@devrouter/cli 0.0.37 → 0.0.39

package/dist/devrouter.js

@@ -48,6 +48,7 @@ function buildDevrouterSection() {
     "- `devrouter tls install` (required when repo defines tcp/postgres apps)",
     "- `devrouter app ls --repo .`",
     "- Primary or linked devcontainer checkout: `devrouter ensure . --json`",
+    "- Managed selective profile: `devrouter ensure . --profile <name> --json`",
     "- Host/docker runtime app only: `devrouter app run <host-app> --repo . --yes`",
     "- `devrouter ls`",
     DEVROUTER_END_SENTINEL
@@ -221,6 +222,78 @@ healthcheck:
   retries: 20
 \`\`\`
 
+## Profiles
+
+Optional named subsets of routed apps in \`.devrouter.yml\` so \`ensure\` can start only what a task needs:
+
+\`\`\`yaml
+profiles:
+  manage:
+    apps: [manage, api, auth]
+    readiness: [manage, api]
+  pwa:
+    apps: [pwa, api, auth]
+    readiness: [pwa, api]
+  full:
+    apps: ['*']
+    default: true
+\`\`\`
+
+- \`apps\` (required for app-only profiles): routed app names (\`kind=app\`) or \`['*']\` for everything; with \`managedRuntime\`, omit it for a route-free capability profile.
+- \`dependencies\` (optional): \`kind=dependency\` services this profile needs; omitted = every dependency a kept app requires transitively.
+- \`readiness\` (optional): subset of the profile's apps that \`ensure\` HTTP-probes; omitted = all profile apps with an http route.
+- \`default\` (optional): at most one; used when \`--profile\` is omitted. No \`profiles\` key at all = implicit full behavior.
+- Validation is strict at config load: unknown keys, non-routed \`apps\`, non-dependency \`dependencies\`, \`readiness\` outside the profile's apps, and multiple defaults are rejected.
+- Selection: \`devrouter ensure <path> --profile <name>\`. Comma-separated selections (\`--profile manage,pwa\`) merge with deduplication; the canonical name is sorted-unique so order never affects identity or fingerprints. A wildcard member collapses to everything.
+- Managed adapters receive \`DEVROUTER_PROFILE\` (canonical resolved name) in the post-start env; profile switches replace the owned process group via the fingerprint.
+
+### Managed devcontainer resources
+
+The optional \`managedRuntime\` registry separates the primary container's base
+Compose services, optional profile services, and repository-owned process
+markers. Profiles select those dimensions independently:
+
+\`\`\`yaml
+managedRuntime:
+  devcontainer:
+    baseServices: [postgres]
+    profileServices: [litellm, mcp-server]
+  processes: [web, local-mcp]
+
+profiles:
+  ai:
+    apps: [web]
+    devcontainerServices: [litellm]
+    processes: [web]
+  mcp:
+    devcontainerServices: [mcp-server]
+    processes: [local-mcp]
+  full:
+    apps: ['*']
+    devcontainerServices: ['*']
+    processes: ['*']
+    default: true
+\`\`\`
+
+- \`baseServices\` remain selected with the primary Dev Container service for
+  every managed profile; \`profileServices\` and \`processes\` are registries.
+- \`devcontainerServices\` selects registered optional Compose services, and
+  \`processes\` selects registered managed process markers.
+- With \`managedRuntime\`, \`apps\` may be omitted for a route-free capability
+  profile. An omitted optional dimension selects nothing, so an app-only
+  profile does not start LiteLLM, MCP, MailHog, or another optional service.
+- Use \`*\` or the \`full\` profile to select every registered resource. A config
+  without \`managedRuntime\` keeps the app-only profile behavior.
+- Native Dev Container clients still use the source configuration's full
+  service set. Managed \`ensure\` derives an ignored, marker-owned sibling
+  configuration and changes only \`runServices\`.
+- Warm profile changes retain the exact DevPod and volumes, do not rerun
+  \`postCreateCommand\`, avoid \`--recreate\` and broad \`down\`, and stop dropped
+  services/processes only after exact ownership proof. Routes publish last.
+- Inspect managed desired, active, and drift state with \`devrouter status\` and
+  \`devrouter doctor\`; values such as credentials and environment contents are
+  never written to managed runtime state.
+
 ## Env var injection
 
 When a host app depends on a TCP Docker service, \`devrouter app run\` and \`devrouter app exec\` inject per-dep deterministic vars (where \`{PREFIX} = dep.name.toUpperCase().replace(/-/g, "_")\`):
@@ -299,7 +372,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter -V [--repo .]\`: show installed CLI version, local repo version, and next upgrade target
 - \`devrouter upgrade [version] [--repo .]\`: list upgrade targets or print target Agent Adaptation Prompt
 - \`devrouter setup --yes [--repo .] [--json]\`: first-run machine setup plus structured diagnostics
-- \`devrouter ensure [path] [--open] [--json]\`: canonical startup/reconciliation for primary and linked checkouts
+- \`devrouter ensure [path] [--profile <name>] [--open] [--json]\`: canonical startup/reconciliation for primary and linked checkouts; a managed profile selects its independent resource dimensions
 - \`devrouter stop [path] [--delete] [--json]\`: stop the exact DevPod and remove exact routes; \`--delete\` explicitly deletes its ownership-proven data without removing the checkout
 - \`devrouter exec [path] -- <command...>\`: literal one-shot command inside the exact running DevPod
 - \`devrouter up\` / \`devrouter down\`: start/stop shared Traefik router
@@ -322,7 +395,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter app exec <name> [--shell] [--env <env>] [--workspace <slug>] -- <cmd>\`: one-shot command with resolved dep env
 - \`devrouter app rm <name> [--keep-config]\`: remove app entry (\`--keep-config\` frees only the live route/hostname, leaves \`.devrouter.yml\` untouched)
 - \`devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]\`: create a worktree and start/prove it unless create-only mode is requested
-- \`devrouter workspace ensure [path] [--open] [--json]\`: compatibility alias of \`devrouter ensure\`
+- \`devrouter workspace ensure [path] [--profile <name>] [--open] [--json]\`: compatibility alias of \`devrouter ensure\`
 - \`devrouter workspace ls [--json]\`: list ownership, Git, DevPod, route, path, and branch evidence
 - \`devrouter workspace cleanup [--repo .] [--inactive-for 30d] [--check-merged] [--measure-size] [--json]\`: report-only cleanup evidence and exact guarded suggestions; no \`--yes\` or apply mode
 - \`devrouter workspace stop <workspace|branch>\`: stop DevPod and routes; preserve checkout, owner record, and data
@@ -339,7 +412,7 @@ For devcontainer onboarding:
 4. \`devrouter repo devcontainer write --repo . --dry-run --json\`
 5. \`devrouter repo devcontainer write --repo . --yes\`
 6. \`devrouter repo devcontainer verify --repo . --json\`
-7. Start and prove either checkout kind with \`devrouter ensure . --json\`
+7. Start and prove either checkout kind with \`devrouter ensure . --json\`; for managed selective work, use \`--profile <name>\` and inspect desired/active/drift state
 8. Run seeds or migrations with \`devrouter exec . -- <command...>\`
 
 For host/docker runtime apps only:
@@ -1924,9 +1997,77 @@ function parseApp(value, index) {
   }
   throw new Error(`${pathLabel} has unsupported protocol/runtime combination.`);
 }
+function parseUniqueStringArray(value, pathLabel) {
+  const values = toStringArray(value, pathLabel);
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of values) {
+    if (seen.has(item)) {
+      throw new Error(`${pathLabel} contains duplicate '${item}'.`);
+    }
+    seen.add(item);
+  }
+  return values;
+}
+function parseRequiredUniqueStringArray(value, pathLabel) {
+  if (value === void 0) {
+    throw new Error(`${pathLabel} must be an array of strings.`);
+  }
+  return parseUniqueStringArray(value, pathLabel);
+}
+function parseManagedRuntime(value, configPath) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const managedRuntime = ensureObject(value, `${configPath}.managedRuntime`);
+  ensureAllowedKeys(managedRuntime, ["devcontainer", "processes"], `${configPath}.managedRuntime`);
+  const devcontainer = ensureObject(
+    managedRuntime.devcontainer,
+    `${configPath}.managedRuntime.devcontainer`
+  );
+  ensureAllowedKeys(
+    devcontainer,
+    ["baseServices", "profileServices"],
+    `${configPath}.managedRuntime.devcontainer`
+  );
+  const baseServices = parseRequiredUniqueStringArray(
+    devcontainer.baseServices,
+    `${configPath}.managedRuntime.devcontainer.baseServices`
+  );
+  const profileServices = parseRequiredUniqueStringArray(
+    devcontainer.profileServices,
+    `${configPath}.managedRuntime.devcontainer.profileServices`
+  );
+  const baseSet = new Set(baseServices);
+  const overlappingServices = profileServices.filter((service) => baseSet.has(service));
+  if (overlappingServices.length > 0) {
+    throw new Error(
+      `${configPath}.managedRuntime.devcontainer.baseServices and profileServices overlap: ${overlappingServices.join(", ")}.`
+    );
+  }
+  const processes = parseRequiredUniqueStringArray(
+    managedRuntime.processes,
+    `${configPath}.managedRuntime.processes`
+  );
+  const unsafeProcesses = processes.filter(
+    (process2) => !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(process2)
+  );
+  if (unsafeProcesses.length > 0) {
+    throw new Error(
+      `${configPath}.managedRuntime.processes entries must be safe exact identifiers: ${unsafeProcesses.join(", ")}.`
+    );
+  }
+  return {
+    devcontainer: { baseServices, profileServices },
+    processes
+  };
+}
 function parseConfig(raw, configPath) {
   const root = ensureObject(raw, configPath);
-  ensureAllowedKeys(root, ["version", "devrouter", "project", "secretManager", "apps"], configPath);
+  ensureAllowedKeys(
+    root,
+    ["version", "devrouter", "project", "secretManager", "managedRuntime", "profiles", "apps"],
+    configPath
+  );
   const version = toIntegerOrThrow(root.version, `${configPath}.version`);
   if (version !== 1) {
     throw new Error(`${configPath}.version must be 1.`);
@@ -1994,14 +2135,328 @@ function parseConfig(raw, configPath) {
     }
     seenNames.add(app.name);
   }
+  const managedRuntime = parseManagedRuntime(root.managedRuntime, configPath);
+  const profiles = parseProfiles(root.profiles, configPath, apps, managedRuntime);
   return {
     version: 1,
     ...devrouter ? { devrouter } : {},
     project: root.project && typeof root.project === "object" ? { name: root.project.name } : void 0,
     ...secretManager ? { secretManager } : {},
+    ...managedRuntime ? { managedRuntime } : {},
+    ...profiles ? { profiles } : {},
     apps
   };
 }
+function parseProfiles(value, configPath, apps, managedRuntime) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const raw = ensureObject(value, `${configPath}.profiles`);
+  if (Object.keys(raw).length === 0) {
+    throw new Error(`${configPath}.profiles must define at least one profile.`);
+  }
+  if (Object.keys(raw).length > MAX_PROFILES) {
+    throw new Error(`${configPath}.profiles exceeds the maximum of ${MAX_PROFILES} profiles.`);
+  }
+  const routedNames = new Set(
+    apps.filter((app) => app.kind !== "dependency").map((app) => app.name)
+  );
+  const result = {};
+  let defaultCount = 0;
+  const profileServices = new Set(managedRuntime?.devcontainer.profileServices ?? []);
+  const processMarkers = new Set(managedRuntime?.processes ?? []);
+  for (const [name, profileValue] of Object.entries(raw)) {
+    if (!PROFILE_NAME_RE.test(name)) {
+      throw new Error(
+        `${configPath}.profiles.${name} is not a valid profile name (lowercase alphanumerics and hyphens).`
+      );
+    }
+    const profile = ensureObject(profileValue, `${configPath}.profiles.${name}`);
+    ensureAllowedKeys(
+      profile,
+      ["apps", "dependencies", "readiness", "devcontainerServices", "processes", "default"],
+      `${configPath}.profiles.${name}`
+    );
+    const profileApps = toStringArray(profile.apps, `${configPath}.profiles.${name}.apps`);
+    if (!managedRuntime && profileApps.length === 0) {
+      throw new Error(`${configPath}.profiles.${name}.apps must not be empty.`);
+    }
+    const isWildcard3 = profileApps.length === 1 && profileApps[0] === "*";
+    if (profileApps.includes("*") && !isWildcard3) {
+      throw new Error(
+        `${configPath}.profiles.${name}.apps must use '*' as its only entry when selecting all apps.`
+      );
+    }
+    if (!isWildcard3) {
+      for (const appName of profileApps) {
+        if (!routedNames.has(appName)) {
+          throw new Error(
+            `${configPath}.profiles.${name}.apps references '${appName}', which is not a routed app (kind=app).`
+          );
+        }
+      }
+    }
+    let dependencies;
+    if (profile.dependencies !== void 0) {
+      dependencies = toStringArray(
+        profile.dependencies,
+        `${configPath}.profiles.${name}.dependencies`
+      );
+      for (const depName of dependencies) {
+        const dependency = apps.find((candidate) => candidate.name === depName);
+        if (!dependency) {
+          throw new Error(
+            `${configPath}.profiles.${name}.dependencies references '${depName}', which does not exist in apps.`
+          );
+        }
+        if (dependency.kind !== "dependency") {
+          throw new Error(
+            `${configPath}.profiles.${name}.dependencies references '${depName}', which is not kind=dependency.`
+          );
+        }
+      }
+    }
+    let readiness;
+    if (profile.readiness !== void 0) {
+      readiness = toStringArray(profile.readiness, `${configPath}.profiles.${name}.readiness`);
+      const appSet = new Set(isWildcard3 ? Array.from(routedNames) : profileApps);
+      for (const readyName of readiness) {
+        if (!appSet.has(readyName)) {
+          throw new Error(
+            `${configPath}.profiles.${name}.readiness references '${readyName}', which is not in the profile's apps.`
+          );
+        }
+      }
+    }
+    let devcontainerServices;
+    if (profile.devcontainerServices !== void 0) {
+      if (!managedRuntime) {
+        throw new Error(
+          `${configPath}.profiles.${name}.devcontainerServices requires managedRuntime.`
+        );
+      }
+      devcontainerServices = toStringArray(
+        profile.devcontainerServices,
+        `${configPath}.profiles.${name}.devcontainerServices`
+      );
+      const isServiceWildcard = devcontainerServices.length === 1 && devcontainerServices[0] === "*";
+      if (devcontainerServices.includes("*") && !isServiceWildcard) {
+        throw new Error(
+          `${configPath}.profiles.${name}.devcontainerServices must use '*' as its only entry when selecting all services.`
+        );
+      }
+      if (!isServiceWildcard) {
+        for (const service of devcontainerServices) {
+          if (!profileServices.has(service)) {
+            throw new Error(
+              `${configPath}.profiles.${name}.devcontainerServices references '${service}', which is not a registered profile service.`
+            );
+          }
+        }
+      }
+    }
+    let processes;
+    if (profile.processes !== void 0) {
+      if (!managedRuntime) {
+        throw new Error(`${configPath}.profiles.${name}.processes requires managedRuntime.`);
+      }
+      processes = toStringArray(profile.processes, `${configPath}.profiles.${name}.processes`);
+      const isProcessWildcard = processes.length === 1 && processes[0] === "*";
+      if (processes.includes("*") && !isProcessWildcard) {
+        throw new Error(
+          `${configPath}.profiles.${name}.processes must use '*' as its only entry when selecting all processes.`
+        );
+      }
+      if (!isProcessWildcard) {
+        for (const process2 of processes) {
+          if (!processMarkers.has(process2)) {
+            throw new Error(
+              `${configPath}.profiles.${name}.processes references '${process2}', which is not a registered process marker.`
+            );
+          }
+        }
+      }
+    }
+    const selectsDimension = profileApps.length > 0 || (dependencies?.length ?? 0) > 0 || (devcontainerServices?.length ?? 0) > 0 || (processes?.length ?? 0) > 0;
+    if (!selectsDimension) {
+      throw new Error(
+        `${configPath}.profiles.${name}.apps must not be empty; select at least one profile dimension.`
+      );
+    }
+    let isDefault = false;
+    if (profile.default !== void 0) {
+      if (typeof profile.default !== "boolean") {
+        throw new Error(`${configPath}.profiles.${name}.default must be a boolean.`);
+      }
+      isDefault = profile.default;
+    }
+    if (isDefault) {
+      defaultCount += 1;
+    }
+    result[name] = {
+      apps: profileApps,
+      ...dependencies ? { dependencies } : {},
+      ...readiness ? { readiness } : {},
+      ...devcontainerServices ? { devcontainerServices } : {},
+      ...processes ? { processes } : {},
+      ...isDefault ? { default: true } : {}
+    };
+  }
+  if (defaultCount > 1) {
+    throw new Error(`${configPath}.profiles must have at most one default profile.`);
+  }
+  return result;
+}
+function canonicalProfileValues(values) {
+  return Array.from(new Set(values)).sort();
+}
+function isProfileWildcard(values) {
+  return values?.length === 1 && values[0] === "*";
+}
+function normalizeProfile(profile) {
+  return {
+    apps: canonicalProfileValues(profile.apps),
+    ...profile.dependencies ? { dependencies: canonicalProfileValues(profile.dependencies) } : {},
+    ...profile.readiness ? { readiness: canonicalProfileValues(profile.readiness) } : {},
+    ...profile.devcontainerServices ? { devcontainerServices: canonicalProfileValues(profile.devcontainerServices) } : {},
+    ...profile.processes ? { processes: canonicalProfileValues(profile.processes) } : {},
+    ...profile.default ? { default: true } : {}
+  };
+}
+function normalizeSelectedProfile(name, profile, managedRuntime) {
+  const normalized = normalizeProfile(profile);
+  if (name !== "full" || !managedRuntime) return normalized;
+  return {
+    ...normalized,
+    apps: ["*"],
+    devcontainerServices: ["*"],
+    processes: ["*"]
+  };
+}
+function resolveProfile(config, profileOverride) {
+  const profiles = config.profiles;
+  const mergeSelection = (selection) => {
+    const rawNames = selection.split(",");
+    if (rawNames.some((name) => name.trim().length === 0)) {
+      throw new Error("Profile selection contains an empty token.");
+    }
+    const names = Array.from(new Set(rawNames.map((name) => name.trim())));
+    if (names.length === 0) {
+      throw new Error("Profile selection is empty.");
+    }
+    const missing = names.filter((name) => !profiles?.[name]);
+    if (missing.length > 0) {
+      const available = profiles ? Object.keys(profiles).join(", ") : "(none defined)";
+      throw new Error(
+        `Profile '${missing[0]}' is not defined in .devrouter.yml. Available: ${available}`
+      );
+    }
+    if (names.length === 1) {
+      const profile = profiles?.[names[0]];
+      if (!profile) return { name: names[0] };
+      return {
+        name: names[0],
+        profile: normalizeSelectedProfile(names[0], profile, config.managedRuntime)
+      };
+    }
+    const canonicalName = [...names].sort().join(",");
+    const apps = /* @__PURE__ */ new Set();
+    const dependencies = /* @__PURE__ */ new Set();
+    const readiness = /* @__PURE__ */ new Set();
+    const devcontainerServices = /* @__PURE__ */ new Set();
+    const processes = /* @__PURE__ */ new Set();
+    let hasAppWildcard = false;
+    let hasServiceWildcard = false;
+    let hasProcessWildcard = false;
+    for (const name of names) {
+      const profile = profiles?.[name];
+      if (!profile) continue;
+      if (isProfileWildcard(profile.apps)) {
+        hasAppWildcard = true;
+      } else {
+        for (const appName of profile.apps) apps.add(appName);
+      }
+      for (const depName of profile.dependencies ?? []) dependencies.add(depName);
+      for (const readyName of profile.readiness ?? []) readiness.add(readyName);
+      if (isProfileWildcard(profile.devcontainerServices)) {
+        hasServiceWildcard = true;
+      } else {
+        for (const service of profile.devcontainerServices ?? []) {
+          devcontainerServices.add(service);
+        }
+      }
+      if (isProfileWildcard(profile.processes)) {
+        hasProcessWildcard = true;
+      } else {
+        for (const process2 of profile.processes ?? []) processes.add(process2);
+      }
+    }
+    const merged = {
+      apps: hasAppWildcard ? ["*"] : canonicalProfileValues(Array.from(apps)),
+      ...dependencies.size > 0 ? { dependencies: canonicalProfileValues(Array.from(dependencies)) } : {},
+      ...readiness.size > 0 ? { readiness: canonicalProfileValues(Array.from(readiness)) } : {},
+      ...hasServiceWildcard ? { devcontainerServices: ["*"] } : devcontainerServices.size > 0 ? { devcontainerServices: canonicalProfileValues(Array.from(devcontainerServices)) } : {},
+      ...hasProcessWildcard ? { processes: ["*"] } : processes.size > 0 ? { processes: canonicalProfileValues(Array.from(processes)) } : {}
+    };
+    return { name: canonicalName, profile: merged };
+  };
+  if (profileOverride !== void 0) {
+    return mergeSelection(profileOverride);
+  }
+  if (profiles) {
+    const defaultName = Object.keys(profiles).find((name) => profiles[name].default);
+    if (defaultName) {
+      return {
+        name: defaultName,
+        profile: normalizeSelectedProfile(
+          defaultName,
+          profiles[defaultName],
+          config.managedRuntime
+        )
+      };
+    }
+    return {
+      name: "full",
+      profile: config.managedRuntime ? { apps: ["*"], devcontainerServices: ["*"], processes: ["*"] } : void 0
+    };
+  }
+  return {
+    name: "full",
+    profile: config.managedRuntime ? { apps: ["*"], devcontainerServices: ["*"], processes: ["*"] } : void 0
+  };
+}
+function applyProfile(config, profile) {
+  const wildcardApps = profile?.apps.length === 1 && profile.apps[0] === "*";
+  if (!profile || wildcardApps && profile.dependencies === void 0) {
+    return config;
+  }
+  const appSet = new Set(profile.apps);
+  const next = structuredClone(config);
+  const kept = [];
+  const keptDependencies = /* @__PURE__ */ new Set();
+  for (const app of next.apps) {
+    if (app.kind === "dependency") {
+      continue;
+    }
+    if (!wildcardApps && !appSet.has(app.name)) {
+      continue;
+    }
+    for (const dependency of resolveAppDependencies(config, app)) {
+      keptDependencies.add(dependency.name);
+    }
+    kept.push(app);
+  }
+  for (const dependencyName of profile.dependencies ?? []) {
+    keptDependencies.add(dependencyName);
+  }
+  for (const app of next.apps) {
+    if (app.kind === "dependency" && keptDependencies.has(app.name)) {
+      kept.push(app);
+    }
+  }
+  next.apps = kept;
+  return next;
+}
 function renderConfig(config) {
   return import_yaml2.default.stringify(config, { lineWidth: 0 });
 }
@@ -2049,7 +2504,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.37" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.39" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -2340,11 +2795,18 @@ function applyWorkspace(config, workspace, repoPath) {
   }
   return next;
 }
-function loadRuntimeConfig(repoPath, workspaceOverride) {
+function loadRuntimeConfig(repoPath, workspaceOverride, profileOverride) {
   const resolved = resolveRepoPath(repoPath);
   const raw = loadRepoConfig(resolved);
+  const resolvedProfile = resolveProfile(raw, profileOverride);
   const workspace = resolveWorkspace(resolved, workspaceOverride);
-  return { config: applyWorkspace(raw, workspace, resolved), workspace };
+  const config = applyProfile(applyWorkspace(raw, workspace, resolved), resolvedProfile.profile);
+  return {
+    config,
+    workspace,
+    profile: resolvedProfile.name,
+    resolvedProfile: resolvedProfile.profile
+  };
 }
 function resolveAppByName(repoPath, name, workspaceOverride) {
   const { config, workspace } = loadRuntimeConfig(repoPath, workspaceOverride);
@@ -2386,7 +2848,7 @@ function resolveAppDependencies(config, app) {
   }
   return results;
 }
-var import_node_fs7, import_node_path6, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY;
+var import_node_fs7, import_node_path6, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY, PROFILE_NAME_RE, MAX_PROFILES;
 var init_repo_config = __esm({
   "src/core/repo-config.ts"() {
     "use strict";
@@ -2410,6 +2872,8 @@ var init_repo_config = __esm({
       denyPorts: [80, 443, 5432],
       allowPortRange: "1024-65535"
     };
+    PROFILE_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+    MAX_PROFILES = 32;
   }
 });
 
@@ -2470,6 +2934,7 @@ function buildOnboardingPrompt(options = {}) {
     "- project.name: string (optional)",
     `- secretManager.command: string (optional; SM command including trailing \`--\` boundary; supports \`${SECRET_MANAGER_ENV_PLACEHOLDER}\` template placeholder)`,
     `- secretManager.defaultEnv: string (optional; fallback env for \`${SECRET_MANAGER_ENV_PLACEHOLDER}\` template; required when command contains \`${SECRET_MANAGER_ENV_PLACEHOLDER}\`)`,
+    "- profiles: map (optional; named subsets of routed apps; see Profile schema below)",
     "- apps: array (required)",
     "",
     "Canonical valid skeleton:",
@@ -2514,6 +2979,18 @@ function buildOnboardingPrompt(options = {}) {
     "  - docker.composeFiles: string[]",
     "  - do not set host/protocol/tcpProtocol/hostRun/docker.internalPort/docker.router",
     "",
+    "Profile schema (each value in the optional top-level profiles map):",
+    '- apps: array (required for app-only profiles; with managedRuntime it may be omitted for a route-free capability profile; routed app names, or ["*"] for every routed app)',
+    "- dependencies: array (optional; kind=dependency names this profile needs; omitted = every dependency a kept app requires transitively)",
+    "- readiness: array (optional; subset of the profile's apps that `devrouter ensure` HTTP-probes before readiness; omitted = all profile apps with an http route)",
+    "- default: boolean (optional; at most one profile may set true)",
+    "- validation: unknown profile keys are rejected; apps must reference routed apps (kind=app); dependencies must reference kind=dependency apps; readiness entries must be in the profile's apps; at most one default",
+    "- selection: `devrouter ensure <path> --profile <name>` scopes routes/readiness to the profile; comma-separated selections (e.g. --profile a,b) merge with deduplication and a canonical sorted name; managed adapters receive DEVROUTER_PROFILE in the post-start env",
+    "- managedRuntime (optional) registers devcontainer baseServices, profileServices, and managed process markers",
+    "- managed profiles may add devcontainerServices and processes independently; with managedRuntime, apps may be omitted for a route-free capability profile",
+    "- an omitted optional managed dimension selects nothing; use `*` or a full profile to select every registered service/process; baseServices and the primary service are always retained",
+    "- native Dev Container clients continue to use the source configuration's full service set; managed ensure derives an ignored sibling and changes only runServices",
+    "",
     "Validation rules to enforce:",
     "- kind=app host must end with .localhost",
     `- kind=app runtime=host supports protocol=${formatProtocolRule("host")} only`,
@@ -2549,6 +3026,8 @@ function buildOnboardingPrompt(options = {}) {
     "- For TCP/Postgres, standard app frameworks should use the injected port env vars; only direct-TLS-capable tools should use sslmode=require on :5432.",
     "- `devrouter app exec <name> -- <command>` starts dependencies as needed, resolves env vars, and runs a one-shot command with the resolved env. Exec stops only dependencies started by that invocation (already-running dependencies stay running). If ownership detection fails, exec leaves selected dependencies running to avoid non-owned teardown. Exec preserves argv semantics by default (`shell: false`) and supports explicit shell mode via `--shell` when needed.",
     "- `envMap` on dependency references (config-level) aliases per-dep vars after dependency env resolution. `envMap` fails fast when source var is missing.",
+    "- Managed devcontainer profiles reconcile apps, optional Compose services, and repository-owned processes independently. Warm profile changes retain the exact DevPod and volumes, do not rerun postCreateCommand or use --recreate/down, and publish routes last after exact health/readiness proof.",
+    "- Use `devrouter status --repo <REPO_PATH> --json` and `devrouter doctor --repo <REPO_PATH> --json` to inspect managed desired/active resources, fingerprints, transition state, and values-free drift.",
     "",
     "Workspace isolation (parallel git worktrees / agents):",
     `- A "workspace token" lets several worktrees of one repo run in parallel without host/route collisions. Each managed linked worktree has a local Git token plus a durable owner record in the repository's Git common directory spanning the DevPod id, devrouter routes, the \`${WORKSPACE_PLACEHOLDER}\` proxy upstream, and devcontainer aliases.`,
@@ -2602,6 +3081,7 @@ function buildOnboardingPrompt(options = {}) {
     "- devrouter repo devcontainer write --repo <REPO_PATH> --yes",
     "- devrouter repo devcontainer verify --repo <REPO_PATH> --json",
     "- Normal primary or linked startup: devrouter ensure <REPO_PATH> --json",
+    "- Managed selective startup: devrouter ensure <REPO_PATH> --profile <name> --json",
     "- Container seed/migration: devrouter exec <REPO_PATH> -- <command...>",
     "- Compatibility verification only after ensure: devrouter repo devcontainer verify --repo <REPO_PATH> --live --yes --json",
     "",
@@ -2719,7 +3199,7 @@ var init_ai_prompt = __esm({
         purpose: "Write/update devrouter section in the repo's AGENTS.md and install the devrouter skill."
       },
       {
-        command: "devrouter ensure [path] [--open] [--json]",
+        command: "devrouter ensure [path] [--profile <name>] [--open] [--json]",
         purpose: "Canonical startup and proof for an exact primary or linked checkout; atomically publishes routes after readiness."
       },
       {
@@ -2940,6 +3420,9 @@ function printStatus(status) {
       status.repo.valid ? "yes" : `no (${status.repo.error ?? "validation failed"})`
     ]);
     rows.push(["Repo apps", String(status.repo.appCount)]);
+    if (status.repo.managedRuntime) {
+      appendManagedRuntimeRows(rows, status.repo.managedRuntime);
+    }
   }
   process.stdout.write(`${renderTable(["FIELD", "VALUE"], rows)}
 `);
@@ -2951,6 +3434,38 @@ function printStatus(status) {
     }
   }
 }
+function formatResourceNames(values) {
+  return values.join(", ") || "-";
+}
+function formatResourceStatuses(values) {
+  return Object.entries(values).sort(([left], [right]) => left.localeCompare(right)).map(([name, resourceStatus]) => `${name}=${resourceStatus}`).join(", ") || "-";
+}
+function appendManagedRuntimeRows(rows, managedRuntime) {
+  if (managedRuntime.mode === "legacy") {
+    rows.push(["Managed runtime", "legacy (app-only compatibility)"]);
+    return;
+  }
+  rows.push(["Runtime mode", managedRuntime.mode]);
+  rows.push(["Runtime status", managedRuntime.status]);
+  rows.push(["Runtime profile", managedRuntime.profile]);
+  rows.push(["Active profile", managedRuntime.activeProfile ?? "-"]);
+  rows.push(["Runtime workspace", managedRuntime.workspace ?? "-"]);
+  rows.push(["Runtime DevPod", managedRuntime.devpodId ?? "-"]);
+  rows.push(["Runtime Compose project", managedRuntime.composeProject ?? "-"]);
+  rows.push(["Desired apps", formatResourceNames(managedRuntime.desired.apps)]);
+  rows.push(["Desired services", formatResourceNames(managedRuntime.desired.services)]);
+  rows.push(["Desired processes", formatResourceNames(managedRuntime.desired.processes)]);
+  rows.push(["Active apps", formatResourceNames(managedRuntime.active.apps)]);
+  rows.push(["Active services", formatResourceNames(managedRuntime.active.services)]);
+  rows.push(["Active processes", formatResourceNames(managedRuntime.active.processes)]);
+  rows.push(["Service statuses", formatResourceStatuses(managedRuntime.serviceStatuses)]);
+  rows.push(["Base service statuses", formatResourceStatuses(managedRuntime.baseServiceStatuses)]);
+  rows.push(["Process statuses", formatResourceStatuses(managedRuntime.processStatuses)]);
+  rows.push(["Source config SHA-256", managedRuntime.sourceConfigSha256 ?? "-"]);
+  rows.push(["Effective config SHA-256", managedRuntime.effectiveConfigSha256 ?? "-"]);
+  rows.push(["Transition phase", managedRuntime.transitionPhase ?? "-"]);
+  rows.push(["Runtime drift", formatResourceNames(managedRuntime.drift)]);
+}
 function printRoutes(routes, duplicateHosts) {
   if (routes.length === 0) {
     process.stdout.write("No routes found.\n");
@@ -3619,6 +4134,13 @@ function runManagedPostStart(options) {
       `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
       "--env",
       `DEVROUTER_PROCESS_ADAPTER_SHA256=${options.plan.adapterSha256}`,
+      ...options.profile ? ["--env", `DEVROUTER_PROFILE=${options.profile}`] : [],
+      ...options.processes ? [
+        "--env",
+        `DEVROUTER_PROCESS_SET=${options.processes.join(",")}`,
+        "--env",
+        "DEVROUTER_PROCESS_FINGERPRINT_ENV=DEVROUTER_PROFILE,DEVROUTER_PROCESS_SET"
+      ] : [],
       options.container.id,
       "bash",
       "-c",
@@ -3630,8 +4152,51 @@ function runManagedPostStart(options) {
   );
   if (started.status !== 0) {
     const details = commandFailure(started);
-    throw new Error(`Managed post-start failed${details ? `: ${details}` : "."}`);
+    throw new Error(`Managed post-start failed${details ? `: ${details}.` : "."}`);
+  }
+}
+function assertSafeProcessName(name) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name)) {
+    throw new Error(`Managed process '${name}' is not a safe exact identifier.`);
+  }
+}
+function runManagedProcessAction(options) {
+  assertSafeProcessName(options.name);
+  const result = (0, import_node_child_process5.spawnSync)(
+    "docker",
+    [
+      "exec",
+      "--workdir",
+      options.container.workspacePath,
+      "--env",
+      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
+      options.container.id,
+      "bash",
+      "-c",
+      'exec "$DEVROUTER_PROCESS_HELPER" "$1" --name "$2"',
+      "devrouter-process",
+      options.action,
+      options.name
+    ],
+    {
+      encoding: "utf-8",
+      stdio: options.action === "status" ? ["ignore", "pipe", "pipe"] : ["ignore", 2, "inherit"]
+    }
+  );
+  if (options.action === "stop") {
+    if (result.status !== 0) {
+      throw new Error(`Could not stop managed process '${options.name}'.`);
+    }
+    return "stopped";
+  }
+  try {
+    const parsed = JSON.parse(result.stdout.trim());
+    if (parsed.status === "running" || parsed.status === "stopped" || parsed.status === "foreign" || parsed.status === "drifted") {
+      return parsed.status;
+    }
+  } catch {
   }
+  return "drifted";
 }
 var import_node_child_process5, import_node_crypto3, import_node_fs9, import_node_path8, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
 var init_managed_post_start = __esm({
@@ -4137,61 +4702,1051 @@ var init_routes = __esm({
   }
 });
 
-// src/core/status.ts
-function hasPortBinding(ports, privatePort, publicPort) {
-  if (!ports) {
-    return false;
-  }
-  return ports.some((port) => port.PrivatePort === privatePort && port.PublicPort === publicPort);
+// src/core/managed-runtime-state.ts
+function stateKey(repoPath, workspace) {
+  return (0, import_node_crypto4.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
-function toRepoStatus(repoPath) {
-  const resolvedRepoPath = resolveRepoPath(repoPath);
-  const configPath = getRepoConfigPath(resolvedRepoPath);
-  const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
-  const configExists = import_node_fs12.default.existsSync(configPath);
-  if (!explicitRepo && !configExists) {
-    return void 0;
+function managedRuntimeStatePath(repoPath, workspace) {
+  return import_node_path11.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string") && new Set(value).size === value.length;
+}
+function validateState(value, repoPath, workspace) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Managed runtime state must contain an object.");
   }
-  if (!configExists) {
-    return {
-      path: resolvedRepoPath,
-      configPath,
-      exists: false,
-      valid: false,
-      appCount: 0,
-      tcpAppCount: 0,
-      error: `Missing .devrouter.yml in ${resolvedRepoPath}`
-    };
+  const candidate = value;
+  if (candidate.version !== 1) throw new Error("Managed runtime state has an unsupported version.");
+  if (candidate.repoPath !== repoPath || candidate.workspace !== workspace) {
+    throw new Error("Managed runtime state belongs to a different exact workspace.");
+  }
+  if (typeof candidate.devpodId !== "string" || candidate.devpodId.length === 0) {
+    throw new Error("Managed runtime state has no exact DevPod identity.");
+  }
+  if (typeof candidate.composeProject !== "string" || candidate.composeProject.length === 0) {
+    throw new Error("Managed runtime state has no exact Compose project identity.");
+  }
+  if (typeof candidate.profile !== "string" || candidate.profile.length === 0) {
+    throw new Error("Managed runtime state has no canonical profile.");
+  }
+  if (!candidate.desired || typeof candidate.desired !== "object") {
+    throw new Error("Managed runtime state has no desired resource set.");
+  }
+  const desired = candidate.desired;
+  if (!isStringArray(desired.apps) || !isStringArray(desired.services) || !isStringArray(desired.processes)) {
+    throw new Error("Managed runtime state has an invalid desired resource set.");
+  }
+  if (typeof candidate.sourceConfigSha256 !== "string" || !/^[a-f0-9]{64}$/.test(candidate.sourceConfigSha256) || typeof candidate.effectiveConfigSha256 !== "string" || !/^[a-f0-9]{64}$/.test(candidate.effectiveConfigSha256)) {
+    throw new Error("Managed runtime state has invalid config fingerprints.");
+  }
+  if (candidate.status !== "ready" && candidate.status !== "degraded") {
+    throw new Error("Managed runtime state has an invalid transition status.");
   }
+  if (candidate.transitionPhase !== void 0 && typeof candidate.transitionPhase !== "string") {
+    throw new Error("Managed runtime state has an invalid transition phase.");
+  }
+  if (typeof candidate.updatedAt !== "string" || !Number.isFinite(Date.parse(candidate.updatedAt))) {
+    throw new Error("Managed runtime state has an invalid timestamp.");
+  }
+  return {
+    version: 1,
+    repoPath,
+    ...workspace !== void 0 ? { workspace } : {},
+    devpodId: candidate.devpodId,
+    composeProject: candidate.composeProject,
+    profile: candidate.profile,
+    desired: {
+      apps: [...desired.apps],
+      services: [...desired.services],
+      processes: [...desired.processes]
+    },
+    sourceConfigSha256: candidate.sourceConfigSha256,
+    effectiveConfigSha256: candidate.effectiveConfigSha256,
+    status: candidate.status,
+    ...candidate.transitionPhase ? { transitionPhase: candidate.transitionPhase } : {},
+    updatedAt: candidate.updatedAt
+  };
+}
+function readManagedRuntimeState(repoPath, workspace) {
+  const statePath = managedRuntimeStatePath(repoPath, workspace);
+  if (!import_node_fs12.default.existsSync(statePath)) return void 0;
+  let parsed;
   try {
-    const config = loadRuntimeConfig(resolvedRepoPath).config;
-    const tcpAppCount = config.apps.filter(
-      (app) => app.kind !== "dependency" && app.protocol === "tcp"
-    ).length;
-    return {
-      path: resolvedRepoPath,
-      configPath,
-      exists: true,
-      valid: true,
-      appCount: config.apps.length,
-      tcpAppCount
-    };
+    parsed = JSON.parse(import_node_fs12.default.readFileSync(statePath, "utf-8"));
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      path: resolvedRepoPath,
-      configPath,
-      exists: true,
-      valid: false,
-      appCount: 0,
-      tcpAppCount: 0,
-      error: message
-    };
+    throw new Error(`Could not parse managed runtime state: ${String(error)}`);
   }
+  return validateState(parsed, repoPath, workspace);
 }
-async function collectRouterStatus(repoPath) {
-  const repo = toRepoStatus(repoPath);
-  const tlsEnabled = isTLSEnabled();
+function writeManagedRuntimeState(state) {
+  const validated = validateState(state, state.repoPath, state.workspace);
+  writeFileAtomically(
+    managedRuntimeStatePath(validated.repoPath, validated.workspace),
+    `${JSON.stringify(validated, null, 2)}
+`
+  );
+}
+function markManagedRuntimeDegraded(state, transitionPhase) {
+  writeManagedRuntimeState({
+    ...state,
+    status: "degraded",
+    transitionPhase,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+var import_node_crypto4, import_node_fs12, import_node_path11;
+var init_managed_runtime_state = __esm({
+  "src/core/managed-runtime-state.ts"() {
+    "use strict";
+    import_node_crypto4 = require("crypto");
+    import_node_fs12 = __toESM(require("fs"));
+    import_node_path11 = __toESM(require("path"));
+    init_atomic_file();
+    init_router();
+  }
+});
+
+// src/core/devcontainer-profile.ts
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function nonEmptyString(value, label) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  return value.trim();
+}
+function stringArray(value, label) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+    throw new Error(`${label} must be an array of strings.`);
+  }
+  const result = value.map((item) => item.trim());
+  if (result.some((item) => item.length === 0)) {
+    throw new Error(`${label} must not contain empty strings.`);
+  }
+  if (new Set(result).size !== result.length) {
+    throw new Error(`${label} must not contain duplicates.`);
+  }
+  return result;
+}
+function resolveComposeReference(value, linked) {
+  return value.replace(
+    /\$\{localEnv:([A-Za-z_][A-Za-z0-9_]*)(?::([^}]*))?\}/g,
+    (_match, name, fallback) => {
+      if (name === "DEVCONTAINER_COMPOSE_OVERLAY" && linked) {
+        return "docker-compose.devrouter.yml";
+      }
+      if (fallback !== void 0) return fallback;
+      throw new Error(
+        `Cannot resolve localEnv '${name}' while validating the managed Dev Container config.`
+      );
+    }
+  );
+}
+function resolveComposeFiles(source, repoPath, linked) {
+  const composeValue = source.dockerComposeFile;
+  const references = typeof composeValue === "string" ? [composeValue] : Array.isArray(composeValue) && composeValue.every((item) => typeof item === "string") ? composeValue : [];
+  if (references.length === 0) {
+    throw new Error(
+      "managedRuntime requires .devcontainer/devcontainer.json to define dockerComposeFile."
+    );
+  }
+  const directory = import_node_path12.default.join(repoPath, ".devcontainer");
+  const files = references.map((reference) => {
+    const resolved2 = assertPathWithinRepo(
+      resolveComposeReference(reference, linked),
+      directory,
+      "dockerComposeFile"
+    );
+    if (!import_node_fs13.default.existsSync(resolved2) || !import_node_fs13.default.lstatSync(resolved2).isFile()) {
+      throw new Error(`Managed Dev Container compose file does not exist: ${resolved2}`);
+    }
+    return resolved2;
+  });
+  for (const file of files) {
+    let parsed;
+    try {
+      parsed = import_yaml4.default.parse(import_node_fs13.default.readFileSync(file, "utf-8"));
+    } catch (error) {
+      throw new Error(
+        `Could not parse managed Dev Container compose file '${file}': ${String(error)}`
+      );
+    }
+    if (!isObject(parsed) || !isObject(parsed.services)) {
+      throw new Error(`Managed Dev Container compose file '${file}' has no services map.`);
+    }
+  }
+  const fileArgs = files.flatMap((file) => ["-f", file]);
+  const resolved = (0, import_node_child_process6.spawnSync)(
+    "docker",
+    [
+      "compose",
+      "--profile",
+      "*",
+      "--project-directory",
+      directory,
+      ...fileArgs,
+      "config",
+      "--services",
+      "--no-interpolate",
+      "--no-env-resolution"
+    ],
+    { cwd: directory, encoding: "utf-8" }
+  );
+  if (resolved.status !== 0) {
+    throw new Error("Could not resolve the effective managed Dev Container Compose model.");
+  }
+  const services = String(resolved.stdout ?? "").split(/\r?\n/).map((service) => service.trim()).filter(Boolean);
+  if (services.length === 0 || new Set(services).size !== services.length) {
+    throw new Error("The effective managed Dev Container Compose model has no unique services.");
+  }
+  return { directory, files, services: services.sort() };
+}
+function assertIgnoredGeneratedPath(repoPath, generatedPath) {
+  const ignored = (0, import_node_child_process6.spawnSync)(
+    "git",
+    ["-C", repoPath, "check-ignore", "--quiet", "--no-index", "--", generatedPath],
+    { encoding: "utf-8" }
+  );
+  if (ignored.status !== 0) {
+    throw new Error(
+      `Managed Dev Container path '${generatedPath}' must be ignored before devrouter can generate it.`
+    );
+  }
+}
+function assertGeneratedPathOwnership(generatedPath) {
+  if (!import_node_fs13.default.existsSync(generatedPath)) return;
+  const stat = import_node_fs13.default.lstatSync(generatedPath);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error(`Managed Dev Container path '${generatedPath}' is not a regular file.`);
+  }
+  const firstLine2 = import_node_fs13.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
+  if (firstLine2 !== MANAGED_DEVCONTAINER_MARKER) {
+    throw new Error(
+      `Managed Dev Container path '${generatedPath}' exists without the devrouter ownership marker.`
+    );
+  }
+}
+function isWildcard(values) {
+  return values?.length === 1 && values[0] === "*";
+}
+function sha256(contents) {
+  return (0, import_node_crypto5.createHash)("sha256").update(contents, "utf-8").digest("hex");
+}
+function safeComposeProject(value) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
+    throw new Error(`Docker Compose project '${value}' is not a safe exact identifier.`);
+  }
+  return value;
+}
+function inspectManagedDevcontainerConfig(options) {
+  const managedRuntime = options.config.managedRuntime;
+  if (!managedRuntime) {
+    throw new Error("Cannot prepare a managed Dev Container without managedRuntime.");
+  }
+  const sourcePath = import_node_path12.default.join(options.repoPath, ".devcontainer/devcontainer.json");
+  if (!import_node_fs13.default.existsSync(sourcePath) || !import_node_fs13.default.lstatSync(sourcePath).isFile()) {
+    throw new Error(`Managed Dev Container source config does not exist: ${sourcePath}`);
+  }
+  const sourceContents = import_node_fs13.default.readFileSync(sourcePath, "utf-8");
+  let parsed;
+  try {
+    parsed = import_yaml4.default.parse(sourceContents);
+  } catch (error) {
+    throw new Error(`Could not parse managed Dev Container source config: ${String(error)}`);
+  }
+  if (!isObject(parsed)) {
+    throw new Error("Managed Dev Container source config must contain an object.");
+  }
+  const source = parsed;
+  const primaryService = nonEmptyString(source.service, "devcontainer.service");
+  const compose = resolveComposeFiles(source, options.repoPath, options.linked);
+  const composeServiceSet = new Set(compose.services);
+  if (!composeServiceSet.has(primaryService)) {
+    throw new Error(`devcontainer.service '${primaryService}' is not in the Compose model.`);
+  }
+  const nativeRunServices = source.runServices === void 0 ? compose.services : stringArray(source.runServices, "devcontainer.runServices");
+  for (const service of nativeRunServices) {
+    if (!composeServiceSet.has(service)) {
+      throw new Error(`devcontainer.runServices references unknown service '${service}'.`);
+    }
+  }
+  if (!nativeRunServices.includes(primaryService)) {
+    throw new Error(`devcontainer.runServices must include primary service '${primaryService}'.`);
+  }
+  const baseServices = managedRuntime.devcontainer.baseServices;
+  const profileServices = managedRuntime.devcontainer.profileServices;
+  for (const service of [...baseServices, ...profileServices]) {
+    if (!composeServiceSet.has(service)) {
+      throw new Error(`managedRuntime references unknown Compose service '${service}'.`);
+    }
+    if (!nativeRunServices.includes(service)) {
+      throw new Error(`managedRuntime service '${service}' is missing from native runServices.`);
+    }
+  }
+  if (baseServices.includes(primaryService) || profileServices.includes(primaryService)) {
+    throw new Error(`managedRuntime must not classify primary service '${primaryService}'.`);
+  }
+  const classified = /* @__PURE__ */ new Set([primaryService, ...baseServices, ...profileServices]);
+  const unclassified = nativeRunServices.filter((service) => !classified.has(service));
+  if (unclassified.length > 0) {
+    throw new Error(
+      `managedRuntime does not classify native runServices: ${unclassified.join(", ")}.`
+    );
+  }
+  const desiredProfileServices = !options.profile || isWildcard(options.profile.devcontainerServices) ? [...profileServices] : [...options.profile.devcontainerServices ?? []];
+  const unregisteredDesiredServices = desiredProfileServices.filter(
+    (service) => !profileServices.includes(service)
+  );
+  if (unregisteredDesiredServices.length > 0) {
+    throw new Error(
+      `Profile selects unregistered managed services: ${unregisteredDesiredServices.join(", ")}.`
+    );
+  }
+  const desiredSet = /* @__PURE__ */ new Set([primaryService, ...baseServices, ...desiredProfileServices]);
+  const desiredServices = nativeRunServices.filter((service) => desiredSet.has(service));
+  const effective = JSON.parse(JSON.stringify(source));
+  effective.runServices = desiredServices;
+  const contents = `${MANAGED_DEVCONTAINER_MARKER}
+${JSON.stringify(effective, null, 2)}
+`;
+  const generatedPath = import_node_path12.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
+  assertIgnoredGeneratedPath(options.repoPath, generatedPath);
+  assertGeneratedPathOwnership(generatedPath);
+  return {
+    sourcePath,
+    generatedPath,
+    generatedRelativePath: MANAGED_DEVCONTAINER_PATH,
+    sourceConfigSha256: sha256(sourceContents),
+    effectiveConfigSha256: sha256(contents),
+    primaryService,
+    composeDirectory: compose.directory,
+    composeFiles: compose.files,
+    composeServices: compose.services,
+    nativeRunServices,
+    baseServices: [...baseServices],
+    profileServices: [...profileServices],
+    desiredProfileServices,
+    desiredServices,
+    contents
+  };
+}
+function writeManagedDevcontainerConfig(plan) {
+  writeFileAtomically(plan.generatedPath, plan.contents);
+}
+function inspectManagedDevcontainerGeneratedConfig(plan) {
+  let stat;
+  try {
+    stat = import_node_fs13.default.lstatSync(plan.generatedPath);
+  } catch (error) {
+    if (error.code === "ENOENT") return { status: "missing" };
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink()) return { status: "foreign" };
+  const contents = import_node_fs13.default.readFileSync(plan.generatedPath, "utf-8");
+  if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
+`)) {
+    return { status: "foreign" };
+  }
+  const fingerprint = sha256(contents);
+  return {
+    status: fingerprint === plan.effectiveConfigSha256 ? "valid" : "drifted",
+    sha256: fingerprint
+  };
+}
+function removeManagedDevcontainerConfig(plan) {
+  if (!import_node_fs13.default.existsSync(plan.generatedPath)) return;
+  const stat = import_node_fs13.default.lstatSync(plan.generatedPath);
+  if (!stat.isFile()) {
+    throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not a regular file.`);
+  }
+  const contents = import_node_fs13.default.readFileSync(plan.generatedPath, "utf-8");
+  if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
+`)) {
+    throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not devrouter-owned.`);
+  }
+  import_node_fs13.default.unlinkSync(plan.generatedPath);
+}
+function assertSafeContainerId(containerId) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(containerId)) {
+    throw new Error(`Container '${containerId}' is not a safe exact identifier.`);
+  }
+}
+function startExactManagedServices(options) {
+  if (options.services.length === 0) return;
+  const project = safeComposeProject(options.composeProject);
+  const services = Array.from(new Set(options.services));
+  if (services.some((service) => !options.plan.composeServices.includes(service))) {
+    throw new Error("Exact Compose startup contains a service outside the validated model.");
+  }
+  const fileArgs = options.plan.composeFiles.flatMap((file) => ["-f", file]);
+  const env = { ...process.env };
+  if (options.workspace) {
+    env.WORKSPACE = options.workspace.token;
+    env.DEVROUTER_WORKSPACE = options.workspace.token;
+    env.DEVROUTER_GIT_COMMON_DIR = options.workspace.gitCommonDir;
+    env.DEVCONTAINER_COMPOSE_OVERLAY = "docker-compose.devrouter.yml";
+  } else {
+    delete env.WORKSPACE;
+    delete env.DEVROUTER_WORKSPACE;
+    delete env.DEVROUTER_GIT_COMMON_DIR;
+    delete env.DEVCONTAINER_COMPOSE_OVERLAY;
+  }
+  const result = (0, import_node_child_process6.spawnSync)(
+    "docker",
+    [
+      "compose",
+      "--project-name",
+      project,
+      "--project-directory",
+      options.plan.composeDirectory,
+      ...fileArgs,
+      "up",
+      "-d",
+      "--no-recreate",
+      "--no-deps",
+      ...services
+    ],
+    {
+      cwd: options.plan.composeDirectory,
+      encoding: "utf-8",
+      env,
+      stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit"
+    }
+  );
+  if (result.status !== 0) {
+    throw new Error(
+      `Exact Compose startup failed for project '${project}' and service set '${services.join(",")}'.`
+    );
+  }
+}
+function stopExactManagedService(containerId, service) {
+  assertSafeContainerId(containerId);
+  const result = (0, import_node_child_process6.spawnSync)("docker", ["stop", containerId], {
+    encoding: "utf-8",
+    stdio: "inherit"
+  });
+  if (result.status !== 0) {
+    throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
+  }
+}
+var import_node_child_process6, import_node_crypto5, import_node_fs13, import_node_path12, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var init_devcontainer_profile = __esm({
+  "src/core/devcontainer-profile.ts"() {
+    "use strict";
+    import_node_child_process6 = require("child_process");
+    import_node_crypto5 = require("crypto");
+    import_node_fs13 = __toESM(require("fs"));
+    import_node_path12 = __toESM(require("path"));
+    import_yaml4 = __toESM(require("yaml"));
+    init_atomic_file();
+    init_paths();
+    MANAGED_DEVCONTAINER_PATH = ".devcontainer/devcontainer.devrouter.json";
+    MANAGED_DEVCONTAINER_MARKER = "// devrouter:managed devcontainer profile";
+  }
+});
+
+// src/core/devpod-environment.ts
+function inspectWorkspaceContainers(options) {
+  let ids = options?.ids;
+  if (!ids) {
+    const listed = (0, import_node_child_process7.spawnSync)("docker", ["ps", "-a", "--format", "{{.ID}}"], {
+      encoding: "utf-8"
+    });
+    if (listed.status !== 0) {
+      throw new Error(
+        `docker ps failed: ${(listed.stderr || listed.stdout || listed.error?.message || "unknown error").trim()}`
+      );
+    }
+    ids = listed.stdout.split(/\r?\n/).map((id) => id.trim()).filter(Boolean);
+  }
+  if (ids.length === 0) return [];
+  const template = options?.withSize ? SIZE_INSPECT_TEMPLATE : SAFE_INSPECT_TEMPLATE;
+  const inspected = (0, import_node_child_process7.spawnSync)(
+    "docker",
+    ["inspect", ...options?.withSize ? ["--size"] : [], "--format", template, ...ids],
+    { encoding: "utf-8" }
+  );
+  if (inspected.status !== 0) {
+    throw new Error(
+      `docker inspect failed: ${(inspected.stderr || inspected.stdout || "unknown error").trim()}`
+    );
+  }
+  return inspected.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => JSON.parse(line));
+}
+function workspaceAppContainers(containers, repoPath) {
+  return containers.filter((container) => {
+    const workingDir = container.labels["com.docker.compose.project.working_dir"];
+    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path13.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
+      (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+    );
+  });
+}
+function hasExactComposeIdentity(container, options) {
+  if (options.composeProject !== void 0 && container.labels["com.docker.compose.project"] !== options.composeProject || container.labels["com.docker.compose.service"] !== options.service || !sameWorkspacePath(
+    container.labels["com.docker.compose.project.working_dir"] ?? "",
+    import_node_path13.default.join(options.repoPath, ".devcontainer")
+  )) {
+    return false;
+  }
+  const expectedFiles = options.composeFiles;
+  if (!expectedFiles) return true;
+  const actualFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim()).filter(Boolean);
+  const providerGeneratedFiles = actualFiles.filter((file) => {
+    const normalized = file.replaceAll("\\", "/");
+    return /\/.devpod\/agent\/contexts\/[^/]+\/workspaces\/[^/]+\/.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
+      normalized
+    );
+  });
+  return actualFiles.length === expectedFiles.length + providerGeneratedFiles.length && expectedFiles.every(
+    (expected) => actualFiles.some((actual) => sameWorkspacePath(actual, expected))
+  ) && actualFiles.every(
+    (actual) => providerGeneratedFiles.includes(actual) || expectedFiles.some((expected) => sameWorkspacePath(actual, expected))
+  );
+}
+function resolveRunningWorkspaceContainer(repoPath) {
+  const matches = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).filter(
+    (container2) => container2.state.Running
+  );
+  if (matches.length !== 1) {
+    throw new Error(
+      `Expected one running workspace app container for '${repoPath}', found ${matches.length}.`
+    );
+  }
+  const container = matches[0];
+  const repoMount = container.mounts.find(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  );
+  if (!repoMount) {
+    throw new Error(`Workspace app container no longer mounts '${repoPath}'.`);
+  }
+  return { id: container.id, workspacePath: repoMount.Destination };
+}
+var import_node_child_process7, import_node_path13, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
+var init_devpod_environment = __esm({
+  "src/core/devpod-environment.ts"() {
+    "use strict";
+    import_node_child_process7 = require("child_process");
+    import_node_path13 = __toESM(require("path"));
+    init_workspace();
+    SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.service":{{json (index .Config.Labels "com.docker.compose.service")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
+    SIZE_INSPECT_TEMPLATE = SAFE_INSPECT_TEMPLATE.replace(
+      /}$/,
+      ',"sizeRw":{{json (index . "SizeRw")}},"sizeRootFs":{{json (index . "SizeRootFs")}}}'
+    );
+  }
+});
+
+// src/core/managed-runtime-status.ts
+function sortedUnique(values) {
+  return Array.from(new Set(values)).sort((left, right) => left.localeCompare(right));
+}
+function selectedResources(values, allValues, hasResolvedProfile) {
+  if (values === void 0) return hasResolvedProfile ? [] : sortedUnique(allValues);
+  return values.length === 1 && values[0] === "*" ? sortedUnique(allValues) : sortedUnique(values);
+}
+function containerResourceStatus(container) {
+  if (!container) return "missing";
+  if (!container.state.Running) return "stopped";
+  const health = container.state.Health?.Status;
+  if (health === "starting") return "starting";
+  if (health === "unhealthy") return "unhealthy";
+  return "healthy";
+}
+function isActiveResourceStatus(status) {
+  return status === "running" || status === "healthy" || status === "starting" || status === "unhealthy";
+}
+function isReadyResourceStatus(status) {
+  return status === "running" || status === "healthy";
+}
+function exactRoutes(repoPath, workspace) {
+  try {
+    const routes = listHostRouteState().filter(
+      (route) => sameWorkspacePath(route.repoPath, repoPath) && route.workspace === workspace
+    );
+    return { apps: sortedUnique(routes.map((route) => route.name)), drift: [] };
+  } catch {
+    return { apps: [], drift: ["managed route state could not be inspected"] };
+  }
+}
+function compareResourceSet(label, expected, actual) {
+  if (expected.length !== actual.length || expected.some((value, index) => value !== actual[index])) {
+    return `active ${label} differ from the selected profile`;
+  }
+  return void 0;
+}
+function resourceStatusesForMissing(names, status) {
+  return Object.fromEntries(names.map((name) => [name, status]));
+}
+function inspectManagedRuntime(options) {
+  const {
+    repoPath,
+    config,
+    registeredServices,
+    registeredProcesses,
+    desiredServices,
+    desiredProcesses,
+    workspace,
+    state
+  } = options;
+  const drift = [];
+  const baseServices = sortedUnique(config.managedRuntime?.devcontainer.baseServices ?? []);
+  const serviceStatuses = resourceStatusesForMissing(registeredServices, "missing");
+  const baseStatuses = resourceStatusesForMissing(baseServices, "missing");
+  const processStatuses = resourceStatusesForMissing(registeredProcesses, "missing");
+  const activeServices = [];
+  const activeProcesses = [];
+  let plan;
+  try {
+    plan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config,
+      profile: {
+        apps: ["*"],
+        devcontainerServices: desiredServices,
+        processes: ["*"]
+      },
+      linked: workspace !== void 0
+    });
+  } catch {
+    drift.push("managed Dev Container configuration could not be inspected");
+    return {
+      plan,
+      primaryReady: false,
+      primaryActive: false,
+      baseStatuses,
+      serviceStatuses,
+      processStatuses,
+      activeServices,
+      activeProcesses,
+      drift
+    };
+  }
+  let containers;
+  try {
+    containers = inspectWorkspaceContainers();
+  } catch {
+    drift.push("managed workspace containers could not be inspected");
+    return {
+      plan,
+      primaryReady: false,
+      primaryActive: false,
+      baseStatuses,
+      serviceStatuses,
+      processStatuses,
+      activeServices,
+      activeProcesses,
+      drift
+    };
+  }
+  if (!plan) {
+    drift.push("managed Dev Container configuration could not be inspected");
+    return {
+      plan,
+      primaryReady: false,
+      primaryActive: false,
+      baseStatuses,
+      serviceStatuses,
+      processStatuses,
+      activeServices,
+      activeProcesses,
+      drift
+    };
+  }
+  const resolvedPlan = plan;
+  let generatedConfigSha256;
+  let generatedConfigMissing = false;
+  try {
+    const generated = inspectManagedDevcontainerGeneratedConfig(resolvedPlan);
+    generatedConfigSha256 = generated.sha256;
+    if (generated.status === "missing") {
+      generatedConfigMissing = true;
+    } else if (generated.status === "foreign") {
+      drift.push("managed generated Dev Container configuration is not devrouter-owned");
+    } else if (generated.status === "drifted") {
+      drift.push("managed generated Dev Container configuration changed");
+    }
+  } catch {
+    drift.push("managed generated Dev Container configuration could not be inspected");
+  }
+  const appContainers = workspaceAppContainers(containers, repoPath).filter(
+    (container) => hasExactComposeIdentity(container, {
+      repoPath,
+      service: resolvedPlan.primaryService,
+      composeFiles: resolvedPlan.composeFiles
+    })
+  );
+  const projectScopedPrimary = state?.composeProject ? appContainers.filter(
+    (container) => container.labels["com.docker.compose.project"] === state.composeProject
+  ) : appContainers;
+  let primary;
+  let composeProject = state?.composeProject;
+  if (projectScopedPrimary.length === 1) {
+    primary = projectScopedPrimary[0];
+    composeProject = primary.labels["com.docker.compose.project"] ?? composeProject;
+  } else if (projectScopedPrimary.length > 1) {
+    drift.push("managed primary container identity is ambiguous");
+  } else if (appContainers.length > 0) {
+    drift.push(
+      state?.composeProject ? "managed primary container is foreign" : "managed primary container identity is ambiguous"
+    );
+  }
+  if (!composeProject && appContainers.length === 1) {
+    composeProject = appContainers[0].labels["com.docker.compose.project"];
+  }
+  if (primary && !composeProject) {
+    drift.push("managed primary container has no Compose project identity");
+  }
+  const exactService = (service) => containers.filter(
+    (container) => hasExactComposeIdentity(container, {
+      repoPath,
+      service,
+      composeProject,
+      composeFiles: resolvedPlan.composeFiles
+    })
+  );
+  const unscopedService = (service) => containers.filter(
+    (container) => hasExactComposeIdentity(container, {
+      repoPath,
+      service,
+      composeFiles: resolvedPlan.composeFiles
+    })
+  );
+  const inspectService = (service, statuses) => {
+    const exact = exactService(service);
+    if (exact.length > 1) {
+      statuses[service] = "drifted";
+      drift.push(`managed service '${service}' identity is ambiguous`);
+      return;
+    }
+    if (exact.length === 0) {
+      const foreign = unscopedService(service);
+      statuses[service] = foreign.length > 0 ? "foreign" : "missing";
+      if (foreign.length > 0) drift.push(`managed service '${service}' is foreign`);
+      return;
+    }
+    const status = containerResourceStatus(exact[0]);
+    statuses[service] = status;
+    if (isActiveResourceStatus(status)) {
+      if (statuses === serviceStatuses) activeServices.push(service);
+    }
+  };
+  for (const service of registeredServices) inspectService(service, serviceStatuses);
+  for (const service of baseServices) inspectService(service, baseStatuses);
+  const managedServicesActive = activeServices.length > 0 || Object.values(baseStatuses).some(isActiveResourceStatus);
+  const primaryWorkspacePath = primary?.mounts.find(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  )?.Destination;
+  const primaryActive = Boolean(primary?.state.Running);
+  if (generatedConfigMissing && (state || primaryActive || managedServicesActive)) {
+    drift.push("managed generated Dev Container configuration is missing");
+  }
+  const primaryHealth = primary?.state.Health?.Status;
+  const primaryReady = primaryActive && primaryHealth !== "starting" && primaryHealth !== "unhealthy";
+  if (!primary) {
+    if (managedServicesActive) {
+      drift.push("managed primary container is missing");
+    }
+  } else if (!primaryActive) {
+    if (managedServicesActive) {
+      drift.push("managed primary container is stopped");
+    }
+  } else if (primaryHealth === "unhealthy") {
+    drift.push("managed primary container is unhealthy");
+  }
+  if (primary && primaryActive && primaryWorkspacePath) {
+    for (const process2 of registeredProcesses) {
+      let status;
+      try {
+        status = runManagedProcessAction({
+          container: { id: primary.id, workspacePath: primaryWorkspacePath },
+          name: process2,
+          action: "status",
+          quiet: true
+        });
+      } catch {
+        status = "drifted";
+      }
+      processStatuses[process2] = status;
+      if (status === "running") activeProcesses.push(process2);
+      if (desiredProcesses.includes(process2) && status !== "running") {
+        drift.push(`managed process '${process2}' is not running`);
+      }
+    }
+  } else {
+    if (primary && !primaryActive) {
+      for (const process2 of registeredProcesses) processStatuses[process2] = "stopped";
+    }
+    if (desiredProcesses.length > 0 && (primaryActive || managedServicesActive)) {
+      drift.push("managed processes cannot be proven without the primary container");
+    }
+  }
+  for (const service of desiredServices) {
+    const status = serviceStatuses[service] ?? "missing";
+    if (!isReadyResourceStatus(status) && status !== "starting" && (primaryActive || managedServicesActive)) {
+      drift.push(`managed service '${service}' is not ready`);
+    }
+  }
+  for (const service of baseServices) {
+    const status = baseStatuses[service] ?? "missing";
+    if (!isReadyResourceStatus(status) && status !== "starting" && (primaryActive || managedServicesActive)) {
+      drift.push(`managed base service '${service}' is not ready`);
+    }
+  }
+  return {
+    plan,
+    generatedConfigSha256,
+    composeProject,
+    primaryReady,
+    primaryActive,
+    baseStatuses,
+    serviceStatuses,
+    processStatuses,
+    activeServices: sortedUnique(activeServices),
+    activeProcesses: sortedUnique(activeProcesses),
+    drift
+  };
+}
+function collectManagedRuntimeStatus(options) {
+  if (!options.config.managedRuntime) {
+    return {
+      mode: "legacy",
+      status: "legacy",
+      profile: options.profile,
+      desired: { ...EMPTY_RESOURCES },
+      active: { ...EMPTY_RESOURCES },
+      serviceStatuses: {},
+      baseServiceStatuses: {},
+      processStatuses: {},
+      drift: []
+    };
+  }
+  const managedRuntime = options.config.managedRuntime;
+  const hasResolvedProfile = options.resolvedProfile !== void 0;
+  const routedApps = options.config.apps.filter((app) => app.kind !== "dependency").map((app) => app.name);
+  const registeredServices = sortedUnique(managedRuntime.devcontainer.profileServices);
+  const registeredProcesses = sortedUnique(managedRuntime.processes);
+  const desiredApps = selectedResources(
+    options.resolvedProfile?.apps,
+    routedApps,
+    hasResolvedProfile
+  );
+  const desiredServices = selectedResources(
+    options.resolvedProfile?.devcontainerServices,
+    registeredServices,
+    hasResolvedProfile
+  );
+  const desiredProcesses = selectedResources(
+    options.resolvedProfile?.processes,
+    registeredProcesses,
+    hasResolvedProfile
+  );
+  let state;
+  let stateReadFailed = false;
+  try {
+    state = readManagedRuntimeState(options.repoPath, options.workspace);
+  } catch {
+    stateReadFailed = true;
+  }
+  const drift = [];
+  if (stateReadFailed) drift.push("managed runtime state could not be read");
+  if (state?.status === "degraded") drift.push("the last managed transition is degraded");
+  if (state) {
+    const desiredState = {
+      apps: sortedUnique(state.desired.apps),
+      services: sortedUnique(state.desired.services),
+      processes: sortedUnique(state.desired.processes)
+    };
+    const desired = {
+      apps: desiredApps,
+      services: desiredServices,
+      processes: desiredProcesses
+    };
+    for (const [label, expected, actual] of [
+      ["apps", desired.apps, desiredState.apps],
+      ["services", desired.services, desiredState.services],
+      ["processes", desired.processes, desiredState.processes]
+    ]) {
+      const mismatch = compareResourceSet(label, expected, actual);
+      if (mismatch) drift.push(mismatch);
+    }
+    if (state.profile !== options.profile)
+      drift.push("active profile differs from the selected profile");
+  }
+  const inspection = inspectManagedRuntime({
+    repoPath: options.repoPath,
+    config: options.config,
+    registeredServices,
+    registeredProcesses,
+    desiredServices,
+    desiredProcesses,
+    workspace: options.workspace,
+    state
+  });
+  drift.push(...inspection.drift);
+  if (state && inspection.plan && state.sourceConfigSha256 !== inspection.plan.sourceConfigSha256) {
+    drift.push("managed Dev Container source configuration changed");
+  }
+  if (state && inspection.plan && state.effectiveConfigSha256 !== inspection.plan.effectiveConfigSha256) {
+    drift.push("managed Dev Container effective configuration changed");
+  }
+  if (state && inspection.generatedConfigSha256 && state.effectiveConfigSha256 !== inspection.generatedConfigSha256) {
+    drift.push("managed generated Dev Container configuration differs from last successful state");
+  }
+  const routes = exactRoutes(options.repoPath, options.workspace);
+  drift.push(...routes.drift);
+  const activeApps = routes.apps;
+  const anyActive = inspection.primaryActive || inspection.activeServices.length > 0 || Object.values(inspection.baseStatuses).some(isActiveResourceStatus) || inspection.activeProcesses.length > 0 || activeApps.length > 0;
+  if (activeApps.length > 0 && !inspection.primaryActive) {
+    drift.push("active app routes exist without a running primary container");
+  }
+  if (desiredApps.some((app) => !activeApps.includes(app)) && anyActive) {
+    drift.push("one or more selected app routes are missing");
+  }
+  if (activeApps.some((app) => !desiredApps.includes(app))) {
+    drift.push("one or more active app routes are outside the selected profile");
+  }
+  if (inspection.activeServices.some((service) => !desiredServices.includes(service))) {
+    drift.push("one or more active services are outside the selected profile");
+  }
+  if (inspection.activeProcesses.some((process2) => !desiredProcesses.includes(process2))) {
+    drift.push("one or more active processes are outside the selected profile");
+  }
+  const requiredServicesReady = desiredServices.every(
+    (service) => isReadyResourceStatus(inspection.serviceStatuses[service] ?? "missing")
+  );
+  const baseServicesReady = Object.values(inspection.baseStatuses).every(isReadyResourceStatus);
+  const processesReady = desiredProcesses.every(
+    (process2) => isReadyResourceStatus(inspection.processStatuses[process2] ?? "missing")
+  );
+  const routesReady = desiredApps.every((app) => activeApps.includes(app));
+  const ready = inspection.primaryReady && requiredServicesReady && baseServicesReady && processesReady && routesReady && !stateReadFailed && !drift.length;
+  const status = state?.status === "degraded" ? "failed-transition" : drift.length > 0 ? "drifted" : ready ? "ready" : anyActive ? "starting" : "stopped";
+  const active = {
+    apps: activeApps,
+    services: inspection.activeServices,
+    processes: inspection.activeProcesses
+  };
+  return {
+    mode: "managed",
+    status,
+    profile: options.profile,
+    ...state?.profile ? { activeProfile: state.profile } : {},
+    ...options.workspace !== void 0 ? { workspace: options.workspace } : {},
+    ...state?.devpodId ? { devpodId: state.devpodId } : {},
+    ...inspection.composeProject ? { composeProject: inspection.composeProject } : {},
+    desired: {
+      apps: desiredApps,
+      services: desiredServices,
+      processes: desiredProcesses
+    },
+    active,
+    serviceStatuses: inspection.serviceStatuses,
+    baseServiceStatuses: inspection.baseStatuses,
+    processStatuses: inspection.processStatuses,
+    drift: sortedUnique(drift),
+    ...inspection.plan?.sourceConfigSha256 || state?.sourceConfigSha256 ? { sourceConfigSha256: inspection.plan?.sourceConfigSha256 ?? state?.sourceConfigSha256 } : {},
+    ...inspection.plan?.effectiveConfigSha256 || state?.effectiveConfigSha256 ? {
+      effectiveConfigSha256: inspection.plan?.effectiveConfigSha256 ?? state?.effectiveConfigSha256
+    } : {},
+    ...state?.transitionPhase ? { transitionPhase: state.transitionPhase } : {}
+  };
+}
+var EMPTY_RESOURCES;
+var init_managed_runtime_status = __esm({
+  "src/core/managed-runtime-status.ts"() {
+    "use strict";
+    init_devcontainer_profile();
+    init_devpod_environment();
+    init_host_routes();
+    init_managed_post_start();
+    init_managed_runtime_state();
+    init_workspace();
+    EMPTY_RESOURCES = {
+      apps: [],
+      services: [],
+      processes: []
+    };
+  }
+});
+
+// src/core/status.ts
+function hasPortBinding(ports, privatePort, publicPort) {
+  if (!ports) {
+    return false;
+  }
+  return ports.some((port) => port.PrivatePort === privatePort && port.PublicPort === publicPort);
+}
+function toRepoStatus(repoPath) {
+  const resolvedRepoPath = resolveRepoPath(repoPath);
+  const configPath = getRepoConfigPath(resolvedRepoPath);
+  const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
+  const configExists = import_node_fs14.default.existsSync(configPath);
+  if (!explicitRepo && !configExists) {
+    return void 0;
+  }
+  if (!configExists) {
+    return {
+      path: resolvedRepoPath,
+      configPath,
+      exists: false,
+      valid: false,
+      appCount: 0,
+      tcpAppCount: 0,
+      error: `Missing .devrouter.yml in ${resolvedRepoPath}`
+    };
+  }
+  try {
+    let runtime = loadRuntimeConfig(resolvedRepoPath);
+    if (runtime.config.managedRuntime) {
+      let state;
+      try {
+        state = readManagedRuntimeState(resolvedRepoPath, runtime.workspace);
+      } catch {
+      }
+      if (state && state.profile !== runtime.profile) {
+        try {
+          runtime = loadRuntimeConfig(resolvedRepoPath, runtime.workspace, state.profile);
+        } catch {
+        }
+      }
+    }
+    const config = runtime.config;
+    const tcpAppCount = config.apps.filter(
+      (app) => app.kind !== "dependency" && app.protocol === "tcp"
+    ).length;
+    return {
+      path: resolvedRepoPath,
+      configPath,
+      exists: true,
+      valid: true,
+      appCount: config.apps.length,
+      tcpAppCount,
+      managedRuntime: collectManagedRuntimeStatus({
+        repoPath: resolvedRepoPath,
+        workspace: runtime.workspace,
+        config,
+        profile: runtime.profile,
+        resolvedProfile: runtime.resolvedProfile
+      })
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      path: resolvedRepoPath,
+      configPath,
+      exists: true,
+      valid: false,
+      appCount: 0,
+      tcpAppCount: 0,
+      error: message
+    };
+  }
+}
+async function collectRouterStatus(repoPath) {
+  const repo = toRepoStatus(repoPath);
+  const tlsEnabled = isTLSEnabled();
   let container;
   let networkIsPresent = false;
   let dockerContext = "unknown";
@@ -4275,12 +5830,14 @@ async function collectRouterStatus(repoPath) {
     }
   };
 }
-var import_node_fs12;
+var import_node_fs14;
 var init_status = __esm({
   "src/core/status.ts"() {
     "use strict";
-    import_node_fs12 = __toESM(require("fs"));
+    import_node_fs14 = __toESM(require("fs"));
     init_docker();
+    init_managed_runtime_state();
+    init_managed_runtime_status();
     init_repo_config();
     init_router();
   }
@@ -4288,7 +5845,7 @@ var init_status = __esm({
 
 // src/core/tls.ts
 function runOrThrow(command, args) {
-  const result = (0, import_node_child_process6.spawnSync)(command, args, {
+  const result = (0, import_node_child_process8.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -4298,7 +5855,7 @@ function runOrThrow(command, args) {
   return result.stdout.trim();
 }
 function commandExists(command) {
-  const result = (0, import_node_child_process6.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
+  const result = (0, import_node_child_process8.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
   return result.status === 0;
 }
 function ensureMkcert() {
@@ -4316,8 +5873,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path11.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs13.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path14.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs15.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -4350,7 +5907,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto4.X509Certificate(pem);
+  const certificate = new import_node_crypto6.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -4383,10 +5940,10 @@ function findUncoveredCertificateHosts(requiredHosts, certificateHosts) {
   );
 }
 function readCurrentCertificateHosts() {
-  if (!import_node_fs13.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs15.default.existsSync(CERT_FILE)) {
     return [];
   }
-  const pem = import_node_fs13.default.readFileSync(CERT_FILE, "utf-8");
+  const pem = import_node_fs15.default.readFileSync(CERT_FILE, "utf-8");
   return parseCertificateDnsHosts(pem);
 }
 function currentCertificateHostsOrEmpty() {
@@ -4475,14 +6032,14 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process6, import_node_crypto4, import_node_fs13, import_node_path11, DEFAULT_TLS_CERT_HOSTS;
+var import_node_child_process8, import_node_crypto6, import_node_fs15, import_node_path14, DEFAULT_TLS_CERT_HOSTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
-    import_node_child_process6 = require("child_process");
-    import_node_crypto4 = require("crypto");
-    import_node_fs13 = __toESM(require("fs"));
-    import_node_path11 = __toESM(require("path"));
+    import_node_child_process8 = require("child_process");
+    import_node_crypto6 = require("crypto");
+    import_node_fs15 = __toESM(require("fs"));
+    import_node_path14 = __toESM(require("path"));
     init_docker();
     init_host_routes();
     init_router();
@@ -4498,7 +6055,7 @@ function outputFromResult(result) {
   return output2.length > 0 ? output2 : void 0;
 }
 function runTool(command, args = []) {
-  const result = (0, import_node_child_process7.spawnSync)(command, args, {
+  const result = (0, import_node_child_process9.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.error) {
@@ -4555,12 +6112,12 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path12.default.join(repoPath, "package.json");
-  if (!import_node_fs14.default.existsSync(packagePath)) {
+  const packagePath = import_node_path15.default.join(repoPath, "package.json");
+  if (!import_node_fs16.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs14.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs16.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -4655,19 +6212,19 @@ function buildGlobalToolChecks(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process7, import_node_fs14, import_node_path12;
+var import_node_child_process9, import_node_fs16, import_node_path15;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
-    import_node_child_process7 = require("child_process");
-    import_node_fs14 = __toESM(require("fs"));
-    import_node_path12 = __toESM(require("path"));
+    import_node_child_process9 = require("child_process");
+    import_node_fs16 = __toESM(require("fs"));
+    import_node_path15 = __toESM(require("path"));
   }
 });
 
 // src/core/devpod-workspaces.ts
 function listDevpodWorkspaces() {
-  const result = (0, import_node_child_process8.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
+  const result = (0, import_node_child_process10.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -4726,7 +6283,7 @@ function parseDevpodRuntimeStatus(output2, expectedId) {
   }
 }
 function inspectDevpodRuntimeStatus(devpodId) {
-  const result = (0, import_node_child_process8.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
+  const result = (0, import_node_child_process10.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
     encoding: "utf-8"
   });
   if (result.status !== 0 || result.error) return "unknown";
@@ -4759,18 +6316,18 @@ function selectDevpodWorkspace(workspaces, repoPath) {
   }
   return matches[0];
 }
-var import_node_child_process8;
+var import_node_child_process10;
 var init_devpod_workspaces = __esm({
   "src/core/devpod-workspaces.ts"() {
     "use strict";
-    import_node_child_process8 = require("child_process");
+    import_node_child_process10 = require("child_process");
     init_workspace();
   }
 });
 
 // src/core/devpod-mutation.ts
 function withMutationLock(activity, target, operation) {
-  import_node_fs15.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs17.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     { activity, target: `'${target}'`, waitMs: DEVPOD_MUTATION_WAIT_MS },
@@ -4782,7 +6339,7 @@ function commandFailure2(result) {
 }
 function runDevpodAction(action2, devpodId, force = false) {
   const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
-  const result = (0, import_node_child_process9.spawnSync)("devpod", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process11.spawnSync)("devpod", args, { encoding: "utf-8" });
   if (result.status !== 0) {
     throw new Error(
       `devpod ${action2}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
@@ -4846,6 +6403,9 @@ function startDevpodWorkspace(options) {
     }
     const args = ["up", options.repoPath];
     if (devpodId) args.push("--id", devpodId);
+    if (options.devcontainerPath) {
+      args.push("--devcontainer-path", options.devcontainerPath);
+    }
     args.push("--open-ide=false");
     if (options.workspace) {
       args.push(
@@ -4868,7 +6428,7 @@ function startDevpodWorkspace(options) {
       delete env.DEVROUTER_GIT_COMMON_DIR;
       delete env.DEVCONTAINER_COMPOSE_OVERLAY;
     }
-    const result = (0, import_node_child_process9.spawnSync)("devpod", args, {
+    const result = (0, import_node_child_process11.spawnSync)("devpod", args, {
       stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
       env
     });
@@ -4895,17 +6455,17 @@ function startDevpodWorkspace(options) {
     }
   });
 }
-var import_node_child_process9, import_node_fs15, import_node_path13, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
+var import_node_child_process11, import_node_fs17, import_node_path16, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
-    import_node_child_process9 = require("child_process");
-    import_node_fs15 = __toESM(require("fs"));
-    import_node_path13 = __toESM(require("path"));
+    import_node_child_process11 = require("child_process");
+    import_node_fs17 = __toESM(require("fs"));
+    import_node_path16 = __toESM(require("path"));
     init_devpod_workspaces();
     init_file_lock();
     init_router();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path13.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path16.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
     DEVPOD_MUTATION_WAIT_MS = 6e4;
     DevpodStartPostconditionError = class extends Error {
     };
@@ -4919,7 +6479,7 @@ function commandError(command, repoPath, stderr) {
   );
 }
 function resolveGitCommonDir(repoPath) {
-  const result = (0, import_node_child_process10.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
+  const result = (0, import_node_child_process12.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -4927,10 +6487,10 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path14.default.isAbsolute(output2) ? output2 : import_node_path14.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path17.default.isAbsolute(output2) ? output2 : import_node_path17.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
-  const result = (0, import_node_child_process10.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
+  const result = (0, import_node_child_process12.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -4941,7 +6501,7 @@ function resolveGitTopLevel(repoPath) {
   return comparableWorkspacePath(output2);
 }
 function listGitWorktrees(repoPath) {
-  const result = (0, import_node_child_process10.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
+  const result = (0, import_node_child_process12.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -4978,7 +6538,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path14.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path17.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -5006,7 +6566,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path14.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path17.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -5026,7 +6586,7 @@ function validateRecord(value, expectedWorkspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs16.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs18.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -5042,7 +6602,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs16.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs18.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -5050,14 +6610,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path14.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path17.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path14.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path17.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record2) => record2.workspace === workspace);
@@ -5093,9 +6653,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
   return record;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path14.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path17.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs16.default.rmSync(filePath);
+    import_node_fs18.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -5106,7 +6666,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path14.default.join(
+  const filePath = import_node_path17.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -5118,14 +6678,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs16.default.rmSync(filePath);
+  import_node_fs18.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs16.default.mkdirSync(directory, { recursive: true });
+  import_node_fs18.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path14.default.join(directory, ".lock"),
+    import_node_path17.default.join(directory, ".lock"),
     { activity: "workspace ownership transaction", target: `'${repoPath}'`, waitMs: 5e3 },
     () => operation({
       list: () => listWorkspaceOwnershipInDirectory(directory),
@@ -5156,7 +6716,7 @@ function inspectWorkspaceOwnership(record, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs16.default.existsSync(record.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs18.default.existsSync(record.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -5180,20 +6740,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process10, import_node_fs16, import_node_path14, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process12, import_node_fs18, import_node_path17, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
-    import_node_child_process10 = require("child_process");
-    import_node_fs16 = __toESM(require("fs"));
-    import_node_path14 = __toESM(require("path"));
+    import_node_child_process12 = require("child_process");
+    import_node_fs18 = __toESM(require("fs"));
+    import_node_path17 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path14.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path17.default.join("devrouter", "workspaces");
   }
 });
 
@@ -5207,10 +6767,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path15.default.join(comparableRepo, "trees") + import_node_path15.default.sep;
+  const localRoot = import_node_path18.default.join(comparableRepo, "trees") + import_node_path18.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path15.default.basename(comparableRepo)}-`;
-  return import_node_path15.default.dirname(comparableWorktree) === import_node_path15.default.dirname(comparableRepo) && import_node_path15.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path18.default.basename(comparableRepo)}-`;
+  return import_node_path18.default.dirname(comparableWorktree) === import_node_path18.default.dirname(comparableRepo) && import_node_path18.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -5453,11 +7013,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path15;
+var import_node_path18;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path15 = __toESM(require("path"));
+    import_node_path18 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -5527,12 +7087,12 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs17.default.existsSync(absolutePath)) {
+      if (!import_node_fs19.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs17.default.readFileSync(absolutePath, "utf-8");
-        const parsed = import_yaml4.default.parse(raw);
+        const raw = import_node_fs19.default.readFileSync(absolutePath, "utf-8");
+        const parsed = import_yaml5.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
         const service = asRecord2(services?.[app.docker.service]);
@@ -5782,6 +7342,22 @@ async function buildDoctorReport(options = {}) {
         level: "ok",
         summary: `.devrouter.yml is valid (${repo.appCount} app(s)).`
       });
+      if (repo.managedRuntime) {
+        const managedRuntime = repo.managedRuntime;
+        const level = managedRuntime.mode === "legacy" || managedRuntime.status === "ready" ? "ok" : managedRuntime.status === "starting" || managedRuntime.status === "stopped" ? "warn" : "error";
+        const summary2 = managedRuntime.mode === "legacy" ? "Legacy runtime contract is active." : managedRuntime.status === "ready" ? `Managed runtime profile '${managedRuntime.profile}' is ready.` : managedRuntime.status === "starting" ? `Managed runtime profile '${managedRuntime.profile}' is starting.` : managedRuntime.status === "stopped" ? `Managed runtime profile '${managedRuntime.profile}' is stopped.` : managedRuntime.status === "failed-transition" ? `Managed runtime profile '${managedRuntime.profile}' has a failed transition.` : `Managed runtime profile '${managedRuntime.profile}' has runtime drift.`;
+        const details = [
+          managedRuntime.transitionPhase ? `transitionPhase=${managedRuntime.transitionPhase}` : void 0,
+          ...managedRuntime.drift
+        ].filter((detail) => Boolean(detail)).join("; ");
+        addCheck(checks, {
+          id: "repo.managed-runtime",
+          level,
+          summary: summary2,
+          ...details ? { details } : {},
+          suggestion: managedRuntime.mode === "legacy" ? void 0 : managedRuntime.status === "failed-transition" ? `Inspect: dev status --repo ${repo.path}; resolve the reported drift before retrying ensure.` : managedRuntime.status === "ready" ? void 0 : `Run: dev ensure ${repo.path}`
+        });
+      }
       if (repo.appCount === 0) {
         addCheck(checks, {
           id: "repo.apps",
@@ -5794,7 +7370,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.37" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.39" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -5824,9 +7400,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path16.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path19.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs17.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs19.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -5869,8 +7445,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path16.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs17.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path19.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs19.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -6014,13 +7590,13 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs17, import_node_path16, import_yaml4, POSTGRES_DEFAULTS;
+var import_node_fs19, import_node_path19, import_yaml5, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs17 = __toESM(require("fs"));
-    import_node_path16 = __toESM(require("path"));
-    import_yaml4 = __toESM(require("yaml"));
+    import_node_fs19 = __toESM(require("fs"));
+    import_node_path19 = __toESM(require("path"));
+    import_yaml5 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -6277,12 +7853,12 @@ function parseSsPortListeners(stdout, port) {
   return listeners;
 }
 function findPortListeners(port) {
-  const result = (0, import_node_child_process11.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+  const result = (0, import_node_child_process13.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process11.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process13.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsPortListeners(ssResult.stdout, port);
       }
@@ -6311,11 +7887,11 @@ function findPortListeners(port) {
     };
   });
 }
-var import_node_child_process11;
+var import_node_child_process13;
 var init_ports = __esm({
   "src/util/ports.ts"() {
     "use strict";
-    import_node_child_process11 = require("child_process");
+    import_node_child_process13 = require("child_process");
   }
 });
 
@@ -6341,101 +7917,32 @@ ${details}
 
 Mitigation:
 1) Stop the conflicting process/container
-2) Re-run: dev up
-
-Debug commands:
-- lsof -nP -iTCP:80 -sTCP:LISTEN
-- lsof -nP -iTCP:443 -sTCP:LISTEN
-- lsof -nP -iTCP:5432 -sTCP:LISTEN`;
-}
-async function runUpCommand() {
-  await ensureNetwork(DEVNET_NAME);
-  ensureRouterFiles();
-  const routerRunning = await isContainerRunning(ROUTER_CONTAINER_NAME);
-  if (!routerRunning) {
-    const message = buildPortConflictMessage();
-    if (message) {
-      throw new Error(message);
-    }
-  }
-  startRouterStack();
-  process.stdout.write("devrouter is up.\n");
-}
-var init_up = __esm({
-  "src/commands/up.ts"() {
-    "use strict";
-    init_docker();
-    init_router();
-    init_ports();
-  }
-});
-
-// src/core/devpod-environment.ts
-function inspectWorkspaceContainers(options) {
-  let ids = options?.ids;
-  if (!ids) {
-    const listed = (0, import_node_child_process12.spawnSync)("docker", ["ps", "-a", "--format", "{{.ID}}"], {
-      encoding: "utf-8"
-    });
-    if (listed.status !== 0) {
-      throw new Error(
-        `docker ps failed: ${(listed.stderr || listed.stdout || listed.error?.message || "unknown error").trim()}`
-      );
-    }
-    ids = listed.stdout.split(/\r?\n/).map((id) => id.trim()).filter(Boolean);
-  }
-  if (ids.length === 0) return [];
-  const template = options?.withSize ? SIZE_INSPECT_TEMPLATE : SAFE_INSPECT_TEMPLATE;
-  const inspected = (0, import_node_child_process12.spawnSync)(
-    "docker",
-    ["inspect", ...options?.withSize ? ["--size"] : [], "--format", template, ...ids],
-    { encoding: "utf-8" }
-  );
-  if (inspected.status !== 0) {
-    throw new Error(
-      `docker inspect failed: ${(inspected.stderr || inspected.stdout || "unknown error").trim()}`
-    );
-  }
-  return inspected.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => JSON.parse(line));
-}
-function workspaceAppContainers(containers, repoPath) {
-  return containers.filter((container) => {
-    const workingDir = container.labels["com.docker.compose.project.working_dir"];
-    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path17.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
-      (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
-    );
-  });
-}
-function resolveRunningWorkspaceContainer(repoPath) {
-  const matches = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).filter(
-    (container2) => container2.state.Running
-  );
-  if (matches.length !== 1) {
-    throw new Error(
-      `Expected one running workspace app container for '${repoPath}', found ${matches.length}.`
-    );
-  }
-  const container = matches[0];
-  const repoMount = container.mounts.find(
-    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
-  );
-  if (!repoMount) {
-    throw new Error(`Workspace app container no longer mounts '${repoPath}'.`);
+2) Re-run: dev up
+
+Debug commands:
+- lsof -nP -iTCP:80 -sTCP:LISTEN
+- lsof -nP -iTCP:443 -sTCP:LISTEN
+- lsof -nP -iTCP:5432 -sTCP:LISTEN`;
+}
+async function runUpCommand() {
+  await ensureNetwork(DEVNET_NAME);
+  ensureRouterFiles();
+  const routerRunning = await isContainerRunning(ROUTER_CONTAINER_NAME);
+  if (!routerRunning) {
+    const message = buildPortConflictMessage();
+    if (message) {
+      throw new Error(message);
+    }
   }
-  return { id: container.id, workspacePath: repoMount.Destination };
+  startRouterStack();
+  process.stdout.write("devrouter is up.\n");
 }
-var import_node_child_process12, import_node_path17, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
-var init_devpod_environment = __esm({
-  "src/core/devpod-environment.ts"() {
+var init_up = __esm({
+  "src/commands/up.ts"() {
     "use strict";
-    import_node_child_process12 = require("child_process");
-    import_node_path17 = __toESM(require("path"));
-    init_workspace();
-    SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
-    SIZE_INSPECT_TEMPLATE = SAFE_INSPECT_TEMPLATE.replace(
-      /}$/,
-      ',"sizeRw":{{json (index . "SizeRw")}},"sizeRootFs":{{json (index . "SizeRootFs")}}}'
-    );
+    init_docker();
+    init_router();
+    init_ports();
   }
 });
 
@@ -6461,18 +7968,18 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process13.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process14.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
   const details = ok ? `HTTP ${status}` : [status === void 0 ? void 0 : `HTTP ${status}`, result.stderr?.trim()].filter(Boolean).join(": ") || `curl exited with status ${result.status ?? "unknown"}`;
   return { ok, status, details };
 }
-var import_node_child_process13;
+var import_node_child_process14;
 var init_http_route_probe = __esm({
   "src/core/http-route-probe.ts"() {
     "use strict";
-    import_node_child_process13 = require("child_process");
+    import_node_child_process14 = require("child_process");
     init_router();
     init_tls();
   }
@@ -6551,11 +8058,11 @@ var init_route_publication = __esm({
 // src/core/workspace-ensure.ts
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path18.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path20.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path18.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path20.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -6569,6 +8076,197 @@ function assertReady(container, label) {
     throw new Error(`${label} container '${container.id}' is not healthy (${health}).`);
   }
 }
+function exactWorkspaceServiceContainers(containers, repoPath, composeProject, service, composeFiles2) {
+  return containers.filter(
+    (container) => hasExactComposeIdentity(container, {
+      repoPath,
+      composeProject,
+      service,
+      composeFiles: composeFiles2
+    })
+  );
+}
+function resolveComposeProject(containers, repoPath, appContainerId, primaryService, composeFiles2) {
+  const app = containers.find((candidate) => candidate.id === appContainerId);
+  if (!app) {
+    throw new Error(
+      `Workspace app container '${appContainerId}' disappeared during reconciliation.`
+    );
+  }
+  if (!hasExactComposeIdentity(app, {
+    repoPath,
+    service: primaryService,
+    composeFiles: composeFiles2
+  })) {
+    throw new Error(`Workspace app container '${appContainerId}' has an unexpected Compose model.`);
+  }
+  const project = app.labels["com.docker.compose.project"];
+  if (!project) {
+    throw new Error(`Workspace app container '${appContainerId}' has no Compose project label.`);
+  }
+  return project;
+}
+async function waitForManagedServices(plan, repoPath, composeProject, expectedServices, expectedAppId, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  let lastError;
+  do {
+    try {
+      const containers = inspectWorkspaceContainers();
+      for (const service of expectedServices) {
+        const matches = exactWorkspaceServiceContainers(
+          containers,
+          repoPath,
+          composeProject,
+          service,
+          plan.composeFiles
+        );
+        if (matches.length !== 1) {
+          throw new Error(
+            `Managed service '${service}' must have exactly one exact workspace container; found ${matches.length}.`
+          );
+        }
+        if (service === plan.primaryService && matches[0].id !== expectedAppId) {
+          throw new Error(
+            `Managed primary service '${service}' changed container identity during profile transition.`
+          );
+        }
+        assertReady(matches[0], `Managed service '${service}'`);
+      }
+      return;
+    } catch (error) {
+      lastError = error;
+    }
+    if (Date.now() < deadline) await sleep(POLL_INTERVAL_MS);
+  } while (Date.now() < deadline);
+  throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+function stopDroppedManagedServices(plan, repoPath, composeProject) {
+  const desired = new Set(plan.desiredProfileServices);
+  const containers = inspectWorkspaceContainers();
+  for (const service of plan.profileServices) {
+    if (desired.has(service)) continue;
+    const matches = exactWorkspaceServiceContainers(
+      containers,
+      repoPath,
+      composeProject,
+      service,
+      plan.composeFiles
+    );
+    if (matches.length > 1) {
+      throw new Error(
+        `Managed service '${service}' has multiple exact workspace containers; refusing to stop any.`
+      );
+    }
+    const match = matches[0];
+    if (match?.state.Running) stopExactManagedService(match.id, service);
+  }
+}
+function assertDroppedManagedServicesStopped(plan, repoPath, composeProject) {
+  const desired = new Set(plan.desiredProfileServices);
+  const containers = inspectWorkspaceContainers();
+  for (const service of plan.profileServices) {
+    if (desired.has(service)) continue;
+    const matches = exactWorkspaceServiceContainers(
+      containers,
+      repoPath,
+      composeProject,
+      service,
+      plan.composeFiles
+    );
+    if (matches.some((match) => match.state.Running)) {
+      throw new Error(`Managed service '${service}' remains running after exact stop.`);
+    }
+  }
+}
+function routeInputFromState(route) {
+  return {
+    name: route.name,
+    host: route.host,
+    protocol: route.protocol,
+    tcpProtocol: route.tcpProtocol,
+    repoPath: route.repoPath,
+    port: route.port,
+    mode: route.mode,
+    upstreamHost: route.upstreamHost,
+    pid: route.pid,
+    command: route.command,
+    workspace: route.workspace
+  };
+}
+function isWildcard2(values) {
+  return values?.length === 1 && values[0] === "*";
+}
+function desiredManagedProcesses(managedRuntime, profile) {
+  if (!profile || isWildcard2(profile.processes)) return [...managedRuntime.processes];
+  return [...profile.processes ?? []];
+}
+function restorePreviousManagedConfig(options) {
+  const restoredPlan = inspectManagedDevcontainerConfig({
+    repoPath: options.repoPath,
+    config: options.config,
+    profile: {
+      apps: [],
+      devcontainerServices: [...options.previousState.desired.services]
+    },
+    linked: options.linked
+  });
+  if (restoredPlan.effectiveConfigSha256 !== options.previousState.effectiveConfigSha256) {
+    throw new Error(
+      "The previous managed Dev Container configuration fingerprint no longer matches the current source."
+    );
+  }
+  writeManagedDevcontainerConfig(restoredPlan);
+}
+function isWarmWorkspaceActive(repoPath) {
+  try {
+    return workspaceAppContainers(inspectWorkspaceContainers(), repoPath).some(
+      (container) => container.state.Running
+    );
+  } catch {
+    return true;
+  }
+}
+function captureFirstTransitionBaseline(options) {
+  const containers = inspectWorkspaceContainers();
+  const runningPrimary = workspaceAppContainers(containers, options.repoPath).filter(
+    (container) => container.state.Running
+  );
+  if (runningPrimary.length === 0) return void 0;
+  if (runningPrimary.length > 1) {
+    throw new Error(
+      "Cannot start the first managed transition while multiple workspace app containers are running."
+    );
+  }
+  const primary = runningPrimary[0];
+  const composeProject = primary.labels["com.docker.compose.project"];
+  const workspacePath = primary.mounts.find(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, options.repoPath)
+  )?.Destination;
+  if (!composeProject || !workspacePath) {
+    throw new Error(
+      "Cannot prove the exact pre-transition Compose identity for the first managed transition."
+    );
+  }
+  const services = options.plan.profileServices.filter(
+    (service) => containers.some(
+      (container) => container.state.Running && hasExactComposeIdentity(container, { repoPath: options.repoPath, service, composeProject })
+    )
+  );
+  const activeProcesses = [];
+  for (const process2 of options.processes) {
+    const status = runManagedProcessAction({
+      container: { id: primary.id, workspacePath },
+      name: process2,
+      action: "status",
+      quiet: true
+    });
+    if (status === "running") activeProcesses.push(process2);
+  }
+  return {
+    services,
+    processes: activeProcesses
+  };
+}
 function validateWorkspaceContainers(containers, options) {
   const appContainers = workspaceAppContainers(containers, options.repoPath);
   if (appContainers.length !== 1) {
@@ -6629,7 +8327,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process14.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process15.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8" }
@@ -6639,7 +8337,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process14.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process15.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8" }
@@ -6650,7 +8348,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process14.spawnSync)(
+      const gitCheck = (0, import_node_child_process15.spawnSync)(
         "docker",
         [
           "exec",
@@ -6737,14 +8435,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs18.default.statSync(import_node_path18.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs20.default.statSync(import_node_path20.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process14.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process15.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -6770,23 +8468,92 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
   }
   return withWorkspaceLifecycleLock(repoPath, async () => {
     let environmentStarted = false;
+    let managedPlan;
+    let previousManagedState;
+    let managedComposeProject;
+    let managedContainer;
+    let previousRoutes = [];
+    let candidateRoutesPublished = false;
+    let transitionPhase = "validation";
+    let managedProcessRegistry = [];
+    let managedPostStartPlan;
+    let managedRuntimeConfig;
+    let managedConfigWritten = false;
+    let managedWorkspaceEnv;
+    let firstTransitionBaseline;
     try {
       const target = linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path18.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs18.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path20.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs20.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
       const managedPostStart = resolveManagedPostStartPlan(repoPath);
+      managedPostStartPlan = managedPostStart;
       const runtime = loadRuntimeConfig(
         repoPath,
-        target.kind === "primary" ? "" : target.workspace
+        target.kind === "primary" ? "" : target.workspace,
+        options.profile
       );
+      const managedRuntime = runtime.config.managedRuntime;
+      managedRuntimeConfig = managedRuntime ? runtime.config : void 0;
+      managedProcessRegistry = managedRuntime?.processes ?? [];
+      const desiredProcesses = managedRuntime ? desiredManagedProcesses(managedRuntime, runtime.resolvedProfile) : [];
+      if (managedRuntime) {
+        previousManagedState = readManagedRuntimeState(repoPath, target.workspace);
+        if (previousManagedState?.status === "degraded") {
+          throw new Error(
+            "Managed runtime state is degraded; refusing a new profile transition until drift is repaired."
+          );
+        }
+        if (previousManagedState && previousManagedState.devpodId !== target.devpodId) {
+          throw new Error(
+            `Managed runtime state names DevPod '${previousManagedState.devpodId}', not the exact target '${target.devpodId ?? "(absent)"}'.`
+          );
+        }
+        if (previousManagedState?.desired.services.some(
+          (service) => !managedRuntime.devcontainer.profileServices.includes(service)
+        )) {
+          throw new Error("Managed runtime state contains an unregistered profile service.");
+        }
+        if (previousManagedState?.desired.processes.some(
+          (process2) => !managedRuntime.processes.includes(process2)
+        )) {
+          throw new Error("Managed runtime state contains an unregistered process marker.");
+        }
+        previousRoutes = listHostRouteState().filter(
+          (route) => sameWorkspacePath(route.repoPath, repoPath)
+        );
+        if (managedPostStart.kind !== "runtime") {
+          throw new Error(
+            "managedRuntime requires the runtime managed post-start adapter for exact process reconciliation."
+          );
+        }
+        managedPlan = inspectManagedDevcontainerConfig({
+          repoPath,
+          config: runtime.config,
+          profile: runtime.resolvedProfile,
+          linked: target.kind === "linked"
+        });
+        managedWorkspaceEnv = target.kind === "linked" ? { token: target.workspace, gitCommonDir: target.gitCommonDir } : void 0;
+        if (previousManagedState && isWarmWorkspaceActive(repoPath) && previousManagedState.sourceConfigSha256 !== managedPlan.sourceConfigSha256) {
+          throw new Error(
+            `Managed Dev Container source configuration changed since the last successful transition; a warm ensure cannot apply it to the existing runtime for '${repoPath}'. Stop and delete the exact runtime, then run ensure again to recreate it from the current source configuration.`
+          );
+        }
+        if (!previousManagedState) {
+          firstTransitionBaseline = captureFirstTransitionBaseline({
+            repoPath,
+            plan: managedPlan,
+            processes: managedRuntime.processes
+          });
+        }
+      }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path18.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path20.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -6795,6 +8562,10 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           );
         }
       }
+      if (managedPlan) {
+        writeManagedDevcontainerConfig(managedPlan);
+        managedConfigWritten = true;
+      }
       const upstreamHosts = parsedUpstreams.map((upstream) => upstream.host);
       const ownership = target.kind === "linked" ? {
         workspace: target.workspace,
@@ -6812,6 +8583,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           devpodId = startDevpodWorkspace({
             repoPath,
             devpodId: requestedTarget.devpodId,
+            devcontainerPath: managedPlan?.generatedRelativePath,
             recreate,
             quiet: options.quiet,
             ...requestedTarget.kind === "linked" ? {
@@ -6840,7 +8612,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       try {
         startAndProveAttachment();
       } catch (error) {
-        if (!target.hadExactDevpod) {
+        if (managedPlan || !target.hadExactDevpod) {
           throw error;
         }
         container = await recreateAndPreflight();
@@ -6850,23 +8622,113 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         try {
           container = await preflight(0);
         } catch (error) {
-          if (!target.hadExactDevpod) {
+          if (managedPlan || !target.hadExactDevpod) {
             throw error;
           }
           container = await recreateAndPreflight();
           recreated = true;
         }
       }
+      managedContainer = container;
+      if (managedPlan) {
+        transitionPhase = "service-start";
+        const initialContainers = inspectWorkspaceContainers();
+        managedComposeProject = resolveComposeProject(
+          initialContainers,
+          repoPath,
+          container.id,
+          managedPlan.primaryService,
+          managedPlan.composeFiles
+        );
+        if (previousManagedState && previousManagedState.composeProject !== managedComposeProject) {
+          throw new Error(
+            `Managed runtime state names Compose project '${previousManagedState.composeProject}', not '${managedComposeProject}'.`
+          );
+        }
+        const missingServices = [];
+        for (const service of managedPlan.desiredServices) {
+          const matches = exactWorkspaceServiceContainers(
+            initialContainers,
+            repoPath,
+            managedComposeProject,
+            service,
+            managedPlan.composeFiles
+          );
+          if (matches.length > 1) {
+            throw new Error(
+              `Managed service '${service}' has multiple exact workspace containers; refusing to reconcile it.`
+            );
+          }
+          if (!matches[0]?.state.Running) missingServices.push(service);
+        }
+        startExactManagedServices({
+          plan: managedPlan,
+          composeProject: managedComposeProject,
+          services: missingServices,
+          quiet: options.quiet,
+          workspace: managedWorkspaceEnv
+        });
+        await waitForManagedServices(
+          managedPlan,
+          repoPath,
+          managedComposeProject,
+          managedPlan.desiredServices,
+          container.id,
+          options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS
+        );
+        container = await preflight(options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS);
+        managedContainer = container;
+      }
+      transitionPhase = "process-start";
       runManagedPostStart({
         plan: managedPostStart,
         container,
-        quiet: options.quiet
+        quiet: options.quiet,
+        profile: runtime.profile,
+        ...managedPlan ? { processes: desiredProcesses } : {}
       });
+      if (managedPlan && managedComposeProject) {
+        const processRegistry = runtime.config.managedRuntime?.processes ?? [];
+        const desiredProcessSet = new Set(desiredProcesses);
+        for (const process2 of processRegistry) {
+          if (desiredProcessSet.has(process2)) continue;
+          runManagedProcessAction({
+            container,
+            name: process2,
+            action: "stop",
+            quiet: options.quiet
+          });
+        }
+        for (const process2 of desiredProcesses) {
+          const status = runManagedProcessAction({
+            container,
+            name: process2,
+            action: "status",
+            quiet: options.quiet
+          });
+          if (status !== "running") {
+            throw new Error(`Managed process '${process2}' is not running (${status}).`);
+          }
+        }
+        transitionPhase = "service-stop";
+        stopDroppedManagedServices(managedPlan, repoPath, managedComposeProject);
+        assertDroppedManagedServicesStopped(managedPlan, repoPath, managedComposeProject);
+        await waitForManagedServices(
+          managedPlan,
+          repoPath,
+          managedComposeProject,
+          managedPlan.desiredServices,
+          container.id,
+          options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS
+        );
+      }
+      transitionPhase = "route-publication";
       const publication = await replacePublishedProxyRoutes(
         repoPath,
         runtime.config,
         target.workspace
       );
+      candidateRoutesPublished = true;
       try {
         await waitForHttpRoutes(
           repoPath,
@@ -6874,6 +8736,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS
         );
       } catch (error) {
+        if (managedPlan) {
+          throw error;
+        }
         replaceHostRoutesForRepo(repoPath, []);
         if (!target.hadExactDevpod || recreated) {
           throw error;
@@ -6882,7 +8747,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         runManagedPostStart({
           plan: managedPostStart,
           container: recoveredContainer,
-          quiet: options.quiet
+          quiet: options.quiet,
+          profile: runtime.profile
         });
         recreated = true;
         replaceHostRoutesForRepo(repoPath, publication.routes);
@@ -6903,16 +8769,216 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       if (!devpodId) {
         throw new Error(`DevPod id for '${repoPath}' was not resolved after startup.`);
       }
+      if (managedPlan && managedComposeProject) {
+        writeManagedRuntimeState({
+          version: 1,
+          repoPath,
+          ...target.workspace !== void 0 ? { workspace: target.workspace } : {},
+          devpodId,
+          composeProject: managedComposeProject,
+          profile: runtime.profile,
+          desired: {
+            apps: apps.map((app) => app.name).sort(),
+            services: [...managedPlan.desiredProfileServices].sort(),
+            processes: [...desiredProcesses].sort()
+          },
+          sourceConfigSha256: managedPlan.sourceConfigSha256,
+          effectiveConfigSha256: managedPlan.effectiveConfigSha256,
+          status: "ready",
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+      const managedRuntimeStatus = managedPlan ? collectManagedRuntimeStatus({
+        repoPath,
+        workspace: target.workspace,
+        config: runtime.config,
+        profile: runtime.profile,
+        resolvedProfile: runtime.resolvedProfile
+      }) : void 0;
       return {
         kind: target.kind,
         repoPath,
         workspace: target.workspace,
+        profile: runtime.profile,
         devpodId,
         urls,
         recreated,
-        tlsRefreshed: publication.tlsRefreshed
+        tlsRefreshed: publication.tlsRefreshed,
+        ...managedRuntimeStatus ? { managedRuntime: managedRuntimeStatus } : {}
       };
     } catch (error) {
+      if (managedPlan && managedContainer && managedComposeProject) {
+        const rollbackErrors = [];
+        const failedPhase = transitionPhase;
+        transitionPhase = "rollback";
+        const previousServices = previousManagedState?.desired.services ?? firstTransitionBaseline?.services ?? [];
+        const previousProcesses = previousManagedState?.desired.processes ?? firstTransitionBaseline?.processes ?? [];
+        const previousServiceSet = new Set(previousServices);
+        const previousProcessSet = new Set(previousProcesses);
+        try {
+          if (managedConfigWritten) {
+            if (previousManagedState && managedRuntimeConfig) {
+              restorePreviousManagedConfig({
+                repoPath,
+                config: managedRuntimeConfig,
+                linked,
+                previousState: previousManagedState
+              });
+            } else {
+              removeManagedDevcontainerConfig(managedPlan);
+            }
+          }
+        } catch (rollbackError) {
+          rollbackErrors.push(
+            `configuration: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+          );
+        }
+        try {
+          const previousAllServices = [
+            managedPlan.primaryService,
+            ...managedPlan.baseServices,
+            ...previousServices
+          ];
+          startExactManagedServices({
+            plan: managedPlan,
+            composeProject: managedComposeProject,
+            services: previousAllServices,
+            quiet: options.quiet,
+            workspace: managedWorkspaceEnv
+          });
+          await waitForManagedServices(
+            managedPlan,
+            repoPath,
+            managedComposeProject,
+            previousAllServices,
+            managedContainer.id,
+            options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS
+          );
+        } catch (rollbackError) {
+          rollbackErrors.push(
+            `services: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+          );
+        }
+        try {
+          if (!managedPostStartPlan) {
+            throw new Error("Managed post-start plan disappeared during rollback.");
+          }
+          runManagedPostStart({
+            plan: managedPostStartPlan,
+            container: managedContainer,
+            quiet: options.quiet,
+            profile: previousManagedState?.profile ?? "full",
+            processes: previousProcesses
+          });
+          for (const process2 of managedProcessRegistry) {
+            if (previousProcessSet.has(process2)) continue;
+            runManagedProcessAction({
+              container: managedContainer,
+              name: process2,
+              action: "stop",
+              quiet: options.quiet
+            });
+          }
+        } catch (rollbackError) {
+          rollbackErrors.push(
+            `processes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+          );
+        }
+        try {
+          const containers = inspectWorkspaceContainers();
+          for (const service of managedPlan.profileServices) {
+            if (previousServiceSet.has(service)) continue;
+            const matches = exactWorkspaceServiceContainers(
+              containers,
+              repoPath,
+              managedComposeProject,
+              service,
+              managedPlan.composeFiles
+            );
+            if (matches.length > 1) {
+              throw new Error(`service '${service}' has multiple exact containers`);
+            }
+            if (matches[0]?.state.Running) stopExactManagedService(matches[0].id, service);
+          }
+          assertDroppedManagedServicesStopped(
+            {
+              ...managedPlan,
+              desiredProfileServices: previousServices,
+              desiredServices: [
+                managedPlan.primaryService,
+                ...managedPlan.baseServices,
+                ...previousServices
+              ]
+            },
+            repoPath,
+            managedComposeProject
+          );
+        } catch (rollbackError) {
+          rollbackErrors.push(
+            `service cleanup: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+          );
+        }
+        if (candidateRoutesPublished) {
+          try {
+            replaceHostRoutesForRepo(repoPath, previousRoutes.map(routeInputFromState));
+          } catch (rollbackError) {
+            rollbackErrors.push(
+              `routes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+            );
+          }
+        }
+        if (rollbackErrors.length > 0 && previousManagedState) {
+          try {
+            markManagedRuntimeDegraded(previousManagedState, failedPhase);
+          } catch (stateError) {
+            rollbackErrors.push(
+              `state: ${stateError instanceof Error ? stateError.message : String(stateError)}`
+            );
+          }
+        }
+        const original = error instanceof Error ? error.message : String(error);
+        const suffix = rollbackErrors.length > 0 ? ` Rollback left degraded drift: ${rollbackErrors.join("; ")}.` : " Candidate runtime was rolled back.";
+        throw new Error(`${original}${suffix}`);
+      }
+      if (managedPlan) {
+        const original = error instanceof Error ? error.message : String(error);
+        const rollbackErrors = [];
+        if (managedConfigWritten) {
+          try {
+            if (previousManagedState && managedRuntimeConfig) {
+              restorePreviousManagedConfig({
+                repoPath,
+                config: managedRuntimeConfig,
+                linked,
+                previousState: previousManagedState
+              });
+            } else {
+              removeManagedDevcontainerConfig(managedPlan);
+            }
+          } catch (rollbackError) {
+            rollbackErrors.push(
+              `configuration: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+            );
+          }
+        }
+        if (candidateRoutesPublished) {
+          try {
+            replaceHostRoutesForRepo(repoPath, previousRoutes.map(routeInputFromState));
+          } catch (rollbackError) {
+            rollbackErrors.push(
+              `routes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+            );
+          }
+        }
+        if (rollbackErrors.length > 0) {
+          throw new Error(
+            `${original} Rollback left degraded drift: ${rollbackErrors.join("; ")}.`
+          );
+        }
+        throw new Error(
+          `${original} Managed runtime transition did not reach a rollback boundary.`
+        );
+      }
       if (environmentStarted) {
         try {
           replaceHostRoutesForRepo(repoPath, []);
@@ -6926,19 +8992,22 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
   });
 }
-var import_node_child_process14, import_node_fs18, import_node_path18, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
+var import_node_child_process15, import_node_fs20, import_node_path20, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process14 = require("child_process");
-    import_node_fs18 = __toESM(require("fs"));
-    import_node_path18 = __toESM(require("path"));
+    import_node_child_process15 = require("child_process");
+    import_node_fs20 = __toESM(require("fs"));
+    import_node_path20 = __toESM(require("path"));
+    init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
     init_http_route_probe();
     init_managed_post_start();
+    init_managed_runtime_state();
+    init_managed_runtime_status();
     init_repo_config();
     init_route_publication();
     init_router();
@@ -6978,14 +9047,15 @@ async function runEnsureCommand(options) {
   const repoPath = resolveGitCheckoutPath(options.path);
   const result = await workspaceEnsure(repoPath, {
     open: options.open,
-    quiet: Boolean(options.json)
+    quiet: Boolean(options.json),
+    profile: options.profile
   });
   if (options.json) {
     process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
     return;
   }
-  const label = result.kind === "primary" ? "Primary checkout" : `Workspace '${result.workspace}'`;
+  const label = result.kind === "primary" ? `Primary checkout [profile: ${result.profile}]` : `Workspace '${result.workspace}' [profile: ${result.profile}]`;
   const routes = result.urls.map((url) => `  ${url}`).join("\n");
   process.stdout.write(`${label} is ready (${result.devpodId}).
 ${routes}${routes ? "\n" : ""}`);
@@ -7008,20 +9078,20 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path19.default.join(mainRepo, "trees", ws);
+  return import_node_path21.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process15.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process16.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path19.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path19.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path21.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path21.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path19.default.join(import_node_path19.default.dirname(mainRepo), `${import_node_path19.default.basename(mainRepo)}-${ws}`);
+  return import_node_path21.default.join(import_node_path21.default.dirname(mainRepo), `${import_node_path21.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -7133,13 +9203,13 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs19.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs21.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
     );
   }
-  const status = (0, import_node_child_process15.spawnSync)(
+  const status = (0, import_node_child_process16.spawnSync)(
     "git",
     ["-C", target.worktreePath, "status", "--porcelain", "--untracked-files=normal"],
     { encoding: "utf-8" }
@@ -7160,8 +9230,8 @@ async function workspaceUp(branch, opts = {}) {
   if (!ws) {
     throw new Error(`Branch '${branch}' does not yield a valid workspace token.`);
   }
-  const worktreePath = opts.path ? import_node_path19.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
-  if (import_node_fs19.default.existsSync(worktreePath)) {
+  const worktreePath = opts.path ? import_node_path21.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
+  if (import_node_fs21.default.existsSync(worktreePath)) {
     const registered = listGitWorktrees(mainRepo).find(
       (worktree) => sameWorkspacePath(worktree.path, worktreePath)
     );
@@ -7179,11 +9249,11 @@ async function workspaceUp(branch, opts = {}) {
     if (!opts.path) {
       assertDefaultWorktreeRootIgnored(mainRepo);
     }
-    const add = (0, import_node_child_process15.spawnSync)("git", ["-C", mainRepo, "worktree", "add", worktreePath, branch], {
+    const add = (0, import_node_child_process16.spawnSync)("git", ["-C", mainRepo, "worktree", "add", worktreePath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process15.spawnSync)(
+      const addNew = (0, import_node_child_process16.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, worktreePath],
         {
@@ -7288,8 +9358,8 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
       opts.quiet
     );
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs19.default.existsSync(resolved.worktreePath)) {
-        const rm = (0, import_node_child_process15.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs21.default.existsSync(resolved.worktreePath)) {
+        const rm = (0, import_node_child_process16.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -7307,7 +9377,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs19.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs21.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
 }
 async function mutateWorkspaceOwnedPath(action2, worktreePath, opts = {}) {
   const mainRepo = resolveRepoPath(opts.repoPath);
@@ -7342,13 +9412,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process15, import_node_fs19, import_node_path19;
+var import_node_child_process16, import_node_fs21, import_node_path21;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process15 = require("child_process");
-    import_node_fs19 = __toESM(require("fs"));
-    import_node_path19 = __toESM(require("path"));
+    import_node_child_process16 = require("child_process");
+    import_node_fs21 = __toESM(require("fs"));
+    import_node_path21 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_repo_config();
@@ -7475,7 +9545,7 @@ function ensureGuidance(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process16.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process17.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -7513,7 +9583,7 @@ async function devpodExec(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto5.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto7.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -7531,7 +9601,7 @@ async function devpodExec(repoPath, command) {
       wrappedCommand
     ];
     return new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process16.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+      const child = (0, import_node_child_process17.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       let pending = Buffer.alloc(0);
       let statusBytes = Buffer.alloc(0);
       let readingStatus = false;
@@ -7590,12 +9660,12 @@ async function devpodExec(repoPath, command) {
     });
   });
 }
-var import_node_child_process16, import_node_crypto5, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
+var import_node_child_process17, import_node_crypto7, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
 var init_devpod_exec = __esm({
   "src/core/devpod-exec.ts"() {
     "use strict";
-    import_node_child_process16 = require("child_process");
-    import_node_crypto5 = require("crypto");
+    import_node_child_process17 = require("child_process");
+    import_node_crypto7 = require("crypto");
     init_devpod_environment();
     init_devpod_workspaces();
     init_workspace();
@@ -7779,7 +9849,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process17.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process18.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -7787,11 +9857,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process17;
+var import_node_child_process18;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process17 = require("child_process");
+    import_node_child_process18 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -7814,7 +9884,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process18.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process19.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -7828,17 +9898,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process18.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process19.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process18;
+var import_node_child_process19;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process18 = require("child_process");
+    import_node_child_process19 = require("child_process");
     init_docker();
     init_router();
   }
@@ -7878,17 +9948,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs20.default.existsSync(filePath)) {
+  if (!import_node_fs22.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs20.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs22.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path20.default.relative(repoPath, filePath) || ".";
+  return import_node_path22.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -7929,7 +9999,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs20.default.existsSync(import_node_path20.default.join(repoPath, fileName))) {
+    if (import_node_fs22.default.existsSync(import_node_path22.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -7944,9 +10014,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path20.default.join(repoPath, ".nvmrc");
-  if (import_node_fs20.default.existsSync(nvmrc)) {
-    const version = import_node_fs20.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path22.default.join(repoPath, ".nvmrc");
+  if (import_node_fs22.default.existsSync(nvmrc)) {
+    const version = import_node_fs22.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -8007,7 +10077,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path20.default.isAbsolute(fileName) && !import_node_path20.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path22.default.isAbsolute(fileName) && !import_node_path22.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -8025,10 +10095,10 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs20.default.existsSync(import_node_path20.default.join(repoPath, fileName))
+    (fileName) => import_node_fs22.default.existsSync(import_node_path22.default.join(repoPath, fileName))
   );
 }
-function stringArray(value) {
+function stringArray2(value) {
   if (!Array.isArray(value)) {
     return [];
   }
@@ -8063,7 +10133,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml5.default.parse(import_node_fs20.default.readFileSync(import_node_path20.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs22.default.readFileSync(import_node_path22.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -8077,7 +10147,7 @@ function inspectServices(repoPath) {
           kind: kind.kind,
           source: fileName,
           image,
-          ports: stringArray(service.ports),
+          ports: stringArray2(service.ports),
           hasHealthcheck: service.healthcheck !== void 0,
           envNames: envNames(service.environment),
           confidence: kind.confidence
@@ -8098,8 +10168,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs20.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs20.default.readFileSync(import_node_path20.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs22.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs22.default.readFileSync(import_node_path22.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -8113,18 +10183,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path20.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs20.default.existsSync(dir)) {
+  const dir = import_node_path22.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs22.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs20.default.readdirSync(dir).filter((fileName) => import_node_fs20.default.statSync(import_node_path20.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs22.default.readdirSync(dir).filter((fileName) => import_node_fs22.default.statSync(import_node_path22.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs20.default.existsSync(configPath)) {
+  if (!import_node_fs22.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -8168,15 +10238,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs20.default.existsSync(import_node_path20.default.join(repoPath, fileName))) {
+    if (import_node_fs22.default.existsSync(import_node_path22.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path20.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs20.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs20.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path20.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs20.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path22.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs22.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs22.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path22.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs22.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -8219,7 +10289,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path20.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path22.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -8238,13 +10308,13 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs20, import_node_path20, import_yaml5;
+var import_node_fs22, import_node_path22, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs20 = __toESM(require("fs"));
-    import_node_path20 = __toESM(require("path"));
-    import_yaml5 = __toESM(require("yaml"));
+    import_node_fs22 = __toESM(require("fs"));
+    import_node_path22 = __toESM(require("path"));
+    import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
 });
@@ -8348,7 +10418,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs21.default.existsSync(import_node_path21.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs23.default.existsSync(import_node_path23.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -8567,12 +10637,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs21, import_node_path21;
+var import_node_fs23, import_node_path23;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs21 = __toESM(require("fs"));
-    import_node_path21 = __toESM(require("path"));
+    import_node_fs23 = __toESM(require("fs"));
+    import_node_path23 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -8868,7 +10938,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path22.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path24.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -8913,8 +10983,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path22.default.join(repoPath, file.relativePath);
-  if (!import_node_fs22.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path24.default.join(repoPath, file.relativePath);
+  if (!import_node_fs24.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -8922,7 +10992,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs22.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs24.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -8979,11 +11049,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path22.default.join(repoPath, file.relativePath);
-  import_node_fs22.default.mkdirSync(import_node_path22.default.dirname(absolutePath), { recursive: true });
-  import_node_fs22.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path24.default.join(repoPath, file.relativePath);
+  import_node_fs24.default.mkdirSync(import_node_path24.default.dirname(absolutePath), { recursive: true });
+  import_node_fs24.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs22.default.chmodSync(absolutePath, 493);
+    import_node_fs24.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -9021,12 +11091,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs22, import_node_path22, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs24, import_node_path24, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs22 = __toESM(require("fs"));
-    import_node_path22 = __toESM(require("path"));
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path24 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -9417,7 +11487,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto6.createHash)("sha1").update(import_node_path23.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto8.createHash)("sha1").update(import_node_path25.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -9496,11 +11566,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path23.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs23.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path23.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path25.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs25.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path25.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs23.default.writeFileSync(overlayPath, import_yaml6.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs25.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -9514,7 +11584,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process20.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -9542,7 +11612,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process20.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -9568,7 +11638,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process20.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -9594,7 +11664,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process19.spawnSync)("docker", args, {
+  (0, import_node_child_process20.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -9606,7 +11676,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process20.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -9620,15 +11690,15 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process19, import_node_crypto6, import_node_fs23, import_node_path23, import_yaml6;
+var import_node_child_process20, import_node_crypto8, import_node_fs25, import_node_path25, import_yaml7;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process19 = require("child_process");
-    import_node_crypto6 = require("crypto");
-    import_node_fs23 = __toESM(require("fs"));
-    import_node_path23 = __toESM(require("path"));
-    import_yaml6 = __toESM(require("yaml"));
+    import_node_child_process20 = require("child_process");
+    import_node_crypto8 = require("crypto");
+    import_node_fs25 = __toESM(require("fs"));
+    import_node_path25 = __toESM(require("path"));
+    import_yaml7 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
     init_router();
@@ -9717,7 +11787,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process20.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process21.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -9828,12 +11898,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process20.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process21.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process20.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process21.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -9892,7 +11962,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process20.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process21.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -10260,7 +12330,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process20.spawn)(wrapped, {
+        child = (0, import_node_child_process21.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -10274,7 +12344,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process20.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process21.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -10282,7 +12352,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process20.spawn)(options.command[0], {
+      child = (0, import_node_child_process21.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -10290,7 +12360,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process20.spawn)(command, args, {
+      child = (0, import_node_child_process21.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -10311,11 +12381,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process20, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process21, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process20 = require("child_process");
+    import_node_child_process21 = require("child_process");
     import_node_net = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -10449,13 +12519,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs24.default.lstatSync(worktreePath);
+    rootStat = import_node_fs26.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs24.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs26.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -10481,10 +12551,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path24.default.join(dirPath, entry.name);
+      const entryPath = import_node_path26.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs24.default.lstatSync(entryPath);
+        entryStat = import_node_fs26.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -10494,7 +12564,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs24.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs26.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -10558,12 +12628,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs24, import_node_path24, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs26, import_node_path26, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs24 = __toESM(require("fs"));
-    import_node_path24 = __toESM(require("path"));
+    import_node_fs26 = __toESM(require("fs"));
+    import_node_path26 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -10664,7 +12734,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs25.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs27.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -11195,7 +13265,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers = new Map(worktreePaths.map((path24) => [path24, unknownContainers(reason)]));
+      containers = new Map(worktreePaths.map((path26) => [path26, unknownContainers(reason)]));
     }
   }
   const rows = records.map((record) => {
@@ -11243,12 +13313,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process21, import_node_fs25, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process22, import_node_fs27, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process21 = require("child_process");
-    import_node_fs25 = __toESM(require("fs"));
+    import_node_child_process22 = require("child_process");
+    import_node_fs27 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -11265,7 +13335,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process21.spawnSync)(command, args, {
+      const result = (0, import_node_child_process22.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -11425,7 +13495,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.37" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.39" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -11475,12 +13545,13 @@ program.command("up").description("Ensure devnet and start shared Traefik (reser
     await runUpCommand2();
   })
 );
-program.command("ensure").description("Start and prove a primary or linked checkout's environment and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+program.command("ensure").description("Start and prove a primary or linked checkout's environment and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(async (repoPath, _options, command) => {
     const options = command.opts();
     const { runEnsureCommand: runEnsureCommand2 } = await Promise.resolve().then(() => (init_ensure(), ensure_exports));
     await runEnsureCommand2({
       path: repoPath,
+      profile: options.profile,
       open: Boolean(options.open),
       json: Boolean(options.json)
     });
@@ -11679,13 +13750,14 @@ workspaceCommand2.command("up").description(
     });
   })
 );
-workspaceCommand2.command("ensure").description("Start and prove a primary or linked checkout's DevPod, upstreams, and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+workspaceCommand2.command("ensure").description("Start and prove a primary or linked checkout's DevPod, upstreams, and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(
     async (worktreePath, _options, command) => {
       const options = command.opts();
       const { runEnsureCommand: runEnsureCommand2 } = await Promise.resolve().then(() => (init_ensure(), ensure_exports));
       await runEnsureCommand2({
         path: worktreePath,
+        profile: options.profile,
         open: Boolean(options.open),
         json: Boolean(options.json)
       });