snapshot.checkout,
+    routeStatus(record, routes),
+    activity.status,
+    integration,
+    snapshot.worktree,
+    checkMerged
+  );
+  const reasons = [
+    `ownership=${ownershipEvidence.ownerStatus}`,
+    `provider=${ownershipEvidence.devpodStatus}`,
+    `runtime=${runtime}`,
+    `checkout=${snapshot.checkout}`,
+    `route=${routeStatus(record, routes)}`,
+    `activity=${activity.status}`,
+    `integration=${integration.status}`,
+    ...integration.reason ? [integration.reason] : [],
+    ...suggestions.reasons
+  ];
+  return {
+    schemaVersion: 2,
+    workspace: record.workspace,
+    branch,
+    repo: repoPath,
+    worktreePath: record.worktreePath,
+    devpodId: record.devpodId,
+    ownership: ownershipEvidence.ownerStatus,
+    provider: ownershipEvidence.devpodStatus,
+    runtime,
+    checkout: snapshot.checkout,
+    route: routeStatus(record, routes),
+    activity: activity.status,
+    cutoff,
+    latestTimestamp: activity.latestTimestamp,
+    contributingEvidence: activity.contributingEvidence,
+    activityEvidence: activity.evidence,
+    integration: integration.status,
+    eligibleActions: suggestions.eligibleActions,
+    suggestions: suggestions.suggestions,
+    reasons: Array.from(new Set(reasons))
+  };
+}
+function deriveReclaimable(worktree, containerWritable) {
+  if (worktree.status === "unknown") {
+    return worktree;
+  }
+  if (containerWritable.status === "unknown") {
+    return containerWritable;
+  }
+  return { status: "measured", bytes: worktree.bytes + containerWritable.bytes };
+}
+function collectConsumption(worktreePath, measureWorktreeFn, containers) {
+  let worktree;
+  try {
+    worktree = measureWorktreeFn(worktreePath);
+  } catch (error) {
+    worktree = {
+      status: "unknown",
+      reason: `worktree measurement failed: ${describeCause(error)}`
+    };
+  }
+  const docker = containers.get(worktreePath) ?? unknownContainers("attribution not collected");
+  return {
+    worktree,
+    containerWritable: docker.containerWritable,
+    imageShared: docker.imageShared,
+    reclaimable: deriveReclaimable(worktree, docker.containerWritable)
+  };
+}
+function unknownContainers(reason) {
+  return {
+    containerWritable: { status: "unknown", reason },
+    imageShared: { status: "unknown", reason }
+  };
+}
+function describeCause(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
+  const repoPath = resolveRepoPath(options.repo);
+  const commandRunner = dependencies.commandRunner ?? defaultCommandRunner;
+  const duration = parseInactiveFor(options.inactiveFor);
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const cutoff = new Date(now.getTime() - duration.seconds * 1e3).toISOString();
+  const worktrees = (dependencies.listWorktrees ?? listGitWorktrees)(repoPath);
+  const records = (dependencies.listOwnership ?? listWorkspaceOwnership)(repoPath);
+  let devpods;
+  try {
+    devpods = (dependencies.listDevpods ?? listDevpodWorkspaces)();
+  } catch {
+    devpods = void 0;
+  }
+  let routes;
+  try {
+    routes = (dependencies.readRoutes ?? readHostRouteStateReadOnly)();
+  } catch {
+    routes = void 0;
+  }
+  const measureSize = Boolean(options.measureSize);
+  const measureWorktreeFn = dependencies.measureWorktree ?? measureWorktreeConsumption;
+  const measureContainersFn = dependencies.measureContainers ?? measureContainerConsumption;
+  let containers = /* @__PURE__ */ new Map();
+  if (measureSize) {
+    const worktreePaths = records.map((record) => record.worktreePath);
+    try {
+      containers = measureContainersFn(worktreePaths);
+    } catch (error) {
+      const reason = `container measurement failed: ${describeCause(error)}`;
+      containers = new Map(worktreePaths.map((path24) => [path24, unknownContainers(reason)]));
+    }
+  }
+  const rows = records.map((record) => {
+    const worktree = worktrees.find(
+      (candidate) => sameWorkspacePath(candidate.path, record.worktreePath)
+    );
+    const snapshot = (dependencies.readGitSnapshot ?? ((candidate) => readGitSnapshot(candidate, commandRunner)))(
+      worktree ?? {
+        path: record.worktreePath,
+        branch: record.branch ?? void 0,
+        locked: false,
+        prunable: true
+      }
+    );
+    const row = buildRow(
+      repoPath,
+      record,
+      worktrees,
+      devpods,
+      routes,
+      snapshot,
+      cutoff,
+      Boolean(options.checkMerged),
+      commandRunner,
+      dependencies.inspectOwnership ?? ((recordValue, worktreeValues, devpodValues) => {
+        const status = inspectWorkspaceOwnership(recordValue, worktreeValues, devpodValues);
+        return { ownerStatus: status.ownerStatus, devpodStatus: status.devpodStatus };
+      }),
+      dependencies.inspectIntegration,
+      dependencies.inspectDevpodRuntime ?? inspectDevpodRuntimeStatus
+    );
+    return measureSize ? {
+      ...row,
+      consumption: collectConsumption(record.worktreePath, measureWorktreeFn, containers)
+    } : row;
+  }).sort((left, right) => left.workspace.localeCompare(right.workspace));
+  return {
+    schemaVersion: 2,
+    generatedAt: now.toISOString(),
+    repoPath,
+    inactiveFor: duration.input,
+    cutoff,
+    checkMerged: Boolean(options.checkMerged),
+    measureSize,
+    workspaces: rows
+  };
+}
+var import_node_child_process21, import_node_fs25, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var init_workspace_cleanup = __esm({
+  "src/core/workspace-cleanup.ts"() {
+    "use strict";
+    import_node_child_process21 = require("child_process");
+    import_node_fs25 = __toESM(require("fs"));
+    init_devpod_workspaces();
+    init_host_routes();
+    init_repo_config();
+    init_workspace();
+    init_workspace_consumption();
+    init_workspace_ownership();
+    DEFAULT_INACTIVE_FOR = "30d";
+    READ_ONLY_GIT_ENV2 = { ...process.env, GIT_OPTIONAL_LOCKS: "0", LC_ALL: "C" };
+    ACTIVITY_SOURCES = [
+      "devpod.lastUsed",
+      "route.updatedAt",
+      "ownership.updatedAt",
+      "git.headCommitterDate"
+    ];
+    defaultCommandRunner = (command, args, input2) => {
+      const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
+      const result = (0, import_node_child_process21.spawnSync)(command, args, {
+        encoding: "utf-8",
+        env: environment,
+        ...input2 === void 0 ? {} : { input: input2 }
+      });
+      return {
+        status: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        ...result.error ? { error: result.error } : {}
+      };
+    };
+  }
+});
+
 // src/commands/workspace.ts
 var workspace_exports = {};
 __export(workspace_exports, {
+  runWorkspaceCleanupCommand: () => runWorkspaceCleanupCommand,
   runWorkspaceDownCommand: () => runWorkspaceDownCommand,
   runWorkspaceGcCommand: () => runWorkspaceGcCommand,
   runWorkspaceLsCommand: () => runWorkspaceLsCommand,
@@ -10304,6 +11331,15 @@ function runWorkspaceLsCommand(options) {
     );
   }
 }
+function runWorkspaceCleanupCommand(options) {
+  const repoPath = resolveGitWorkspaceRepo(options.repo);
+  const report = buildWorkspaceCleanupReport({ ...options, repo: repoPath });
+  if (options.json) {
+    printJSON(report);
+    return;
+  }
+  printWorkspaceCleanupReport(report);
+}
 async function runWorkspaceDownCommand(target, options) {
   const repoPath = resolveGitWorkspaceRepo(options.repo);
   await workspaceDown(target, {
@@ -10342,7 +11378,9 @@ function runWorkspaceGcCommand(options) {
 var init_workspace2 = __esm({
   "src/commands/workspace.ts"() {
     "use strict";
+    init_output();
     init_repo_config();
+    init_workspace_cleanup();
     init_workspace_gc();
     init_workspace_lifecycle();
     init_workspace_ownership();
@@ -10387,7 +11425,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.35" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.37" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -10626,8 +11664,8 @@ tlsCommand.command("install").description("Install mkcert certs and enable HTTPS
     await runTLSInstallCommand2();
   })
 );
-var workspaceCommand = program.command("workspace").description("Spin up / list / tear down isolated worktree+devcontainer workspaces");
-workspaceCommand.command("up").description(
+var workspaceCommand2 = program.command("workspace").description("Spin up / list / tear down isolated worktree+devcontainer workspaces");
+workspaceCommand2.command("up").description(
   "Create a worktree for <branch>, bring up its devpod, and register namespaced routes"
 ).argument("<branch>", "Git branch to base the workspace on").option("--path <dir>", "Worktree directory (default: <repo>/trees/<workspace>)").option("--no-devpod", "Only create the worktree; do not start the environment or change routes").option("--open", "Open the namespaced routes after registering").option("--repo <path>", "Main repository path (defaults to current directory)").action(
   withErrorHandling(async (branch, _options, command) => {
@@ -10641,7 +11679,7 @@ workspaceCommand.command("up").description(
     });
   })
 );
-workspaceCommand.command("ensure").description("Start and prove a primary or linked checkout's DevPod, upstreams, and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+workspaceCommand2.command("ensure").description("Start and prove a primary or linked checkout's DevPod, upstreams, and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(
     async (worktreePath, _options, command) => {
       const options = command.opts();
@@ -10654,28 +11692,41 @@ workspaceCommand.command("ensure").description("Start and prove a primary or lin
     }
   )
 );
-workspaceCommand.command("ls").description("List git worktrees with their workspace token and active route count").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").action(
+workspaceCommand2.command("ls").description("List git worktrees with their workspace token and active route count").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").action(
   withErrorHandling(async (_options, command) => {
     const options = command.opts();
     const { runWorkspaceLsCommand: runWorkspaceLsCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
     runWorkspaceLsCommand2(options);
   })
 );
-workspaceCommand.command("gc").description("Report or clean missing ledger-owned workspace resources").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").option("--yes", "Delete eligible DevPod, route, and ownership resources").action(
+workspaceCommand2.command("cleanup").description("Report managed workspace activity, identity, checkout, and integration evidence").option("--repo <path>", "Main repository path (defaults to current directory)").option("--inactive-for <duration>", "Inactive threshold using Ns, Nm, Nh, Nd, or Nw", "30d").option("--check-merged", "Enable read-only origin and GitHub/GitLab integration checks").option("--measure-size", "Measure per-workspace storage consumption (slower, still read-only)").option("--json", "Output the stable cleanup report as JSON").action(
+  withErrorHandling(async (_options, command) => {
+    const options = command.opts();
+    const { runWorkspaceCleanupCommand: runWorkspaceCleanupCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
+    runWorkspaceCleanupCommand2({
+      repo: options.repo,
+      inactiveFor: options.inactiveFor,
+      checkMerged: Boolean(options.checkMerged),
+      measureSize: Boolean(options.measureSize),
+      json: Boolean(options.json)
+    });
+  })
+);
+workspaceCommand2.command("gc").description("Report or clean missing ledger-owned workspace resources").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").option("--yes", "Delete eligible DevPod, route, and ownership resources").action(
   withErrorHandling(async (_options, command) => {
     const options = command.opts();
     const { runWorkspaceGcCommand: runWorkspaceGcCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
     runWorkspaceGcCommand2(options);
   })
 );
-workspaceCommand.command("stop").description("Stop a workspace's DevPod and free routes while preserving its worktree and data").argument("<workspace>", "Workspace token or live branch name").option("--repo <path>", "Main repository path (defaults to current directory)").action(
+workspaceCommand2.command("stop").description("Stop a workspace's DevPod and free routes while preserving its worktree and data").argument("<workspace>", "Workspace token or live branch name").option("--repo <path>", "Main repository path (defaults to current directory)").action(
   withErrorHandling(async (target, _options, command) => {
     const options = command.opts();
     const { runWorkspaceStopCommand: runWorkspaceStopCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
     await runWorkspaceStopCommand2(target, options);
   })
 );
-workspaceCommand.command("down").description("Delete a workspace's DevPod and routes, then remove its clean Git worktree").argument("<workspace>", "Workspace token or live branch name").option("--keep-worktree", "Delete runtime resources but preserve the Git worktree and record").option("--repo <path>", "Main repository path (defaults to current directory)").action(
+workspaceCommand2.command("down").description("Delete a workspace's DevPod and routes, then remove its clean Git worktree").argument("<workspace>", "Workspace token or live branch name").option("--keep-worktree", "Delete runtime resources but preserve the Git worktree and record").option("--repo <path>", "Main repository path (defaults to current directory)").action(
   withErrorHandling(async (target, _options, command) => {
     const options = command.opts();
     const { runWorkspaceDownCommand: runWorkspaceDownCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));