@devrouter/cli 0.0.43 → 0.0.45

package/dist/devrouter.js

@@ -316,9 +316,9 @@ Config-level \`envMap\` on dependency references aliases per-dep vars to app-exp
 
 ## Workspace isolation (parallel git worktrees / agents)
 
-Run several worktrees of one repo in parallel without host/route collisions. A **workspace token** spans the DevPod id, devrouter routes, \`\${WORKSPACE}\` proxy upstreams, and devcontainer aliases.
+Run several worktrees of one repo in parallel without host/route collisions. A **workspace token** spans the workspace-runtime id, devrouter routes, \`\${WORKSPACE}\` proxy upstreams, and devcontainer aliases.
 
-- **Identity**: each managed linked worktree stores a local token in Git metadata plus a durable owner record in the repository's Git common directory. The record survives linked-worktree removal and binds the exact path to its DevPod ID. First use reuses an exact-path DevPod or derives a sanitized branch/path slug. Later flags or \`DEVROUTER_WORKSPACE\` may repeat the identity but cannot rename it. Ambiguous identities fail closed. The primary checkout remains non-namespaced.
+- **Identity**: each managed linked worktree stores a local token in Git metadata plus a durable owner record in the repository's Git common directory. The record survives linked-worktree removal and binds the exact path to its workspace-runtime ID. First use reconciles persisted metadata, the exact-path owner record, and both DevPod and Devsy registries. It reuses an established agreement, keeps the readable sanitized branch/path slug when free, or claims a deterministic hash-suffixed fallback on collision before provider or route mutation. Later flags or \`DEVROUTER_WORKSPACE\` may repeat the identity but cannot rename it. Unreadable or conflicting evidence fails closed. The primary checkout remains non-namespaced.
 - **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed \`ensure\` rejects every HTTP/TCP proxy upstream outside that exact alias namespace before it mutates DevPod or routes. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: managed scaffolds list the base compose file, then \`\${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}\`; custom repositories may keep another default overlay. Selecting \`.devcontainer/docker-compose.devrouter.yml\` for linked worktrees must pass \`WORKSPACE\` and \`DEVROUTER_WORKSPACE\` across the combined base/overlay config and bind-mount \`\${DEVROUTER_GIT_COMMON_DIR}\` to the same absolute app-container path. The app exposes \`\${WORKSPACE}-app\`; the proxy uses \`upstream: \${WORKSPACE}-app:<port>\`.
@@ -1057,6 +1057,21 @@ function wsFromBranch(branch) {
   const slug = branch.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+/, "").slice(0, MAX_WORKSPACE_LENGTH).replace(/-+$/, "");
   return slug.length > 0 ? slug : void 0;
 }
+function workspaceIdentityFallback(source, attempt) {
+  const readablePrefix = (wsFromBranch(source) ?? "workspace").slice(0, WORKSPACE_IDENTITY_PREFIX_LENGTH).replace(/-+$/, "");
+  const prefix = readablePrefix || "workspace";
+  const hash = (0, import_node_crypto3.createHash)("sha256").update(WORKSPACE_IDENTITY_HASH_DOMAIN, "utf-8").update("\0", "utf-8").update(source, "utf-8").update("\0", "utf-8").update(String(attempt), "utf-8").digest("hex").slice(0, WORKSPACE_IDENTITY_HASH_LENGTH);
+  return `${prefix}-${hash}`;
+}
+function workspaceIdentityCandidates(source) {
+  const candidates = [];
+  const legacy = wsFromBranch(source);
+  if (legacy) candidates.push(legacy);
+  for (let attempt = 0; candidates.length < WORKSPACE_IDENTITY_CANDIDATE_LIMIT; attempt += 1) {
+    candidates.push(workspaceIdentityFallback(source, attempt));
+  }
+  return candidates;
+}
 function isLinkedWorktree(repoPath) {
   const gitPath = import_node_path4.default.join(repoPath, ".git");
   let stat;
@@ -1138,8 +1153,8 @@ function persistWorkspace(repoPath, value) {
   if (!gitDir) {
     throw new Error(`cannot persist workspace identity: '${repoPath}' is not a Git checkout`);
   }
-  import_node_fs5.default.writeFileSync(import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
-`, "utf-8");
+  writeFileAtomically(import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
+`);
   return workspace;
 }
 async function withWorkspaceLifecycleLock(repoPath, operation) {
@@ -1198,15 +1213,21 @@ function resolveWorkspace(repoPath, override) {
   }
   return deriveLinkedWorktreeWorkspace(repoPath);
 }
-var import_node_child_process3, import_node_fs5, import_node_path4, MAX_WORKSPACE_LENGTH, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
+var import_node_child_process3, import_node_crypto3, import_node_fs5, import_node_path4, MAX_WORKSPACE_LENGTH, WORKSPACE_IDENTITY_CANDIDATE_LIMIT, WORKSPACE_IDENTITY_HASH_LENGTH, WORKSPACE_IDENTITY_PREFIX_LENGTH, WORKSPACE_IDENTITY_HASH_DOMAIN, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
 var init_workspace = __esm({
   "src/core/workspace.ts"() {
     "use strict";
     import_node_child_process3 = require("child_process");
+    import_node_crypto3 = require("crypto");
     import_node_fs5 = __toESM(require("fs"));
     import_node_path4 = __toESM(require("path"));
+    init_atomic_file();
     init_file_lock();
     MAX_WORKSPACE_LENGTH = 32;
+    WORKSPACE_IDENTITY_CANDIDATE_LIMIT = 16;
+    WORKSPACE_IDENTITY_HASH_LENGTH = 8;
+    WORKSPACE_IDENTITY_PREFIX_LENGTH = MAX_WORKSPACE_LENGTH - WORKSPACE_IDENTITY_HASH_LENGTH - 1;
+    WORKSPACE_IDENTITY_HASH_DOMAIN = "devrouter-workspace-identity-v1";
     WORKSPACE_METADATA_FILE = "devrouter-workspace";
     WORKSPACE_LOCK_FILE = "devrouter-workspace.lock";
   }
@@ -2509,7 +2530,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.43" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.45" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -3035,8 +3056,8 @@ function buildOnboardingPrompt(options = {}) {
     "- Use `devrouter status --repo <REPO_PATH> --json` and `devrouter doctor --repo <REPO_PATH> --json` to inspect managed desired/active resources, fingerprints, transition state, and values-free drift.",
     "",
     "Workspace isolation (parallel git worktrees / agents):",
-    `- A "workspace token" lets several worktrees of one repo run in parallel without host/route collisions. Each managed linked worktree has a local Git token plus a durable owner record in the repository's Git common directory spanning the DevPod id, devrouter routes, the \`${WORKSPACE_PLACEHOLDER}\` proxy upstream, and devcontainer aliases.`,
-    "- The owner record survives linked-worktree removal and binds the exact path to its DevPod ID. First use reuses an exact-path DevPod or derives a sanitized branch/path identity. Later flags or `DEVROUTER_WORKSPACE` may repeat but cannot rename it. Ambiguous identities fail closed. The primary checkout stays non-namespaced.",
+    `- A "workspace token" lets several worktrees of one repo run in parallel without host/route collisions. Each managed linked worktree has a local Git token plus a durable owner record in the repository's Git common directory spanning the workspace-runtime id, devrouter routes, the \`${WORKSPACE_PLACEHOLDER}\` proxy upstream, and devcontainer aliases.`,
+    "- The owner record survives linked-worktree removal and binds the exact path to its workspace-runtime ID. First use reconciles persisted metadata, the exact-path owner record, and both DevPod and Devsy registries. It preserves an established agreement, uses the readable sanitized identity when free, or claims a deterministic hash-suffixed fallback on collision before provider or route mutation. Later flags or `DEVROUTER_WORKSPACE` may repeat but cannot rename it. Unreadable or conflicting evidence fails closed. The primary checkout stays non-namespaced.",
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
@@ -4110,7 +4131,7 @@ function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto3.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto4.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
@@ -4257,12 +4278,12 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process5, import_node_crypto3, import_node_fs10, import_node_path9, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
+var import_node_child_process5, import_node_crypto4, import_node_fs10, import_node_path9, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
     import_node_child_process5 = require("child_process");
-    import_node_crypto3 = require("crypto");
+    import_node_crypto4 = require("crypto");
     import_node_fs10 = __toESM(require("fs"));
     import_node_path9 = __toESM(require("path"));
     init_devcontainer_config();
@@ -4764,7 +4785,7 @@ var init_routes = __esm({
 
 // src/core/managed-runtime-state.ts
 function stateKey(repoPath, workspace) {
-  return (0, import_node_crypto4.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
+  return (0, import_node_crypto5.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
 function managedRuntimeStatePath(repoPath, workspace) {
   return import_node_path12.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
@@ -4855,11 +4876,11 @@ function markManagedRuntimeDegraded(state, transitionPhase) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
-var import_node_crypto4, import_node_fs13, import_node_path12;
+var import_node_crypto5, import_node_fs13, import_node_path12;
 var init_managed_runtime_state = __esm({
   "src/core/managed-runtime-state.ts"() {
     "use strict";
-    import_node_crypto4 = require("crypto");
+    import_node_crypto5 = require("crypto");
     import_node_fs13 = __toESM(require("fs"));
     import_node_path12 = __toESM(require("path"));
     init_atomic_file();
@@ -4992,7 +5013,7 @@ function isWildcard(values) {
   return values?.length === 1 && values[0] === "*";
 }
 function sha256(contents) {
-  return (0, import_node_crypto5.createHash)("sha256").update(contents, "utf-8").digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(contents, "utf-8").digest("hex");
 }
 function safeComposeProject(value) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
@@ -5177,12 +5198,12 @@ function stopExactManagedService(containerId, service) {
     throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
   }
 }
-var import_node_child_process6, import_node_crypto5, import_node_fs14, import_node_path13, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var import_node_child_process6, import_node_crypto6, import_node_fs14, import_node_path13, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
 var init_devcontainer_profile = __esm({
   "src/core/devcontainer-profile.ts"() {
     "use strict";
     import_node_child_process6 = require("child_process");
-    import_node_crypto5 = require("crypto");
+    import_node_crypto6 = require("crypto");
     import_node_fs14 = __toESM(require("fs"));
     import_node_path13 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
@@ -5954,7 +5975,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto6.X509Certificate(pem);
+  const certificate = new import_node_crypto7.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -5964,6 +5985,9 @@ function parseCertificateDnsHosts(pem) {
 function isHostCoveredByCertificateHost(host, certificateHost) {
   const normalizedHost = normalizeHost(host);
   const normalizedCertificateHost = normalizeHost(certificateHost);
+  if (normalizedHost === normalizedCertificateHost) {
+    return true;
+  }
   if (normalizedCertificateHost.startsWith("*.")) {
     if (normalizedCertificateHost === "*.localhost") {
       return false;
@@ -5975,7 +5999,7 @@ function isHostCoveredByCertificateHost(host, certificateHost) {
     const wildcardPart = normalizedHost.slice(0, normalizedHost.length - suffix.length);
     return wildcardPart.length > 0 && !wildcardPart.includes(".");
   }
-  return normalizedHost === normalizedCertificateHost;
+  return false;
 }
 function findUncoveredCertificateHosts(requiredHosts, certificateHosts) {
   const normalizedRequired = normalizeUniqueHosts(requiredHosts);
@@ -5986,22 +6010,54 @@ function findUncoveredCertificateHosts(requiredHosts, certificateHosts) {
     )
   );
 }
-function readCurrentCertificateHosts() {
+function compactTLSCertificateHosts(hosts) {
+  const normalizedHosts = normalizeUniqueHosts(hosts);
+  const wildcardHosts = new Set(normalizedHosts.filter((host) => host.startsWith("*.")));
+  const siblingGroups = /* @__PURE__ */ new Map();
+  const compacted = new Set(wildcardHosts);
+  for (const host of normalizedHosts) {
+    if (host.startsWith("*.")) {
+      continue;
+    }
+    const labels = host.split(".");
+    if (labels.length < 3 || labels.at(-1) !== "localhost") {
+      compacted.add(host);
+      continue;
+    }
+    const suffix = labels.slice(1).join(".");
+    const siblings = siblingGroups.get(suffix) ?? [];
+    siblings.push(host);
+    siblingGroups.set(suffix, siblings);
+  }
+  for (const [suffix, siblings] of siblingGroups) {
+    const wildcard = `*.${suffix}`;
+    if (siblings.length > 1 || wildcardHosts.has(wildcard)) {
+      compacted.add(wildcard);
+      continue;
+    }
+    compacted.add(siblings[0]);
+  }
+  const selectedWildcards = Array.from(compacted).filter((host) => host.startsWith("*."));
+  return normalizeUniqueHosts(Array.from(compacted)).filter(
+    (host) => host.startsWith("*.") || !selectedWildcards.some((wildcard) => isHostCoveredByCertificateHost(host, wildcard))
+  );
+}
+function readCurrentCertificateHosts(options = {}) {
   if (!import_node_fs16.default.existsSync(CERT_FILE)) {
     return [];
   }
-  const pem = import_node_fs16.default.readFileSync(CERT_FILE, "utf-8");
-  return parseCertificateDnsHosts(pem);
-}
-function currentCertificateHostsOrEmpty() {
   try {
-    return readCurrentCertificateHosts();
-  } catch {
-    return [];
+    const pem = import_node_fs16.default.readFileSync(CERT_FILE, "utf-8");
+    return parseCertificateDnsHosts(pem);
+  } catch (error) {
+    if (options.replaceMalformed) {
+      return [];
+    }
+    throw error;
   }
 }
 function buildDesiredTLSCertificateHosts(requestedHosts, existingCertificateHosts) {
-  return normalizeUniqueHosts([
+  return compactTLSCertificateHosts([
     ...DEFAULT_TLS_CERT_HOSTS,
     ...existingCertificateHosts,
     ...requestedHosts
@@ -6009,35 +6065,75 @@ function buildDesiredTLSCertificateHosts(requestedHosts, existingCertificateHost
 }
 function getTLSHostCoverage(hosts) {
   const requiredHosts = normalizeUniqueHosts([...DEFAULT_TLS_CERT_HOSTS, ...hosts]);
-  const certificateHosts = readCurrentCertificateHosts();
-  const uncoveredHosts = findUncoveredCertificateHosts(requiredHosts, certificateHosts);
-  return {
-    requiredHosts,
-    certificateHosts,
-    uncoveredHosts
-  };
+  return withFileLockSync(
+    TLS_CERTIFICATE_LOCK_FILE,
+    { activity: "TLS certificate inspection", waitMs: TLS_CERTIFICATE_LOCK_WAIT_MS },
+    () => {
+      const certificateHosts = readCurrentCertificateHosts();
+      const uncoveredHosts = findUncoveredCertificateHosts(requiredHosts, certificateHosts);
+      return {
+        requiredHosts,
+        certificateHosts,
+        uncoveredHosts
+      };
+    }
+  );
 }
 async function applyTLSCertificate(options, installTrust) {
   ensureRouterFiles();
-  const alreadyEnabled = isTLSEnabled();
-  const desiredHosts = buildDesiredTLSCertificateHosts(
-    options.hosts ?? [],
-    currentCertificateHostsOrEmpty()
-  );
-  if (installTrust) {
-    ensureMkcert();
-    runOrThrow("mkcert", ["-install"]);
-  } else {
-    getMkcertRootCAPath({ repoPath: options.repoPath });
-  }
-  runOrThrow("mkcert", ["-cert-file", CERT_FILE, "-key-file", CERT_KEY_FILE, ...desiredHosts]);
-  setTLSEnabled(true);
-  refreshHostRoutesDynamicFile();
+  const result = withFileLockSync(
+    TLS_CERTIFICATE_LOCK_FILE,
+    {
+      activity: "TLS certificate refresh",
+      target: options.repoPath,
+      waitMs: TLS_CERTIFICATE_LOCK_WAIT_MS
+    },
+    () => {
+      const alreadyEnabled = isTLSEnabled();
+      if (installTrust) {
+        ensureMkcert();
+        runOrThrow("mkcert", ["-install"]);
+      } else {
+        getMkcertRootCAPath({ repoPath: options.repoPath });
+      }
+      const existingCertificateHosts = readCurrentCertificateHosts({
+        replaceMalformed: installTrust
+      });
+      const desiredHosts = buildDesiredTLSCertificateHosts(
+        options.hosts ?? [],
+        existingCertificateHosts
+      );
+      let certificateHosts = [];
+      let uncoveredHosts = [];
+      for (let attempt = 1; attempt <= TLS_CERTIFICATE_WRITE_ATTEMPTS; attempt += 1) {
+        runOrThrow("mkcert", [
+          "-cert-file",
+          CERT_FILE,
+          "-key-file",
+          CERT_KEY_FILE,
+          ...desiredHosts
+        ]);
+        certificateHosts = readCurrentCertificateHosts();
+        uncoveredHosts = findUncoveredCertificateHosts(desiredHosts, certificateHosts);
+        if (uncoveredHosts.length === 0) {
+          break;
+        }
+      }
+      if (uncoveredHosts.length > 0) {
+        throw new Error(
+          `mkcert did not produce certificate coverage for host(s): ${uncoveredHosts.join(", ")} after ${TLS_CERTIFICATE_WRITE_ATTEMPTS} attempts`
+        );
+      }
+      setTLSEnabled(true);
+      refreshHostRoutesDynamicFile();
+      return { alreadyEnabled, hosts: certificateHosts };
+    }
+  );
   const routerContainer = await findContainerByName("devrouter-traefik");
   if (routerContainer && await isContainerRunning("devrouter-traefik")) {
     startRouterStack();
   }
-  return { alreadyEnabled, hosts: desiredHosts };
+  return result;
 }
 async function installTLS(options = {}) {
   return applyTLSCertificate(options, true);
@@ -6079,18 +6175,22 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process8, import_node_crypto6, import_node_fs16, import_node_path15, DEFAULT_TLS_CERT_HOSTS;
+var import_node_child_process8, import_node_crypto7, import_node_fs16, import_node_path15, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
     import_node_child_process8 = require("child_process");
-    import_node_crypto6 = require("crypto");
+    import_node_crypto7 = require("crypto");
     import_node_fs16 = __toESM(require("fs"));
     import_node_path15 = __toESM(require("path"));
     init_docker();
+    init_file_lock();
     init_host_routes();
     init_router();
     DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
+    TLS_CERTIFICATE_LOCK_FILE = import_node_path15.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+    TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
+    TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
   }
 });
 
@@ -7376,12 +7476,16 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
   import_node_fs21.default.rmSync(filePath);
   return "removed";
 }
-function withWorkspaceOwnershipTransaction(repoPath, operation) {
+function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
   import_node_fs21.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
     import_node_path20.default.join(directory, ".lock"),
-    { activity: "workspace ownership transaction", target: `'${repoPath}'`, waitMs: 5e3 },
+    {
+      activity: "workspace ownership transaction",
+      target: `'${repoPath}'`,
+      waitMs: options.waitMs ?? 5e3
+    },
     () => operation({
       list: () => listWorkspaceOwnershipInDirectory(directory),
       write: (input2) => writeWorkspaceOwnershipInDirectory(directory, input2),
@@ -7390,8 +7494,169 @@ function withWorkspaceOwnershipTransaction(repoPath, operation) {
     })
   );
 }
-function writeWorkspaceOwnership(repoPath, input2) {
-  return withWorkspaceOwnershipTransaction(repoPath, (transaction) => transaction.write(input2));
+function providerPathOwner(providerWorkspaces, worktreePath) {
+  const owners = providerWorkspaces.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, worktreePath)
+  );
+  if (owners.length > 1) {
+    throw new Error(
+      `Worktree '${worktreePath}' is registered by multiple workspace runtimes; no identity was claimed.`
+    );
+  }
+  return owners[0];
+}
+function persistedWorkspaceOwners(repoPath, worktreePath) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const worktree of listGitWorktrees(repoPath)) {
+    if (sameWorkspacePath(worktree.path, worktreePath)) continue;
+    let workspace;
+    try {
+      workspace = readPersistedWorkspace(worktree.path);
+    } catch (error) {
+      if (!import_node_fs21.default.existsSync(worktree.path)) continue;
+      throw error;
+    }
+    if (!workspace) continue;
+    const existing = owners.get(workspace);
+    if (existing && !sameWorkspacePath(existing, worktree.path)) {
+      throw new Error(`Persisted workspace identity '${workspace}' belongs to multiple worktrees.`);
+    }
+    owners.set(workspace, worktree.path);
+  }
+  return owners;
+}
+function claimConflict(workspace, devpodId, worktreePath, records, providerWorkspaces, persistedOwners, exactRecord) {
+  const recordOwner = records.find(
+    (record) => record !== exactRecord && (record.workspace === workspace || record.devpodId === devpodId)
+  );
+  if (recordOwner) {
+    return `workspace owner record '${recordOwner.workspace}' for '${recordOwner.worktreePath}'`;
+  }
+  const providerOwner = providerWorkspaces.find(
+    (providerWorkspace) => providerWorkspace.id === devpodId && !sameWorkspacePath(providerWorkspace.source.localFolder, worktreePath)
+  );
+  if (providerOwner) {
+    return `workspace runtime identity '${providerOwner.id}' already belongs to '${providerOwner.source.localFolder}'`;
+  }
+  const persistedOwner = persistedOwners.get(workspace);
+  if (persistedOwner) {
+    return `persisted checkout metadata for '${persistedOwner}'`;
+  }
+  return void 0;
+}
+function claimWorkspaceIdentity(repoPath, input2) {
+  const worktreePath = comparableWorkspacePath(repoPath);
+  const exactProvider = providerPathOwner(input2.providerWorkspaces, worktreePath);
+  return withWorkspaceOwnershipTransaction(repoPath, (transaction) => {
+    const records = transaction.list();
+    const exactRecords = records.filter(
+      (record) => sameWorkspacePath(record.worktreePath, worktreePath)
+    );
+    if (exactRecords.length > 1) {
+      throw new Error(
+        `Worktree '${worktreePath}' has multiple workspace owner records; no identity was claimed.`
+      );
+    }
+    const exactRecord = exactRecords[0];
+    const persisted = readPersistedWorkspace(worktreePath);
+    const persistedOwners = persistedWorkspaceOwners(repoPath, worktreePath);
+    if (exactRecord) {
+      if (persisted && persisted !== exactRecord.workspace) {
+        throw new Error(
+          `Persisted workspace identity '${persisted}' disagrees with owner record '${exactRecord.workspace}'.`
+        );
+      }
+      if (exactProvider && exactProvider.id !== exactRecord.devpodId) {
+        throw new Error(
+          `Workspace runtime '${exactProvider.id}' disagrees with owner record '${exactRecord.devpodId}'.`
+        );
+      }
+      const conflict2 = claimConflict(
+        exactRecord.workspace,
+        exactRecord.devpodId,
+        worktreePath,
+        records,
+        input2.providerWorkspaces,
+        persistedOwners,
+        exactRecord
+      );
+      if (conflict2) {
+        throw new Error(
+          `Workspace '${exactRecord.workspace}' conflicts with ${conflict2}; no identity was claimed.`
+        );
+      }
+      if (!persisted) persistWorkspace(worktreePath, exactRecord.workspace);
+      return transaction.write({
+        workspace: exactRecord.workspace,
+        worktreePath,
+        branch: input2.branch ?? null,
+        devpodId: exactRecord.devpodId
+      });
+    }
+    if (persisted && exactProvider && persisted !== exactProvider.id) {
+      throw new Error(
+        `Persisted workspace identity '${persisted}' disagrees with workspace runtime '${exactProvider.id}'.`
+      );
+    }
+    let workspace = persisted ?? exactProvider?.id;
+    let devpodId = exactProvider?.id ?? persisted;
+    if (!workspace || !devpodId) {
+      if (input2.unavailableRuntimes.length > 0) {
+        throw new Error(
+          `Cannot claim a new workspace identity because these runtime registries are unavailable: ${input2.unavailableRuntimes.join(", ")}.`
+        );
+      }
+      const candidate = workspaceIdentityCandidates(input2.source).find(
+        (next) => !claimConflict(
+          next,
+          next,
+          worktreePath,
+          records,
+          input2.providerWorkspaces,
+          persistedOwners
+        )
+      );
+      if (!candidate) {
+        throw new Error(
+          `Could not allocate a collision-safe workspace identity for '${worktreePath}'.`
+        );
+      }
+      workspace = candidate;
+      devpodId = candidate;
+    }
+    const conflict = claimConflict(
+      workspace,
+      devpodId,
+      worktreePath,
+      records,
+      input2.providerWorkspaces,
+      persistedOwners
+    );
+    if (conflict) {
+      throw new Error(
+        `Workspace '${workspace}' conflicts with ${conflict}; no identity was claimed.`
+      );
+    }
+    const written = transaction.write({
+      workspace,
+      worktreePath,
+      branch: input2.branch ?? null,
+      devpodId
+    });
+    try {
+      persistWorkspace(worktreePath, workspace);
+    } catch (error) {
+      const cleanup = transaction.removeIfMatches(written);
+      if (cleanup !== "removed") {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `Could not persist workspace identity and owner-record rollback was '${cleanup}': ${detail}`
+        );
+      }
+      throw error;
+    }
+    return written;
+  });
 }
 function removeWorkspaceOwnership(repoPath, workspace) {
   return withWorkspaceOwnershipTransaction(
@@ -8074,7 +8339,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.43" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.45" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -9150,25 +9415,30 @@ async function waitForHttpRoutes(repoPath, apps, timeoutMs) {
   );
 }
 function resolveLinkedTarget(repoPath) {
-  const devpods = listDevpodWorkspaces(repoPath);
-  const existingDevpod = selectDevpodWorkspace(devpods, repoPath);
-  const persisted = readPersistedWorkspace(repoPath);
-  const candidate = existingDevpod?.id ?? persisted ?? resolveWorktreeWorkspace(repoPath);
-  if (!candidate) {
-    throw new Error(`Could not resolve a workspace identity for '${repoPath}'.`);
-  }
-  const otherOwner = devpods.find(
-    (devpod) => devpod.id === candidate && !sameWorkspacePath(devpod.source.localFolder, repoPath)
+  const snapshots = getWorkspaceRegistrySnapshots();
+  const providerWorkspaces = [
+    ...snapshots.devpod ?? [],
+    ...snapshots.devsy?.map((workspace) => ({
+      id: workspace.id,
+      source: workspace.source,
+      ...workspace.lastUsed ? { lastUsed: workspace.lastUsed } : {},
+      ...workspace.lastUsedMalformed ? { lastUsedMalformed: true } : {}
+    })) ?? []
+  ];
+  const branch = currentBranch(repoPath);
+  const claim = claimWorkspaceIdentity(repoPath, {
+    source: branch ?? repoPath,
+    branch: branch ?? null,
+    providerWorkspaces,
+    unavailableRuntimes: snapshots.unavailable
+  });
+  const existingDevpod = providerWorkspaces.find(
+    (workspace) => workspace.id === claim.devpodId && sameWorkspacePath(workspace.source.localFolder, repoPath)
   );
-  if (otherOwner) {
-    throw new Error(
-      `DevPod identity '${candidate}' already belongs to '${otherOwner.source.localFolder}'.`
-    );
-  }
   return {
     kind: "linked",
-    workspace: persistWorkspace(repoPath, candidate),
-    devpodId: candidate,
+    workspace: claim.workspace,
+    devpodId: claim.devpodId,
     hadExactDevpod: Boolean(existingDevpod),
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
@@ -9315,15 +9585,6 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         managedConfigWritten = true;
       }
       const upstreamHosts = parsedUpstreams.map((upstream) => upstream.host);
-      const ownership = target.kind === "linked" ? {
-        workspace: target.workspace,
-        worktreePath: repoPath,
-        branch: currentBranch(repoPath),
-        devpodId: target.devpodId
-      } : void 0;
-      if (ownership) {
-        writeWorkspaceOwnership(repoPath, ownership);
-      }
       const currentTarget = () => target.kind === "linked" ? target : { ...target, devpodId };
       const startAndProveAttachment = (recreate = false) => {
         const requestedTarget = currentTarget();
@@ -9346,9 +9607,6 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           if (error instanceof DevpodStartPostconditionError) environmentStarted = true;
           throw error;
         }
-        if (ownership) {
-          writeWorkspaceOwnership(repoPath, ownership);
-        }
       };
       const preflight = (timeoutMs) => waitForContainerPreflight(repoPath, currentTarget(), upstreamHosts, timeoutMs);
       const recreateAndPreflight = async () => {
@@ -9766,6 +10024,7 @@ var init_workspace_ensure = __esm({
     init_router();
     init_workspace();
     init_workspace_ownership();
+    init_workspace_runtime();
     DEVCONTAINER_OVERLAY = "docker-compose.devrouter.yml";
     DEFAULT_READINESS_TIMEOUT_MS = 12e4;
     POLL_INTERVAL_MS = 1e3;
@@ -9822,6 +10081,11 @@ var init_ensure = __esm({
 });
 
 // src/core/workspace-lifecycle.ts
+function withWorkspaceAllocationTransaction(repoPath, operation) {
+  return withWorkspaceOwnershipTransaction(repoPath, operation, {
+    waitMs: WORKSPACE_ALLOCATION_LOCK_WAIT_MS
+  });
+}
 function warnMissingWorkspaceOwnership(repoPath) {
   const missing = listMissingWorkspaceOwnership(repoPath);
   if (missing.length === 0) return;
@@ -9983,44 +10247,67 @@ async function workspaceUp(branch, opts = {}) {
   if (!ws) {
     throw new Error(`Branch '${branch}' does not yield a valid workspace token.`);
   }
-  const worktreePath = opts.path ? import_node_path24.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
-  if (import_node_fs24.default.existsSync(worktreePath)) {
-    const registered = listGitWorktrees(mainRepo).find(
-      (worktree) => sameWorkspacePath(worktree.path, worktreePath)
+  const worktreePath = withWorkspaceAllocationTransaction(mainRepo, () => {
+    const worktrees = listGitWorktrees(mainRepo);
+    const branchWorktrees = worktrees.filter((worktree) => worktree.branch === branch);
+    if (branchWorktrees.length > 1) {
+      throw new Error(
+        `Branch '${branch}' is checked out in multiple worktrees: ${branchWorktrees.map((worktree) => worktree.path).join(", ")}`
+      );
+    }
+    const existingBranch = branchWorktrees[0];
+    const candidatePaths = workspaceIdentityCandidates(branch).map(
+      (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
-    if (!registered || sameWorkspacePath(registered.path, mainRepo)) {
-      throw new Error(`Existing path '${worktreePath}' is not a linked worktree of '${mainRepo}'.`);
+    const generatedPath = candidatePaths.find(
+      (candidate) => !import_node_fs24.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+    );
+    const selectedPath = opts.path ? import_node_path24.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    if (!selectedPath) {
+      throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
-    if (registered.branch !== branch) {
+    if (existingBranch && !sameWorkspacePath(existingBranch.path, selectedPath)) {
       throw new Error(
-        `Existing worktree '${worktreePath}' uses branch '${registered.branch ?? "detached"}', not '${branch}'.`
+        `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    process.stdout.write(`Worktree already exists: ${worktreePath}
+    if (import_node_fs24.default.existsSync(selectedPath)) {
+      const registered = worktrees.find(
+        (worktree) => sameWorkspacePath(worktree.path, selectedPath)
+      );
+      if (!registered || sameWorkspacePath(registered.path, mainRepo)) {
+        throw new Error(
+          `Existing path '${selectedPath}' is not a linked worktree of '${mainRepo}'.`
+        );
+      }
+      if (registered.branch !== branch) {
+        throw new Error(
+          `Existing worktree '${selectedPath}' uses branch '${registered.branch ?? "detached"}', not '${branch}'.`
+        );
+      }
+      process.stdout.write(`Worktree already exists: ${selectedPath}
 `);
-  } else {
-    if (!opts.path) {
-      assertDefaultWorktreeRootIgnored(mainRepo);
+      return selectedPath;
     }
-    const add = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "add", worktreePath, branch], {
+    if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
+    const add = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
       const addNew = (0, import_node_child_process20.spawnSync)(
         "git",
-        ["-C", mainRepo, "worktree", "add", "-b", branch, worktreePath],
-        {
-          encoding: "utf-8"
-        }
+        ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
+        { encoding: "utf-8" }
       );
       if (addNew.status !== 0) {
-        const detail = [add.stderr, addNew.stderr].map((s) => s?.trim()).filter(Boolean).join("; ");
+        const detail = [add.stderr, addNew.stderr].map((stderr) => stderr?.trim()).filter(Boolean).join("; ");
         throw new Error(`git worktree add failed: ${detail || "unknown error"}`);
       }
     }
-    process.stdout.write(`Created worktree ${worktreePath} (workspace '${ws}')
+    process.stdout.write(`Created worktree ${selectedPath}
 `);
-  }
+    return selectedPath;
+  });
   if (opts.noDevpod) {
     warnMissingWorkspaceOwnership(mainRepo);
     process.stdout.write("Skipped environment startup; no routes were changed.\n");
@@ -10163,7 +10450,7 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process20, import_node_fs24, import_node_path24;
+var import_node_child_process20, import_node_fs24, import_node_path24, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
@@ -10177,6 +10464,7 @@ var init_workspace_lifecycle = __esm({
     init_workspace();
     init_workspace_ensure();
     init_workspace_ownership();
+    WORKSPACE_ALLOCATION_LOCK_WAIT_MS = 6e4;
   }
 });
 
@@ -10370,7 +10658,7 @@ async function devpodExec(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto7.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto8.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -10447,12 +10735,12 @@ async function devpodExec(repoPath, command) {
     });
   });
 }
-var import_node_child_process22, import_node_crypto7, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
+var import_node_child_process22, import_node_crypto8, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
 var init_devpod_exec = __esm({
   "src/core/devpod-exec.ts"() {
     "use strict";
     import_node_child_process22 = require("child_process");
-    import_node_crypto7 = require("crypto");
+    import_node_crypto8 = require("crypto");
     init_devpod_environment();
     init_devpod_workspaces();
     init_devsy_exec();
@@ -12277,7 +12565,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto8.createHash)("sha1").update(import_node_path28.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto9.createHash)("sha1").update(import_node_path28.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -12480,12 +12768,12 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process25, import_node_crypto8, import_node_fs28, import_node_path28, import_yaml7;
+var import_node_child_process25, import_node_crypto9, import_node_fs28, import_node_path28, import_yaml7;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process25 = require("child_process");
-    import_node_crypto8 = require("crypto");
+    import_node_crypto9 = require("crypto");
     import_node_fs28 = __toESM(require("fs"));
     import_node_path28 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
@@ -14280,7 +14568,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.43" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.45" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.43",
+  "version": "0.0.45",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.0.44.md

@@ -0,0 +1,30 @@
+# Upgrade to devrouter 0.0.44
+
+Shared local TLS certificate refresh now serializes inspection, generation,
+verification, and route-configuration refresh across parallel worktrees.
+
+1. Install `@devrouter/cli@0.0.44` on the host and bump `.devrouter.yml` to
+   `devrouter.version: 0.0.44`.
+2. Keep using `devrouter ensure <checkout>` for primary and linked checkouts.
+   Do not run `mkcert` manually for individual worktree hosts; Devrouter now
+   preserves and compacts shared certificate coverage under its own lock.
+3. Do not remove the shared certificate or lock as routine cleanup. Routine
+   refresh still fails closed on a malformed certificate; the explicit
+   repository-scoped setup command printed by Devrouter replaces that generated
+   certificate while holding the same machine-global lock.
+
+Verification:
+
+- Run `devrouter -V --repo <checkout>` and confirm the installed CLI and local
+  repository report `0.0.44`.
+- Start two linked checkouts concurrently with `devrouter ensure`; require both
+  namespaced HTTPS routes to pass readiness and remain covered afterward.
+- Run `devrouter doctor --repo <checkout>` and confirm no TLS host-coverage
+  warning remains.
+
+Report template:
+
+- CLI/config version: `0.0.44`
+- Parallel worktree routes: `<passed or details>`
+- TLS host coverage: `<passed or details>`
+- Remaining blockers: `<none or details>`

package/upgrade-prompts/0.0.45.md

@@ -0,0 +1,33 @@
+# Upgrade to devrouter 0.0.45
+
+Parallel linked worktrees now claim collision-safe workspace identities across
+mixed DevPod and Devsy fleets.
+
+1. Install `@devrouter/cli@0.0.45` on the host and bump `.devrouter.yml` to
+   `devrouter.version: 0.0.45`.
+2. Keep using `devrouter ensure <checkout>` or `devrouter workspace up
+   <branch>`. Do not derive workspace ids or worktree paths in wrapper scripts.
+3. Existing persisted workspace identities stay unchanged. A genuinely new
+   checkout keeps its readable branch/path identity when free and receives a
+   deterministic hash-suffixed fallback only when another checkout or provider
+   already occupies that identity.
+4. Treat an unreadable DevPod or Devsy registry as a startup blocker for a new
+   claim. Devrouter fails before provider, process, service, or route mutation.
+
+Verification:
+
+- Run `devrouter -V --repo <checkout>` and confirm the installed CLI and local
+  repository report `0.0.45`.
+- Start two new linked checkouts whose branch names share the first 32
+  sanitized characters, one with DevPod and one with Devsy.
+- Require distinct persisted workspace ids, exact provider registrations, and
+  namespaced routes. Stop each checkout with `devrouter stop <checkout>` and
+  require both route sets to disappear.
+
+Report template:
+
+- CLI/config version: `0.0.45`
+- Colliding-prefix identities: `<passed or details>`
+- DevPod/Devsy ownership: `<passed or details>`
+- Exact stop and route release: `<passed or details>`
+- Remaining blockers: `<none or details>`