@devrouter/cli 0.0.42 → 0.0.44

package/dist/devrouter.js

@@ -51,6 +51,7 @@ function buildDevrouterSection() {
     "- Managed selective profile: `devrouter ensure . --profile <name> --json`",
     "- Host/docker runtime app only: `devrouter app run <host-app> --repo . --yes`",
     "- `devrouter ls`",
+    "- Managed devcontainer source configs with `postCreateCommand` and a managed post-start adapter must set `waitFor` exactly to `postCreateCommand` or `postStartCommand`; generated managed configs preserve lifecycle fields and change only `runServices`.",
     DEVROUTER_END_SENTINEL
   ].join("\n");
 }
@@ -293,6 +294,10 @@ profiles:
 - Inspect managed desired, active, and drift state with \`devrouter status\` and
   \`devrouter doctor\`; values such as credentials and environment contents are
   never written to managed runtime state.
+- A managed adapter paired with \`postCreateCommand\` requires \`waitFor\` exactly
+  \`postCreateCommand\` or \`postStartCommand\` before provider mutation. Generated
+  selective configuration preserves lifecycle fields and changes only
+  \`runServices\`.
 
 ## Env var injection
 
@@ -1658,12 +1663,12 @@ var init_host_routes = __esm({
 
 // src/core/repo-config.ts
 function compareSemver(a, b) {
-  const parse = (v) => {
+  const parse2 = (v) => {
     const match = v.trim().match(/^v?(\d+)\.(\d+)\.(\d+)$/);
     return match ? { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]) } : { major: 0, minor: 0, patch: 0 };
   };
-  const left = parse(a);
-  const right = parse(b);
+  const left = parse2(a);
+  const right = parse2(b);
   if (left.major !== right.major) return left.major - right.major;
   if (left.minor !== right.minor) return left.minor - right.minor;
   return left.patch - right.patch;
@@ -2504,7 +2509,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.42" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.44" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -3035,6 +3040,7 @@ function buildOnboardingPrompt(options = {}) {
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
     "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, workspace runtime registration, runtime state (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod/Devsy list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. Runtime `lastUsed` remains advisory.",
@@ -4005,12 +4011,64 @@ var init_docker = __esm({
   }
 });
 
+// src/core/devcontainer-config.ts
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseDevcontainerConfig(contents, sourcePath) {
+  const errors = [];
+  const parsed = (0, import_jsonc_parser.parse)(contents, errors, {
+    allowTrailingComma: true,
+    disallowComments: false
+  });
+  if (errors.length > 0) {
+    const first = errors[0];
+    throw new Error(
+      `Could not parse Dev Container source config '${sourcePath}' as JSONC at offset ${first.offset}.`
+    );
+  }
+  if (!isObject(parsed)) {
+    throw new Error(`Dev Container source config '${sourcePath}' must contain an object.`);
+  }
+  return parsed;
+}
+function readDevcontainerConfig(repoPath) {
+  const sourcePath = import_node_path8.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  if (!import_node_fs9.default.existsSync(sourcePath) || !import_node_fs9.default.lstatSync(sourcePath).isFile()) {
+    throw new Error(`Managed Dev Container source config does not exist: ${sourcePath}`);
+  }
+  const sourceContents = import_node_fs9.default.readFileSync(sourcePath, "utf-8");
+  return {
+    sourcePath,
+    sourceContents,
+    source: parseDevcontainerConfig(sourceContents, sourcePath)
+  };
+}
+function assertManagedDevcontainerLifecycle(repoPath) {
+  const { sourcePath, source } = readDevcontainerConfig(repoPath);
+  if (source.postCreateCommand === void 0) return;
+  if (source.waitFor === "postCreateCommand" || source.waitFor === "postStartCommand") return;
+  const actual = source.waitFor === void 0 ? "is missing" : typeof source.waitFor === "string" ? "is an unsupported string" : "is not a string";
+  throw new Error(
+    `Managed Dev Container source '${sourcePath}' defines postCreateCommand, but waitFor ${actual}. Set waitFor to 'postCreateCommand' or 'postStartCommand' before retrying devrouter ensure.`
+  );
+}
+var import_node_fs9, import_node_path8, import_jsonc_parser;
+var init_devcontainer_config = __esm({
+  "src/core/devcontainer-config.ts"() {
+    "use strict";
+    import_node_fs9 = __toESM(require("fs"));
+    import_node_path8 = __toESM(require("path"));
+    import_jsonc_parser = require("jsonc-parser");
+  }
+});
+
 // src/core/managed-post-start.ts
 function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path8.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path9.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -4045,8 +4103,8 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs9.default.existsSync(filePath) || !import_node_fs9.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs9.default.readFileSync(filePath);
+  if (!import_node_fs10.default.existsSync(filePath) || !import_node_fs10.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs10.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
@@ -4056,21 +4114,21 @@ function adapterFingerprint(adapter) {
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path8.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path8.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path9.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path9.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs9.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs10.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path8.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path9.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path8.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path8.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path9.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path9.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -4093,6 +4151,7 @@ function resolveManagedPostStartPlan(repoPath) {
     }
     return { kind: "unmanaged" };
   }
+  assertManagedDevcontainerLifecycle(repoPath);
   if (adapter.includes("DEVROUTER_PROCESS_HELPER")) {
     return {
       kind: "runtime",
@@ -4110,7 +4169,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs9.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs10.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -4198,14 +4257,15 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process5, import_node_crypto3, import_node_fs9, import_node_path8, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
+var import_node_child_process5, import_node_crypto3, import_node_fs10, import_node_path9, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
     import_node_child_process5 = require("child_process");
     import_node_crypto3 = require("crypto");
-    import_node_fs9 = __toESM(require("fs"));
-    import_node_path8 = __toESM(require("path"));
+    import_node_fs10 = __toESM(require("fs"));
+    import_node_path9 = __toESM(require("path"));
+    init_devcontainer_config();
     MANAGED_MARKER = "devrouter:managed devcontainer";
     MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
     RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
@@ -4271,7 +4331,7 @@ function isLoopbackHost(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "host.docker.internal";
 }
 function inspectCompose(composeFile, _workspace) {
-  if (!import_node_fs10.default.existsSync(composeFile)) {
+  if (!import_node_fs11.default.existsSync(composeFile)) {
     return {
       aliases: [],
       publishedPorts: [],
@@ -4280,7 +4340,7 @@ function inspectCompose(composeFile, _workspace) {
     };
   }
   try {
-    const raw = import_node_fs10.default.readFileSync(composeFile, "utf-8");
+    const raw = import_node_fs11.default.readFileSync(composeFile, "utf-8");
     const parsed = import_yaml3.default.parse(raw);
     const root = asRecord(parsed);
     const services = asRecord(root?.services);
@@ -4337,11 +4397,11 @@ function routedProxyApps(config) {
   );
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path9.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs10.default.existsSync(devcontainerDir)) {
+  const devcontainerDir = import_node_path10.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs11.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path9.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path10.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -4368,9 +4428,9 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path9.default.join(devcontainerDir, "Dockerfile");
-  const dockerfileExists = import_node_fs10.default.existsSync(dockerfilePath);
-  const dockerfile = dockerfileExists ? import_node_fs10.default.readFileSync(dockerfilePath, "utf-8") : "";
+  const dockerfilePath = import_node_path10.default.join(devcontainerDir, "Dockerfile");
+  const dockerfileExists = import_node_fs11.default.existsSync(dockerfilePath);
+  const dockerfile = dockerfileExists ? import_node_fs11.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
     (artifact) => dockerfile.includes(artifact)
   );
@@ -4425,12 +4485,12 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs10, import_node_path9, import_yaml3;
+var import_node_fs11, import_node_path10, import_yaml3;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
-    import_node_fs10 = __toESM(require("fs"));
-    import_node_path9 = __toESM(require("path"));
+    import_node_fs11 = __toESM(require("fs"));
+    import_node_path10 = __toESM(require("path"));
     import_yaml3 = __toESM(require("yaml"));
     init_managed_post_start();
   }
@@ -4438,18 +4498,18 @@ var init_devcontainer_diagnostics = __esm({
 
 // src/core/paths.ts
 function assertPathWithinRepo(filePath, repoRoot, label) {
-  const resolvedRoot = import_node_path10.default.resolve(repoRoot);
-  const resolved = import_node_path10.default.resolve(repoRoot, filePath);
-  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path10.default.sep)) {
+  const resolvedRoot = import_node_path11.default.resolve(repoRoot);
+  const resolved = import_node_path11.default.resolve(repoRoot, filePath);
+  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path11.default.sep)) {
     throw new Error(`${label} path '${filePath}' escapes the repository root.`);
   }
   return resolved;
 }
-var import_node_path10;
+var import_node_path11;
 var init_paths = __esm({
   "src/core/paths.ts"() {
     "use strict";
-    import_node_path10 = __toESM(require("path"));
+    import_node_path11 = __toESM(require("path"));
   }
 });
 
@@ -4534,11 +4594,11 @@ function reconcileRouteRunConflict(repoPath, app) {
     }
   }
 }
-var import_node_fs11;
+var import_node_fs12;
 var init_route_state = __esm({
   "src/core/route-state.ts"() {
     "use strict";
-    import_node_fs11 = __toESM(require("fs"));
+    import_node_fs12 = __toESM(require("fs"));
     init_host_routes();
     init_workspace();
   }
@@ -4707,7 +4767,7 @@ function stateKey(repoPath, workspace) {
   return (0, import_node_crypto4.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
 function managedRuntimeStatePath(repoPath, workspace) {
-  return import_node_path11.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
+  return import_node_path12.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string") && new Set(value).size === value.length;
@@ -4770,10 +4830,10 @@ function validateState(value, repoPath, workspace) {
 }
 function readManagedRuntimeState(repoPath, workspace) {
   const statePath = managedRuntimeStatePath(repoPath, workspace);
-  if (!import_node_fs12.default.existsSync(statePath)) return void 0;
+  if (!import_node_fs13.default.existsSync(statePath)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs12.default.readFileSync(statePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs13.default.readFileSync(statePath, "utf-8"));
   } catch (error) {
     throw new Error(`Could not parse managed runtime state: ${String(error)}`);
   }
@@ -4795,20 +4855,20 @@ function markManagedRuntimeDegraded(state, transitionPhase) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
-var import_node_crypto4, import_node_fs12, import_node_path11;
+var import_node_crypto4, import_node_fs13, import_node_path12;
 var init_managed_runtime_state = __esm({
   "src/core/managed-runtime-state.ts"() {
     "use strict";
     import_node_crypto4 = require("crypto");
-    import_node_fs12 = __toESM(require("fs"));
-    import_node_path11 = __toESM(require("path"));
+    import_node_fs13 = __toESM(require("fs"));
+    import_node_path12 = __toESM(require("path"));
     init_atomic_file();
     init_router();
   }
 });
 
 // src/core/devcontainer-profile.ts
-function isObject(value) {
+function isObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function nonEmptyString(value, label) {
@@ -4852,14 +4912,14 @@ function resolveComposeFiles(source, repoPath, linked) {
       "managedRuntime requires .devcontainer/devcontainer.json to define dockerComposeFile."
     );
   }
-  const directory = import_node_path12.default.join(repoPath, ".devcontainer");
+  const directory = import_node_path13.default.join(repoPath, ".devcontainer");
   const files = references.map((reference) => {
     const resolved2 = assertPathWithinRepo(
       resolveComposeReference(reference, linked),
       directory,
       "dockerComposeFile"
     );
-    if (!import_node_fs13.default.existsSync(resolved2) || !import_node_fs13.default.lstatSync(resolved2).isFile()) {
+    if (!import_node_fs14.default.existsSync(resolved2) || !import_node_fs14.default.lstatSync(resolved2).isFile()) {
       throw new Error(`Managed Dev Container compose file does not exist: ${resolved2}`);
     }
     return resolved2;
@@ -4867,13 +4927,13 @@ function resolveComposeFiles(source, repoPath, linked) {
   for (const file of files) {
     let parsed;
     try {
-      parsed = import_yaml4.default.parse(import_node_fs13.default.readFileSync(file, "utf-8"));
+      parsed = import_yaml4.default.parse(import_node_fs14.default.readFileSync(file, "utf-8"));
     } catch (error) {
       throw new Error(
         `Could not parse managed Dev Container compose file '${file}': ${String(error)}`
       );
     }
-    if (!isObject(parsed) || !isObject(parsed.services)) {
+    if (!isObject2(parsed) || !isObject2(parsed.services)) {
       throw new Error(`Managed Dev Container compose file '${file}' has no services map.`);
     }
   }
@@ -4916,12 +4976,12 @@ function assertIgnoredGeneratedPath(repoPath, generatedPath) {
   }
 }
 function assertGeneratedPathOwnership(generatedPath) {
-  if (!import_node_fs13.default.existsSync(generatedPath)) return;
-  const stat = import_node_fs13.default.lstatSync(generatedPath);
+  if (!import_node_fs14.default.existsSync(generatedPath)) return;
+  const stat = import_node_fs14.default.lstatSync(generatedPath);
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`Managed Dev Container path '${generatedPath}' is not a regular file.`);
   }
-  const firstLine2 = import_node_fs13.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
+  const firstLine2 = import_node_fs14.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
   if (firstLine2 !== MANAGED_DEVCONTAINER_MARKER) {
     throw new Error(
       `Managed Dev Container path '${generatedPath}' exists without the devrouter ownership marker.`
@@ -4945,21 +5005,7 @@ function inspectManagedDevcontainerConfig(options) {
   if (!managedRuntime) {
     throw new Error("Cannot prepare a managed Dev Container without managedRuntime.");
   }
-  const sourcePath = import_node_path12.default.join(options.repoPath, ".devcontainer/devcontainer.json");
-  if (!import_node_fs13.default.existsSync(sourcePath) || !import_node_fs13.default.lstatSync(sourcePath).isFile()) {
-    throw new Error(`Managed Dev Container source config does not exist: ${sourcePath}`);
-  }
-  const sourceContents = import_node_fs13.default.readFileSync(sourcePath, "utf-8");
-  let parsed;
-  try {
-    parsed = import_yaml4.default.parse(sourceContents);
-  } catch (error) {
-    throw new Error(`Could not parse managed Dev Container source config: ${String(error)}`);
-  }
-  if (!isObject(parsed)) {
-    throw new Error("Managed Dev Container source config must contain an object.");
-  }
-  const source = parsed;
+  const { sourcePath, sourceContents, source } = readDevcontainerConfig(options.repoPath);
   const primaryService = nonEmptyString(source.service, "devcontainer.service");
   const compose = resolveComposeFiles(source, options.repoPath, options.linked);
   const composeServiceSet = new Set(compose.services);
@@ -5011,7 +5057,7 @@ function inspectManagedDevcontainerConfig(options) {
   const contents = `${MANAGED_DEVCONTAINER_MARKER}
 ${JSON.stringify(effective, null, 2)}
 `;
-  const generatedPath = import_node_path12.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
+  const generatedPath = import_node_path13.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
   assertIgnoredGeneratedPath(options.repoPath, generatedPath);
   assertGeneratedPathOwnership(generatedPath);
   return {
@@ -5038,13 +5084,13 @@ function writeManagedDevcontainerConfig(plan) {
 function inspectManagedDevcontainerGeneratedConfig(plan) {
   let stat;
   try {
-    stat = import_node_fs13.default.lstatSync(plan.generatedPath);
+    stat = import_node_fs14.default.lstatSync(plan.generatedPath);
   } catch (error) {
     if (error.code === "ENOENT") return { status: "missing" };
     throw error;
   }
   if (!stat.isFile() || stat.isSymbolicLink()) return { status: "foreign" };
-  const contents = import_node_fs13.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs14.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     return { status: "foreign" };
@@ -5056,17 +5102,17 @@ function inspectManagedDevcontainerGeneratedConfig(plan) {
   };
 }
 function removeManagedDevcontainerConfig(plan) {
-  if (!import_node_fs13.default.existsSync(plan.generatedPath)) return;
-  const stat = import_node_fs13.default.lstatSync(plan.generatedPath);
+  if (!import_node_fs14.default.existsSync(plan.generatedPath)) return;
+  const stat = import_node_fs14.default.lstatSync(plan.generatedPath);
   if (!stat.isFile()) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not a regular file.`);
   }
-  const contents = import_node_fs13.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs14.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not devrouter-owned.`);
   }
-  import_node_fs13.default.unlinkSync(plan.generatedPath);
+  import_node_fs14.default.unlinkSync(plan.generatedPath);
 }
 function assertSafeContainerId(containerId) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(containerId)) {
@@ -5131,16 +5177,17 @@ function stopExactManagedService(containerId, service) {
     throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
   }
 }
-var import_node_child_process6, import_node_crypto5, import_node_fs13, import_node_path12, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var import_node_child_process6, import_node_crypto5, import_node_fs14, import_node_path13, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
 var init_devcontainer_profile = __esm({
   "src/core/devcontainer-profile.ts"() {
     "use strict";
     import_node_child_process6 = require("child_process");
     import_node_crypto5 = require("crypto");
-    import_node_fs13 = __toESM(require("fs"));
-    import_node_path12 = __toESM(require("path"));
+    import_node_fs14 = __toESM(require("fs"));
+    import_node_path13 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
     init_atomic_file();
+    init_devcontainer_config();
     init_paths();
     MANAGED_DEVCONTAINER_PATH = ".devcontainer/devcontainer.devrouter.json";
     MANAGED_DEVCONTAINER_MARKER = "// devrouter:managed devcontainer profile";
@@ -5178,7 +5225,7 @@ function inspectWorkspaceContainers(options) {
 function workspaceAppContainers(containers, repoPath) {
   return containers.filter((container) => {
     const workingDir = container.labels["com.docker.compose.project.working_dir"];
-    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path13.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
+    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path14.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
       (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
     );
   });
@@ -5186,7 +5233,7 @@ function workspaceAppContainers(containers, repoPath) {
 function hasExactComposeIdentity(container, options) {
   if (options.composeProject !== void 0 && container.labels["com.docker.compose.project"] !== options.composeProject || container.labels["com.docker.compose.service"] !== options.service || !sameWorkspacePath(
     container.labels["com.docker.compose.project.working_dir"] ?? "",
-    import_node_path13.default.join(options.repoPath, ".devcontainer")
+    import_node_path14.default.join(options.repoPath, ".devcontainer")
   )) {
     return false;
   }
@@ -5223,12 +5270,12 @@ function resolveRunningWorkspaceContainer(repoPath) {
   }
   return { id: container.id, workspacePath: repoMount.Destination };
 }
-var import_node_child_process7, import_node_path13, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
+var import_node_child_process7, import_node_path14, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
 var init_devpod_environment = __esm({
   "src/core/devpod-environment.ts"() {
     "use strict";
     import_node_child_process7 = require("child_process");
-    import_node_path13 = __toESM(require("path"));
+    import_node_path14 = __toESM(require("path"));
     init_workspace();
     SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.service":{{json (index .Config.Labels "com.docker.compose.service")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
     SIZE_INSPECT_TEMPLATE = SAFE_INSPECT_TEMPLATE.replace(
@@ -5682,7 +5729,7 @@ function toRepoStatus(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
   const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
-  const configExists = import_node_fs14.default.existsSync(configPath);
+  const configExists = import_node_fs15.default.existsSync(configPath);
   if (!explicitRepo && !configExists) {
     return void 0;
   }
@@ -5830,11 +5877,11 @@ async function collectRouterStatus(repoPath) {
     }
   };
 }
-var import_node_fs14;
+var import_node_fs15;
 var init_status = __esm({
   "src/core/status.ts"() {
     "use strict";
-    import_node_fs14 = __toESM(require("fs"));
+    import_node_fs15 = __toESM(require("fs"));
     init_docker();
     init_managed_runtime_state();
     init_managed_runtime_status();
@@ -5873,8 +5920,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path14.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs15.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path15.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs16.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -5917,6 +5964,9 @@ function parseCertificateDnsHosts(pem) {
 function isHostCoveredByCertificateHost(host, certificateHost) {
   const normalizedHost = normalizeHost(host);
   const normalizedCertificateHost = normalizeHost(certificateHost);
+  if (normalizedHost === normalizedCertificateHost) {
+    return true;
+  }
   if (normalizedCertificateHost.startsWith("*.")) {
     if (normalizedCertificateHost === "*.localhost") {
       return false;
@@ -5928,7 +5978,7 @@ function isHostCoveredByCertificateHost(host, certificateHost) {
     const wildcardPart = normalizedHost.slice(0, normalizedHost.length - suffix.length);
     return wildcardPart.length > 0 && !wildcardPart.includes(".");
   }
-  return normalizedHost === normalizedCertificateHost;
+  return false;
 }
 function findUncoveredCertificateHosts(requiredHosts, certificateHosts) {
   const normalizedRequired = normalizeUniqueHosts(requiredHosts);
@@ -5939,22 +5989,54 @@ function findUncoveredCertificateHosts(requiredHosts, certificateHosts) {
     )
   );
 }
-function readCurrentCertificateHosts() {
-  if (!import_node_fs15.default.existsSync(CERT_FILE)) {
-    return [];
+function compactTLSCertificateHosts(hosts) {
+  const normalizedHosts = normalizeUniqueHosts(hosts);
+  const wildcardHosts = new Set(normalizedHosts.filter((host) => host.startsWith("*.")));
+  const siblingGroups = /* @__PURE__ */ new Map();
+  const compacted = new Set(wildcardHosts);
+  for (const host of normalizedHosts) {
+    if (host.startsWith("*.")) {
+      continue;
+    }
+    const labels = host.split(".");
+    if (labels.length < 3 || labels.at(-1) !== "localhost") {
+      compacted.add(host);
+      continue;
+    }
+    const suffix = labels.slice(1).join(".");
+    const siblings = siblingGroups.get(suffix) ?? [];
+    siblings.push(host);
+    siblingGroups.set(suffix, siblings);
+  }
+  for (const [suffix, siblings] of siblingGroups) {
+    const wildcard = `*.${suffix}`;
+    if (siblings.length > 1 || wildcardHosts.has(wildcard)) {
+      compacted.add(wildcard);
+      continue;
+    }
+    compacted.add(siblings[0]);
   }
-  const pem = import_node_fs15.default.readFileSync(CERT_FILE, "utf-8");
-  return parseCertificateDnsHosts(pem);
+  const selectedWildcards = Array.from(compacted).filter((host) => host.startsWith("*."));
+  return normalizeUniqueHosts(Array.from(compacted)).filter(
+    (host) => host.startsWith("*.") || !selectedWildcards.some((wildcard) => isHostCoveredByCertificateHost(host, wildcard))
+  );
 }
-function currentCertificateHostsOrEmpty() {
-  try {
-    return readCurrentCertificateHosts();
-  } catch {
+function readCurrentCertificateHosts(options = {}) {
+  if (!import_node_fs16.default.existsSync(CERT_FILE)) {
     return [];
   }
+  try {
+    const pem = import_node_fs16.default.readFileSync(CERT_FILE, "utf-8");
+    return parseCertificateDnsHosts(pem);
+  } catch (error) {
+    if (options.replaceMalformed) {
+      return [];
+    }
+    throw error;
+  }
 }
 function buildDesiredTLSCertificateHosts(requestedHosts, existingCertificateHosts) {
-  return normalizeUniqueHosts([
+  return compactTLSCertificateHosts([
     ...DEFAULT_TLS_CERT_HOSTS,
     ...existingCertificateHosts,
     ...requestedHosts
@@ -5962,35 +6044,75 @@ function buildDesiredTLSCertificateHosts(requestedHosts, existingCertificateHost
 }
 function getTLSHostCoverage(hosts) {
   const requiredHosts = normalizeUniqueHosts([...DEFAULT_TLS_CERT_HOSTS, ...hosts]);
-  const certificateHosts = readCurrentCertificateHosts();
-  const uncoveredHosts = findUncoveredCertificateHosts(requiredHosts, certificateHosts);
-  return {
-    requiredHosts,
-    certificateHosts,
-    uncoveredHosts
-  };
+  return withFileLockSync(
+    TLS_CERTIFICATE_LOCK_FILE,
+    { activity: "TLS certificate inspection", waitMs: TLS_CERTIFICATE_LOCK_WAIT_MS },
+    () => {
+      const certificateHosts = readCurrentCertificateHosts();
+      const uncoveredHosts = findUncoveredCertificateHosts(requiredHosts, certificateHosts);
+      return {
+        requiredHosts,
+        certificateHosts,
+        uncoveredHosts
+      };
+    }
+  );
 }
 async function applyTLSCertificate(options, installTrust) {
   ensureRouterFiles();
-  const alreadyEnabled = isTLSEnabled();
-  const desiredHosts = buildDesiredTLSCertificateHosts(
-    options.hosts ?? [],
-    currentCertificateHostsOrEmpty()
+  const result = withFileLockSync(
+    TLS_CERTIFICATE_LOCK_FILE,
+    {
+      activity: "TLS certificate refresh",
+      target: options.repoPath,
+      waitMs: TLS_CERTIFICATE_LOCK_WAIT_MS
+    },
+    () => {
+      const alreadyEnabled = isTLSEnabled();
+      if (installTrust) {
+        ensureMkcert();
+        runOrThrow("mkcert", ["-install"]);
+      } else {
+        getMkcertRootCAPath({ repoPath: options.repoPath });
+      }
+      const existingCertificateHosts = readCurrentCertificateHosts({
+        replaceMalformed: installTrust
+      });
+      const desiredHosts = buildDesiredTLSCertificateHosts(
+        options.hosts ?? [],
+        existingCertificateHosts
+      );
+      let certificateHosts = [];
+      let uncoveredHosts = [];
+      for (let attempt = 1; attempt <= TLS_CERTIFICATE_WRITE_ATTEMPTS; attempt += 1) {
+        runOrThrow("mkcert", [
+          "-cert-file",
+          CERT_FILE,
+          "-key-file",
+          CERT_KEY_FILE,
+          ...desiredHosts
+        ]);
+        certificateHosts = readCurrentCertificateHosts();
+        uncoveredHosts = findUncoveredCertificateHosts(desiredHosts, certificateHosts);
+        if (uncoveredHosts.length === 0) {
+          break;
+        }
+      }
+      if (uncoveredHosts.length > 0) {
+        throw new Error(
+          `mkcert did not produce certificate coverage for host(s): ${uncoveredHosts.join(", ")} after ${TLS_CERTIFICATE_WRITE_ATTEMPTS} attempts`
+        );
+      }
+      setTLSEnabled(true);
+      refreshHostRoutesDynamicFile();
+      return { alreadyEnabled, hosts: certificateHosts };
+    }
   );
-  if (installTrust) {
-    ensureMkcert();
-    runOrThrow("mkcert", ["-install"]);
-  } else {
-    getMkcertRootCAPath({ repoPath: options.repoPath });
-  }
-  runOrThrow("mkcert", ["-cert-file", CERT_FILE, "-key-file", CERT_KEY_FILE, ...desiredHosts]);
-  setTLSEnabled(true);
-  refreshHostRoutesDynamicFile();
   const routerContainer = await findContainerByName("devrouter-traefik");
   if (routerContainer && await isContainerRunning("devrouter-traefik")) {
     startRouterStack();
   }
-  return { alreadyEnabled, hosts: desiredHosts };
+  return result;
 }
 async function installTLS(options = {}) {
   return applyTLSCertificate(options, true);
@@ -6032,18 +6154,22 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process8, import_node_crypto6, import_node_fs15, import_node_path14, DEFAULT_TLS_CERT_HOSTS;
+var import_node_child_process8, import_node_crypto6, import_node_fs16, import_node_path15, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
     import_node_child_process8 = require("child_process");
     import_node_crypto6 = require("crypto");
-    import_node_fs15 = __toESM(require("fs"));
-    import_node_path14 = __toESM(require("path"));
+    import_node_fs16 = __toESM(require("fs"));
+    import_node_path15 = __toESM(require("path"));
     init_docker();
+    init_file_lock();
     init_host_routes();
     init_router();
     DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
+    TLS_CERTIFICATE_LOCK_FILE = import_node_path15.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+    TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
+    TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
   }
 });
 
@@ -6220,7 +6346,7 @@ function isRuntimeInstalled(runtime) {
 function readWorkspaceRuntimeConfig() {
   let raw;
   try {
-    raw = JSON.parse(import_node_fs16.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8"));
+    raw = JSON.parse(import_node_fs17.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -6241,7 +6367,7 @@ function readWorkspaceRuntimeConfig() {
 function inspectWorkspaceRuntimeConfig() {
   let rawText;
   try {
-    rawText = import_node_fs16.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8");
+    rawText = import_node_fs17.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8");
   } catch {
     return { exists: false, config: {}, problems: [] };
   }
@@ -6292,7 +6418,7 @@ function writeWorkspaceRuntimeConfig(config) {
     }
     next.devsyInactivityTimeout = timeout;
   }
-  import_node_fs16.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs17.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   writeFileAtomically(RUNTIME_CONFIG_FILE, `${JSON.stringify(next, null, 2)}
 `);
 }
@@ -6400,20 +6526,20 @@ function resetWorkspaceRuntimeCaches() {
   cachedRuntime = void 0;
   cachedSnapshots = void 0;
 }
-var import_node_child_process11, import_node_fs16, import_node_path15, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
+var import_node_child_process11, import_node_fs17, import_node_path16, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
 var init_workspace_runtime = __esm({
   "src/core/workspace-runtime.ts"() {
     "use strict";
     import_node_child_process11 = require("child_process");
-    import_node_fs16 = __toESM(require("fs"));
-    import_node_path15 = __toESM(require("path"));
+    import_node_fs17 = __toESM(require("fs"));
+    import_node_path16 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_registry();
     init_devsy_workspaces();
     init_router();
     init_workspace();
     SUPPORTED_RUNTIMES2 = ["devpod", "devsy"];
-    RUNTIME_CONFIG_FILE = import_node_path15.default.join(DEVROUTER_HOME, "workspace-runtime.json");
+    RUNTIME_CONFIG_FILE = import_node_path16.default.join(DEVROUTER_HOME, "workspace-runtime.json");
     INACTIVITY_TIMEOUT_PATTERN = /^(?:\d+(?:ms|s|m|h))+$/;
     UnsupportedWorkspaceRuntimeError = class extends Error {
     };
@@ -6491,12 +6617,12 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path16.default.join(repoPath, "package.json");
-  if (!import_node_fs17.default.existsSync(packagePath)) {
+  const packagePath = import_node_path17.default.join(repoPath, "package.json");
+  if (!import_node_fs18.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs17.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs18.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -6636,13 +6762,13 @@ function buildGlobalToolChecks(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process12, import_node_fs17, import_node_path16;
+var import_node_child_process12, import_node_fs18, import_node_path17;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
     import_node_child_process12 = require("child_process");
-    import_node_fs17 = __toESM(require("fs"));
-    import_node_path16 = __toESM(require("path"));
+    import_node_fs18 = __toESM(require("fs"));
+    import_node_path17 = __toESM(require("path"));
     init_workspace_runtime();
   }
 });
@@ -6769,7 +6895,7 @@ function failedStartMayHaveAttached(devsyId, repoPath) {
   }
 }
 function withMutationLock(activity, target, operation) {
-  import_node_fs18.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     { activity, target: `'${target}'`, waitMs: DEVSY_MUTATION_WAIT_MS },
@@ -6914,17 +7040,17 @@ function startDevsyWorkspace(options) {
     }
   });
 }
-var import_node_child_process14, import_node_fs18, import_node_path17, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError;
+var import_node_child_process14, import_node_fs19, import_node_path18, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError;
 var init_devsy_mutation = __esm({
   "src/core/devsy-mutation.ts"() {
     "use strict";
     import_node_child_process14 = require("child_process");
-    import_node_fs18 = __toESM(require("fs"));
-    import_node_path17 = __toESM(require("path"));
+    import_node_fs19 = __toESM(require("fs"));
+    import_node_path18 = __toESM(require("path"));
     init_devsy_workspaces();
     init_file_lock();
     init_router();
-    DEVSY_MUTATION_LOCK_FILE = import_node_path17.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_LOCK_FILE = import_node_path18.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
     DEVSY_MUTATION_WAIT_MS = 6e4;
     DevsyStartPostconditionError = class extends Error {
     };
@@ -6933,7 +7059,7 @@ var init_devsy_mutation = __esm({
 
 // src/core/devpod-mutation.ts
 function withMutationLock2(activity, target, operation) {
-  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     { activity, target: `'${target}'`, waitMs: DEVPOD_MUTATION_WAIT_MS },
@@ -7101,19 +7227,19 @@ function startDevpodWorkspace(options) {
     }
   });
 }
-var import_node_child_process15, import_node_fs19, import_node_path18, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
+var import_node_child_process15, import_node_fs20, import_node_path19, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
     import_node_child_process15 = require("child_process");
-    import_node_fs19 = __toESM(require("fs"));
-    import_node_path18 = __toESM(require("path"));
+    import_node_fs20 = __toESM(require("fs"));
+    import_node_path19 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
     init_file_lock();
     init_router();
     init_workspace_runtime();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path18.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path19.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
     DEVPOD_MUTATION_WAIT_MS = 6e4;
     DevpodStartPostconditionError = class extends Error {
     };
@@ -7135,7 +7261,7 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path19.default.isAbsolute(output2) ? output2 : import_node_path19.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path20.default.isAbsolute(output2) ? output2 : import_node_path20.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
   const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
@@ -7186,7 +7312,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path19.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path20.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -7214,7 +7340,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path19.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path20.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -7234,7 +7360,7 @@ function validateRecord(value, expectedWorkspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs20.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs21.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -7250,7 +7376,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs20.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs21.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -7258,14 +7384,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path19.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path20.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path19.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path20.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record2) => record2.workspace === workspace);
@@ -7301,9 +7427,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
   return record;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path19.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path20.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs20.default.rmSync(filePath);
+    import_node_fs21.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -7314,7 +7440,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path19.default.join(
+  const filePath = import_node_path20.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -7326,14 +7452,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs20.default.rmSync(filePath);
+  import_node_fs21.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs20.default.mkdirSync(directory, { recursive: true });
+  import_node_fs21.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path19.default.join(directory, ".lock"),
+    import_node_path20.default.join(directory, ".lock"),
     { activity: "workspace ownership transaction", target: `'${repoPath}'`, waitMs: 5e3 },
     () => operation({
       list: () => listWorkspaceOwnershipInDirectory(directory),
@@ -7364,7 +7490,7 @@ function inspectWorkspaceOwnership(record, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs20.default.existsSync(record.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs21.default.existsSync(record.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -7388,20 +7514,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process16, import_node_fs20, import_node_path19, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process16, import_node_fs21, import_node_path20, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
     import_node_child_process16 = require("child_process");
-    import_node_fs20 = __toESM(require("fs"));
-    import_node_path19 = __toESM(require("path"));
+    import_node_fs21 = __toESM(require("fs"));
+    import_node_path20 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path19.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path20.default.join("devrouter", "workspaces");
   }
 });
 
@@ -7415,10 +7541,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path20.default.join(comparableRepo, "trees") + import_node_path20.default.sep;
+  const localRoot = import_node_path21.default.join(comparableRepo, "trees") + import_node_path21.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path20.default.basename(comparableRepo)}-`;
-  return import_node_path20.default.dirname(comparableWorktree) === import_node_path20.default.dirname(comparableRepo) && import_node_path20.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path21.default.basename(comparableRepo)}-`;
+  return import_node_path21.default.dirname(comparableWorktree) === import_node_path21.default.dirname(comparableRepo) && import_node_path21.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -7670,11 +7796,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path20;
+var import_node_path21;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path20 = __toESM(require("path"));
+    import_node_path21 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -7744,11 +7870,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs21.default.existsSync(absolutePath)) {
+      if (!import_node_fs22.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs21.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs22.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml5.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -8027,7 +8153,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.42" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.44" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -8057,9 +8183,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path21.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path22.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs21.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs22.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -8102,8 +8228,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path21.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs21.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path22.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs22.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -8247,12 +8373,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs21, import_node_path21, import_yaml5, POSTGRES_DEFAULTS;
+var import_node_fs22, import_node_path22, import_yaml5, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs21 = __toESM(require("fs"));
-    import_node_path21 = __toESM(require("path"));
+    import_node_fs22 = __toESM(require("fs"));
+    import_node_path22 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -8747,11 +8873,11 @@ var init_route_publication = __esm({
 // src/core/workspace-ensure.ts
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path22.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path23.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path22.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path23.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -9136,7 +9262,7 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs22.default.statSync(import_node_path22.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs23.default.statSync(import_node_path23.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
@@ -9186,8 +9312,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path22.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs22.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path23.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs23.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -9254,7 +9380,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path22.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path23.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -9698,13 +9824,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
   });
 }
-var import_node_child_process19, import_node_fs22, import_node_path22, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
+var import_node_child_process19, import_node_fs23, import_node_path23, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
     import_node_child_process19 = require("child_process");
-    import_node_fs22 = __toESM(require("fs"));
-    import_node_path22 = __toESM(require("path"));
+    import_node_fs23 = __toESM(require("fs"));
+    import_node_path23 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
@@ -9784,7 +9910,7 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path23.default.join(mainRepo, "trees", ws);
+  return import_node_path24.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
   const ignored = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
@@ -9792,12 +9918,12 @@ function assertDefaultWorktreeRootIgnored(mainRepo) {
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path23.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path23.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path24.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path24.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path23.default.join(import_node_path23.default.dirname(mainRepo), `${import_node_path23.default.basename(mainRepo)}-${ws}`);
+  return import_node_path24.default.join(import_node_path24.default.dirname(mainRepo), `${import_node_path24.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -9909,7 +10035,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs23.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs24.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -9936,8 +10062,8 @@ async function workspaceUp(branch, opts = {}) {
   if (!ws) {
     throw new Error(`Branch '${branch}' does not yield a valid workspace token.`);
   }
-  const worktreePath = opts.path ? import_node_path23.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
-  if (import_node_fs23.default.existsSync(worktreePath)) {
+  const worktreePath = opts.path ? import_node_path24.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
+  if (import_node_fs24.default.existsSync(worktreePath)) {
     const registered = listGitWorktrees(mainRepo).find(
       (worktree) => sameWorkspacePath(worktree.path, worktreePath)
     );
@@ -10062,7 +10188,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
       opts.quiet
     );
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs23.default.existsSync(resolved.worktreePath)) {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs24.default.existsSync(resolved.worktreePath)) {
         const rm = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
@@ -10081,7 +10207,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs23.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs24.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
 }
 async function mutateWorkspaceOwnedPath(action2, worktreePath, opts = {}) {
   const mainRepo = resolveRepoPath(opts.repoPath);
@@ -10116,13 +10242,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process20, import_node_fs23, import_node_path23;
+var import_node_child_process20, import_node_fs24, import_node_path24;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
     import_node_child_process20 = require("child_process");
-    import_node_fs23 = __toESM(require("fs"));
-    import_node_path23 = __toESM(require("path"));
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path24 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_repo_config();
@@ -10690,17 +10816,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs24.default.existsSync(filePath)) {
+  if (!import_node_fs25.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs24.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs25.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path24.default.relative(repoPath, filePath) || ".";
+  return import_node_path25.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -10741,7 +10867,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs24.default.existsSync(import_node_path24.default.join(repoPath, fileName))) {
+    if (import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -10756,9 +10882,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path24.default.join(repoPath, ".nvmrc");
-  if (import_node_fs24.default.existsSync(nvmrc)) {
-    const version = import_node_fs24.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path25.default.join(repoPath, ".nvmrc");
+  if (import_node_fs25.default.existsSync(nvmrc)) {
+    const version = import_node_fs25.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -10819,7 +10945,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path24.default.isAbsolute(fileName) && !import_node_path24.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path25.default.isAbsolute(fileName) && !import_node_path25.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -10837,7 +10963,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs24.default.existsSync(import_node_path24.default.join(repoPath, fileName))
+    (fileName) => import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -10875,7 +11001,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs24.default.readFileSync(import_node_path24.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs25.default.readFileSync(import_node_path25.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -10910,8 +11036,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs24.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs24.default.readFileSync(import_node_path24.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs25.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs25.default.readFileSync(import_node_path25.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -10925,18 +11051,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path24.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs24.default.existsSync(dir)) {
+  const dir = import_node_path25.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs25.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs24.default.readdirSync(dir).filter((fileName) => import_node_fs24.default.statSync(import_node_path24.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs25.default.readdirSync(dir).filter((fileName) => import_node_fs25.default.statSync(import_node_path25.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs24.default.existsSync(configPath)) {
+  if (!import_node_fs25.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -10980,15 +11106,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs24.default.existsSync(import_node_path24.default.join(repoPath, fileName))) {
+    if (import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path24.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs24.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs24.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path24.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs24.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path25.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs25.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs25.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path25.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs25.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -11031,7 +11157,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path24.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path25.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -11050,12 +11176,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs24, import_node_path24, import_yaml6;
+var import_node_fs25, import_node_path25, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs24 = __toESM(require("fs"));
-    import_node_path24 = __toESM(require("path"));
+    import_node_fs25 = __toESM(require("fs"));
+    import_node_path25 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -11160,7 +11286,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs26.default.existsSync(import_node_path26.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -11379,12 +11505,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs25, import_node_path25;
+var import_node_fs26, import_node_path26;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs25 = __toESM(require("fs"));
-    import_node_path25 = __toESM(require("path"));
+    import_node_fs26 = __toESM(require("fs"));
+    import_node_path26 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -11530,6 +11656,7 @@ function renderDevcontainerJson(projectName) {
   "service": "app",
   "workspaceFolder": "/workspaces/${projectName}",
   "postCreateCommand": "bash .devcontainer/post-create.sh",
+  "waitFor": "postCreateCommand",
   "customizations": {
     "devrouter": {
       "managed": "${MANAGED_MARKER2}"
@@ -11680,7 +11807,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path26.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path27.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -11725,8 +11852,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path26.default.join(repoPath, file.relativePath);
-  if (!import_node_fs26.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path27.default.join(repoPath, file.relativePath);
+  if (!import_node_fs27.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -11734,7 +11861,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs26.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs27.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -11791,11 +11918,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path26.default.join(repoPath, file.relativePath);
-  import_node_fs26.default.mkdirSync(import_node_path26.default.dirname(absolutePath), { recursive: true });
-  import_node_fs26.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path27.default.join(repoPath, file.relativePath);
+  import_node_fs27.default.mkdirSync(import_node_path27.default.dirname(absolutePath), { recursive: true });
+  import_node_fs27.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs26.default.chmodSync(absolutePath, 493);
+    import_node_fs27.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -11833,12 +11960,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs26, import_node_path26, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs27, import_node_path27, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs26 = __toESM(require("fs"));
-    import_node_path26 = __toESM(require("path"));
+    import_node_fs27 = __toESM(require("fs"));
+    import_node_path27 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -12229,7 +12356,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto8.createHash)("sha1").update(import_node_path27.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto8.createHash)("sha1").update(import_node_path28.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -12308,11 +12435,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path27.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs27.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path27.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path28.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs28.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path28.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs27.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs28.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -12432,14 +12559,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process25, import_node_crypto8, import_node_fs27, import_node_path27, import_yaml7;
+var import_node_child_process25, import_node_crypto8, import_node_fs28, import_node_path28, import_yaml7;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process25 = require("child_process");
     import_node_crypto8 = require("crypto");
-    import_node_fs27 = __toESM(require("fs"));
-    import_node_path27 = __toESM(require("path"));
+    import_node_fs28 = __toESM(require("fs"));
+    import_node_path28 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -13261,13 +13388,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs28.default.lstatSync(worktreePath);
+    rootStat = import_node_fs29.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs28.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs29.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -13293,10 +13420,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path28.default.join(dirPath, entry.name);
+      const entryPath = import_node_path29.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs28.default.lstatSync(entryPath);
+        entryStat = import_node_fs29.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -13306,7 +13433,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs28.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs29.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -13370,12 +13497,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs28, import_node_path28, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs29, import_node_path29, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs28 = __toESM(require("fs"));
-    import_node_path28 = __toESM(require("path"));
+    import_node_fs29 = __toESM(require("fs"));
+    import_node_path29 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -13476,7 +13603,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs29.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs30.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -14001,7 +14128,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers = new Map(worktreePaths.map((path28) => [path28, unknownContainers(reason)]));
+      containers = new Map(worktreePaths.map((path29) => [path29, unknownContainers(reason)]));
     }
   }
   const rows = records.map((record) => {
@@ -14050,12 +14177,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process27, import_node_fs29, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process27, import_node_fs30, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
     import_node_child_process27 = require("child_process");
-    import_node_fs29 = __toESM(require("fs"));
+    import_node_fs30 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -14232,7 +14359,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.42" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.44" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {