@devrouter/cli 0.0.44 → 0.0.45

package/dist/devrouter.js

@@ -316,9 +316,9 @@ Config-level \`envMap\` on dependency references aliases per-dep vars to app-exp
 
 ## Workspace isolation (parallel git worktrees / agents)
 
-Run several worktrees of one repo in parallel without host/route collisions. A **workspace token** spans the DevPod id, devrouter routes, \`\${WORKSPACE}\` proxy upstreams, and devcontainer aliases.
+Run several worktrees of one repo in parallel without host/route collisions. A **workspace token** spans the workspace-runtime id, devrouter routes, \`\${WORKSPACE}\` proxy upstreams, and devcontainer aliases.
 
-- **Identity**: each managed linked worktree stores a local token in Git metadata plus a durable owner record in the repository's Git common directory. The record survives linked-worktree removal and binds the exact path to its DevPod ID. First use reuses an exact-path DevPod or derives a sanitized branch/path slug. Later flags or \`DEVROUTER_WORKSPACE\` may repeat the identity but cannot rename it. Ambiguous identities fail closed. The primary checkout remains non-namespaced.
+- **Identity**: each managed linked worktree stores a local token in Git metadata plus a durable owner record in the repository's Git common directory. The record survives linked-worktree removal and binds the exact path to its workspace-runtime ID. First use reconciles persisted metadata, the exact-path owner record, and both DevPod and Devsy registries. It reuses an established agreement, keeps the readable sanitized branch/path slug when free, or claims a deterministic hash-suffixed fallback on collision before provider or route mutation. Later flags or \`DEVROUTER_WORKSPACE\` may repeat the identity but cannot rename it. Unreadable or conflicting evidence fails closed. The primary checkout remains non-namespaced.
 - **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed \`ensure\` rejects every HTTP/TCP proxy upstream outside that exact alias namespace before it mutates DevPod or routes. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: managed scaffolds list the base compose file, then \`\${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}\`; custom repositories may keep another default overlay. Selecting \`.devcontainer/docker-compose.devrouter.yml\` for linked worktrees must pass \`WORKSPACE\` and \`DEVROUTER_WORKSPACE\` across the combined base/overlay config and bind-mount \`\${DEVROUTER_GIT_COMMON_DIR}\` to the same absolute app-container path. The app exposes \`\${WORKSPACE}-app\`; the proxy uses \`upstream: \${WORKSPACE}-app:<port>\`.
@@ -1057,6 +1057,21 @@ function wsFromBranch(branch) {
   const slug = branch.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+/, "").slice(0, MAX_WORKSPACE_LENGTH).replace(/-+$/, "");
   return slug.length > 0 ? slug : void 0;
 }
+function workspaceIdentityFallback(source, attempt) {
+  const readablePrefix = (wsFromBranch(source) ?? "workspace").slice(0, WORKSPACE_IDENTITY_PREFIX_LENGTH).replace(/-+$/, "");
+  const prefix = readablePrefix || "workspace";
+  const hash = (0, import_node_crypto3.createHash)("sha256").update(WORKSPACE_IDENTITY_HASH_DOMAIN, "utf-8").update("\0", "utf-8").update(source, "utf-8").update("\0", "utf-8").update(String(attempt), "utf-8").digest("hex").slice(0, WORKSPACE_IDENTITY_HASH_LENGTH);
+  return `${prefix}-${hash}`;
+}
+function workspaceIdentityCandidates(source) {
+  const candidates = [];
+  const legacy = wsFromBranch(source);
+  if (legacy) candidates.push(legacy);
+  for (let attempt = 0; candidates.length < WORKSPACE_IDENTITY_CANDIDATE_LIMIT; attempt += 1) {
+    candidates.push(workspaceIdentityFallback(source, attempt));
+  }
+  return candidates;
+}
 function isLinkedWorktree(repoPath) {
   const gitPath = import_node_path4.default.join(repoPath, ".git");
   let stat;
@@ -1138,8 +1153,8 @@ function persistWorkspace(repoPath, value) {
   if (!gitDir) {
     throw new Error(`cannot persist workspace identity: '${repoPath}' is not a Git checkout`);
   }
-  import_node_fs5.default.writeFileSync(import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
-`, "utf-8");
+  writeFileAtomically(import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
+`);
   return workspace;
 }
 async function withWorkspaceLifecycleLock(repoPath, operation) {
@@ -1198,15 +1213,21 @@ function resolveWorkspace(repoPath, override) {
   }
   return deriveLinkedWorktreeWorkspace(repoPath);
 }
-var import_node_child_process3, import_node_fs5, import_node_path4, MAX_WORKSPACE_LENGTH, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
+var import_node_child_process3, import_node_crypto3, import_node_fs5, import_node_path4, MAX_WORKSPACE_LENGTH, WORKSPACE_IDENTITY_CANDIDATE_LIMIT, WORKSPACE_IDENTITY_HASH_LENGTH, WORKSPACE_IDENTITY_PREFIX_LENGTH, WORKSPACE_IDENTITY_HASH_DOMAIN, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
 var init_workspace = __esm({
   "src/core/workspace.ts"() {
     "use strict";
     import_node_child_process3 = require("child_process");
+    import_node_crypto3 = require("crypto");
     import_node_fs5 = __toESM(require("fs"));
     import_node_path4 = __toESM(require("path"));
+    init_atomic_file();
     init_file_lock();
     MAX_WORKSPACE_LENGTH = 32;
+    WORKSPACE_IDENTITY_CANDIDATE_LIMIT = 16;
+    WORKSPACE_IDENTITY_HASH_LENGTH = 8;
+    WORKSPACE_IDENTITY_PREFIX_LENGTH = MAX_WORKSPACE_LENGTH - WORKSPACE_IDENTITY_HASH_LENGTH - 1;
+    WORKSPACE_IDENTITY_HASH_DOMAIN = "devrouter-workspace-identity-v1";
     WORKSPACE_METADATA_FILE = "devrouter-workspace";
     WORKSPACE_LOCK_FILE = "devrouter-workspace.lock";
   }
@@ -2509,7 +2530,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.44" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.45" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -3035,8 +3056,8 @@ function buildOnboardingPrompt(options = {}) {
     "- Use `devrouter status --repo <REPO_PATH> --json` and `devrouter doctor --repo <REPO_PATH> --json` to inspect managed desired/active resources, fingerprints, transition state, and values-free drift.",
     "",
     "Workspace isolation (parallel git worktrees / agents):",
-    `- A "workspace token" lets several worktrees of one repo run in parallel without host/route collisions. Each managed linked worktree has a local Git token plus a durable owner record in the repository's Git common directory spanning the DevPod id, devrouter routes, the \`${WORKSPACE_PLACEHOLDER}\` proxy upstream, and devcontainer aliases.`,
-    "- The owner record survives linked-worktree removal and binds the exact path to its DevPod ID. First use reuses an exact-path DevPod or derives a sanitized branch/path identity. Later flags or `DEVROUTER_WORKSPACE` may repeat but cannot rename it. Ambiguous identities fail closed. The primary checkout stays non-namespaced.",
+    `- A "workspace token" lets several worktrees of one repo run in parallel without host/route collisions. Each managed linked worktree has a local Git token plus a durable owner record in the repository's Git common directory spanning the workspace-runtime id, devrouter routes, the \`${WORKSPACE_PLACEHOLDER}\` proxy upstream, and devcontainer aliases.`,
+    "- The owner record survives linked-worktree removal and binds the exact path to its workspace-runtime ID. First use reconciles persisted metadata, the exact-path owner record, and both DevPod and Devsy registries. It preserves an established agreement, uses the readable sanitized identity when free, or claims a deterministic hash-suffixed fallback on collision before provider or route mutation. Later flags or `DEVROUTER_WORKSPACE` may repeat but cannot rename it. Unreadable or conflicting evidence fails closed. The primary checkout stays non-namespaced.",
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
@@ -4110,7 +4131,7 @@ function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto3.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto4.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
@@ -4257,12 +4278,12 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process5, import_node_crypto3, import_node_fs10, import_node_path9, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
+var import_node_child_process5, import_node_crypto4, import_node_fs10, import_node_path9, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
     import_node_child_process5 = require("child_process");
-    import_node_crypto3 = require("crypto");
+    import_node_crypto4 = require("crypto");
     import_node_fs10 = __toESM(require("fs"));
     import_node_path9 = __toESM(require("path"));
     init_devcontainer_config();
@@ -4764,7 +4785,7 @@ var init_routes = __esm({
 
 // src/core/managed-runtime-state.ts
 function stateKey(repoPath, workspace) {
-  return (0, import_node_crypto4.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
+  return (0, import_node_crypto5.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
 function managedRuntimeStatePath(repoPath, workspace) {
   return import_node_path12.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
@@ -4855,11 +4876,11 @@ function markManagedRuntimeDegraded(state, transitionPhase) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
-var import_node_crypto4, import_node_fs13, import_node_path12;
+var import_node_crypto5, import_node_fs13, import_node_path12;
 var init_managed_runtime_state = __esm({
   "src/core/managed-runtime-state.ts"() {
     "use strict";
-    import_node_crypto4 = require("crypto");
+    import_node_crypto5 = require("crypto");
     import_node_fs13 = __toESM(require("fs"));
     import_node_path12 = __toESM(require("path"));
     init_atomic_file();
@@ -4992,7 +5013,7 @@ function isWildcard(values) {
   return values?.length === 1 && values[0] === "*";
 }
 function sha256(contents) {
-  return (0, import_node_crypto5.createHash)("sha256").update(contents, "utf-8").digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(contents, "utf-8").digest("hex");
 }
 function safeComposeProject(value) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
@@ -5177,12 +5198,12 @@ function stopExactManagedService(containerId, service) {
     throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
   }
 }
-var import_node_child_process6, import_node_crypto5, import_node_fs14, import_node_path13, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var import_node_child_process6, import_node_crypto6, import_node_fs14, import_node_path13, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
 var init_devcontainer_profile = __esm({
   "src/core/devcontainer-profile.ts"() {
     "use strict";
     import_node_child_process6 = require("child_process");
-    import_node_crypto5 = require("crypto");
+    import_node_crypto6 = require("crypto");
     import_node_fs14 = __toESM(require("fs"));
     import_node_path13 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
@@ -5954,7 +5975,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto6.X509Certificate(pem);
+  const certificate = new import_node_crypto7.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -6154,12 +6175,12 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process8, import_node_crypto6, import_node_fs16, import_node_path15, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
+var import_node_child_process8, import_node_crypto7, import_node_fs16, import_node_path15, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
     import_node_child_process8 = require("child_process");
-    import_node_crypto6 = require("crypto");
+    import_node_crypto7 = require("crypto");
     import_node_fs16 = __toESM(require("fs"));
     import_node_path15 = __toESM(require("path"));
     init_docker();
@@ -7455,12 +7476,16 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
   import_node_fs21.default.rmSync(filePath);
   return "removed";
 }
-function withWorkspaceOwnershipTransaction(repoPath, operation) {
+function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
   import_node_fs21.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
     import_node_path20.default.join(directory, ".lock"),
-    { activity: "workspace ownership transaction", target: `'${repoPath}'`, waitMs: 5e3 },
+    {
+      activity: "workspace ownership transaction",
+      target: `'${repoPath}'`,
+      waitMs: options.waitMs ?? 5e3
+    },
     () => operation({
       list: () => listWorkspaceOwnershipInDirectory(directory),
       write: (input2) => writeWorkspaceOwnershipInDirectory(directory, input2),
@@ -7469,8 +7494,169 @@ function withWorkspaceOwnershipTransaction(repoPath, operation) {
     })
   );
 }
-function writeWorkspaceOwnership(repoPath, input2) {
-  return withWorkspaceOwnershipTransaction(repoPath, (transaction) => transaction.write(input2));
+function providerPathOwner(providerWorkspaces, worktreePath) {
+  const owners = providerWorkspaces.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, worktreePath)
+  );
+  if (owners.length > 1) {
+    throw new Error(
+      `Worktree '${worktreePath}' is registered by multiple workspace runtimes; no identity was claimed.`
+    );
+  }
+  return owners[0];
+}
+function persistedWorkspaceOwners(repoPath, worktreePath) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const worktree of listGitWorktrees(repoPath)) {
+    if (sameWorkspacePath(worktree.path, worktreePath)) continue;
+    let workspace;
+    try {
+      workspace = readPersistedWorkspace(worktree.path);
+    } catch (error) {
+      if (!import_node_fs21.default.existsSync(worktree.path)) continue;
+      throw error;
+    }
+    if (!workspace) continue;
+    const existing = owners.get(workspace);
+    if (existing && !sameWorkspacePath(existing, worktree.path)) {
+      throw new Error(`Persisted workspace identity '${workspace}' belongs to multiple worktrees.`);
+    }
+    owners.set(workspace, worktree.path);
+  }
+  return owners;
+}
+function claimConflict(workspace, devpodId, worktreePath, records, providerWorkspaces, persistedOwners, exactRecord) {
+  const recordOwner = records.find(
+    (record) => record !== exactRecord && (record.workspace === workspace || record.devpodId === devpodId)
+  );
+  if (recordOwner) {
+    return `workspace owner record '${recordOwner.workspace}' for '${recordOwner.worktreePath}'`;
+  }
+  const providerOwner = providerWorkspaces.find(
+    (providerWorkspace) => providerWorkspace.id === devpodId && !sameWorkspacePath(providerWorkspace.source.localFolder, worktreePath)
+  );
+  if (providerOwner) {
+    return `workspace runtime identity '${providerOwner.id}' already belongs to '${providerOwner.source.localFolder}'`;
+  }
+  const persistedOwner = persistedOwners.get(workspace);
+  if (persistedOwner) {
+    return `persisted checkout metadata for '${persistedOwner}'`;
+  }
+  return void 0;
+}
+function claimWorkspaceIdentity(repoPath, input2) {
+  const worktreePath = comparableWorkspacePath(repoPath);
+  const exactProvider = providerPathOwner(input2.providerWorkspaces, worktreePath);
+  return withWorkspaceOwnershipTransaction(repoPath, (transaction) => {
+    const records = transaction.list();
+    const exactRecords = records.filter(
+      (record) => sameWorkspacePath(record.worktreePath, worktreePath)
+    );
+    if (exactRecords.length > 1) {
+      throw new Error(
+        `Worktree '${worktreePath}' has multiple workspace owner records; no identity was claimed.`
+      );
+    }
+    const exactRecord = exactRecords[0];
+    const persisted = readPersistedWorkspace(worktreePath);
+    const persistedOwners = persistedWorkspaceOwners(repoPath, worktreePath);
+    if (exactRecord) {
+      if (persisted && persisted !== exactRecord.workspace) {
+        throw new Error(
+          `Persisted workspace identity '${persisted}' disagrees with owner record '${exactRecord.workspace}'.`
+        );
+      }
+      if (exactProvider && exactProvider.id !== exactRecord.devpodId) {
+        throw new Error(
+          `Workspace runtime '${exactProvider.id}' disagrees with owner record '${exactRecord.devpodId}'.`
+        );
+      }
+      const conflict2 = claimConflict(
+        exactRecord.workspace,
+        exactRecord.devpodId,
+        worktreePath,
+        records,
+        input2.providerWorkspaces,
+        persistedOwners,
+        exactRecord
+      );
+      if (conflict2) {
+        throw new Error(
+          `Workspace '${exactRecord.workspace}' conflicts with ${conflict2}; no identity was claimed.`
+        );
+      }
+      if (!persisted) persistWorkspace(worktreePath, exactRecord.workspace);
+      return transaction.write({
+        workspace: exactRecord.workspace,
+        worktreePath,
+        branch: input2.branch ?? null,
+        devpodId: exactRecord.devpodId
+      });
+    }
+    if (persisted && exactProvider && persisted !== exactProvider.id) {
+      throw new Error(
+        `Persisted workspace identity '${persisted}' disagrees with workspace runtime '${exactProvider.id}'.`
+      );
+    }
+    let workspace = persisted ?? exactProvider?.id;
+    let devpodId = exactProvider?.id ?? persisted;
+    if (!workspace || !devpodId) {
+      if (input2.unavailableRuntimes.length > 0) {
+        throw new Error(
+          `Cannot claim a new workspace identity because these runtime registries are unavailable: ${input2.unavailableRuntimes.join(", ")}.`
+        );
+      }
+      const candidate = workspaceIdentityCandidates(input2.source).find(
+        (next) => !claimConflict(
+          next,
+          next,
+          worktreePath,
+          records,
+          input2.providerWorkspaces,
+          persistedOwners
+        )
+      );
+      if (!candidate) {
+        throw new Error(
+          `Could not allocate a collision-safe workspace identity for '${worktreePath}'.`
+        );
+      }
+      workspace = candidate;
+      devpodId = candidate;
+    }
+    const conflict = claimConflict(
+      workspace,
+      devpodId,
+      worktreePath,
+      records,
+      input2.providerWorkspaces,
+      persistedOwners
+    );
+    if (conflict) {
+      throw new Error(
+        `Workspace '${workspace}' conflicts with ${conflict}; no identity was claimed.`
+      );
+    }
+    const written = transaction.write({
+      workspace,
+      worktreePath,
+      branch: input2.branch ?? null,
+      devpodId
+    });
+    try {
+      persistWorkspace(worktreePath, workspace);
+    } catch (error) {
+      const cleanup = transaction.removeIfMatches(written);
+      if (cleanup !== "removed") {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `Could not persist workspace identity and owner-record rollback was '${cleanup}': ${detail}`
+        );
+      }
+      throw error;
+    }
+    return written;
+  });
 }
 function removeWorkspaceOwnership(repoPath, workspace) {
   return withWorkspaceOwnershipTransaction(
@@ -8153,7 +8339,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.44" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.45" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -9229,25 +9415,30 @@ async function waitForHttpRoutes(repoPath, apps, timeoutMs) {
   );
 }
 function resolveLinkedTarget(repoPath) {
-  const devpods = listDevpodWorkspaces(repoPath);
-  const existingDevpod = selectDevpodWorkspace(devpods, repoPath);
-  const persisted = readPersistedWorkspace(repoPath);
-  const candidate = existingDevpod?.id ?? persisted ?? resolveWorktreeWorkspace(repoPath);
-  if (!candidate) {
-    throw new Error(`Could not resolve a workspace identity for '${repoPath}'.`);
-  }
-  const otherOwner = devpods.find(
-    (devpod) => devpod.id === candidate && !sameWorkspacePath(devpod.source.localFolder, repoPath)
+  const snapshots = getWorkspaceRegistrySnapshots();
+  const providerWorkspaces = [
+    ...snapshots.devpod ?? [],
+    ...snapshots.devsy?.map((workspace) => ({
+      id: workspace.id,
+      source: workspace.source,
+      ...workspace.lastUsed ? { lastUsed: workspace.lastUsed } : {},
+      ...workspace.lastUsedMalformed ? { lastUsedMalformed: true } : {}
+    })) ?? []
+  ];
+  const branch = currentBranch(repoPath);
+  const claim = claimWorkspaceIdentity(repoPath, {
+    source: branch ?? repoPath,
+    branch: branch ?? null,
+    providerWorkspaces,
+    unavailableRuntimes: snapshots.unavailable
+  });
+  const existingDevpod = providerWorkspaces.find(
+    (workspace) => workspace.id === claim.devpodId && sameWorkspacePath(workspace.source.localFolder, repoPath)
   );
-  if (otherOwner) {
-    throw new Error(
-      `DevPod identity '${candidate}' already belongs to '${otherOwner.source.localFolder}'.`
-    );
-  }
   return {
     kind: "linked",
-    workspace: persistWorkspace(repoPath, candidate),
-    devpodId: candidate,
+    workspace: claim.workspace,
+    devpodId: claim.devpodId,
     hadExactDevpod: Boolean(existingDevpod),
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
@@ -9394,15 +9585,6 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         managedConfigWritten = true;
       }
       const upstreamHosts = parsedUpstreams.map((upstream) => upstream.host);
-      const ownership = target.kind === "linked" ? {
-        workspace: target.workspace,
-        worktreePath: repoPath,
-        branch: currentBranch(repoPath),
-        devpodId: target.devpodId
-      } : void 0;
-      if (ownership) {
-        writeWorkspaceOwnership(repoPath, ownership);
-      }
       const currentTarget = () => target.kind === "linked" ? target : { ...target, devpodId };
       const startAndProveAttachment = (recreate = false) => {
         const requestedTarget = currentTarget();
@@ -9425,9 +9607,6 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           if (error instanceof DevpodStartPostconditionError) environmentStarted = true;
           throw error;
         }
-        if (ownership) {
-          writeWorkspaceOwnership(repoPath, ownership);
-        }
       };
       const preflight = (timeoutMs) => waitForContainerPreflight(repoPath, currentTarget(), upstreamHosts, timeoutMs);
       const recreateAndPreflight = async () => {
@@ -9845,6 +10024,7 @@ var init_workspace_ensure = __esm({
     init_router();
     init_workspace();
     init_workspace_ownership();
+    init_workspace_runtime();
     DEVCONTAINER_OVERLAY = "docker-compose.devrouter.yml";
     DEFAULT_READINESS_TIMEOUT_MS = 12e4;
     POLL_INTERVAL_MS = 1e3;
@@ -9901,6 +10081,11 @@ var init_ensure = __esm({
 });
 
 // src/core/workspace-lifecycle.ts
+function withWorkspaceAllocationTransaction(repoPath, operation) {
+  return withWorkspaceOwnershipTransaction(repoPath, operation, {
+    waitMs: WORKSPACE_ALLOCATION_LOCK_WAIT_MS
+  });
+}
 function warnMissingWorkspaceOwnership(repoPath) {
   const missing = listMissingWorkspaceOwnership(repoPath);
   if (missing.length === 0) return;
@@ -10062,44 +10247,67 @@ async function workspaceUp(branch, opts = {}) {
   if (!ws) {
     throw new Error(`Branch '${branch}' does not yield a valid workspace token.`);
   }
-  const worktreePath = opts.path ? import_node_path24.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
-  if (import_node_fs24.default.existsSync(worktreePath)) {
-    const registered = listGitWorktrees(mainRepo).find(
-      (worktree) => sameWorkspacePath(worktree.path, worktreePath)
+  const worktreePath = withWorkspaceAllocationTransaction(mainRepo, () => {
+    const worktrees = listGitWorktrees(mainRepo);
+    const branchWorktrees = worktrees.filter((worktree) => worktree.branch === branch);
+    if (branchWorktrees.length > 1) {
+      throw new Error(
+        `Branch '${branch}' is checked out in multiple worktrees: ${branchWorktrees.map((worktree) => worktree.path).join(", ")}`
+      );
+    }
+    const existingBranch = branchWorktrees[0];
+    const candidatePaths = workspaceIdentityCandidates(branch).map(
+      (candidate) => defaultWorktreePath(mainRepo, candidate)
+    );
+    const generatedPath = candidatePaths.find(
+      (candidate) => !import_node_fs24.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    if (!registered || sameWorkspacePath(registered.path, mainRepo)) {
-      throw new Error(`Existing path '${worktreePath}' is not a linked worktree of '${mainRepo}'.`);
+    const selectedPath = opts.path ? import_node_path24.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    if (!selectedPath) {
+      throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
-    if (registered.branch !== branch) {
+    if (existingBranch && !sameWorkspacePath(existingBranch.path, selectedPath)) {
       throw new Error(
-        `Existing worktree '${worktreePath}' uses branch '${registered.branch ?? "detached"}', not '${branch}'.`
+        `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    process.stdout.write(`Worktree already exists: ${worktreePath}
+    if (import_node_fs24.default.existsSync(selectedPath)) {
+      const registered = worktrees.find(
+        (worktree) => sameWorkspacePath(worktree.path, selectedPath)
+      );
+      if (!registered || sameWorkspacePath(registered.path, mainRepo)) {
+        throw new Error(
+          `Existing path '${selectedPath}' is not a linked worktree of '${mainRepo}'.`
+        );
+      }
+      if (registered.branch !== branch) {
+        throw new Error(
+          `Existing worktree '${selectedPath}' uses branch '${registered.branch ?? "detached"}', not '${branch}'.`
+        );
+      }
+      process.stdout.write(`Worktree already exists: ${selectedPath}
 `);
-  } else {
-    if (!opts.path) {
-      assertDefaultWorktreeRootIgnored(mainRepo);
+      return selectedPath;
     }
-    const add = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "add", worktreePath, branch], {
+    if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
+    const add = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
       const addNew = (0, import_node_child_process20.spawnSync)(
         "git",
-        ["-C", mainRepo, "worktree", "add", "-b", branch, worktreePath],
-        {
-          encoding: "utf-8"
-        }
+        ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
+        { encoding: "utf-8" }
       );
       if (addNew.status !== 0) {
-        const detail = [add.stderr, addNew.stderr].map((s) => s?.trim()).filter(Boolean).join("; ");
+        const detail = [add.stderr, addNew.stderr].map((stderr) => stderr?.trim()).filter(Boolean).join("; ");
         throw new Error(`git worktree add failed: ${detail || "unknown error"}`);
       }
     }
-    process.stdout.write(`Created worktree ${worktreePath} (workspace '${ws}')
+    process.stdout.write(`Created worktree ${selectedPath}
 `);
-  }
+    return selectedPath;
+  });
   if (opts.noDevpod) {
     warnMissingWorkspaceOwnership(mainRepo);
     process.stdout.write("Skipped environment startup; no routes were changed.\n");
@@ -10242,7 +10450,7 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process20, import_node_fs24, import_node_path24;
+var import_node_child_process20, import_node_fs24, import_node_path24, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
@@ -10256,6 +10464,7 @@ var init_workspace_lifecycle = __esm({
     init_workspace();
     init_workspace_ensure();
     init_workspace_ownership();
+    WORKSPACE_ALLOCATION_LOCK_WAIT_MS = 6e4;
   }
 });
 
@@ -10449,7 +10658,7 @@ async function devpodExec(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto7.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto8.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -10526,12 +10735,12 @@ async function devpodExec(repoPath, command) {
     });
   });
 }
-var import_node_child_process22, import_node_crypto7, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
+var import_node_child_process22, import_node_crypto8, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
 var init_devpod_exec = __esm({
   "src/core/devpod-exec.ts"() {
     "use strict";
     import_node_child_process22 = require("child_process");
-    import_node_crypto7 = require("crypto");
+    import_node_crypto8 = require("crypto");
     init_devpod_environment();
     init_devpod_workspaces();
     init_devsy_exec();
@@ -12356,7 +12565,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto8.createHash)("sha1").update(import_node_path28.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto9.createHash)("sha1").update(import_node_path28.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -12559,12 +12768,12 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process25, import_node_crypto8, import_node_fs28, import_node_path28, import_yaml7;
+var import_node_child_process25, import_node_crypto9, import_node_fs28, import_node_path28, import_yaml7;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process25 = require("child_process");
-    import_node_crypto8 = require("crypto");
+    import_node_crypto9 = require("crypto");
     import_node_fs28 = __toESM(require("fs"));
     import_node_path28 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
@@ -14359,7 +14568,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.44" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.45" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.0.44",
+  "version": "0.0.45",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.0.45.md

@@ -0,0 +1,33 @@
+# Upgrade to devrouter 0.0.45
+
+Parallel linked worktrees now claim collision-safe workspace identities across
+mixed DevPod and Devsy fleets.
+
+1. Install `@devrouter/cli@0.0.45` on the host and bump `.devrouter.yml` to
+   `devrouter.version: 0.0.45`.
+2. Keep using `devrouter ensure <checkout>` or `devrouter workspace up
+   <branch>`. Do not derive workspace ids or worktree paths in wrapper scripts.
+3. Existing persisted workspace identities stay unchanged. A genuinely new
+   checkout keeps its readable branch/path identity when free and receives a
+   deterministic hash-suffixed fallback only when another checkout or provider
+   already occupies that identity.
+4. Treat an unreadable DevPod or Devsy registry as a startup blocker for a new
+   claim. Devrouter fails before provider, process, service, or route mutation.
+
+Verification:
+
+- Run `devrouter -V --repo <checkout>` and confirm the installed CLI and local
+  repository report `0.0.45`.
+- Start two new linked checkouts whose branch names share the first 32
+  sanitized characters, one with DevPod and one with Devsy.
+- Require distinct persisted workspace ids, exact provider registrations, and
+  namespaced routes. Stop each checkout with `devrouter stop <checkout>` and
+  require both route sets to disappear.
+
+Report template:
+
+- CLI/config version: `0.0.45`
+- Colliding-prefix identities: `<passed or details>`
+- DevPod/Devsy ownership: `<passed or details>`
+- Exact stop and route release: `<passed or details>`
+- Remaining blockers: `<none or details>`