@devrouter/cli 0.0.39 → 0.0.41

package/dist/devrouter.js

@@ -317,10 +317,10 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed \`ensure\` rejects every HTTP/TCP proxy upstream outside that exact alias namespace before it mutates DevPod or routes. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: managed scaffolds list the base compose file, then \`\${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}\`; custom repositories may keep another default overlay. Selecting \`.devcontainer/docker-compose.devrouter.yml\` for linked worktrees must pass \`WORKSPACE\` and \`DEVROUTER_WORKSPACE\` across the combined base/overlay config and bind-mount \`\${DEVROUTER_GIT_COMMON_DIR}\` to the same absolute app-container path. The app exposes \`\${WORKSPACE}-app\`; the proxy uses \`upstream: \${WORKSPACE}-app:<port>\`.
-- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running DevPod. Never substitute raw \`devpod up\`, \`stop\`, or \`delete\`: they bypass devrouter's machine-global ownership lock. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects.
+- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects.
 - **Managed process identity**: \`ensure\` executes an exact captured adapter snapshot. Default reuse includes command argv, workspace, and adapter SHA-256. Set \`DEVROUTER_PROCESS_FINGERPRINT_ENV\` only to comma-separated non-secret environment names whose values affect runtime identity; secret-like names are rejected and raw values are never persisted.
 - **Route state**: the versioned Traefik dynamic file is authoritative for both metadata and rendering. JSON is a compatibility mirror; valid headerless generations migrate automatically, while corrupt canonical metadata fails closed.
-- **Cleanup**: \`workspace cleanup --repo . --inactive-for 30d --json\` is a report-only, no-\`--yes\` report for managed linked workspaces. It joins ownership (\`present|missing|locked|conflict\`), DevPod registration, runtime (\`running|stopped|busy|not-found|absent|unknown\`), checkout, route, advisory activity, and integration evidence without mutating DevPod, routes, ownership, Git, Docker, applications, worktrees, or branches. Local DevPod list/status checks always run; \`--check-merged\` alone enables read-only origin and matching GitHub/GitLab checks. Treat \`not-found\` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit \`gc\`/\`down\` can remove exact stale registration only after expected-ID \`NotFound\` proof and ownership revalidation. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
+- **Cleanup**: \`workspace cleanup --repo . --inactive-for 30d --json\` is a report-only, no-\`--yes\` report for managed linked workspaces. It joins ownership (\`present|missing|locked|conflict\`), workspace runtime registration, runtime state (\`running|stopped|busy|not-found|absent|unknown\`), checkout, route, advisory activity, and integration evidence without mutating the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. Local DevPod/Devsy list/status checks always run; \`--check-merged\` alone enables read-only origin and matching GitHub/GitLab checks. Treat \`not-found\` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit \`gc\`/\`down\` can remove exact stale registration only after expected-ID \`NotFound\` proof and ownership revalidation. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
 - **Sizing**: \`--measure-size\` adds per-workspace storage consumption to that report and stays read-only, but it walks each worktree and runs \`docker ps\` / \`docker inspect --size\`, so leave it off when you only need the evidence states. Each row reports reclaimable \`worktree\` and \`containerWritable\` bytes, non-reclaimable \`imageShared\` bytes, and a \`reclaimable\` total of the first two. \`imageShared\` covers image layers shared with other containers and overlaps across rows, so never sum it. Attribution is the workspace's own app container; sibling compose services such as a database are excluded. Any untrustworthy figure reports \`unknown\` with a reason rather than zero, and a workspace with no container reports a measured \`0\`.
 - **Boundary**: workspace commands require Git. Normal config, app, status, and doctor flows remain usable from a \`.devrouter.yml\` folder without \`.git\`.
 
@@ -373,8 +373,8 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter upgrade [version] [--repo .]\`: list upgrade targets or print target Agent Adaptation Prompt
 - \`devrouter setup --yes [--repo .] [--json]\`: first-run machine setup plus structured diagnostics
 - \`devrouter ensure [path] [--profile <name>] [--open] [--json]\`: canonical startup/reconciliation for primary and linked checkouts; a managed profile selects its independent resource dimensions
-- \`devrouter stop [path] [--delete] [--json]\`: stop the exact DevPod and remove exact routes; \`--delete\` explicitly deletes its ownership-proven data without removing the checkout
-- \`devrouter exec [path] -- <command...>\`: literal one-shot command inside the exact running DevPod
+- \`devrouter stop [path] [--delete] [--json]\`: stop the exact workspace runtime and remove exact routes; \`--delete\` explicitly deletes its ownership-proven data without removing the checkout
+- \`devrouter exec [path] -- <command...>\`: literal one-shot command inside the exact running workspace runtime
 - \`devrouter up\` / \`devrouter down\`: start/stop shared Traefik router
 - \`devrouter status\`: router/container/network/TLS health
 - \`devrouter doctor [--repo .]\`: deep diagnostics (global + repo)
@@ -396,7 +396,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter app rm <name> [--keep-config]\`: remove app entry (\`--keep-config\` frees only the live route/hostname, leaves \`.devrouter.yml\` untouched)
 - \`devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]\`: create a worktree and start/prove it unless create-only mode is requested
 - \`devrouter workspace ensure [path] [--profile <name>] [--open] [--json]\`: compatibility alias of \`devrouter ensure\`
-- \`devrouter workspace ls [--json]\`: list ownership, Git, DevPod, route, path, and branch evidence
+- \`devrouter workspace ls [--json]\`: list ownership, Git, workspace runtime, route, path, and branch evidence
 - \`devrouter workspace cleanup [--repo .] [--inactive-for 30d] [--check-merged] [--measure-size] [--json]\`: report-only cleanup evidence and exact guarded suggestions; no \`--yes\` or apply mode
 - \`devrouter workspace stop <workspace|branch>\`: stop DevPod and routes; preserve checkout, owner record, and data
 - \`devrouter workspace down <workspace|branch> [--keep-worktree]\`: delete runtime/routes and optionally remove the clean worktree and record
@@ -2504,7 +2504,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.39" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.41" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -2922,7 +2922,7 @@ function buildOnboardingPrompt(options = {}) {
     "- Shared Traefik router owns host ports 80 (HTTP), 443 (HTTPS), and 5432 (Postgres TCP).",
     "- Per-repo source of truth is REPO_PATH/.devrouter.yml only.",
     "- Global generated/runtime artifacts are managed under ~/.config/devrouter (do not edit these manually).",
-    "- Managed DevPod lifecycle uses devrouter ensure/stop/workspace commands; raw devpod mutations bypass exact checkout ownership checks.",
+    "- Managed workspace runtime lifecycle uses devrouter ensure/stop/workspace commands; raw DevPod/Devsy mutations bypass exact checkout ownership checks. The active runtime is DevPod or Devsy, resolved per checkout: DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy forces one runtime, an exact-path registry owner wins next (mixed fleets stay separated), then the machine preference from 'devrouter setup --workspace-runtime', then installed-CLI auto-detection.",
     "",
     "Inputs:",
     `- REPO_PATH=${repoPath}`,
@@ -3034,13 +3034,13 @@ function buildOnboardingPrompt(options = {}) {
     "- The owner record survives linked-worktree removal and binds the exact path to its DevPod ID. First use reuses an exact-path DevPod or derives a sanitized branch/path identity. Later flags or `DEVROUTER_WORKSPACE` may repeat but cannot rename it. Ambiguous identities fail closed. The primary checkout stays non-namespaced.",
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
-    "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod mutations; they bypass the machine-global ownership lock. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
-    "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates DevPod, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, DevPod registration, runtime (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. DevPod `lastUsed` remains advisory.",
+    "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, workspace runtime registration, runtime state (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod/Devsy list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. Runtime `lastUsed` remains advisory.",
     '- `--measure-size` adds per-workspace storage consumption and stays read-only, but walks each worktree and runs `docker ps` / `docker inspect --size`, so leave it off for a quick report. Each row reports `worktree` and `containerWritable` bytes, which are reclaimable; `imageShared` bytes, which are not, because those image layers are shared with other containers and overlap across rows; and `reclaimable`, the sum of the reclaimable fields. Never add `imageShared` across rows. Any figure that cannot be trusted reports `{"status": "unknown", "reason": ...}` rather than zero, and a workspace with no container reports a measured `0`.',
     "- Workspace commands require Git. Normal config, app, status, and doctor flows work from a `.devrouter.yml` folder without `.git`. Git has no worktree-removal hook; use `workspace ls`, doctor, or dry-run GC after out-of-band removal.",
-    "- devcontainer integration: `devcontainer.json` lists the base compose file then `${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}`. The default overlay contains `services: {}`; `.devcontainer/docker-compose.devrouter.yml` passes `WORKSPACE` and `DEVROUTER_WORKSPACE` into the app and bind-mounts `${DEVROUTER_GIT_COMMON_DIR}` to the same absolute app-container path. Ensure proves exact DevPod ownership, overlay/Git mounts, env, aliases, health, Git, HTTP route reachability, and unique running TCP upstream ownership before success.",
+    "- devcontainer integration: `devcontainer.json` lists the base compose file then `${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}`. The default overlay contains `services: {}`; `.devcontainer/docker-compose.devrouter.yml` passes `WORKSPACE` and `DEVROUTER_WORKSPACE` into the app and bind-mounts `${DEVROUTER_GIT_COMMON_DIR}` to the same absolute app-container path. Ensure proves exact workspace runtime ownership, overlay/Git mounts, env, aliases, health, Git, HTTP route reachability, and unique running TCP upstream ownership before success.",
     "",
     "Secret Manager Integration (config-based):",
     "- Optional top-level `secretManager.command` in `.devrouter.yml` wraps `devrouter app run` and `devrouter app exec` commands with the SM command and re-applies devrouter-injected dep env vars after the SM boundary via `env KEY=VAL` prefix.",
@@ -3204,11 +3204,11 @@ var init_ai_prompt = __esm({
       },
       {
         command: "devrouter stop [path] [--delete] [--json]",
-        purpose: "Stop the exact checkout DevPod and routes; --delete explicitly deletes the ownership-proven DevPod without removing the checkout."
+        purpose: "Stop the exact checkout workspace runtime and routes; --delete explicitly deletes the ownership-proven runtime without removing the checkout."
       },
       {
         command: "devrouter exec [path] -- <command...>",
-        purpose: "Run literal argv inside the exact already-running DevPod and proven checkout mount."
+        purpose: "Run literal argv inside the exact already-running workspace runtime and proven checkout mount."
       },
       {
         command: "devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]",
@@ -3220,7 +3220,7 @@ var init_ai_prompt = __esm({
       },
       {
         command: "devrouter workspace ls [--json]",
-        purpose: "List owner, Git, DevPod, route, path, and branch evidence for managed workspaces."
+        purpose: "List owner, Git, workspace runtime, route, path, and branch evidence for managed workspaces."
       },
       {
         command: "devrouter workspace cleanup [--repo <path>] [--inactive-for 30d] [--check-merged] [--measure-size] [--json]",
@@ -3228,11 +3228,11 @@ var init_ai_prompt = __esm({
       },
       {
         command: "devrouter workspace stop <workspace|branch>",
-        purpose: "Stop the exact DevPod and remove exact routes while preserving the worktree, owner record, and data."
+        purpose: "Stop the exact workspace runtime and remove exact routes while preserving the worktree, owner record, and data."
       },
       {
         command: "devrouter workspace down <workspace|branch> [--keep-worktree]",
-        purpose: "Delete exact runtime/routes and remove only a clean, unlocked worktree and its owner record; --keep-worktree preserves checkout and record."
+        purpose: "Delete exact workspace runtime/routes and remove only a clean, unlocked worktree and its owner record; --keep-worktree preserves checkout and record."
       },
       {
         command: "devrouter workspace gc [--json] [--yes]",
@@ -6047,6 +6047,385 @@ var init_tls = __esm({
   }
 });
 
+// src/core/devpod-registry.ts
+function listDevpodWorkspacesRaw() {
+  const result = (0, import_node_child_process9.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
+    encoding: "utf-8"
+  });
+  if (result.status !== 0) {
+    const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(result.stdout);
+  } catch {
+    throw new Error("devpod list returned invalid JSON.");
+  }
+  if (!Array.isArray(parsed)) {
+    throw new Error("devpod list returned an unexpected response.");
+  }
+  return parsed.map((entry) => {
+    const candidate = entry;
+    if (typeof candidate.id !== "string" || !candidate.source || typeof candidate.source.localFolder !== "string") {
+      throw new Error("devpod list returned a workspace without id/source.localFolder.");
+    }
+    const workspace = {
+      id: candidate.id,
+      source: { localFolder: candidate.source.localFolder }
+    };
+    if ("lastUsed" in candidate) {
+      if (typeof candidate.lastUsed === "string") {
+        workspace.lastUsed = candidate.lastUsed;
+      } else {
+        workspace.lastUsedMalformed = true;
+      }
+    }
+    return workspace;
+  });
+}
+var import_node_child_process9;
+var init_devpod_registry = __esm({
+  "src/core/devpod-registry.ts"() {
+    "use strict";
+    import_node_child_process9 = require("child_process");
+  }
+});
+
+// src/core/devsy-workspaces.ts
+function listDevsyWorkspaces() {
+  const result = (0, import_node_child_process10.spawnSync)(
+    "devsy",
+    ["workspace", "list", "--result-format", "json", "--skip-pro"],
+    {
+      encoding: "utf-8"
+    }
+  );
+  if (result.status !== 0) {
+    const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+    throw new Error(
+      `devsy workspace list failed: ${details || "devsy is not installed or unavailable"}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(result.stdout);
+  } catch {
+    throw new Error("devsy workspace list returned invalid JSON.");
+  }
+  if (!Array.isArray(parsed)) {
+    throw new Error("devsy workspace list returned an unexpected response.");
+  }
+  return parsed.map((entry) => {
+    const candidate = entry;
+    const source = candidate.source;
+    if (typeof candidate.id !== "string" || !source || typeof source.localFolder !== "string") {
+      throw new Error("devsy workspace list returned a workspace without id/source.localFolder.");
+    }
+    const workspace = {
+      id: candidate.id,
+      source: { localFolder: source.localFolder }
+    };
+    if ("lastUsed" in candidate) {
+      if (typeof candidate.lastUsed === "string") {
+        workspace.lastUsed = candidate.lastUsed;
+      } else {
+        workspace.lastUsedMalformed = true;
+      }
+    }
+    return workspace;
+  });
+}
+function parseDevsyRuntimeStatus(output2, expectedId) {
+  let parsed;
+  try {
+    parsed = JSON.parse(output2);
+  } catch {
+    return "unknown";
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.id !== expectedId) {
+    return "unknown";
+  }
+  switch (parsed.state) {
+    case "Running":
+      return "running";
+    case "Stopped":
+      return "stopped";
+    case "Busy":
+      return "busy";
+    case "NotFound":
+      return "not-found";
+    default:
+      return "unknown";
+  }
+}
+function inspectDevsyRuntimeStatus(devsyId) {
+  const result = (0, import_node_child_process10.spawnSync)("devsy", ["workspace", "status", devsyId, "--result-format", "json"], {
+    encoding: "utf-8",
+    timeout: 1e4
+  });
+  if (result.status !== 0 || result.error) return "unknown";
+  return parseDevsyRuntimeStatus(result.stdout, devsyId);
+}
+function inspectDevsyWorkspaceOwnership(workspaces, devsyId, worktreePath) {
+  const idOwners = workspaces.filter((workspace) => workspace.id === devsyId);
+  const pathOwners = workspaces.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, worktreePath)
+  );
+  const exact = idOwners.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, worktreePath)
+  );
+  if (idOwners.length > 1 || pathOwners.length > 1 || idOwners[0] && exact.length === 0 || pathOwners[0] && pathOwners[0].id !== devsyId) {
+    return {
+      status: "conflict",
+      reason: `Devsy workspace '${devsyId}' and worktree '${worktreePath}' do not have one exact owner.`
+    };
+  }
+  return exact[0] ? { status: "owned", workspace: exact[0] } : { status: "absent" };
+}
+function selectDevsyWorkspace(workspaces, repoPath) {
+  const matches = workspaces.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, repoPath)
+  );
+  if (matches.length > 1) {
+    const ids = matches.map((match) => match.id).join(", ");
+    throw new Error(`Multiple Devsy workspaces reference '${repoPath}': ${ids}`);
+  }
+  return matches[0];
+}
+var import_node_child_process10;
+var init_devsy_workspaces = __esm({
+  "src/core/devsy-workspaces.ts"() {
+    "use strict";
+    import_node_child_process10 = require("child_process");
+    init_workspace();
+  }
+});
+
+// src/core/workspace-runtime.ts
+function parseWorkspaceRuntime(value) {
+  const requested = value.trim().toLowerCase();
+  if (!SUPPORTED_RUNTIMES2.includes(requested)) {
+    throw new UnsupportedWorkspaceRuntimeError(
+      `Unsupported workspace runtime '${value}'. Supported: ${SUPPORTED_RUNTIMES2.join(", ")}.`
+    );
+  }
+  return requested;
+}
+function isRuntimeInstalled(runtime) {
+  const probeArgs = runtime === "devsy" ? ["--version"] : ["version"];
+  const probe = (0, import_node_child_process11.spawnSync)(runtime, probeArgs, { encoding: "utf-8" });
+  return probe.status === 0 && !probe.error;
+}
+function readWorkspaceRuntimeConfig() {
+  let raw;
+  try {
+    raw = JSON.parse(import_node_fs16.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const candidate = raw;
+  const config = {};
+  if (typeof candidate.runtime === "string") {
+    try {
+      config.runtime = parseWorkspaceRuntime(candidate.runtime);
+    } catch {
+    }
+  }
+  if (typeof candidate.devsyInactivityTimeout === "string" && INACTIVITY_TIMEOUT_PATTERN.test(candidate.devsyInactivityTimeout)) {
+    config.devsyInactivityTimeout = candidate.devsyInactivityTimeout;
+  }
+  return config;
+}
+function inspectWorkspaceRuntimeConfig() {
+  let rawText;
+  try {
+    rawText = import_node_fs16.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8");
+  } catch {
+    return { exists: false, config: {}, problems: [] };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(rawText);
+  } catch {
+    return { exists: true, config: {}, problems: ["workspace-runtime.json is not valid JSON."] };
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return {
+      exists: true,
+      config: {},
+      problems: ["workspace-runtime.json must contain a JSON object."]
+    };
+  }
+  const candidate = raw;
+  const problems = [];
+  if (candidate.runtime !== void 0) {
+    try {
+      parseWorkspaceRuntime(String(candidate.runtime));
+    } catch {
+      problems.push(`runtime='${String(candidate.runtime)}' is not a supported workspace runtime.`);
+    }
+  }
+  if (candidate.devsyInactivityTimeout !== void 0) {
+    const timeout = String(candidate.devsyInactivityTimeout);
+    if (!isValidInactivityTimeout(timeout)) {
+      problems.push(
+        `devsyInactivityTimeout='${timeout}' is not a Go duration such as 30s, 10m, or 1h30m.`
+      );
+    }
+  }
+  return { exists: true, config: readWorkspaceRuntimeConfig(), problems };
+}
+function isValidInactivityTimeout(value) {
+  return INACTIVITY_TIMEOUT_PATTERN.test(value.trim());
+}
+function writeWorkspaceRuntimeConfig(config) {
+  const next = {};
+  if (config.runtime !== void 0) next.runtime = parseWorkspaceRuntime(config.runtime);
+  if (config.devsyInactivityTimeout !== void 0) {
+    const timeout = config.devsyInactivityTimeout.trim();
+    if (!isValidInactivityTimeout(timeout)) {
+      throw new Error(
+        `Invalid Devsy inactivity timeout '${config.devsyInactivityTimeout}': use a duration such as 30s, 10m, or 1h30m.`
+      );
+    }
+    next.devsyInactivityTimeout = timeout;
+  }
+  import_node_fs16.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  writeFileAtomically(RUNTIME_CONFIG_FILE, `${JSON.stringify(next, null, 2)}
+`);
+}
+function getWorkspaceRegistrySnapshots() {
+  if (cachedSnapshots) return cachedSnapshots;
+  const snapshots = { unavailable: [], errors: {} };
+  if (isRuntimeInstalled("devsy")) {
+    try {
+      snapshots.devsy = listDevsyWorkspaces();
+    } catch (error) {
+      snapshots.unavailable.push("devsy");
+      snapshots.errors.devsy = error instanceof Error ? error.message : String(error);
+    }
+  }
+  if (isRuntimeInstalled("devpod")) {
+    try {
+      snapshots.devpod = listDevpodWorkspacesRaw();
+    } catch (error) {
+      snapshots.unavailable.push("devpod");
+      snapshots.errors.devpod = error instanceof Error ? error.message : String(error);
+    }
+  }
+  cachedSnapshots = snapshots;
+  return snapshots;
+}
+function pathOwnerRuntime(repoPath, snapshots) {
+  if (snapshots.unavailable.length > 0) {
+    return { status: "unavailable", runtimes: snapshots.unavailable };
+  }
+  const devsyOwners = snapshots.devsy?.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, repoPath)
+  );
+  const devpodOwners = snapshots.devpod?.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, repoPath)
+  );
+  if (devsyOwners?.length && devpodOwners?.length) return { status: "conflict" };
+  if (devsyOwners?.length) return { status: "owner", runtime: "devsy" };
+  if (devpodOwners?.length) return { status: "owner", runtime: "devpod" };
+  return { status: "none" };
+}
+function autoDetectedRuntime() {
+  for (const runtime of SUPPORTED_RUNTIMES2) {
+    if (isRuntimeInstalled(runtime)) return runtime;
+  }
+  return void 0;
+}
+function resolveWorkspaceRuntimeDetailed(repoPath, override) {
+  if (override) {
+    return { runtime: parseWorkspaceRuntime(override), source: "override" };
+  }
+  const envRaw = process.env.DEVROUTER_WORKSPACE_RUNTIME?.trim();
+  if (envRaw) {
+    return { runtime: parseWorkspaceRuntime(envRaw), source: "env" };
+  }
+  if (repoPath) {
+    const snapshots = getWorkspaceRegistrySnapshots();
+    const owner = pathOwnerRuntime(repoPath, snapshots);
+    if (owner.status === "conflict") {
+      throw new WorkspaceRuntimeOwnershipError(
+        "Both DevPod and Devsy claim this checkout. Remove the stale registration before running a workspace lifecycle command."
+      );
+    }
+    if (owner.status === "unavailable") {
+      throw new WorkspaceRuntimeOwnershipError(
+        `Cannot prove checkout ownership because the ${owner.runtimes.join(
+          " and "
+        )} workspace registry is unavailable. Restore registry access before running a workspace lifecycle command.`
+      );
+    }
+    if (owner.status === "owner") {
+      return { runtime: owner.runtime, source: "path-owner" };
+    }
+  }
+  if (cachedRuntime) return cachedRuntime;
+  let resolution;
+  const machine = readWorkspaceRuntimeConfig().runtime;
+  if (machine) {
+    resolution = { runtime: machine, source: "machine-config" };
+  } else {
+    const detected = autoDetectedRuntime();
+    resolution = detected ? { runtime: detected, source: "auto-detect" } : { runtime: "devpod", source: "default" };
+  }
+  cachedRuntime = resolution;
+  return resolution;
+}
+function resolveWorkspaceRuntimeOrDefault(repoPath) {
+  return resolveWorkspaceRuntimeDetailed(repoPath).runtime;
+}
+function resolveWorkspaceRuntimeForReport(repoPath) {
+  const snapshots = getWorkspaceRegistrySnapshots();
+  const envRaw = process.env.DEVROUTER_WORKSPACE_RUNTIME?.trim();
+  if (envRaw) {
+    const runtime2 = parseWorkspaceRuntime(envRaw);
+    return snapshots[runtime2] ? runtime2 : void 0;
+  }
+  if (repoPath) {
+    const owner = pathOwnerRuntime(repoPath, snapshots);
+    if (owner.status === "conflict" || owner.status === "unavailable") return void 0;
+    if (owner.status === "owner") return owner.runtime;
+  }
+  const runtime = resolveWorkspaceRuntimeDetailed().runtime;
+  return snapshots[runtime] ? runtime : void 0;
+}
+function resetWorkspaceRuntimeCaches() {
+  cachedRuntime = void 0;
+  cachedSnapshots = void 0;
+}
+var import_node_child_process11, import_node_fs16, import_node_path15, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
+var init_workspace_runtime = __esm({
+  "src/core/workspace-runtime.ts"() {
+    "use strict";
+    import_node_child_process11 = require("child_process");
+    import_node_fs16 = __toESM(require("fs"));
+    import_node_path15 = __toESM(require("path"));
+    init_atomic_file();
+    init_devpod_registry();
+    init_devsy_workspaces();
+    init_router();
+    init_workspace();
+    SUPPORTED_RUNTIMES2 = ["devpod", "devsy"];
+    RUNTIME_CONFIG_FILE = import_node_path15.default.join(DEVROUTER_HOME, "workspace-runtime.json");
+    INACTIVITY_TIMEOUT_PATTERN = /^(?:\d+(?:ms|s|m|h))+$/;
+    UnsupportedWorkspaceRuntimeError = class extends Error {
+    };
+    WorkspaceRuntimeOwnershipError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "WorkspaceRuntimeOwnershipError";
+      }
+    };
+  }
+});
+
 // src/core/tool-diagnostics.ts
 function outputFromResult(result) {
   const stdout = typeof result.stdout === "string" ? result.stdout.trim() : "";
@@ -6055,7 +6434,7 @@ function outputFromResult(result) {
   return output2.length > 0 ? output2 : void 0;
 }
 function runTool(command, args = []) {
-  const result = (0, import_node_child_process9.spawnSync)(command, args, {
+  const result = (0, import_node_child_process12.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.error) {
@@ -6112,12 +6491,12 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path15.default.join(repoPath, "package.json");
-  if (!import_node_fs16.default.existsSync(packagePath)) {
+  const packagePath = import_node_path16.default.join(repoPath, "package.json");
+  if (!import_node_fs17.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs16.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs17.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -6201,63 +6580,110 @@ function buildGlobalToolChecks(repoPath) {
     details: mkcert.ok ? firstLine(mkcert.output) : mkcert.error,
     suggestion: mkcert.ok ? void 0 : brew.ok ? "Install mkcert: brew install mkcert" : "Install mkcert for local HTTPS, then run: devrouter setup --yes"
   });
-  const devpod = runTool("devpod", ["version"]);
+  let ownershipProblem;
+  let runtimeResolution;
+  try {
+    runtimeResolution = resolveWorkspaceRuntimeDetailed(repoPath);
+  } catch (error) {
+    if (!(error instanceof WorkspaceRuntimeOwnershipError)) throw error;
+    ownershipProblem = error.message;
+    runtimeResolution = resolveWorkspaceRuntimeDetailed();
+  }
+  const workspaceRuntime = runtimeResolution.runtime;
+  const machineConfig = readWorkspaceRuntimeConfig();
+  const runtimeLabel = workspaceRuntime === "devsy" ? "Devsy" : "DevPod";
+  const configInspection = inspectWorkspaceRuntimeConfig();
+  const runtimeArgs = workspaceRuntime === "devsy" ? ["--version"] : ["version"];
+  const runtimeTool = runTool(workspaceRuntime, runtimeArgs);
+  if (ownershipProblem) {
+    checks.push({
+      id: "repo.workspace-runtime-ownership",
+      level: "error",
+      summary: "Workspace runtime ownership cannot be resolved safely.",
+      details: ownershipProblem,
+      suggestion: "Restore both registries and remove any duplicate checkout registration."
+    });
+  }
   checks.push({
     id: "global.devpod",
-    level: devpod.ok ? "ok" : "warn",
-    summary: devpod.ok ? "DevPod is installed." : "DevPod is not installed.",
-    details: firstLine(devpod.output) ?? devpod.error,
-    suggestion: devpod.ok ? void 0 : "Install DevPod for devcontainer workspace flows: brew install devpod"
+    level: runtimeTool.ok ? "ok" : "warn",
+    summary: runtimeTool.ok ? ownershipProblem ? `${runtimeLabel} is configured, but checkout ownership is unresolved.` : `${runtimeLabel} is the active workspace runtime (source: ${runtimeResolution.source}).` : `${runtimeLabel} is the active workspace runtime but is not installed.`,
+    details: [
+      firstLine(runtimeTool.output) ?? runtimeTool.error,
+      `source=${runtimeResolution.source}`,
+      ...machineConfig.devsyInactivityTimeout ? [`devsyInactivityTimeout=${machineConfig.devsyInactivityTimeout}`] : []
+    ].filter(Boolean).join(", "),
+    suggestion: runtimeTool.ok ? void 0 : workspaceRuntime === "devsy" ? "Install Devsy for devcontainer workspace flows: brew install devsy-org/homebrew-tap/devsy" : "Install DevPod for devcontainer workspace flows: brew install devpod"
+  });
+  const configProblems = [...configInspection.problems];
+  const machineResolvedDevpod = workspaceRuntime === "devpod" && (runtimeResolution.source === "auto-detect" || runtimeResolution.source === "default");
+  if (machineConfig.devsyInactivityTimeout && machineResolvedDevpod) {
+    configProblems.push(
+      "devsyInactivityTimeout is configured but the active workspace runtime is DevPod."
+    );
+  }
+  const configDetails = configInspection.exists ? [
+    `runtime=${machineConfig.runtime ?? "unset"}`,
+    ...machineConfig.devsyInactivityTimeout ? [`devsyInactivityTimeout=${machineConfig.devsyInactivityTimeout}`] : []
+  ].join(", ") : "Runtime selection falls back to auto-detection.";
+  checks.push({
+    id: "global.workspace-runtime-config",
+    level: configProblems.length > 0 ? "warn" : "ok",
+    summary: !configInspection.exists ? "No machine workspace-runtime preference is configured." : configProblems.length > 0 ? "Machine workspace-runtime preference has problems." : "Machine workspace-runtime preference is valid.",
+    details: configProblems.length > 0 ? [configDetails, ...configProblems].join(" ") : configDetails,
+    suggestion: configProblems.length > 0 ? "Run: devrouter setup --yes --workspace-runtime <devpod|devsy>" : void 0
   });
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process9, import_node_fs16, import_node_path15;
+var import_node_child_process12, import_node_fs17, import_node_path16;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
-    import_node_child_process9 = require("child_process");
-    import_node_fs16 = __toESM(require("fs"));
-    import_node_path15 = __toESM(require("path"));
+    import_node_child_process12 = require("child_process");
+    import_node_fs17 = __toESM(require("fs"));
+    import_node_path16 = __toESM(require("path"));
+    init_workspace_runtime();
   }
 });
 
 // src/core/devpod-workspaces.ts
-function listDevpodWorkspaces() {
-  const result = (0, import_node_child_process10.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
-    encoding: "utf-8"
-  });
-  if (result.status !== 0) {
-    const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(result.stdout);
-  } catch {
-    throw new Error("devpod list returned invalid JSON.");
-  }
-  if (!Array.isArray(parsed)) {
-    throw new Error("devpod list returned an unexpected response.");
-  }
-  return parsed.map((entry) => {
-    const candidate = entry;
-    if (typeof candidate.id !== "string" || !candidate.source || typeof candidate.source.localFolder !== "string") {
-      throw new Error("devpod list returned a workspace without id/source.localFolder.");
-    }
-    const workspace = {
-      id: candidate.id,
-      source: { localFolder: candidate.source.localFolder }
-    };
-    if ("lastUsed" in candidate) {
-      if (typeof candidate.lastUsed === "string") {
-        workspace.lastUsed = candidate.lastUsed;
-      } else {
-        workspace.lastUsedMalformed = true;
-      }
-    }
-    return workspace;
-  });
+function listDevpodWorkspaces(repoPath) {
+  if (resolveWorkspaceRuntimeOrDefault(repoPath) === "devsy") {
+    return listDevsyWorkspaces().map((workspace) => ({
+      id: workspace.id,
+      source: workspace.source,
+      ...workspace.lastUsed ? { lastUsed: workspace.lastUsed } : {},
+      ...workspace.lastUsedMalformed ? { lastUsedMalformed: true } : {}
+    }));
+  }
+  return listDevpodWorkspacesRaw();
+}
+function listDevpodWorkspacesFromSnapshots(repoPath) {
+  const snapshots = getWorkspaceRegistrySnapshots();
+  const runtime = resolveWorkspaceRuntimeForReport(repoPath);
+  if (!runtime) return void 0;
+  if (runtime === "devsy") {
+    return snapshots.devsy?.map((workspace) => ({
+      id: workspace.id,
+      source: workspace.source,
+      ...workspace.lastUsed ? { lastUsed: workspace.lastUsed } : {},
+      ...workspace.lastUsedMalformed ? { lastUsedMalformed: true } : {}
+    }));
+  }
+  return snapshots.devpod;
+}
+function listMergedRuntimeWorkspaces() {
+  const snapshots = getWorkspaceRegistrySnapshots();
+  return [
+    ...snapshots.devpod ?? [],
+    ...snapshots.devsy?.map((workspace) => ({
+      id: workspace.id,
+      source: workspace.source,
+      ...workspace.lastUsed ? { lastUsed: workspace.lastUsed } : {},
+      ...workspace.lastUsedMalformed ? { lastUsedMalformed: true } : {}
+    })) ?? []
+  ];
 }
 function parseDevpodRuntimeStatus(output2, expectedId) {
   let parsed;
@@ -6282,8 +6708,11 @@ function parseDevpodRuntimeStatus(output2, expectedId) {
       return "unknown";
   }
 }
-function inspectDevpodRuntimeStatus(devpodId) {
-  const result = (0, import_node_child_process10.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
+function inspectDevpodRuntimeStatus(devpodId, repoPath) {
+  if (resolveWorkspaceRuntimeOrDefault(repoPath) === "devsy") {
+    return inspectDevsyRuntimeStatus(devpodId);
+  }
+  const result = (0, import_node_child_process13.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
     encoding: "utf-8"
   });
   if (result.status !== 0 || result.error) return "unknown";
@@ -6316,61 +6745,228 @@ function selectDevpodWorkspace(workspaces, repoPath) {
   }
   return matches[0];
 }
-var import_node_child_process10;
+var import_node_child_process13;
 var init_devpod_workspaces = __esm({
   "src/core/devpod-workspaces.ts"() {
     "use strict";
-    import_node_child_process10 = require("child_process");
+    import_node_child_process13 = require("child_process");
+    init_devpod_registry();
+    init_devsy_workspaces();
     init_workspace();
+    init_workspace_runtime();
   }
 });
 
-// src/core/devpod-mutation.ts
+// src/core/devsy-mutation.ts
 function withMutationLock(activity, target, operation) {
-  import_node_fs17.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs18.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLockSync(
+    DEVSY_MUTATION_LOCK_FILE,
+    { activity, target: `'${target}'`, waitMs: DEVSY_MUTATION_WAIT_MS },
+    operation
+  );
+}
+function commandFailure2(result) {
+  return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+}
+function runDevsyAction(action2, devsyId, force = false) {
+  const args = action2 === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
+  const result = (0, import_node_child_process14.spawnSync)("devsy", ["workspace", ...args], { encoding: "utf-8" });
+  if (result.status !== 0) {
+    throw new Error(
+      `devsy workspace ${action2}${force ? " --force" : ""} failed for '${devsyId}': ${commandFailure2(result) || "unknown error"}`
+    );
+  }
+}
+function inspectExactOwnership(devsyId, worktreePath) {
+  const ownership = inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, worktreePath);
+  if (ownership.status === "conflict") throw new Error(ownership.reason);
+  return ownership;
+}
+function mutateOwnedDevsyWorkspace(action2, devsyId, worktreePath) {
+  return withMutationLock(`Devsy ${action2}`, worktreePath, () => {
+    const before = inspectExactOwnership(devsyId, worktreePath);
+    if (before.status === "absent") return { status: "absent" };
+    runDevsyAction(action2, devsyId);
+    let after = inspectExactOwnership(devsyId, worktreePath);
+    if (action2 === "stop" && after.status !== "owned") {
+      throw new Error(
+        `Devsy workspace '${devsyId}' no longer owns '${worktreePath}' after provider stop.`
+      );
+    }
+    if (action2 === "delete" && after.status === "owned") {
+      const runtime = inspectDevsyRuntimeStatus(devsyId);
+      if (runtime !== "not-found") {
+        throw new Error(
+          `Devsy workspace '${devsyId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
+        );
+      }
+      after = inspectExactOwnership(devsyId, worktreePath);
+      if (after.status === "owned") {
+        runDevsyAction("delete", devsyId, true);
+        after = inspectExactOwnership(devsyId, worktreePath);
+      }
+      if (after.status !== "absent") {
+        throw new Error(
+          `Devsy workspace '${devsyId}' still owns '${worktreePath}' after forced provider delete.`
+        );
+      }
+    }
+    return { status: "changed" };
+  });
+}
+function stopOwnedDevsyWorkspace(devsyId, worktreePath) {
+  return mutateOwnedDevsyWorkspace("stop", devsyId, worktreePath);
+}
+function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
+  return mutateOwnedDevsyWorkspace("delete", devsyId, worktreePath);
+}
+function assertDevsyTarget(devsyId, repoPath) {
+  const workspaces = listDevsyWorkspaces();
+  const existing = selectDevsyWorkspace(workspaces, repoPath);
+  const id = devsyId ?? existing?.id;
+  if (id) {
+    const before = inspectDevsyWorkspaceOwnership(workspaces, id, repoPath);
+    if (before.status === "conflict") throw new Error(before.reason);
+  }
+  return id;
+}
+function startDevsyWorkspace(options) {
+  const activity = options.recreate ? "Devsy recreate" : "Devsy start";
+  return withMutationLock(activity, options.repoPath, () => {
+    let devsyId = assertDevsyTarget(options.devsyId, options.repoPath);
+    if (devsyId && options.recreate) {
+      const attached = listDevsyWorkspaces();
+      const ownership = inspectDevsyWorkspaceOwnership(attached, devsyId, options.repoPath);
+      if (ownership.status !== "owned") {
+        throw new Error(`Cannot recreate Devsy workspace '${devsyId}' without one exact owner.`);
+      }
+    }
+    if (!devsyId && options.recreate) {
+      throw new Error("Cannot recreate a Devsy workspace before its exact id is known.");
+    }
+    const args = ["workspace", "up", options.repoPath];
+    if (devsyId) args.push("--id", devsyId);
+    if (options.devcontainerPath) args.push("--devcontainer", options.devcontainerPath);
+    args.push("--ide-launch", "skip");
+    if (options.workspace) {
+      args.push(
+        "--workspace-env",
+        `WORKSPACE=${options.workspace.token}`,
+        "--workspace-env",
+        `DEVROUTER_WORKSPACE=${options.workspace.token}`
+      );
+    }
+    if (options.inactivityTimeout) {
+      args.push("--provider-option", `INACTIVITY_TIMEOUT=${options.inactivityTimeout}`);
+    }
+    if (options.recreate) args.push("--recreate");
+    const env = { ...process.env };
+    if (options.workspace) {
+      env.WORKSPACE = options.workspace.token;
+      env.DEVROUTER_WORKSPACE = options.workspace.token;
+      env.DEVROUTER_GIT_COMMON_DIR = options.workspace.gitCommonDir;
+      env.DEVCONTAINER_COMPOSE_OVERLAY = "docker-compose.devrouter.yml";
+    } else {
+      delete env.WORKSPACE;
+      delete env.DEVROUTER_WORKSPACE;
+      delete env.DEVROUTER_GIT_COMMON_DIR;
+      delete env.DEVCONTAINER_COMPOSE_OVERLAY;
+    }
+    const result = (0, import_node_child_process14.spawnSync)("devsy", args, {
+      stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
+      env
+    });
+    if (result.status !== 0) {
+      throw new Error(`devsy workspace up failed for '${devsyId ?? options.repoPath}'.`);
+    }
+    try {
+      const attached = listDevsyWorkspaces();
+      devsyId ??= selectDevsyWorkspace(attached, options.repoPath)?.id;
+      if (!devsyId) {
+        throw new Error(`Devsy did not attach '${options.repoPath}' after startup.`);
+      }
+      const ownership = inspectDevsyWorkspaceOwnership(attached, devsyId, options.repoPath);
+      if (ownership.status === "conflict") throw new Error(ownership.reason);
+      if (ownership.status !== "owned") {
+        throw new Error(
+          `Devsy did not attach '${options.repoPath}' as '${devsyId}' after startup.`
+        );
+      }
+      return devsyId;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new DevsyStartPostconditionError(message);
+    }
+  });
+}
+var import_node_child_process14, import_node_fs18, import_node_path17, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError;
+var init_devsy_mutation = __esm({
+  "src/core/devsy-mutation.ts"() {
+    "use strict";
+    import_node_child_process14 = require("child_process");
+    import_node_fs18 = __toESM(require("fs"));
+    import_node_path17 = __toESM(require("path"));
+    init_devsy_workspaces();
+    init_file_lock();
+    init_router();
+    DEVSY_MUTATION_LOCK_FILE = import_node_path17.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_WAIT_MS = 6e4;
+    DevsyStartPostconditionError = class extends Error {
+    };
+  }
+});
+
+// src/core/devpod-mutation.ts
+function withMutationLock2(activity, target, operation) {
+  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     { activity, target: `'${target}'`, waitMs: DEVPOD_MUTATION_WAIT_MS },
     operation
   );
 }
-function commandFailure2(result) {
+function commandFailure3(result) {
   return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
 }
 function runDevpodAction(action2, devpodId, force = false) {
   const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
-  const result = (0, import_node_child_process11.spawnSync)("devpod", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process15.spawnSync)("devpod", args, { encoding: "utf-8" });
   if (result.status !== 0) {
     throw new Error(
-      `devpod ${action2}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
+      `devpod ${action2}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure3(result) || "unknown error"}`
     );
   }
 }
-function inspectExactOwnership(devpodId, worktreePath) {
-  const ownership = inspectDevpodWorkspaceOwnership(listDevpodWorkspaces(), devpodId, worktreePath);
+function inspectExactOwnership2(devpodId, worktreePath) {
+  const ownership = inspectDevpodWorkspaceOwnership(
+    listDevpodWorkspaces(worktreePath),
+    devpodId,
+    worktreePath
+  );
   if (ownership.status === "conflict") throw new Error(ownership.reason);
   return ownership;
 }
 function mutateOwnedDevpodWorkspace(action2, devpodId, worktreePath) {
-  return withMutationLock(`DevPod ${action2}`, worktreePath, () => {
-    const before = inspectExactOwnership(devpodId, worktreePath);
+  return withMutationLock2(`DevPod ${action2}`, worktreePath, () => {
+    const before = inspectExactOwnership2(devpodId, worktreePath);
     if (before.status === "absent") return { status: "absent" };
     runDevpodAction(action2, devpodId);
-    let after = inspectExactOwnership(devpodId, worktreePath);
+    let after = inspectExactOwnership2(devpodId, worktreePath);
     if (action2 === "stop" && after.status !== "owned") {
       throw new Error(`DevPod '${devpodId}' no longer owns '${worktreePath}' after provider stop.`);
     }
     if (action2 === "delete" && after.status === "owned") {
-      const runtime = inspectDevpodRuntimeStatus(devpodId);
+      const runtime = inspectDevpodRuntimeStatus(devpodId, worktreePath);
       if (runtime !== "not-found") {
         throw new Error(
           `DevPod '${devpodId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
         );
       }
-      after = inspectExactOwnership(devpodId, worktreePath);
+      after = inspectExactOwnership2(devpodId, worktreePath);
       if (after.status === "owned") {
         runDevpodAction("delete", devpodId, true);
-        after = inspectExactOwnership(devpodId, worktreePath);
+        after = inspectExactOwnership2(devpodId, worktreePath);
       }
       if (after.status !== "absent") {
         throw new Error(
@@ -6382,15 +6978,42 @@ function mutateOwnedDevpodWorkspace(action2, devpodId, worktreePath) {
   });
 }
 function stopOwnedDevpodWorkspace(devpodId, worktreePath) {
-  return mutateOwnedDevpodWorkspace("stop", devpodId, worktreePath);
+  if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
+    const result2 = stopOwnedDevsyWorkspace(devpodId, worktreePath);
+    resetWorkspaceRuntimeCaches();
+    return result2;
+  }
+  const result = mutateOwnedDevpodWorkspace("stop", devpodId, worktreePath);
+  resetWorkspaceRuntimeCaches();
+  return result;
 }
 function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
-  return mutateOwnedDevpodWorkspace("delete", devpodId, worktreePath);
+  if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
+    const result2 = deleteOwnedDevsyWorkspace(devpodId, worktreePath);
+    resetWorkspaceRuntimeCaches();
+    return result2;
+  }
+  const result = mutateOwnedDevpodWorkspace("delete", devpodId, worktreePath);
+  resetWorkspaceRuntimeCaches();
+  return result;
 }
 function startDevpodWorkspace(options) {
+  if (resolveWorkspaceRuntimeOrDefault(options.repoPath) === "devsy") {
+    const result = startDevsyWorkspace({
+      repoPath: options.repoPath,
+      devsyId: options.devpodId,
+      devcontainerPath: options.devcontainerPath,
+      recreate: options.recreate,
+      quiet: options.quiet,
+      workspace: options.workspace,
+      inactivityTimeout: readWorkspaceRuntimeConfig().devsyInactivityTimeout
+    });
+    resetWorkspaceRuntimeCaches();
+    return result;
+  }
   const activity = options.recreate ? "DevPod recreate" : "DevPod start";
-  return withMutationLock(activity, options.repoPath, () => {
-    const workspaces = listDevpodWorkspaces();
+  return withMutationLock2(activity, options.repoPath, () => {
+    const workspaces = listDevpodWorkspaces(options.repoPath);
     let devpodId = options.devpodId ?? selectDevpodWorkspace(workspaces, options.repoPath)?.id;
     if (devpodId) {
       const before = inspectDevpodWorkspaceOwnership(workspaces, devpodId, options.repoPath);
@@ -6428,7 +7051,7 @@ function startDevpodWorkspace(options) {
       delete env.DEVROUTER_GIT_COMMON_DIR;
       delete env.DEVCONTAINER_COMPOSE_OVERLAY;
     }
-    const result = (0, import_node_child_process11.spawnSync)("devpod", args, {
+    const result = (0, import_node_child_process15.spawnSync)("devpod", args, {
       stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
       env
     });
@@ -6436,7 +7059,7 @@ function startDevpodWorkspace(options) {
       throw new Error(`devpod up failed for '${devpodId ?? options.repoPath}'.`);
     }
     try {
-      const attached = listDevpodWorkspaces();
+      const attached = listDevpodWorkspaces(options.repoPath);
       devpodId ??= selectDevpodWorkspace(attached, options.repoPath)?.id;
       if (!devpodId) {
         throw new Error(`DevPod did not attach '${options.repoPath}' after startup.`);
@@ -6448,6 +7071,7 @@ function startDevpodWorkspace(options) {
           `DevPod did not attach '${options.repoPath}' as '${devpodId}' after startup.`
         );
       }
+      resetWorkspaceRuntimeCaches();
       return devpodId;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
@@ -6455,17 +7079,19 @@ function startDevpodWorkspace(options) {
     }
   });
 }
-var import_node_child_process11, import_node_fs17, import_node_path16, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
+var import_node_child_process15, import_node_fs19, import_node_path18, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
-    import_node_child_process11 = require("child_process");
-    import_node_fs17 = __toESM(require("fs"));
-    import_node_path16 = __toESM(require("path"));
+    import_node_child_process15 = require("child_process");
+    import_node_fs19 = __toESM(require("fs"));
+    import_node_path18 = __toESM(require("path"));
     init_devpod_workspaces();
+    init_devsy_mutation();
     init_file_lock();
     init_router();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path16.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    init_workspace_runtime();
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path18.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
     DEVPOD_MUTATION_WAIT_MS = 6e4;
     DevpodStartPostconditionError = class extends Error {
     };
@@ -6479,7 +7105,7 @@ function commandError(command, repoPath, stderr) {
   );
 }
 function resolveGitCommonDir(repoPath) {
-  const result = (0, import_node_child_process12.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
+  const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -6487,10 +7113,10 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path17.default.isAbsolute(output2) ? output2 : import_node_path17.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path19.default.isAbsolute(output2) ? output2 : import_node_path19.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
-  const result = (0, import_node_child_process12.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
+  const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -6501,7 +7127,7 @@ function resolveGitTopLevel(repoPath) {
   return comparableWorkspacePath(output2);
 }
 function listGitWorktrees(repoPath) {
-  const result = (0, import_node_child_process12.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
+  const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -6538,7 +7164,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path17.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path19.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -6566,7 +7192,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path17.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path19.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -6586,7 +7212,7 @@ function validateRecord(value, expectedWorkspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs18.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs20.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -6602,7 +7228,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs18.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs20.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -6610,14 +7236,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path17.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path19.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path17.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path19.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record2) => record2.workspace === workspace);
@@ -6653,9 +7279,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
   return record;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path17.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path19.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs18.default.rmSync(filePath);
+    import_node_fs20.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -6666,7 +7292,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path17.default.join(
+  const filePath = import_node_path19.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -6678,14 +7304,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs18.default.rmSync(filePath);
+  import_node_fs20.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs18.default.mkdirSync(directory, { recursive: true });
+  import_node_fs20.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path17.default.join(directory, ".lock"),
+    import_node_path19.default.join(directory, ".lock"),
     { activity: "workspace ownership transaction", target: `'${repoPath}'`, waitMs: 5e3 },
     () => operation({
       list: () => listWorkspaceOwnershipInDirectory(directory),
@@ -6716,7 +7342,7 @@ function inspectWorkspaceOwnership(record, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs18.default.existsSync(record.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs20.default.existsSync(record.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -6740,20 +7366,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process12, import_node_fs18, import_node_path17, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process16, import_node_fs20, import_node_path19, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
-    import_node_child_process12 = require("child_process");
-    import_node_fs18 = __toESM(require("fs"));
-    import_node_path17 = __toESM(require("path"));
+    import_node_child_process16 = require("child_process");
+    import_node_fs20 = __toESM(require("fs"));
+    import_node_path19 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path17.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path19.default.join("devrouter", "workspaces");
   }
 });
 
@@ -6767,10 +7393,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path18.default.join(comparableRepo, "trees") + import_node_path18.default.sep;
+  const localRoot = import_node_path20.default.join(comparableRepo, "trees") + import_node_path20.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path18.default.basename(comparableRepo)}-`;
-  return import_node_path18.default.dirname(comparableWorktree) === import_node_path18.default.dirname(comparableRepo) && import_node_path18.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path20.default.basename(comparableRepo)}-`;
+  return import_node_path20.default.dirname(comparableWorktree) === import_node_path20.default.dirname(comparableRepo) && import_node_path20.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -6886,7 +7512,7 @@ function revalidateCandidate(candidate, repoPath, transaction) {
   const fresh = ownedCandidate(
     record,
     listGitWorktrees(repoPath),
-    listDevpodWorkspaces(),
+    listDevpodWorkspaces(record.worktreePath),
     listHostRouteState()
   );
   if (fresh.eligible) return { status: "ready", candidate: fresh, record };
@@ -6987,11 +7613,20 @@ function inspectWorkspaceGc(repo) {
   const repoPath = comparableWorkspacePath(resolveRepoPath(repo));
   const worktrees = listGitWorktrees(repoPath);
   const records = listWorkspaceOwnership(repoPath);
-  const devpods = listDevpodWorkspaces();
   const routes = listHostRouteState();
   const candidates = [
-    ...records.map((record) => ownedCandidate(record, worktrees, devpods, routes)),
-    ...legacyCandidates(repoPath, records, worktrees, devpods, routes)
+    // Per-record resolution keeps mixed DevPod+Devsy fleets on the registry
+    // that owns each record (snapshot reads: the apply path revalidates
+    // live); legacy detection scans both registries.
+    ...records.map(
+      (record) => ownedCandidate(
+        record,
+        worktrees,
+        listDevpodWorkspacesFromSnapshots(record.worktreePath),
+        routes
+      )
+    ),
+    ...legacyCandidates(repoPath, records, worktrees, listMergedRuntimeWorkspaces(), routes)
   ];
   return {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -7013,11 +7648,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path18;
+var import_node_path20;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path18 = __toESM(require("path"));
+    import_node_path20 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -7087,11 +7722,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs19.default.existsSync(absolutePath)) {
+      if (!import_node_fs21.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs19.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs21.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml5.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -7370,7 +8005,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.39" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.41" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -7400,9 +8035,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path19.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path21.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs19.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs21.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -7445,8 +8080,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path19.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs19.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path21.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs21.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -7590,12 +8225,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs19, import_node_path19, import_yaml5, POSTGRES_DEFAULTS;
+var import_node_fs21, import_node_path21, import_yaml5, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs19 = __toESM(require("fs"));
-    import_node_path19 = __toESM(require("path"));
+    import_node_fs21 = __toESM(require("fs"));
+    import_node_path21 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -7702,6 +8337,32 @@ async function runSetup(options = {}) {
       })
     );
   }
+  if (options.workspaceRuntime !== void 0 || options.devsyInactivityTimeout !== void 0) {
+    try {
+      const existing = readWorkspaceRuntimeConfig();
+      const next = {
+        runtime: options.workspaceRuntime ? parseWorkspaceRuntime(options.workspaceRuntime) : existing.runtime,
+        devsyInactivityTimeout: options.devsyInactivityTimeout ?? existing.devsyInactivityTimeout
+      };
+      writeWorkspaceRuntimeConfig(next);
+      actions.push(
+        action("performed", {
+          id: "global.workspace-runtime-config",
+          summary: `Persisted workspace runtime preferences (runtime=${next.runtime ?? "unset"}, devsyInactivityTimeout=${next.devsyInactivityTimeout ?? "unset"}).`
+        })
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      actions.push(
+        action("failed", {
+          id: "global.workspace-runtime-config",
+          summary: "Failed to persist workspace runtime preferences.",
+          details: message,
+          suggestion: "Use: devrouter setup --yes --workspace-runtime <devpod|devsy> [--devsy-inactivity-timeout <duration>]"
+        })
+      );
+    }
+  }
   try {
     const existed = await networkExists(DEVNET_NAME);
     await ensureNetwork(DEVNET_NAME);
@@ -7797,6 +8458,7 @@ var init_setup = __esm({
     init_router();
     init_tls();
     init_tool_diagnostics();
+    init_workspace_runtime();
   }
 });
 
@@ -7806,7 +8468,12 @@ __export(setup_exports, {
   runSetupCommand: () => runSetupCommand
 });
 async function runSetupCommand(options) {
-  const report = await runSetup({ repo: options.repo, yes: Boolean(options.yes) });
+  const report = await runSetup({
+    repo: options.repo,
+    yes: Boolean(options.yes),
+    workspaceRuntime: options.workspaceRuntime,
+    devsyInactivityTimeout: options.devsyInactivityTimeout
+  });
   if (options.json) {
     printJSON(report);
   } else {
@@ -7853,12 +8520,12 @@ function parseSsPortListeners(stdout, port) {
   return listeners;
 }
 function findPortListeners(port) {
-  const result = (0, import_node_child_process13.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+  const result = (0, import_node_child_process17.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process13.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process17.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsPortListeners(ssResult.stdout, port);
       }
@@ -7887,11 +8554,11 @@ function findPortListeners(port) {
     };
   });
 }
-var import_node_child_process13;
+var import_node_child_process17;
 var init_ports = __esm({
   "src/util/ports.ts"() {
     "use strict";
-    import_node_child_process13 = require("child_process");
+    import_node_child_process17 = require("child_process");
   }
 });
 
@@ -7968,18 +8635,18 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process14.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process18.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
   const details = ok ? `HTTP ${status}` : [status === void 0 ? void 0 : `HTTP ${status}`, result.stderr?.trim()].filter(Boolean).join(": ") || `curl exited with status ${result.status ?? "unknown"}`;
   return { ok, status, details };
 }
-var import_node_child_process14;
+var import_node_child_process18;
 var init_http_route_probe = __esm({
   "src/core/http-route-probe.ts"() {
     "use strict";
-    import_node_child_process14 = require("child_process");
+    import_node_child_process18 = require("child_process");
     init_router();
     init_tls();
   }
@@ -8058,11 +8725,11 @@ var init_route_publication = __esm({
 // src/core/workspace-ensure.ts
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path20.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path22.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path20.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path22.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -8217,6 +8884,18 @@ function restorePreviousManagedConfig(options) {
   }
   writeManagedDevcontainerConfig(restoredPlan);
 }
+function restoreFirstTransitionManagedConfig(options) {
+  const restoredPlan = inspectManagedDevcontainerConfig({
+    repoPath: options.repoPath,
+    config: options.config,
+    profile: {
+      apps: [],
+      devcontainerServices: [...options.services]
+    },
+    linked: options.linked
+  });
+  writeManagedDevcontainerConfig(restoredPlan);
+}
 function isWarmWorkspaceActive(repoPath) {
   try {
     return workspaceAppContainers(inspectWorkspaceContainers(), repoPath).some(
@@ -8327,7 +9006,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process15.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process19.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8" }
@@ -8337,7 +9016,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process15.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process19.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8" }
@@ -8348,7 +9027,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process15.spawnSync)(
+      const gitCheck = (0, import_node_child_process19.spawnSync)(
         "docker",
         [
           "exec",
@@ -8402,7 +9081,7 @@ async function waitForHttpRoutes(repoPath, apps, timeoutMs) {
   );
 }
 function resolveLinkedTarget(repoPath) {
-  const devpods = listDevpodWorkspaces();
+  const devpods = listDevpodWorkspaces(repoPath);
   const existingDevpod = selectDevpodWorkspace(devpods, repoPath);
   const persisted = readPersistedWorkspace(repoPath);
   const candidate = existingDevpod?.id ?? persisted ?? resolveWorktreeWorkspace(repoPath);
@@ -8426,7 +9105,7 @@ function resolveLinkedTarget(repoPath) {
   };
 }
 function resolvePrimaryTarget(repoPath) {
-  const existingDevpod = selectDevpodWorkspace(listDevpodWorkspaces(), repoPath);
+  const existingDevpod = selectDevpodWorkspace(listDevpodWorkspaces(repoPath), repoPath);
   return {
     kind: "primary",
     devpodId: existingDevpod?.id,
@@ -8435,14 +9114,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs20.default.statSync(import_node_path20.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs22.default.statSync(import_node_path22.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process15.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process19.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -8485,8 +9164,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path20.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs20.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path22.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs22.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -8553,7 +9232,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path20.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path22.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -8824,8 +9503,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
                 linked,
                 previousState: previousManagedState
               });
-            } else {
-              removeManagedDevcontainerConfig(managedPlan);
+            } else if (managedRuntimeConfig) {
+              restoreFirstTransitionManagedConfig({
+                repoPath,
+                config: managedRuntimeConfig,
+                linked,
+                services: previousServices
+              });
             }
           }
         } catch (rollbackError) {
@@ -8952,7 +9636,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
                 linked,
                 previousState: previousManagedState
               });
-            } else {
+            } else if (!environmentStarted) {
               removeManagedDevcontainerConfig(managedPlan);
             }
           } catch (rollbackError) {
@@ -8992,13 +9676,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
   });
 }
-var import_node_child_process15, import_node_fs20, import_node_path20, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
+var import_node_child_process19, import_node_fs22, import_node_path22, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process15 = require("child_process");
-    import_node_fs20 = __toESM(require("fs"));
-    import_node_path20 = __toESM(require("path"));
+    import_node_child_process19 = require("child_process");
+    import_node_fs22 = __toESM(require("fs"));
+    import_node_path22 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
@@ -9078,20 +9762,20 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path21.default.join(mainRepo, "trees", ws);
+  return import_node_path23.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process16.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path21.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path21.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path23.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path23.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path21.default.join(import_node_path21.default.dirname(mainRepo), `${import_node_path21.default.basename(mainRepo)}-${ws}`);
+  return import_node_path23.default.join(import_node_path23.default.dirname(mainRepo), `${import_node_path23.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -9203,13 +9887,13 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs21.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs23.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
     );
   }
-  const status = (0, import_node_child_process16.spawnSync)(
+  const status = (0, import_node_child_process20.spawnSync)(
     "git",
     ["-C", target.worktreePath, "status", "--porcelain", "--untracked-files=normal"],
     { encoding: "utf-8" }
@@ -9230,8 +9914,8 @@ async function workspaceUp(branch, opts = {}) {
   if (!ws) {
     throw new Error(`Branch '${branch}' does not yield a valid workspace token.`);
   }
-  const worktreePath = opts.path ? import_node_path21.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
-  if (import_node_fs21.default.existsSync(worktreePath)) {
+  const worktreePath = opts.path ? import_node_path23.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
+  if (import_node_fs23.default.existsSync(worktreePath)) {
     const registered = listGitWorktrees(mainRepo).find(
       (worktree) => sameWorkspacePath(worktree.path, worktreePath)
     );
@@ -9249,11 +9933,11 @@ async function workspaceUp(branch, opts = {}) {
     if (!opts.path) {
       assertDefaultWorktreeRootIgnored(mainRepo);
     }
-    const add = (0, import_node_child_process16.spawnSync)("git", ["-C", mainRepo, "worktree", "add", worktreePath, branch], {
+    const add = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "add", worktreePath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process16.spawnSync)(
+      const addNew = (0, import_node_child_process20.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, worktreePath],
         {
@@ -9287,12 +9971,9 @@ function workspaceLs(repoPath) {
   const mainRepo = resolveRepoPath(repoPath);
   const worktrees = identifyGitWorktrees(mainRepo);
   const records = listWorkspaceOwnership(mainRepo);
-  let devpods;
-  try {
-    devpods = listDevpodWorkspaces();
-  } catch {
-    devpods = void 0;
-  }
+  const devpodsForPath = (worktreePath) => {
+    return listDevpodWorkspacesFromSnapshots(worktreePath);
+  };
   const paths = Array.from(
     /* @__PURE__ */ new Set([
       ...worktrees.map((worktree) => worktree.path),
@@ -9305,6 +9986,7 @@ function workspaceLs(repoPath) {
   return paths.map((worktreePath) => {
     const worktree = worktreesByPath.get(worktreePath);
     const record = recordsByPath.get(worktreePath);
+    const devpods = devpodsForPath(worktreePath);
     const status = record ? inspectWorkspaceOwnership(record, worktrees, devpods) : void 0;
     const matchingDevpods = devpods?.filter(
       (devpod) => sameWorkspacePath(devpod.source.localFolder, worktreePath)
@@ -9323,7 +10005,7 @@ function workspaceLs(repoPath) {
   });
 }
 function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = false) {
-  const devpods = listDevpodWorkspaces();
+  const devpods = listDevpodWorkspaces(resolved.worktreePath);
   assertDevpodTargetSafe(resolved, worktrees, devpods);
   const devpodId = resolved.record?.devpodId ?? resolved.workspace;
   const mutation = action2 === "stop" ? stopOwnedDevpodWorkspace(devpodId, resolved.worktreePath) : deleteOwnedDevpodWorkspace(devpodId, resolved.worktreePath);
@@ -9358,8 +10040,8 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
       opts.quiet
     );
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs21.default.existsSync(resolved.worktreePath)) {
-        const rm = (0, import_node_child_process16.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs23.default.existsSync(resolved.worktreePath)) {
+        const rm = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -9377,7 +10059,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs21.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs23.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
 }
 async function mutateWorkspaceOwnedPath(action2, worktreePath, opts = {}) {
   const mainRepo = resolveRepoPath(opts.repoPath);
@@ -9412,13 +10094,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process16, import_node_fs21, import_node_path21;
+var import_node_child_process20, import_node_fs23, import_node_path23;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process16 = require("child_process");
-    import_node_fs21 = __toESM(require("fs"));
-    import_node_path21 = __toESM(require("path"));
+    import_node_child_process20 = require("child_process");
+    import_node_fs23 = __toESM(require("fs"));
+    import_node_path23 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_repo_config();
@@ -9468,7 +10150,7 @@ async function environmentStop(repoPath, options = {}) {
     }
   }
   return withWorkspaceLifecycleLock(repoPath, async () => {
-    const devpod = selectDevpodWorkspace(listDevpodWorkspaces(), repoPath);
+    const devpod = selectDevpodWorkspace(listDevpodWorkspaces(repoPath), repoPath);
     const mutation = devpod ? options.delete ? deleteOwnedDevpodWorkspace(devpod.id, repoPath) : stopOwnedDevpodWorkspace(devpod.id, repoPath) : { status: "absent" };
     const removedRoutes = removeHostRoutesWhere(
       (route) => sameWorkspacePath(route.repoPath, repoPath)
@@ -9529,6 +10211,39 @@ var init_stop = __esm({
   }
 });
 
+// src/core/devsy-exec.ts
+function ensureGuidance(repoPath) {
+  return `Run 'devrouter ensure ${repoPath}' first.`;
+}
+async function devsyExec(repoPath, command) {
+  if (command.length === 0) {
+    throw new Error("No command provided. Use `devrouter exec [path] -- <command...>`.");
+  }
+  return withWorkspaceLifecycleLock(repoPath, async () => {
+    const workspace = selectDevsyWorkspace(listDevsyWorkspaces(), repoPath);
+    if (!workspace) {
+      throw new Error(
+        `No exact Devsy workspace exists for '${repoPath}'. ${ensureGuidance(repoPath)}`
+      );
+    }
+    const args = ["workspace", "exec", "--result-format", "plain", workspace.id, "--", ...command];
+    return new Promise((resolve, reject) => {
+      const child = (0, import_node_child_process21.spawn)("devsy", args, { stdio: "inherit" });
+      child.once("error", (error) => reject(new Error(`devsy exec failed: ${error.message}`)));
+      child.once("close", (code) => resolve(code ?? 1));
+    });
+  });
+}
+var import_node_child_process21;
+var init_devsy_exec = __esm({
+  "src/core/devsy-exec.ts"() {
+    "use strict";
+    import_node_child_process21 = require("child_process");
+    init_devsy_workspaces();
+    init_workspace();
+  }
+});
+
 // src/core/devpod-exec.ts
 function stripDevpodCompletionDiagnostic(value) {
   const index = value.indexOf(DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC);
@@ -9541,27 +10256,27 @@ function stripDevpodCompletionDiagnostic(value) {
 function quotePosixArg(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
-function ensureGuidance(repoPath) {
+function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process17.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process22.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(
-      `Could not prove DevPod '${devpodId}' is running${details ? `: ${details}` : "."} ${ensureGuidance(repoPath)}`
+      `Could not prove DevPod '${devpodId}' is running${details ? `: ${details}` : "."} ${ensureGuidance2(repoPath)}`
     );
   }
   let status;
   try {
     status = JSON.parse(result.stdout);
   } catch {
-    throw new Error(`DevPod '${devpodId}' returned invalid status. ${ensureGuidance(repoPath)}`);
+    throw new Error(`DevPod '${devpodId}' returned invalid status. ${ensureGuidance2(repoPath)}`);
   }
   if (status.id !== devpodId || status.state !== "Running") {
-    throw new Error(`DevPod '${devpodId}' is not running. ${ensureGuidance(repoPath)}`);
+    throw new Error(`DevPod '${devpodId}' is not running. ${ensureGuidance2(repoPath)}`);
   }
 }
 function resolveWorkspaceDirectory(repoPath) {
@@ -9569,17 +10284,20 @@ function resolveWorkspaceDirectory(repoPath) {
     return resolveRunningWorkspaceContainer(repoPath).workspacePath;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`${message} ${ensureGuidance(repoPath)}`);
+    throw new Error(`${message} ${ensureGuidance2(repoPath)}`);
   }
 }
 async function devpodExec(repoPath, command) {
+  if (resolveWorkspaceRuntimeOrDefault(repoPath) === "devsy") {
+    return devsyExec(repoPath, command);
+  }
   if (command.length === 0) {
     throw new Error("No command provided. Use `devrouter exec [path] -- <command...>`.");
   }
   return withWorkspaceLifecycleLock(repoPath, async () => {
-    const devpod = selectDevpodWorkspace(listDevpodWorkspaces(), repoPath);
+    const devpod = selectDevpodWorkspace(listDevpodWorkspaces(repoPath), repoPath);
     if (!devpod) {
-      throw new Error(`No exact DevPod exists for '${repoPath}'. ${ensureGuidance(repoPath)}`);
+      throw new Error(`No exact DevPod exists for '${repoPath}'. ${ensureGuidance2(repoPath)}`);
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
@@ -9601,7 +10319,7 @@ async function devpodExec(repoPath, command) {
       wrappedCommand
     ];
     return new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process17.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+      const child = (0, import_node_child_process22.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       let pending = Buffer.alloc(0);
       let statusBytes = Buffer.alloc(0);
       let readingStatus = false;
@@ -9660,15 +10378,17 @@ async function devpodExec(repoPath, command) {
     });
   });
 }
-var import_node_child_process17, import_node_crypto7, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
+var import_node_child_process22, import_node_crypto7, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
 var init_devpod_exec = __esm({
   "src/core/devpod-exec.ts"() {
     "use strict";
-    import_node_child_process17 = require("child_process");
+    import_node_child_process22 = require("child_process");
     import_node_crypto7 = require("crypto");
     init_devpod_environment();
     init_devpod_workspaces();
+    init_devsy_exec();
     init_workspace();
+    init_workspace_runtime();
     DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC = Buffer.from(
       "Error tunneling to container: wait: remote command exited without exit status or exit signal\n"
     );
@@ -9849,7 +10569,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process18.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process23.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -9857,11 +10577,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process18;
+var import_node_child_process23;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process18 = require("child_process");
+    import_node_child_process23 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -9884,7 +10604,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process19.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process24.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -9898,17 +10618,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process19.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process24.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process19;
+var import_node_child_process24;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process19 = require("child_process");
+    import_node_child_process24 = require("child_process");
     init_docker();
     init_router();
   }
@@ -9948,17 +10668,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs22.default.existsSync(filePath)) {
+  if (!import_node_fs24.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs22.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs24.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path22.default.relative(repoPath, filePath) || ".";
+  return import_node_path24.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -9999,7 +10719,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs22.default.existsSync(import_node_path22.default.join(repoPath, fileName))) {
+    if (import_node_fs24.default.existsSync(import_node_path24.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -10014,9 +10734,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path22.default.join(repoPath, ".nvmrc");
-  if (import_node_fs22.default.existsSync(nvmrc)) {
-    const version = import_node_fs22.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path24.default.join(repoPath, ".nvmrc");
+  if (import_node_fs24.default.existsSync(nvmrc)) {
+    const version = import_node_fs24.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -10077,7 +10797,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path22.default.isAbsolute(fileName) && !import_node_path22.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path24.default.isAbsolute(fileName) && !import_node_path24.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -10095,7 +10815,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs22.default.existsSync(import_node_path22.default.join(repoPath, fileName))
+    (fileName) => import_node_fs24.default.existsSync(import_node_path24.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -10133,7 +10853,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs22.default.readFileSync(import_node_path22.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs24.default.readFileSync(import_node_path24.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -10168,8 +10888,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs22.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs22.default.readFileSync(import_node_path22.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs24.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs24.default.readFileSync(import_node_path24.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -10183,18 +10903,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path22.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs22.default.existsSync(dir)) {
+  const dir = import_node_path24.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs24.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs22.default.readdirSync(dir).filter((fileName) => import_node_fs22.default.statSync(import_node_path22.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs24.default.readdirSync(dir).filter((fileName) => import_node_fs24.default.statSync(import_node_path24.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs22.default.existsSync(configPath)) {
+  if (!import_node_fs24.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -10238,15 +10958,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs22.default.existsSync(import_node_path22.default.join(repoPath, fileName))) {
+    if (import_node_fs24.default.existsSync(import_node_path24.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path22.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs22.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs22.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path22.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs22.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path24.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs24.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs24.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path24.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs24.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -10289,7 +11009,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path22.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path24.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -10308,12 +11028,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs22, import_node_path22, import_yaml6;
+var import_node_fs24, import_node_path24, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs22 = __toESM(require("fs"));
-    import_node_path22 = __toESM(require("path"));
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path24 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -10418,7 +11138,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs23.default.existsSync(import_node_path23.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -10637,12 +11357,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs23, import_node_path23;
+var import_node_fs25, import_node_path25;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs23 = __toESM(require("fs"));
-    import_node_path23 = __toESM(require("path"));
+    import_node_fs25 = __toESM(require("fs"));
+    import_node_path25 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -10938,7 +11658,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path24.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path26.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -10983,8 +11703,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path24.default.join(repoPath, file.relativePath);
-  if (!import_node_fs24.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path26.default.join(repoPath, file.relativePath);
+  if (!import_node_fs26.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -10992,7 +11712,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs24.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs26.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -11049,11 +11769,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path24.default.join(repoPath, file.relativePath);
-  import_node_fs24.default.mkdirSync(import_node_path24.default.dirname(absolutePath), { recursive: true });
-  import_node_fs24.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path26.default.join(repoPath, file.relativePath);
+  import_node_fs26.default.mkdirSync(import_node_path26.default.dirname(absolutePath), { recursive: true });
+  import_node_fs26.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs24.default.chmodSync(absolutePath, 493);
+    import_node_fs26.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -11091,12 +11811,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs24, import_node_path24, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs26, import_node_path26, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs24 = __toESM(require("fs"));
-    import_node_path24 = __toESM(require("path"));
+    import_node_fs26 = __toESM(require("fs"));
+    import_node_path26 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -11487,7 +12207,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto8.createHash)("sha1").update(import_node_path25.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto8.createHash)("sha1").update(import_node_path27.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -11566,11 +12286,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path25.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs25.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path25.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path27.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs27.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path27.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs25.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs27.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -11584,7 +12304,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process20.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -11612,7 +12332,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process20.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -11638,7 +12358,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process20.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -11664,7 +12384,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process20.spawnSync)("docker", args, {
+  (0, import_node_child_process25.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -11676,7 +12396,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process20.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -11690,14 +12410,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process20, import_node_crypto8, import_node_fs25, import_node_path25, import_yaml7;
+var import_node_child_process25, import_node_crypto8, import_node_fs27, import_node_path27, import_yaml7;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process20 = require("child_process");
+    import_node_child_process25 = require("child_process");
     import_node_crypto8 = require("crypto");
-    import_node_fs25 = __toESM(require("fs"));
-    import_node_path25 = __toESM(require("path"));
+    import_node_fs27 = __toESM(require("fs"));
+    import_node_path27 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -11787,7 +12507,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process21.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process26.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -11898,12 +12618,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process21.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process26.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process21.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process26.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -11962,7 +12682,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process21.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process26.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -12330,7 +13050,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process21.spawn)(wrapped, {
+        child = (0, import_node_child_process26.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -12344,7 +13064,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process21.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process26.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -12352,7 +13072,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process21.spawn)(options.command[0], {
+      child = (0, import_node_child_process26.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -12360,7 +13080,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process21.spawn)(command, args, {
+      child = (0, import_node_child_process26.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -12381,11 +13101,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process21, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process26, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process21 = require("child_process");
+    import_node_child_process26 = require("child_process");
     import_node_net = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -12519,13 +13239,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs26.default.lstatSync(worktreePath);
+    rootStat = import_node_fs28.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs26.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs28.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -12551,10 +13271,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path26.default.join(dirPath, entry.name);
+      const entryPath = import_node_path28.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs26.default.lstatSync(entryPath);
+        entryStat = import_node_fs28.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -12564,7 +13284,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs26.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs28.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -12628,12 +13348,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs26, import_node_path26, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs28, import_node_path28, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs26 = __toESM(require("fs"));
-    import_node_path26 = __toESM(require("path"));
+    import_node_fs28 = __toESM(require("fs"));
+    import_node_path28 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -12734,7 +13454,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs27.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs29.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -13243,12 +13963,6 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
   const cutoff = new Date(now.getTime() - duration.seconds * 1e3).toISOString();
   const worktrees = (dependencies.listWorktrees ?? listGitWorktrees)(repoPath);
   const records = (dependencies.listOwnership ?? listWorkspaceOwnership)(repoPath);
-  let devpods;
-  try {
-    devpods = (dependencies.listDevpods ?? listDevpodWorkspaces)();
-  } catch {
-    devpods = void 0;
-  }
   let routes;
   try {
     routes = (dependencies.readRoutes ?? readHostRouteStateReadOnly)();
@@ -13265,7 +13979,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers = new Map(worktreePaths.map((path26) => [path26, unknownContainers(reason)]));
+      containers = new Map(worktreePaths.map((path28) => [path28, unknownContainers(reason)]));
     }
   }
   const rows = records.map((record) => {
@@ -13280,6 +13994,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
         prunable: true
       }
     );
+    const devpods = dependencies.listDevpods ? dependencies.listDevpods() : listDevpodWorkspacesFromSnapshots(record.worktreePath);
     const row = buildRow(
       repoPath,
       record,
@@ -13295,7 +14010,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
         return { ownerStatus: status.ownerStatus, devpodStatus: status.devpodStatus };
       }),
       dependencies.inspectIntegration,
-      dependencies.inspectDevpodRuntime ?? inspectDevpodRuntimeStatus
+      dependencies.inspectDevpodRuntime ?? ((devpodId) => inspectDevpodRuntimeStatus(devpodId, record.worktreePath))
     );
     return measureSize ? {
       ...row,
@@ -13313,12 +14028,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process22, import_node_fs27, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process27, import_node_fs29, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process22 = require("child_process");
-    import_node_fs27 = __toESM(require("fs"));
+    import_node_child_process27 = require("child_process");
+    import_node_fs29 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -13335,7 +14050,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process22.spawnSync)(command, args, {
+      const result = (0, import_node_child_process27.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -13495,7 +14210,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.39" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.41" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -13533,11 +14248,16 @@ program.command("upgrade").description(
     }
   )
 );
-program.command("setup").description("Run first-time devrouter machine setup and report diagnostics").option("--repo <path>", "Repository path for final diagnostics (defaults to current directory)").option("--yes", "Confirm non-interactive setup actions").option("--json", "Output JSON").action(
-  withErrorHandling(async (options) => {
-    const { runSetupCommand: runSetupCommand2 } = await Promise.resolve().then(() => (init_setup2(), setup_exports));
-    await runSetupCommand2(options);
-  })
+program.command("setup").description("Run first-time devrouter machine setup and report diagnostics").option("--repo <path>", "Repository path for final diagnostics (defaults to current directory)").option("--yes", "Confirm non-interactive setup actions").option("--workspace-runtime <runtime>", "Persist the machine workspace runtime (devpod|devsy)").option(
+  "--devsy-inactivity-timeout <duration>",
+  "Persist the Devsy inactivity shutdown duration (e.g. 30m)"
+).option("--json", "Output JSON").action(
+  withErrorHandling(
+    async (options) => {
+      const { runSetupCommand: runSetupCommand2 } = await Promise.resolve().then(() => (init_setup2(), setup_exports));
+      await runSetupCommand2(options);
+    }
+  )
 );
 program.command("up").description("Ensure devnet and start shared Traefik (reserves 80/443/5432)").action(
   withErrorHandling(async () => {
@@ -13557,7 +14277,7 @@ program.command("ensure").description("Start and prove a primary or linked check
     });
   })
 );
-program.command("stop").description("Stop one checkout's exact DevPod and free its routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--json", "Output JSON").option("--delete", "Delete the exact DevPod instead of preserving its data").action(
+program.command("stop").description("Stop one checkout's exact workspace runtime (DevPod/Devsy) and free its routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--json", "Output JSON").option("--delete", "Delete the exact workspace runtime instead of preserving its data").action(
   withErrorHandling(async (repoPath, _options, command) => {
     const options = command.opts();
     const { runStopCommand: runStopCommand2 } = await Promise.resolve().then(() => (init_stop(), stop_exports));
@@ -13568,7 +14288,7 @@ program.command("stop").description("Stop one checkout's exact DevPod and free i
     });
   })
 );
-program.command("exec").description("Run one literal command inside the exact checkout's running DevPod").argument("[args...]", "[path] -- <command...>").allowUnknownOption(true).action(
+program.command("exec").description("Run one literal command inside the exact checkout's running workspace runtime").argument("[args...]", "[path] -- <command...>").allowUnknownOption(true).action(
   withErrorHandling(async () => {
     const commandIndex = process.argv.indexOf("exec", 2);
     const { parseExecInvocation: parseExecInvocation2, runExecCommand: runExecCommand2 } = await Promise.resolve().then(() => (init_exec(), exec_exports));
@@ -13737,7 +14457,7 @@ tlsCommand.command("install").description("Install mkcert certs and enable HTTPS
 );
 var workspaceCommand2 = program.command("workspace").description("Spin up / list / tear down isolated worktree+devcontainer workspaces");
 workspaceCommand2.command("up").description(
-  "Create a worktree for <branch>, bring up its devpod, and register namespaced routes"
+  "Create a worktree for <branch>, bring up its workspace runtime, and register namespaced routes"
 ).argument("<branch>", "Git branch to base the workspace on").option("--path <dir>", "Worktree directory (default: <repo>/trees/<workspace>)").option("--no-devpod", "Only create the worktree; do not start the environment or change routes").option("--open", "Open the namespaced routes after registering").option("--repo <path>", "Main repository path (defaults to current directory)").action(
   withErrorHandling(async (branch, _options, command) => {
     const options = command.opts();
@@ -13750,7 +14470,9 @@ workspaceCommand2.command("up").description(
     });
   })
 );
-workspaceCommand2.command("ensure").description("Start and prove a primary or linked checkout's DevPod, upstreams, and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+workspaceCommand2.command("ensure").description(
+  "Start and prove a primary or linked checkout's workspace runtime, upstreams, and routes"
+).argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(
     async (worktreePath, _options, command) => {
       const options = command.opts();
@@ -13784,21 +14506,21 @@ workspaceCommand2.command("cleanup").description("Report managed workspace activ
     });
   })
 );
-workspaceCommand2.command("gc").description("Report or clean missing ledger-owned workspace resources").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").option("--yes", "Delete eligible DevPod, route, and ownership resources").action(
+workspaceCommand2.command("gc").description("Report or clean missing ledger-owned workspace resources").option("--repo <path>", "Main repository path (defaults to current directory)").option("--json", "Output JSON").option("--yes", "Delete eligible workspace runtime, route, and ownership resources").action(
   withErrorHandling(async (_options, command) => {
     const options = command.opts();
     const { runWorkspaceGcCommand: runWorkspaceGcCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
     runWorkspaceGcCommand2(options);
   })
 );
-workspaceCommand2.command("stop").description("Stop a workspace's DevPod and free routes while preserving its worktree and data").argument("<workspace>", "Workspace token or live branch name").option("--repo <path>", "Main repository path (defaults to current directory)").action(
+workspaceCommand2.command("stop").description("Stop a workspace's runtime and free routes while preserving its worktree and data").argument("<workspace>", "Workspace token or live branch name").option("--repo <path>", "Main repository path (defaults to current directory)").action(
   withErrorHandling(async (target, _options, command) => {
     const options = command.opts();
     const { runWorkspaceStopCommand: runWorkspaceStopCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
     await runWorkspaceStopCommand2(target, options);
   })
 );
-workspaceCommand2.command("down").description("Delete a workspace's DevPod and routes, then remove its clean Git worktree").argument("<workspace>", "Workspace token or live branch name").option("--keep-worktree", "Delete runtime resources but preserve the Git worktree and record").option("--repo <path>", "Main repository path (defaults to current directory)").action(
+workspaceCommand2.command("down").description("Delete a workspace's runtime and routes, then remove its clean Git worktree").argument("<workspace>", "Workspace token or live branch name").option("--keep-worktree", "Delete runtime resources but preserve the Git worktree and record").option("--repo <path>", "Main repository path (defaults to current directory)").action(
   withErrorHandling(async (target, _options, command) => {
     const options = command.opts();
     const { runWorkspaceDownCommand: runWorkspaceDownCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));