@devrouter/cli 0.0.44 → 0.0.46

package/dist/devrouter.js

@@ -316,13 +316,13 @@ Config-level \`envMap\` on dependency references aliases per-dep vars to app-exp
 
 ## Workspace isolation (parallel git worktrees / agents)
 
-Run several worktrees of one repo in parallel without host/route collisions. A **workspace token** spans the DevPod id, devrouter routes, \`\${WORKSPACE}\` proxy upstreams, and devcontainer aliases.
+Run several worktrees of one repo in parallel without host/route collisions. A **workspace token** spans the workspace-runtime id, devrouter routes, \`\${WORKSPACE}\` proxy upstreams, and devcontainer aliases.
 
-- **Identity**: each managed linked worktree stores a local token in Git metadata plus a durable owner record in the repository's Git common directory. The record survives linked-worktree removal and binds the exact path to its DevPod ID. First use reuses an exact-path DevPod or derives a sanitized branch/path slug. Later flags or \`DEVROUTER_WORKSPACE\` may repeat the identity but cannot rename it. Ambiguous identities fail closed. The primary checkout remains non-namespaced.
+- **Identity**: each managed linked worktree stores a local token in Git metadata plus a durable owner record in the repository's Git common directory. The record survives linked-worktree removal and binds the exact path to its workspace-runtime ID. First use reconciles persisted metadata, the exact-path owner record, and both DevPod and Devsy registries. It reuses an established agreement, keeps the readable sanitized branch/path slug when free, or claims a deterministic hash-suffixed fallback on collision before provider or route mutation. Later flags or \`DEVROUTER_WORKSPACE\` may repeat the identity but cannot rename it. Unreadable or conflicting evidence fails closed. The primary checkout remains non-namespaced.
 - **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed \`ensure\` rejects every HTTP/TCP proxy upstream outside that exact alias namespace before it mutates DevPod or routes. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: managed scaffolds list the base compose file, then \`\${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}\`; custom repositories may keep another default overlay. Selecting \`.devcontainer/docker-compose.devrouter.yml\` for linked worktrees must pass \`WORKSPACE\` and \`DEVROUTER_WORKSPACE\` across the combined base/overlay config and bind-mount \`\${DEVROUTER_GIT_COMMON_DIR}\` to the same absolute app-container path. The app exposes \`\${WORKSPACE}-app\`; the proxy uses \`upstream: \${WORKSPACE}-app:<port>\`.
-- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects.
+- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects. A failed Devsy start that reports the agent-binary acquisition failure names the \`DEVSY_AGENT_BINARY\` remediation.
 - **Managed process identity**: \`ensure\` executes an exact captured adapter snapshot. Default reuse includes command argv, workspace, and adapter SHA-256. Set \`DEVROUTER_PROCESS_FINGERPRINT_ENV\` only to comma-separated non-secret environment names whose values affect runtime identity; secret-like names are rejected and raw values are never persisted.
 - **Route state**: the versioned Traefik dynamic file is authoritative for both metadata and rendering. JSON is a compatibility mirror; valid headerless generations migrate automatically, while corrupt canonical metadata fails closed.
 - **Cleanup**: \`workspace cleanup --repo . --inactive-for 30d --json\` is a report-only, no-\`--yes\` report for managed linked workspaces. It joins ownership (\`present|missing|locked|conflict\`), workspace runtime registration, runtime state (\`running|stopped|busy|not-found|absent|unknown\`), checkout, route, advisory activity, and integration evidence without mutating the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. Local DevPod/Devsy list/status checks always run; \`--check-merged\` alone enables read-only origin and matching GitHub/GitLab checks. Treat \`not-found\` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit \`gc\`/\`down\` can remove exact stale registration only after expected-ID \`NotFound\` proof and ownership revalidation. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
@@ -898,16 +898,65 @@ function parseLockOwner(value) {
     return { pid };
   }
 }
-function isLockOwnerLive(owner) {
-  if (!isProcessAlive(owner.pid)) return false;
+function parseCanonicalLockOwner(value) {
+  const trimmed = value.trim();
+  return CANONICAL_OWNER_RE.test(trimmed) ? parseLockOwner(trimmed) : void 0;
+}
+function parseLockRecord(value) {
+  const trimmed = value.trim();
+  const lastColon = trimmed.lastIndexOf(":");
+  if (lastColon >= 0 && CANONICAL_OWNER_RE.test(trimmed.slice(0, lastColon))) {
+    const tail = Number(trimmed.slice(lastColon + 1));
+    if (Number.isInteger(tail) && tail > 0) {
+      return { owner: parseLockOwner(trimmed.slice(0, lastColon)), acquiredAtMs: tail };
+    }
+  }
+  return { owner: parseLockOwner(trimmed) };
+}
+function isLockOwnerLive(owner, cache, now = Date.now()) {
+  const cacheKey = `${owner.pid}:${owner.processBirth ?? "legacy"}`;
+  if (!isProcessAlive(owner.pid)) {
+    cache.delete(cacheKey);
+    return false;
+  }
   if (!owner.processBirth) return true;
+  const cached = cache.get(cacheKey);
+  if (cached && now - cached.checkedAtMs < PROCESS_BIRTH_RECHECK_INTERVAL_MS) {
+    return cached.live;
+  }
   const currentBirth = processBirthIdentity(owner.pid);
-  return currentBirth === void 0 || currentBirth === owner.processBirth;
+  const live = currentBirth === void 0 || currentBirth === owner.processBirth;
+  cache.set(cacheKey, { checkedAtMs: now, live });
+  return live;
 }
 function sameFile(left, right) {
   return left.dev === right.dev && left.ino === right.ino;
 }
-function tryReclaimStaleLock(lockPath, staleLinkPath) {
+function inspectFairQueue(lockPath, ownTicketPath, livenessCache) {
+  const directory = import_node_path4.default.dirname(lockPath);
+  const prefix = `${import_node_path4.default.basename(lockPath)}.queue.`;
+  for (; ; ) {
+    const names = import_node_fs4.default.readdirSync(directory).filter((name) => name.startsWith(prefix)).sort();
+    const ownName = import_node_path4.default.basename(ownTicketPath);
+    const position = names.indexOf(ownName);
+    if (position < 0) {
+      throw new Error("provider mutation queue ticket disappeared before acquisition");
+    }
+    const leaderPath = import_node_path4.default.join(directory, names[0]);
+    let leader;
+    try {
+      leader = parseCanonicalLockOwner(import_node_fs4.default.readFileSync(leaderPath, "utf-8"));
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    if (leader && isLockOwnerLive(leader, livenessCache)) {
+      return { leaderPid: leader.pid, position: position + 1 };
+    }
+    import_node_fs4.default.rmSync(leaderPath, { force: true });
+  }
+}
+function tryReclaimStaleLock(lockPath, staleLinkPath, livenessCache) {
   let fd;
   try {
     fd = import_node_fs4.default.openSync(lockPath, "r");
@@ -918,9 +967,9 @@ function tryReclaimStaleLock(lockPath, staleLinkPath) {
     throw error;
   }
   try {
-    const owner = parseLockOwner(import_node_fs4.default.readFileSync(fd, "utf-8").trim());
-    if (owner && isLockOwnerLive(owner)) {
-      return { kind: "live", pid: owner.pid };
+    const record = parseLockRecord(import_node_fs4.default.readFileSync(fd, "utf-8"));
+    if (record.owner && isLockOwnerLive(record.owner, livenessCache)) {
+      return { kind: "live", pid: record.owner.pid, acquiredAtMs: record.acquiredAtMs };
     }
     const staleStat = import_node_fs4.default.fstatSync(fd);
     if (staleStat.nlink !== 1) {
@@ -965,28 +1014,87 @@ function acquireFileLock(lockPath, options) {
   const owner = `${process.pid}:${Buffer.from(processBirth).toString("base64url")}:${ownerId}`;
   const candidatePath = `${lockPath}.${process.pid}.${ownerId}.candidate`;
   const staleLinkPath = `${candidatePath}.stale`;
+  const enqueuedAtMs = Date.now();
+  const queueTicketPath = `${lockPath}.queue.${String(enqueuedAtMs).padStart(13, "0")}.${String(process.pid).padStart(10, "0")}.${ownerId}`;
+  const queueCandidatePath = `${queueTicketPath}.candidate`;
   const deadline = Date.now() + (options.waitMs ?? 0);
+  const waitStartedAt = Date.now();
+  const progressIntervalMs = options.progressIntervalMs ?? DEFAULT_WAIT_PROGRESS_INTERVAL_MS;
+  let lastProgressAt = waitStartedAt;
   let reclaimAttempts = 0;
+  const livenessCache = /* @__PURE__ */ new Map();
   import_node_fs4.default.writeFileSync(candidatePath, `${owner}
+`, {
+    encoding: "utf-8",
+    flag: "wx"
+  });
+  if (options.fair) {
+    import_node_fs4.default.writeFileSync(queueCandidatePath, `${owner}
 `, { encoding: "utf-8", flag: "wx" });
+    import_node_fs4.default.renameSync(queueCandidatePath, queueTicketPath);
+  }
   try {
     for (; ; ) {
+      let queueState;
+      if (options.fair) {
+        queueState = inspectFairQueue(lockPath, queueTicketPath, livenessCache);
+      }
+      if (queueState && queueState.position > 1) {
+        const now = Date.now();
+        if (now >= deadline) {
+          const target = options.target ? ` for ${options.target}` : "";
+          const waitedSeconds = Math.round((now - waitStartedAt) / 1e3);
+          throw new Error(
+            `${options.activity} is still queued${target} (position ${queueState.position}, ahead PID ${queueState.leaderPid}); gave up after waiting ${waitedSeconds}s`
+          );
+        }
+        if (options.onWait && now - lastProgressAt >= progressIntervalMs) {
+          lastProgressAt = now;
+          options.onWait({
+            waitingMs: now - waitStartedAt,
+            holderPid: queueState.leaderPid,
+            queuePosition: queueState.position,
+            waitingOn: "queue"
+          });
+        }
+        sleepSync(20);
+        continue;
+      }
+      const acquiredAtMs = Date.now();
+      const record = `${owner}:${acquiredAtMs}`;
+      import_node_fs4.default.writeFileSync(candidatePath, `${record}
+`, "utf-8");
       try {
         import_node_fs4.default.linkSync(candidatePath, lockPath);
-        return owner;
+        return record;
       } catch (error) {
         if (error.code !== "EEXIST") {
           throw error;
         }
       }
-      const state = tryReclaimStaleLock(lockPath, staleLinkPath);
+      const state = tryReclaimStaleLock(lockPath, staleLinkPath, livenessCache);
       if (state.kind === "reclaimed") {
         continue;
       }
       if (state.kind === "live") {
-        if (Date.now() >= deadline) {
+        const now = Date.now();
+        if (now >= deadline) {
           const target = options.target ? ` for ${options.target}` : "";
-          throw new Error(`${options.activity} is already running${target} (PID ${state.pid})`);
+          const waitedSeconds = Math.round((now - waitStartedAt) / 1e3);
+          const heldSeconds = state.acquiredAtMs !== void 0 ? `, held for ${Math.round((now - state.acquiredAtMs) / 1e3)}s` : "";
+          throw new Error(
+            `${options.activity} is already running${target} (PID ${state.pid}${heldSeconds}); gave up after waiting ${waitedSeconds}s`
+          );
+        }
+        if (options.onWait && now - lastProgressAt >= progressIntervalMs) {
+          lastProgressAt = now;
+          options.onWait({
+            waitingMs: now - waitStartedAt,
+            holderPid: state.pid,
+            holderHeldMs: state.acquiredAtMs !== void 0 ? Math.max(0, now - state.acquiredAtMs) : void 0,
+            queuePosition: queueState?.position,
+            waitingOn: "lock"
+          });
         }
         sleepSync(20);
         continue;
@@ -1002,6 +1110,8 @@ function acquireFileLock(lockPath, options) {
   } finally {
     import_node_fs4.default.rmSync(candidatePath, { force: true });
     import_node_fs4.default.rmSync(staleLinkPath, { force: true });
+    import_node_fs4.default.rmSync(queueCandidatePath, { force: true });
+    import_node_fs4.default.rmSync(queueTicketPath, { force: true });
   }
 }
 function releaseFileLock(lockPath, owner) {
@@ -1031,19 +1141,33 @@ async function withFileLock(lockPath, options, operation) {
     releaseFileLock(lockPath, owner);
   }
 }
-var import_node_child_process2, import_node_crypto2, import_node_fs4;
+function createStderrWaitReporter(activity, target) {
+  return (progress) => {
+    const heldSeconds = progress.holderHeldMs !== void 0 ? `, held for ${Math.round(progress.holderHeldMs / 1e3)}s` : "";
+    const status = progress.waitingOn === "queue" ? `waiting in provider queue position ${progress.queuePosition} led by PID ${progress.holderPid}` : progress.queuePosition !== void 0 && progress.queuePosition > 1 ? `waiting in provider queue position ${progress.queuePosition}; provider lock held by PID ${progress.holderPid}${heldSeconds}` : `waiting for the provider lock held by PID ${progress.holderPid}${heldSeconds}`;
+    process.stderr.write(
+      `${activity} for ${target}: ${status}; waited ${Math.round(progress.waitingMs / 1e3)}s so far
+`
+    );
+  };
+}
+var import_node_child_process2, import_node_crypto2, import_node_fs4, import_node_path4, DEFAULT_WAIT_PROGRESS_INTERVAL_MS, PROCESS_BIRTH_RECHECK_INTERVAL_MS, CANONICAL_OWNER_RE;
 var init_file_lock = __esm({
   "src/core/file-lock.ts"() {
     "use strict";
     import_node_child_process2 = require("child_process");
     import_node_crypto2 = require("crypto");
     import_node_fs4 = __toESM(require("fs"));
+    import_node_path4 = __toESM(require("path"));
+    DEFAULT_WAIT_PROGRESS_INTERVAL_MS = 1e4;
+    PROCESS_BIRTH_RECHECK_INTERVAL_MS = 1e3;
+    CANONICAL_OWNER_RE = /^[0-9]+:[A-Za-z0-9_-]+:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
   }
 });
 
 // src/core/workspace.ts
 function comparableWorkspacePath(filePath) {
-  const resolved = import_node_path4.default.resolve(filePath);
+  const resolved = import_node_path5.default.resolve(filePath);
   try {
     return import_node_fs5.default.realpathSync.native(resolved);
   } catch {
@@ -1057,8 +1181,23 @@ function wsFromBranch(branch) {
   const slug = branch.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+/, "").slice(0, MAX_WORKSPACE_LENGTH).replace(/-+$/, "");
   return slug.length > 0 ? slug : void 0;
 }
+function workspaceIdentityFallback(source, attempt) {
+  const readablePrefix = (wsFromBranch(source) ?? "workspace").slice(0, WORKSPACE_IDENTITY_PREFIX_LENGTH).replace(/-+$/, "");
+  const prefix = readablePrefix || "workspace";
+  const hash = (0, import_node_crypto3.createHash)("sha256").update(WORKSPACE_IDENTITY_HASH_DOMAIN, "utf-8").update("\0", "utf-8").update(source, "utf-8").update("\0", "utf-8").update(String(attempt), "utf-8").digest("hex").slice(0, WORKSPACE_IDENTITY_HASH_LENGTH);
+  return `${prefix}-${hash}`;
+}
+function workspaceIdentityCandidates(source) {
+  const candidates = [];
+  const legacy = wsFromBranch(source);
+  if (legacy) candidates.push(legacy);
+  for (let attempt = 0; candidates.length < WORKSPACE_IDENTITY_CANDIDATE_LIMIT; attempt += 1) {
+    candidates.push(workspaceIdentityFallback(source, attempt));
+  }
+  return candidates;
+}
 function isLinkedWorktree(repoPath) {
-  const gitPath = import_node_path4.default.join(repoPath, ".git");
+  const gitPath = import_node_path5.default.join(repoPath, ".git");
   let stat;
   try {
     stat = import_node_fs5.default.statSync(gitPath);
@@ -1082,7 +1221,7 @@ function isLinkedWorktree(repoPath) {
   return /(^|\/)worktrees\//.test(gitdir);
 }
 function gitMetadataDir(repoPath) {
-  const gitPath = import_node_path4.default.join(repoPath, ".git");
+  const gitPath = import_node_path5.default.join(repoPath, ".git");
   let stat;
   try {
     stat = import_node_fs5.default.statSync(gitPath);
@@ -1099,7 +1238,7 @@ function gitMetadataDir(repoPath) {
   if (!match) {
     return void 0;
   }
-  return import_node_path4.default.resolve(repoPath, match[1].trim());
+  return import_node_path5.default.resolve(repoPath, match[1].trim());
 }
 function validatePersistedWorkspace(value) {
   const workspace = value.trim();
@@ -1113,7 +1252,7 @@ function readPersistedWorkspace(repoPath) {
   if (!gitDir) {
     return void 0;
   }
-  const metadataPath = import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE);
+  const metadataPath = import_node_path5.default.join(gitDir, WORKSPACE_METADATA_FILE);
   try {
     return validatePersistedWorkspace(import_node_fs5.default.readFileSync(metadataPath, "utf-8"));
   } catch (error) {
@@ -1138,8 +1277,8 @@ function persistWorkspace(repoPath, value) {
   if (!gitDir) {
     throw new Error(`cannot persist workspace identity: '${repoPath}' is not a Git checkout`);
   }
-  import_node_fs5.default.writeFileSync(import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
-`, "utf-8");
+  writeFileAtomically(import_node_path5.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
+`);
   return workspace;
 }
 async function withWorkspaceLifecycleLock(repoPath, operation) {
@@ -1147,7 +1286,7 @@ async function withWorkspaceLifecycleLock(repoPath, operation) {
   if (!gitDir) {
     throw new Error(`cannot lock workspace lifecycle: '${repoPath}' is not a Git checkout`);
   }
-  const lockPath = import_node_path4.default.join(gitDir, WORKSPACE_LOCK_FILE);
+  const lockPath = import_node_path5.default.join(gitDir, WORKSPACE_LOCK_FILE);
   return withFileLock(
     lockPath,
     { activity: "workspace lifecycle", target: `'${repoPath}'` },
@@ -1175,7 +1314,7 @@ function deriveLinkedWorktreeWorkspace(repoPath, linkedWorktreeBranch) {
     return void 0;
   }
   const branch = currentBranch(repoPath);
-  return wsFromBranch(branch ?? import_node_path4.default.basename(import_node_path4.default.resolve(repoPath)));
+  return wsFromBranch(branch ?? import_node_path5.default.basename(import_node_path5.default.resolve(repoPath)));
 }
 function resolveWorktreeWorkspace(repoPath, linkedWorktreeBranch) {
   return readPersistedWorkspace(repoPath) ?? deriveLinkedWorktreeWorkspace(repoPath, linkedWorktreeBranch);
@@ -1198,15 +1337,21 @@ function resolveWorkspace(repoPath, override) {
   }
   return deriveLinkedWorktreeWorkspace(repoPath);
 }
-var import_node_child_process3, import_node_fs5, import_node_path4, MAX_WORKSPACE_LENGTH, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
+var import_node_child_process3, import_node_crypto3, import_node_fs5, import_node_path5, MAX_WORKSPACE_LENGTH, WORKSPACE_IDENTITY_CANDIDATE_LIMIT, WORKSPACE_IDENTITY_HASH_LENGTH, WORKSPACE_IDENTITY_PREFIX_LENGTH, WORKSPACE_IDENTITY_HASH_DOMAIN, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
 var init_workspace = __esm({
   "src/core/workspace.ts"() {
     "use strict";
     import_node_child_process3 = require("child_process");
+    import_node_crypto3 = require("crypto");
     import_node_fs5 = __toESM(require("fs"));
-    import_node_path4 = __toESM(require("path"));
+    import_node_path5 = __toESM(require("path"));
+    init_atomic_file();
     init_file_lock();
     MAX_WORKSPACE_LENGTH = 32;
+    WORKSPACE_IDENTITY_CANDIDATE_LIMIT = 16;
+    WORKSPACE_IDENTITY_HASH_LENGTH = 8;
+    WORKSPACE_IDENTITY_PREFIX_LENGTH = MAX_WORKSPACE_LENGTH - WORKSPACE_IDENTITY_HASH_LENGTH - 1;
+    WORKSPACE_IDENTITY_HASH_DOMAIN = "devrouter-workspace-identity-v1";
     WORKSPACE_METADATA_FILE = "devrouter-workspace";
     WORKSPACE_LOCK_FILE = "devrouter-workspace.lock";
   }
@@ -1623,7 +1768,7 @@ function listHostRoutes(tlsEnabled) {
       protocol: isTcp ? `tcp/${tcpProtocol}` : "http",
       appName: route.name,
       serviceName: route.name,
-      projectName: import_node_path5.default.basename(route.repoPath),
+      projectName: import_node_path6.default.basename(route.repoPath),
       hosts: [route.host],
       // TCP routes are reached via an SNI-aware client on the shared protocol
       // port; surface a protocol-scheme URL rather than http(s)://.
@@ -1638,12 +1783,12 @@ function listHostRoutes(tlsEnabled) {
     };
   });
 }
-var import_node_fs6, import_node_path5, import_node_util, import_yaml, LOOPBACK_HOSTS, UPSTREAM_RE, TCP_TLS_ALPN_PROTOCOLS, ROUTE_METADATA_PREFIX, ROUTE_METADATA_FAMILY_PREFIX, STATE_LOCK_FILE;
+var import_node_fs6, import_node_path6, import_node_util, import_yaml, LOOPBACK_HOSTS, UPSTREAM_RE, TCP_TLS_ALPN_PROTOCOLS, ROUTE_METADATA_PREFIX, ROUTE_METADATA_FAMILY_PREFIX, STATE_LOCK_FILE;
 var init_host_routes = __esm({
   "src/core/host-routes.ts"() {
     "use strict";
     import_node_fs6 = __toESM(require("fs"));
-    import_node_path5 = __toESM(require("path"));
+    import_node_path6 = __toESM(require("path"));
     import_node_util = require("util");
     import_yaml = __toESM(require("yaml"));
     init_atomic_file();
@@ -2491,10 +2636,10 @@ function appToNodeValue(app) {
   return value;
 }
 function resolveRepoPath(repoPath) {
-  return import_node_path6.default.resolve(repoPath ?? process.cwd());
+  return import_node_path7.default.resolve(repoPath ?? process.cwd());
 }
 function getRepoConfigPath(repoPath) {
-  return import_node_path6.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
+  return import_node_path7.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
 }
 function loadRepoConfig(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
@@ -2509,7 +2654,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.44" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.46" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -2542,7 +2687,7 @@ function initRepoConfig(repoPath, options = {}) {
       }
     } : {},
     project: {
-      name: import_node_path6.default.basename(resolvedRepoPath)
+      name: import_node_path7.default.basename(resolvedRepoPath)
     },
     apps: []
   };
@@ -2771,7 +2916,7 @@ function namespaceHost(host, workspace) {
   return `${base}.${workspace}${suffix}`;
 }
 function applyWorkspace(config, workspace, repoPath) {
-  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path6.default.basename(import_node_path6.default.resolve(repoPath))) ?? "app";
+  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path7.default.basename(import_node_path7.default.resolve(repoPath))) ?? "app";
   const substitutionToken = workspace ?? defaultToken;
   const next = structuredClone(config);
   for (const app of next.apps) {
@@ -2853,12 +2998,12 @@ function resolveAppDependencies(config, app) {
   }
   return results;
 }
-var import_node_fs7, import_node_path6, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY, PROFILE_NAME_RE, MAX_PROFILES;
+var import_node_fs7, import_node_path7, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY, PROFILE_NAME_RE, MAX_PROFILES;
 var init_repo_config = __esm({
   "src/core/repo-config.ts"() {
     "use strict";
     import_node_fs7 = __toESM(require("fs"));
-    import_node_path6 = __toESM(require("path"));
+    import_node_path7 = __toESM(require("path"));
     import_yaml2 = __toESM(require("yaml"));
     init_capabilities();
     init_host_routes();
@@ -3035,11 +3180,11 @@ function buildOnboardingPrompt(options = {}) {
     "- Use `devrouter status --repo <REPO_PATH> --json` and `devrouter doctor --repo <REPO_PATH> --json` to inspect managed desired/active resources, fingerprints, transition state, and values-free drift.",
     "",
     "Workspace isolation (parallel git worktrees / agents):",
-    `- A "workspace token" lets several worktrees of one repo run in parallel without host/route collisions. Each managed linked worktree has a local Git token plus a durable owner record in the repository's Git common directory spanning the DevPod id, devrouter routes, the \`${WORKSPACE_PLACEHOLDER}\` proxy upstream, and devcontainer aliases.`,
-    "- The owner record survives linked-worktree removal and binds the exact path to its DevPod ID. First use reuses an exact-path DevPod or derives a sanitized branch/path identity. Later flags or `DEVROUTER_WORKSPACE` may repeat but cannot rename it. Ambiguous identities fail closed. The primary checkout stays non-namespaced.",
+    `- A "workspace token" lets several worktrees of one repo run in parallel without host/route collisions. Each managed linked worktree has a local Git token plus a durable owner record in the repository's Git common directory spanning the workspace-runtime id, devrouter routes, the \`${WORKSPACE_PLACEHOLDER}\` proxy upstream, and devcontainer aliases.`,
+    "- The owner record survives linked-worktree removal and binds the exact path to its workspace-runtime ID. First use reconciles persisted metadata, the exact-path owner record, and both DevPod and Devsy registries. It preserves an established agreement, uses the readable sanitized identity when free, or claims a deterministic hash-suffixed fallback on collision before provider or route mutation. Later flags or `DEVROUTER_WORKSPACE` may repeat but cannot rename it. Unreadable or conflicting evidence fails closed. The primary checkout stays non-namespaced.",
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
-    "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
@@ -3766,7 +3911,7 @@ function readPromptDirectory(promptDirPath) {
       continue;
     }
     const version = normalizeVersion(basename);
-    const promptPath = import_node_path7.default.join(promptDirPath, file.name);
+    const promptPath = import_node_path8.default.join(promptDirPath, file.name);
     const prompt = import_node_fs8.default.readFileSync(promptPath, "utf-8").trim();
     releases.push({ version, prompt, promptPath });
   }
@@ -3788,17 +3933,17 @@ function listAvailableUpgradeTargets(currentVersion, releases) {
 }
 function resolvePromptDirectory(explicitPath) {
   if (explicitPath) {
-    return import_node_path7.default.resolve(explicitPath);
+    return import_node_path8.default.resolve(explicitPath);
   }
-  const entryFile = process.argv[1] ? import_node_path7.default.resolve(process.argv[1]) : __filename;
-  const entryDir = import_node_path7.default.dirname(entryFile);
-  const resolvedEntryDir = import_node_fs8.default.existsSync(entryFile) ? import_node_path7.default.dirname(import_node_fs8.default.realpathSync(entryFile)) : entryDir;
+  const entryFile = process.argv[1] ? import_node_path8.default.resolve(process.argv[1]) : __filename;
+  const entryDir = import_node_path8.default.dirname(entryFile);
+  const resolvedEntryDir = import_node_fs8.default.existsSync(entryFile) ? import_node_path8.default.dirname(import_node_fs8.default.realpathSync(entryFile)) : entryDir;
   const candidates = [
-    import_node_path7.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path7.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path7.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path7.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
-    import_node_path7.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
+    import_node_path8.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path8.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path8.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path8.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
+    import_node_path8.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
   ];
   const existing = candidates.find((candidate) => import_node_fs8.default.existsSync(candidate));
   return existing ?? candidates[0];
@@ -3816,12 +3961,12 @@ function loadUpgradeCatalog(options = {}) {
     releases
   };
 }
-var import_node_fs8, import_node_path7, SEMVER_RE, UPGRADE_PROMPTS_DIR;
+var import_node_fs8, import_node_path8, SEMVER_RE, UPGRADE_PROMPTS_DIR;
 var init_upgrade = __esm({
   "src/core/upgrade.ts"() {
     "use strict";
     import_node_fs8 = __toESM(require("fs"));
-    import_node_path7 = __toESM(require("path"));
+    import_node_path8 = __toESM(require("path"));
     init_repo_config();
     SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
     UPGRADE_PROMPTS_DIR = "upgrade-prompts";
@@ -4033,7 +4178,7 @@ function parseDevcontainerConfig(contents, sourcePath) {
   return parsed;
 }
 function readDevcontainerConfig(repoPath) {
-  const sourcePath = import_node_path8.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const sourcePath = import_node_path9.default.join(repoPath, ".devcontainer", "devcontainer.json");
   if (!import_node_fs9.default.existsSync(sourcePath) || !import_node_fs9.default.lstatSync(sourcePath).isFile()) {
     throw new Error(`Managed Dev Container source config does not exist: ${sourcePath}`);
   }
@@ -4053,12 +4198,12 @@ function assertManagedDevcontainerLifecycle(repoPath) {
     `Managed Dev Container source '${sourcePath}' defines postCreateCommand, but waitFor ${actual}. Set waitFor to 'postCreateCommand' or 'postStartCommand' before retrying devrouter ensure.`
   );
 }
-var import_node_fs9, import_node_path8, import_jsonc_parser;
+var import_node_fs9, import_node_path9, import_jsonc_parser;
 var init_devcontainer_config = __esm({
   "src/core/devcontainer-config.ts"() {
     "use strict";
     import_node_fs9 = __toESM(require("fs"));
-    import_node_path8 = __toESM(require("path"));
+    import_node_path9 = __toESM(require("path"));
     import_jsonc_parser = require("jsonc-parser");
   }
 });
@@ -4068,7 +4213,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path9.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path10.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -4110,12 +4255,12 @@ function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto3.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto4.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path9.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path9.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path10.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path10.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
   const helperPath = candidates.find((candidate) => import_node_fs10.default.existsSync(candidate));
   if (!helperPath) {
@@ -4124,11 +4269,11 @@ function resolveProcessHelperPath() {
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path9.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path10.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path9.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path9.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path10.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path10.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -4257,14 +4402,14 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process5, import_node_crypto3, import_node_fs10, import_node_path9, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
+var import_node_child_process5, import_node_crypto4, import_node_fs10, import_node_path10, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
     import_node_child_process5 = require("child_process");
-    import_node_crypto3 = require("crypto");
+    import_node_crypto4 = require("crypto");
     import_node_fs10 = __toESM(require("fs"));
-    import_node_path9 = __toESM(require("path"));
+    import_node_path10 = __toESM(require("path"));
     init_devcontainer_config();
     MANAGED_MARKER = "devrouter:managed devcontainer";
     MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
@@ -4397,11 +4542,11 @@ function routedProxyApps(config) {
   );
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path10.default.join(repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path11.default.join(repoPath, ".devcontainer");
   if (!import_node_fs11.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path10.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path11.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -4428,7 +4573,7 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path10.default.join(devcontainerDir, "Dockerfile");
+  const dockerfilePath = import_node_path11.default.join(devcontainerDir, "Dockerfile");
   const dockerfileExists = import_node_fs11.default.existsSync(dockerfilePath);
   const dockerfile = dockerfileExists ? import_node_fs11.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
@@ -4485,12 +4630,12 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs11, import_node_path10, import_yaml3;
+var import_node_fs11, import_node_path11, import_yaml3;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
     import_node_fs11 = __toESM(require("fs"));
-    import_node_path10 = __toESM(require("path"));
+    import_node_path11 = __toESM(require("path"));
     import_yaml3 = __toESM(require("yaml"));
     init_managed_post_start();
   }
@@ -4498,18 +4643,18 @@ var init_devcontainer_diagnostics = __esm({
 
 // src/core/paths.ts
 function assertPathWithinRepo(filePath, repoRoot, label) {
-  const resolvedRoot = import_node_path11.default.resolve(repoRoot);
-  const resolved = import_node_path11.default.resolve(repoRoot, filePath);
-  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path11.default.sep)) {
+  const resolvedRoot = import_node_path12.default.resolve(repoRoot);
+  const resolved = import_node_path12.default.resolve(repoRoot, filePath);
+  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path12.default.sep)) {
     throw new Error(`${label} path '${filePath}' escapes the repository root.`);
   }
   return resolved;
 }
-var import_node_path11;
+var import_node_path12;
 var init_paths = __esm({
   "src/core/paths.ts"() {
     "use strict";
-    import_node_path11 = __toESM(require("path"));
+    import_node_path12 = __toESM(require("path"));
   }
 });
 
@@ -4764,10 +4909,10 @@ var init_routes = __esm({
 
 // src/core/managed-runtime-state.ts
 function stateKey(repoPath, workspace) {
-  return (0, import_node_crypto4.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
+  return (0, import_node_crypto5.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
 function managedRuntimeStatePath(repoPath, workspace) {
-  return import_node_path12.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
+  return import_node_path13.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string") && new Set(value).size === value.length;
@@ -4855,13 +5000,13 @@ function markManagedRuntimeDegraded(state, transitionPhase) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
-var import_node_crypto4, import_node_fs13, import_node_path12;
+var import_node_crypto5, import_node_fs13, import_node_path13;
 var init_managed_runtime_state = __esm({
   "src/core/managed-runtime-state.ts"() {
     "use strict";
-    import_node_crypto4 = require("crypto");
+    import_node_crypto5 = require("crypto");
     import_node_fs13 = __toESM(require("fs"));
-    import_node_path12 = __toESM(require("path"));
+    import_node_path13 = __toESM(require("path"));
     init_atomic_file();
     init_router();
   }
@@ -4912,7 +5057,7 @@ function resolveComposeFiles(source, repoPath, linked) {
       "managedRuntime requires .devcontainer/devcontainer.json to define dockerComposeFile."
     );
   }
-  const directory = import_node_path13.default.join(repoPath, ".devcontainer");
+  const directory = import_node_path14.default.join(repoPath, ".devcontainer");
   const files = references.map((reference) => {
     const resolved2 = assertPathWithinRepo(
       resolveComposeReference(reference, linked),
@@ -4992,7 +5137,7 @@ function isWildcard(values) {
   return values?.length === 1 && values[0] === "*";
 }
 function sha256(contents) {
-  return (0, import_node_crypto5.createHash)("sha256").update(contents, "utf-8").digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(contents, "utf-8").digest("hex");
 }
 function safeComposeProject(value) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
@@ -5057,7 +5202,7 @@ function inspectManagedDevcontainerConfig(options) {
   const contents = `${MANAGED_DEVCONTAINER_MARKER}
 ${JSON.stringify(effective, null, 2)}
 `;
-  const generatedPath = import_node_path13.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
+  const generatedPath = import_node_path14.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
   assertIgnoredGeneratedPath(options.repoPath, generatedPath);
   assertGeneratedPathOwnership(generatedPath);
   return {
@@ -5177,14 +5322,14 @@ function stopExactManagedService(containerId, service) {
     throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
   }
 }
-var import_node_child_process6, import_node_crypto5, import_node_fs14, import_node_path13, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var import_node_child_process6, import_node_crypto6, import_node_fs14, import_node_path14, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
 var init_devcontainer_profile = __esm({
   "src/core/devcontainer-profile.ts"() {
     "use strict";
     import_node_child_process6 = require("child_process");
-    import_node_crypto5 = require("crypto");
+    import_node_crypto6 = require("crypto");
     import_node_fs14 = __toESM(require("fs"));
-    import_node_path13 = __toESM(require("path"));
+    import_node_path14 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
     init_atomic_file();
     init_devcontainer_config();
@@ -5198,9 +5343,17 @@ var init_devcontainer_profile = __esm({
 function inspectWorkspaceContainers(options) {
   let ids = options?.ids;
   if (!ids) {
-    const listed = (0, import_node_child_process7.spawnSync)("docker", ["ps", "-a", "--format", "{{.ID}}"], {
-      encoding: "utf-8"
-    });
+    const listed = (0, import_node_child_process7.spawnSync)(
+      "docker",
+      [
+        "ps",
+        "-a",
+        ...options?.composeProject ? ["--filter", `label=com.docker.compose.project=${options.composeProject}`] : [],
+        "--format",
+        "{{.ID}}"
+      ],
+      { encoding: "utf-8" }
+    );
     if (listed.status !== 0) {
       throw new Error(
         `docker ps failed: ${(listed.stderr || listed.stdout || listed.error?.message || "unknown error").trim()}`
@@ -5225,7 +5378,7 @@ function inspectWorkspaceContainers(options) {
 function workspaceAppContainers(containers, repoPath) {
   return containers.filter((container) => {
     const workingDir = container.labels["com.docker.compose.project.working_dir"];
-    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path14.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
+    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path15.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
       (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
     );
   });
@@ -5233,7 +5386,7 @@ function workspaceAppContainers(containers, repoPath) {
 function hasExactComposeIdentity(container, options) {
   if (options.composeProject !== void 0 && container.labels["com.docker.compose.project"] !== options.composeProject || container.labels["com.docker.compose.service"] !== options.service || !sameWorkspacePath(
     container.labels["com.docker.compose.project.working_dir"] ?? "",
-    import_node_path14.default.join(options.repoPath, ".devcontainer")
+    import_node_path15.default.join(options.repoPath, ".devcontainer")
   )) {
     return false;
   }
@@ -5270,12 +5423,12 @@ function resolveRunningWorkspaceContainer(repoPath) {
   }
   return { id: container.id, workspacePath: repoMount.Destination };
 }
-var import_node_child_process7, import_node_path14, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
+var import_node_child_process7, import_node_path15, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
 var init_devpod_environment = __esm({
   "src/core/devpod-environment.ts"() {
     "use strict";
     import_node_child_process7 = require("child_process");
-    import_node_path14 = __toESM(require("path"));
+    import_node_path15 = __toESM(require("path"));
     init_workspace();
     SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.service":{{json (index .Config.Labels "com.docker.compose.service")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
     SIZE_INSPECT_TEMPLATE = SAFE_INSPECT_TEMPLATE.replace(
@@ -5920,7 +6073,7 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path15.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  const rootCAPath = import_node_path16.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
   if (!import_node_fs16.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
@@ -5954,7 +6107,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto6.X509Certificate(pem);
+  const certificate = new import_node_crypto7.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -6154,20 +6307,20 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process8, import_node_crypto6, import_node_fs16, import_node_path15, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
+var import_node_child_process8, import_node_crypto7, import_node_fs16, import_node_path16, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
     import_node_child_process8 = require("child_process");
-    import_node_crypto6 = require("crypto");
+    import_node_crypto7 = require("crypto");
     import_node_fs16 = __toESM(require("fs"));
-    import_node_path15 = __toESM(require("path"));
+    import_node_path16 = __toESM(require("path"));
     init_docker();
     init_file_lock();
     init_host_routes();
     init_router();
     DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
-    TLS_CERTIFICATE_LOCK_FILE = import_node_path15.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+    TLS_CERTIFICATE_LOCK_FILE = import_node_path16.default.join(DEVROUTER_HOME, "tls-certificate.lock");
     TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
     TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
   }
@@ -6526,20 +6679,20 @@ function resetWorkspaceRuntimeCaches() {
   cachedRuntime = void 0;
   cachedSnapshots = void 0;
 }
-var import_node_child_process11, import_node_fs17, import_node_path16, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
+var import_node_child_process11, import_node_fs17, import_node_path17, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
 var init_workspace_runtime = __esm({
   "src/core/workspace-runtime.ts"() {
     "use strict";
     import_node_child_process11 = require("child_process");
     import_node_fs17 = __toESM(require("fs"));
-    import_node_path16 = __toESM(require("path"));
+    import_node_path17 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_registry();
     init_devsy_workspaces();
     init_router();
     init_workspace();
     SUPPORTED_RUNTIMES2 = ["devpod", "devsy"];
-    RUNTIME_CONFIG_FILE = import_node_path16.default.join(DEVROUTER_HOME, "workspace-runtime.json");
+    RUNTIME_CONFIG_FILE = import_node_path17.default.join(DEVROUTER_HOME, "workspace-runtime.json");
     INACTIVITY_TIMEOUT_PATTERN = /^(?:\d+(?:ms|s|m|h))+$/;
     UnsupportedWorkspaceRuntimeError = class extends Error {
     };
@@ -6617,7 +6770,7 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path17.default.join(repoPath, "package.json");
+  const packagePath = import_node_path18.default.join(repoPath, "package.json");
   if (!import_node_fs18.default.existsSync(packagePath)) {
     return void 0;
   }
@@ -6762,13 +6915,13 @@ function buildGlobalToolChecks(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process12, import_node_fs18, import_node_path17;
+var import_node_child_process12, import_node_fs18, import_node_path18;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
     import_node_child_process12 = require("child_process");
     import_node_fs18 = __toESM(require("fs"));
-    import_node_path17 = __toESM(require("path"));
+    import_node_path18 = __toESM(require("path"));
     init_workspace_runtime();
   }
 });
@@ -6898,13 +7051,65 @@ function withMutationLock(activity, target, operation) {
   import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
-    { activity, target: `'${target}'`, waitMs: DEVSY_MUTATION_WAIT_MS },
+    {
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVSY_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
+    },
+    operation
+  );
+}
+function withMutationLockAsync(activity, target, operation) {
+  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLock(
+    DEVSY_MUTATION_LOCK_FILE,
+    {
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVSY_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
+    },
     operation
   );
 }
 function commandFailure2(result) {
   return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
 }
+function runDevsyUp(args, env, quiet) {
+  return new Promise((resolve) => {
+    const child = (0, import_node_child_process14.spawn)("devsy", args, {
+      stdio: ["inherit", quiet ? 2 : "inherit", "pipe"],
+      env
+    });
+    const stderr = child.stderr;
+    if (!stderr) throw new Error("Devsy startup stderr pipe was not created.");
+    let stderrTail = Buffer.alloc(0);
+    let spawnError;
+    stderr.on("data", (chunk) => {
+      const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      const writable = process.stderr.write(value);
+      if (!writable) {
+        stderr.pause();
+        process.stderr.once("drain", () => stderr.resume());
+      }
+      if (value.length >= DEVSY_STDERR_TAIL_BYTES) {
+        stderrTail = Buffer.from(value.subarray(value.length - DEVSY_STDERR_TAIL_BYTES));
+      } else {
+        const combined = Buffer.concat([stderrTail, value]);
+        stderrTail = combined.length > DEVSY_STDERR_TAIL_BYTES ? combined.subarray(combined.length - DEVSY_STDERR_TAIL_BYTES) : combined;
+      }
+    });
+    child.once("error", (error) => {
+      spawnError = error;
+    });
+    child.once("close", (status) => {
+      resolve({ status, error: spawnError, stderrTail: stderrTail.toString("utf-8") });
+    });
+  });
+}
 function runDevsyAction(action2, devsyId, force = false) {
   const args = action2 === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
   const result = (0, import_node_child_process14.spawnSync)("devsy", ["workspace", ...args], { encoding: "utf-8" });
@@ -6969,7 +7174,7 @@ function assertDevsyTarget(devsyId, repoPath) {
 }
 function startDevsyWorkspace(options) {
   const activity = options.recreate ? "Devsy recreate" : "Devsy start";
-  return withMutationLock(activity, options.repoPath, () => {
+  return withMutationLockAsync(activity, options.repoPath, async () => {
     let devsyId = assertDevsyTarget(options.devsyId, options.repoPath);
     if (devsyId && options.recreate) {
       const attached = listDevsyWorkspaces();
@@ -7009,12 +7214,13 @@ function startDevsyWorkspace(options) {
       delete env.DEVROUTER_GIT_COMMON_DIR;
       delete env.DEVCONTAINER_COMPOSE_OVERLAY;
     }
-    const result = (0, import_node_child_process14.spawnSync)("devsy", args, {
-      stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
-      env
-    });
+    const result = await runDevsyUp(args, env, options.quiet ?? false);
     if (result.status !== 0) {
-      const message = `devsy workspace up failed for '${devsyId ?? options.repoPath}'.`;
+      let message = `devsy workspace up failed for '${devsyId ?? options.repoPath}'.`;
+      if (result.error?.message) message += ` ${result.error.message}`;
+      if (AGENT_ACQUISITION_RE.test(result.stderrTail)) {
+        message += " Devsy could not obtain its agent binary; allow Devsy to download it or set DEVSY_AGENT_BINARY to a verified official Devsy agent binary matching this platform and Devsy version.";
+      }
       if (failedStartMayHaveAttached(devsyId, options.repoPath)) {
         throw new DevsyStartPostconditionError(message);
       }
@@ -7040,20 +7246,22 @@ function startDevsyWorkspace(options) {
     }
   });
 }
-var import_node_child_process14, import_node_fs19, import_node_path18, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError;
+var import_node_child_process14, import_node_fs19, import_node_path19, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError, AGENT_ACQUISITION_RE, DEVSY_STDERR_TAIL_BYTES;
 var init_devsy_mutation = __esm({
   "src/core/devsy-mutation.ts"() {
     "use strict";
     import_node_child_process14 = require("child_process");
     import_node_fs19 = __toESM(require("fs"));
-    import_node_path18 = __toESM(require("path"));
+    import_node_path19 = __toESM(require("path"));
     init_devsy_workspaces();
     init_file_lock();
     init_router();
-    DEVSY_MUTATION_LOCK_FILE = import_node_path18.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
-    DEVSY_MUTATION_WAIT_MS = 6e4;
+    DEVSY_MUTATION_LOCK_FILE = import_node_path19.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_WAIT_MS = 18e5;
     DevsyStartPostconditionError = class extends Error {
     };
+    AGENT_ACQUISITION_RE = /inject agent.*agent binary not found/i;
+    DEVSY_STDERR_TAIL_BYTES = 8192;
   }
 });
 
@@ -7062,7 +7270,13 @@ function withMutationLock2(activity, target, operation) {
   import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
-    { activity, target: `'${target}'`, waitMs: DEVPOD_MUTATION_WAIT_MS },
+    {
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVPOD_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
+    },
     operation
   );
 }
@@ -7137,10 +7351,10 @@ function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
   resetWorkspaceRuntimeCaches();
   return result;
 }
-function startDevpodWorkspace(options) {
+async function startDevpodWorkspace(options) {
   if (resolveWorkspaceRuntimeOrDefault(options.repoPath) === "devsy") {
     try {
-      const result = startDevsyWorkspace({
+      const result = await startDevsyWorkspace({
         repoPath: options.repoPath,
         devsyId: options.devpodId,
         devcontainerPath: options.devcontainerPath,
@@ -7227,20 +7441,20 @@ function startDevpodWorkspace(options) {
     }
   });
 }
-var import_node_child_process15, import_node_fs20, import_node_path19, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
+var import_node_child_process15, import_node_fs20, import_node_path20, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
     import_node_child_process15 = require("child_process");
     import_node_fs20 = __toESM(require("fs"));
-    import_node_path19 = __toESM(require("path"));
+    import_node_path20 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
     init_file_lock();
     init_router();
     init_workspace_runtime();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path19.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
-    DEVPOD_MUTATION_WAIT_MS = 6e4;
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path20.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_WAIT_MS = 18e5;
     DevpodStartPostconditionError = class extends Error {
     };
   }
@@ -7261,7 +7475,7 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path20.default.isAbsolute(output2) ? output2 : import_node_path20.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path21.default.isAbsolute(output2) ? output2 : import_node_path21.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
   const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
@@ -7312,7 +7526,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path20.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path21.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -7340,7 +7554,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path20.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path21.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -7384,14 +7598,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path20.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path21.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path20.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path21.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record2) => record2.workspace === workspace);
@@ -7427,7 +7641,7 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
   return record;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path20.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path21.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
     import_node_fs21.default.rmSync(filePath);
     return true;
@@ -7440,7 +7654,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path20.default.join(
+  const filePath = import_node_path21.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -7455,12 +7669,16 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
   import_node_fs21.default.rmSync(filePath);
   return "removed";
 }
-function withWorkspaceOwnershipTransaction(repoPath, operation) {
+function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
   import_node_fs21.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path20.default.join(directory, ".lock"),
-    { activity: "workspace ownership transaction", target: `'${repoPath}'`, waitMs: 5e3 },
+    import_node_path21.default.join(directory, ".lock"),
+    {
+      activity: "workspace ownership transaction",
+      target: `'${repoPath}'`,
+      waitMs: options.waitMs ?? 5e3
+    },
     () => operation({
       list: () => listWorkspaceOwnershipInDirectory(directory),
       write: (input2) => writeWorkspaceOwnershipInDirectory(directory, input2),
@@ -7469,8 +7687,169 @@ function withWorkspaceOwnershipTransaction(repoPath, operation) {
     })
   );
 }
-function writeWorkspaceOwnership(repoPath, input2) {
-  return withWorkspaceOwnershipTransaction(repoPath, (transaction) => transaction.write(input2));
+function providerPathOwner(providerWorkspaces, worktreePath) {
+  const owners = providerWorkspaces.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, worktreePath)
+  );
+  if (owners.length > 1) {
+    throw new Error(
+      `Worktree '${worktreePath}' is registered by multiple workspace runtimes; no identity was claimed.`
+    );
+  }
+  return owners[0];
+}
+function persistedWorkspaceOwners(repoPath, worktreePath) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const worktree of listGitWorktrees(repoPath)) {
+    if (sameWorkspacePath(worktree.path, worktreePath)) continue;
+    let workspace;
+    try {
+      workspace = readPersistedWorkspace(worktree.path);
+    } catch (error) {
+      if (!import_node_fs21.default.existsSync(worktree.path)) continue;
+      throw error;
+    }
+    if (!workspace) continue;
+    const existing = owners.get(workspace);
+    if (existing && !sameWorkspacePath(existing, worktree.path)) {
+      throw new Error(`Persisted workspace identity '${workspace}' belongs to multiple worktrees.`);
+    }
+    owners.set(workspace, worktree.path);
+  }
+  return owners;
+}
+function claimConflict(workspace, devpodId, worktreePath, records, providerWorkspaces, persistedOwners, exactRecord) {
+  const recordOwner = records.find(
+    (record) => record !== exactRecord && (record.workspace === workspace || record.devpodId === devpodId)
+  );
+  if (recordOwner) {
+    return `workspace owner record '${recordOwner.workspace}' for '${recordOwner.worktreePath}'`;
+  }
+  const providerOwner = providerWorkspaces.find(
+    (providerWorkspace) => providerWorkspace.id === devpodId && !sameWorkspacePath(providerWorkspace.source.localFolder, worktreePath)
+  );
+  if (providerOwner) {
+    return `workspace runtime identity '${providerOwner.id}' already belongs to '${providerOwner.source.localFolder}'`;
+  }
+  const persistedOwner = persistedOwners.get(workspace);
+  if (persistedOwner) {
+    return `persisted checkout metadata for '${persistedOwner}'`;
+  }
+  return void 0;
+}
+function claimWorkspaceIdentity(repoPath, input2) {
+  const worktreePath = comparableWorkspacePath(repoPath);
+  const exactProvider = providerPathOwner(input2.providerWorkspaces, worktreePath);
+  return withWorkspaceOwnershipTransaction(repoPath, (transaction) => {
+    const records = transaction.list();
+    const exactRecords = records.filter(
+      (record) => sameWorkspacePath(record.worktreePath, worktreePath)
+    );
+    if (exactRecords.length > 1) {
+      throw new Error(
+        `Worktree '${worktreePath}' has multiple workspace owner records; no identity was claimed.`
+      );
+    }
+    const exactRecord = exactRecords[0];
+    const persisted = readPersistedWorkspace(worktreePath);
+    const persistedOwners = persistedWorkspaceOwners(repoPath, worktreePath);
+    if (exactRecord) {
+      if (persisted && persisted !== exactRecord.workspace) {
+        throw new Error(
+          `Persisted workspace identity '${persisted}' disagrees with owner record '${exactRecord.workspace}'.`
+        );
+      }
+      if (exactProvider && exactProvider.id !== exactRecord.devpodId) {
+        throw new Error(
+          `Workspace runtime '${exactProvider.id}' disagrees with owner record '${exactRecord.devpodId}'.`
+        );
+      }
+      const conflict2 = claimConflict(
+        exactRecord.workspace,
+        exactRecord.devpodId,
+        worktreePath,
+        records,
+        input2.providerWorkspaces,
+        persistedOwners,
+        exactRecord
+      );
+      if (conflict2) {
+        throw new Error(
+          `Workspace '${exactRecord.workspace}' conflicts with ${conflict2}; no identity was claimed.`
+        );
+      }
+      if (!persisted) persistWorkspace(worktreePath, exactRecord.workspace);
+      return transaction.write({
+        workspace: exactRecord.workspace,
+        worktreePath,
+        branch: input2.branch ?? null,
+        devpodId: exactRecord.devpodId
+      });
+    }
+    if (persisted && exactProvider && persisted !== exactProvider.id) {
+      throw new Error(
+        `Persisted workspace identity '${persisted}' disagrees with workspace runtime '${exactProvider.id}'.`
+      );
+    }
+    let workspace = persisted ?? exactProvider?.id;
+    let devpodId = exactProvider?.id ?? persisted;
+    if (!workspace || !devpodId) {
+      if (input2.unavailableRuntimes.length > 0) {
+        throw new Error(
+          `Cannot claim a new workspace identity because these runtime registries are unavailable: ${input2.unavailableRuntimes.join(", ")}.`
+        );
+      }
+      const candidate = workspaceIdentityCandidates(input2.source).find(
+        (next) => !claimConflict(
+          next,
+          next,
+          worktreePath,
+          records,
+          input2.providerWorkspaces,
+          persistedOwners
+        )
+      );
+      if (!candidate) {
+        throw new Error(
+          `Could not allocate a collision-safe workspace identity for '${worktreePath}'.`
+        );
+      }
+      workspace = candidate;
+      devpodId = candidate;
+    }
+    const conflict = claimConflict(
+      workspace,
+      devpodId,
+      worktreePath,
+      records,
+      input2.providerWorkspaces,
+      persistedOwners
+    );
+    if (conflict) {
+      throw new Error(
+        `Workspace '${workspace}' conflicts with ${conflict}; no identity was claimed.`
+      );
+    }
+    const written = transaction.write({
+      workspace,
+      worktreePath,
+      branch: input2.branch ?? null,
+      devpodId
+    });
+    try {
+      persistWorkspace(worktreePath, workspace);
+    } catch (error) {
+      const cleanup = transaction.removeIfMatches(written);
+      if (cleanup !== "removed") {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `Could not persist workspace identity and owner-record rollback was '${cleanup}': ${detail}`
+        );
+      }
+      throw error;
+    }
+    return written;
+  });
 }
 function removeWorkspaceOwnership(repoPath, workspace) {
   return withWorkspaceOwnershipTransaction(
@@ -7514,20 +7893,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process16, import_node_fs21, import_node_path20, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process16, import_node_fs21, import_node_path21, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
     import_node_child_process16 = require("child_process");
     import_node_fs21 = __toESM(require("fs"));
-    import_node_path20 = __toESM(require("path"));
+    import_node_path21 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path20.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path21.default.join("devrouter", "workspaces");
   }
 });
 
@@ -7541,10 +7920,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path21.default.join(comparableRepo, "trees") + import_node_path21.default.sep;
+  const localRoot = import_node_path22.default.join(comparableRepo, "trees") + import_node_path22.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path21.default.basename(comparableRepo)}-`;
-  return import_node_path21.default.dirname(comparableWorktree) === import_node_path21.default.dirname(comparableRepo) && import_node_path21.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path22.default.basename(comparableRepo)}-`;
+  return import_node_path22.default.dirname(comparableWorktree) === import_node_path22.default.dirname(comparableRepo) && import_node_path22.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -7796,11 +8175,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path21;
+var import_node_path22;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path21 = __toESM(require("path"));
+    import_node_path22 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -8153,7 +8532,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.44" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.46" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -8183,7 +8562,7 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path22.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path23.default.resolve(repo.path, filePath)
         }))
       ).filter((entry) => !import_node_fs22.default.existsSync(entry.absolutePath));
       addCheck(checks, {
@@ -8228,7 +8607,7 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path22.default.resolve(repo.path, app.hostRun.cwd)
+        absolutePath: import_node_path23.default.resolve(repo.path, app.hostRun.cwd)
       })).filter((entry) => !import_node_fs22.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
@@ -8373,12 +8752,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs22, import_node_path22, import_yaml5, POSTGRES_DEFAULTS;
+var import_node_fs22, import_node_path23, import_yaml5, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
     import_node_fs22 = __toESM(require("fs"));
-    import_node_path22 = __toESM(require("path"));
+    import_node_path23 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -8873,11 +9252,11 @@ var init_route_publication = __esm({
 // src/core/workspace-ensure.ts
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path23.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path24.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path23.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path24.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -9053,6 +9432,20 @@ function isWarmWorkspaceActive(repoPath) {
     return true;
   }
 }
+function hasExactManagedComposeProject(repoPath, state) {
+  try {
+    return inspectWorkspaceContainers({
+      composeProject: state.composeProject
+    }).some((container) => {
+      const workingDir = container.labels["com.docker.compose.project.working_dir"];
+      return Boolean(
+        workingDir && sameWorkspacePath(workingDir, import_node_path24.default.join(repoPath, ".devcontainer"))
+      );
+    });
+  } catch {
+    return true;
+  }
+}
 function captureFirstTransitionBaseline(options) {
   const containers = inspectWorkspaceContainers();
   const runningPrimary = workspaceAppContainers(containers, options.repoPath).filter(
@@ -9229,25 +9622,30 @@ async function waitForHttpRoutes(repoPath, apps, timeoutMs) {
   );
 }
 function resolveLinkedTarget(repoPath) {
-  const devpods = listDevpodWorkspaces(repoPath);
-  const existingDevpod = selectDevpodWorkspace(devpods, repoPath);
-  const persisted = readPersistedWorkspace(repoPath);
-  const candidate = existingDevpod?.id ?? persisted ?? resolveWorktreeWorkspace(repoPath);
-  if (!candidate) {
-    throw new Error(`Could not resolve a workspace identity for '${repoPath}'.`);
-  }
-  const otherOwner = devpods.find(
-    (devpod) => devpod.id === candidate && !sameWorkspacePath(devpod.source.localFolder, repoPath)
+  const snapshots = getWorkspaceRegistrySnapshots();
+  const providerWorkspaces = [
+    ...snapshots.devpod ?? [],
+    ...snapshots.devsy?.map((workspace) => ({
+      id: workspace.id,
+      source: workspace.source,
+      ...workspace.lastUsed ? { lastUsed: workspace.lastUsed } : {},
+      ...workspace.lastUsedMalformed ? { lastUsedMalformed: true } : {}
+    })) ?? []
+  ];
+  const branch = currentBranch(repoPath);
+  const claim = claimWorkspaceIdentity(repoPath, {
+    source: branch ?? repoPath,
+    branch: branch ?? null,
+    providerWorkspaces,
+    unavailableRuntimes: snapshots.unavailable
+  });
+  const existingDevpod = providerWorkspaces.find(
+    (workspace) => workspace.id === claim.devpodId && sameWorkspacePath(workspace.source.localFolder, repoPath)
   );
-  if (otherOwner) {
-    throw new Error(
-      `DevPod identity '${candidate}' already belongs to '${otherOwner.source.localFolder}'.`
-    );
-  }
   return {
     kind: "linked",
-    workspace: persistWorkspace(repoPath, candidate),
-    devpodId: candidate,
+    workspace: claim.workspace,
+    devpodId: claim.devpodId,
     hadExactDevpod: Boolean(existingDevpod),
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
@@ -9262,7 +9660,7 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs23.default.statSync(import_node_path23.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs23.default.statSync(import_node_path24.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
@@ -9312,7 +9710,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path23.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        const overlayPath = import_node_path24.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
         if (!import_node_fs23.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
@@ -9330,6 +9728,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const desiredProcesses = managedRuntime ? desiredManagedProcesses(managedRuntime, runtime.resolvedProfile) : [];
       if (managedRuntime) {
         previousManagedState = readManagedRuntimeState(repoPath, target.workspace);
+        if (previousManagedState && !hasExactManagedComposeProject(repoPath, previousManagedState)) {
+          previousManagedState = void 0;
+        }
         if (previousManagedState?.status === "degraded") {
           throw new Error(
             "Managed runtime state is degraded; refusing a new profile transition until drift is repaired."
@@ -9380,7 +9781,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path23.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path24.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -9394,20 +9795,11 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         managedConfigWritten = true;
       }
       const upstreamHosts = parsedUpstreams.map((upstream) => upstream.host);
-      const ownership = target.kind === "linked" ? {
-        workspace: target.workspace,
-        worktreePath: repoPath,
-        branch: currentBranch(repoPath),
-        devpodId: target.devpodId
-      } : void 0;
-      if (ownership) {
-        writeWorkspaceOwnership(repoPath, ownership);
-      }
       const currentTarget = () => target.kind === "linked" ? target : { ...target, devpodId };
-      const startAndProveAttachment = (recreate = false) => {
+      const startAndProveAttachment = async (recreate = false) => {
         const requestedTarget = currentTarget();
         try {
-          devpodId = startDevpodWorkspace({
+          devpodId = await startDevpodWorkspace({
             repoPath,
             devpodId: requestedTarget.devpodId,
             devcontainerPath: managedPlan?.generatedRelativePath,
@@ -9425,19 +9817,16 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           if (error instanceof DevpodStartPostconditionError) environmentStarted = true;
           throw error;
         }
-        if (ownership) {
-          writeWorkspaceOwnership(repoPath, ownership);
-        }
       };
       const preflight = (timeoutMs) => waitForContainerPreflight(repoPath, currentTarget(), upstreamHosts, timeoutMs);
       const recreateAndPreflight = async () => {
-        startAndProveAttachment(true);
+        await startAndProveAttachment(true);
         return preflight(options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS);
       };
       let recreated = false;
       let container;
       try {
-        startAndProveAttachment();
+        await startAndProveAttachment();
       } catch (error) {
         if (managedPlan || !target.hadExactDevpod) {
           throw error;
@@ -9824,13 +10213,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
   });
 }
-var import_node_child_process19, import_node_fs23, import_node_path23, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
+var import_node_child_process19, import_node_fs23, import_node_path24, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
     import_node_child_process19 = require("child_process");
     import_node_fs23 = __toESM(require("fs"));
-    import_node_path23 = __toESM(require("path"));
+    import_node_path24 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
@@ -9845,6 +10234,7 @@ var init_workspace_ensure = __esm({
     init_router();
     init_workspace();
     init_workspace_ownership();
+    init_workspace_runtime();
     DEVCONTAINER_OVERLAY = "docker-compose.devrouter.yml";
     DEFAULT_READINESS_TIMEOUT_MS = 12e4;
     POLL_INTERVAL_MS = 1e3;
@@ -9901,6 +10291,11 @@ var init_ensure = __esm({
 });
 
 // src/core/workspace-lifecycle.ts
+function withWorkspaceAllocationTransaction(repoPath, operation) {
+  return withWorkspaceOwnershipTransaction(repoPath, operation, {
+    waitMs: WORKSPACE_ALLOCATION_LOCK_WAIT_MS
+  });
+}
 function warnMissingWorkspaceOwnership(repoPath) {
   const missing = listMissingWorkspaceOwnership(repoPath);
   if (missing.length === 0) return;
@@ -9910,7 +10305,7 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path24.default.join(mainRepo, "trees", ws);
+  return import_node_path25.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
   const ignored = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
@@ -9918,12 +10313,12 @@ function assertDefaultWorktreeRootIgnored(mainRepo) {
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path24.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path24.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path25.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path25.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path24.default.join(import_node_path24.default.dirname(mainRepo), `${import_node_path24.default.basename(mainRepo)}-${ws}`);
+  return import_node_path25.default.join(import_node_path25.default.dirname(mainRepo), `${import_node_path25.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -10062,44 +10457,67 @@ async function workspaceUp(branch, opts = {}) {
   if (!ws) {
     throw new Error(`Branch '${branch}' does not yield a valid workspace token.`);
   }
-  const worktreePath = opts.path ? import_node_path24.default.resolve(opts.path) : defaultWorktreePath(mainRepo, ws);
-  if (import_node_fs24.default.existsSync(worktreePath)) {
-    const registered = listGitWorktrees(mainRepo).find(
-      (worktree) => sameWorkspacePath(worktree.path, worktreePath)
+  const worktreePath = withWorkspaceAllocationTransaction(mainRepo, () => {
+    const worktrees = listGitWorktrees(mainRepo);
+    const branchWorktrees = worktrees.filter((worktree) => worktree.branch === branch);
+    if (branchWorktrees.length > 1) {
+      throw new Error(
+        `Branch '${branch}' is checked out in multiple worktrees: ${branchWorktrees.map((worktree) => worktree.path).join(", ")}`
+      );
+    }
+    const existingBranch = branchWorktrees[0];
+    const candidatePaths = workspaceIdentityCandidates(branch).map(
+      (candidate) => defaultWorktreePath(mainRepo, candidate)
+    );
+    const generatedPath = candidatePaths.find(
+      (candidate) => !import_node_fs24.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    if (!registered || sameWorkspacePath(registered.path, mainRepo)) {
-      throw new Error(`Existing path '${worktreePath}' is not a linked worktree of '${mainRepo}'.`);
+    const selectedPath = opts.path ? import_node_path25.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    if (!selectedPath) {
+      throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
-    if (registered.branch !== branch) {
+    if (existingBranch && !sameWorkspacePath(existingBranch.path, selectedPath)) {
       throw new Error(
-        `Existing worktree '${worktreePath}' uses branch '${registered.branch ?? "detached"}', not '${branch}'.`
+        `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    process.stdout.write(`Worktree already exists: ${worktreePath}
+    if (import_node_fs24.default.existsSync(selectedPath)) {
+      const registered = worktrees.find(
+        (worktree) => sameWorkspacePath(worktree.path, selectedPath)
+      );
+      if (!registered || sameWorkspacePath(registered.path, mainRepo)) {
+        throw new Error(
+          `Existing path '${selectedPath}' is not a linked worktree of '${mainRepo}'.`
+        );
+      }
+      if (registered.branch !== branch) {
+        throw new Error(
+          `Existing worktree '${selectedPath}' uses branch '${registered.branch ?? "detached"}', not '${branch}'.`
+        );
+      }
+      process.stdout.write(`Worktree already exists: ${selectedPath}
 `);
-  } else {
-    if (!opts.path) {
-      assertDefaultWorktreeRootIgnored(mainRepo);
+      return selectedPath;
     }
-    const add = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "add", worktreePath, branch], {
+    if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
+    const add = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
       const addNew = (0, import_node_child_process20.spawnSync)(
         "git",
-        ["-C", mainRepo, "worktree", "add", "-b", branch, worktreePath],
-        {
-          encoding: "utf-8"
-        }
+        ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
+        { encoding: "utf-8" }
       );
       if (addNew.status !== 0) {
-        const detail = [add.stderr, addNew.stderr].map((s) => s?.trim()).filter(Boolean).join("; ");
+        const detail = [add.stderr, addNew.stderr].map((stderr) => stderr?.trim()).filter(Boolean).join("; ");
         throw new Error(`git worktree add failed: ${detail || "unknown error"}`);
       }
     }
-    process.stdout.write(`Created worktree ${worktreePath} (workspace '${ws}')
+    process.stdout.write(`Created worktree ${selectedPath}
 `);
-  }
+    return selectedPath;
+  });
   if (opts.noDevpod) {
     warnMissingWorkspaceOwnership(mainRepo);
     process.stdout.write("Skipped environment startup; no routes were changed.\n");
@@ -10242,13 +10660,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process20, import_node_fs24, import_node_path24;
+var import_node_child_process20, import_node_fs24, import_node_path25, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
     import_node_child_process20 = require("child_process");
     import_node_fs24 = __toESM(require("fs"));
-    import_node_path24 = __toESM(require("path"));
+    import_node_path25 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_repo_config();
@@ -10256,6 +10674,7 @@ var init_workspace_lifecycle = __esm({
     init_workspace();
     init_workspace_ensure();
     init_workspace_ownership();
+    WORKSPACE_ALLOCATION_LOCK_WAIT_MS = 6e4;
   }
 });
 
@@ -10449,7 +10868,7 @@ async function devpodExec(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto7.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto8.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -10526,12 +10945,12 @@ async function devpodExec(repoPath, command) {
     });
   });
 }
-var import_node_child_process22, import_node_crypto7, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
+var import_node_child_process22, import_node_crypto8, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
 var init_devpod_exec = __esm({
   "src/core/devpod-exec.ts"() {
     "use strict";
     import_node_child_process22 = require("child_process");
-    import_node_crypto7 = require("crypto");
+    import_node_crypto8 = require("crypto");
     init_devpod_environment();
     init_devpod_workspaces();
     init_devsy_exec();
@@ -10826,7 +11245,7 @@ function readJson(filePath) {
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path25.default.relative(repoPath, filePath) || ".";
+  return import_node_path26.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -10867,7 +11286,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName))) {
+    if (import_node_fs25.default.existsSync(import_node_path26.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -10882,7 +11301,7 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path25.default.join(repoPath, ".nvmrc");
+  const nvmrc = import_node_path26.default.join(repoPath, ".nvmrc");
   if (import_node_fs25.default.existsSync(nvmrc)) {
     const version = import_node_fs25.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
@@ -10945,7 +11364,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path25.default.isAbsolute(fileName) && !import_node_path25.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path26.default.isAbsolute(fileName) && !import_node_path26.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -10963,7 +11382,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName))
+    (fileName) => import_node_fs25.default.existsSync(import_node_path26.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -11001,7 +11420,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs25.default.readFileSync(import_node_path25.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs25.default.readFileSync(import_node_path26.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -11037,7 +11456,7 @@ function inspectServices(repoPath) {
 }
 function inspectEnvFiles(repoPath) {
   const files = import_node_fs25.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs25.default.readFileSync(import_node_path25.default.join(repoPath, fileName), "utf-8");
+    const content = import_node_fs25.default.readFileSync(import_node_path26.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -11051,13 +11470,13 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path25.default.join(repoPath, ".devcontainer");
+  const dir = import_node_path26.default.join(repoPath, ".devcontainer");
   if (!import_node_fs25.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs25.default.readdirSync(dir).filter((fileName) => import_node_fs25.default.statSync(import_node_path25.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs25.default.readdirSync(dir).filter((fileName) => import_node_fs25.default.statSync(import_node_path26.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
@@ -11106,14 +11525,14 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName))) {
+    if (import_node_fs25.default.existsSync(import_node_path26.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path25.default.join(repoPath, ".agents", "skills");
+  const skillsDir = import_node_path26.default.join(repoPath, ".agents", "skills");
   if (import_node_fs25.default.existsSync(skillsDir)) {
     for (const name of import_node_fs25.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path25.default.join(skillsDir, name, "SKILL.md");
+      const skillPath = import_node_path26.default.join(skillsDir, name, "SKILL.md");
       if (import_node_fs25.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
@@ -11157,7 +11576,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path25.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path26.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -11176,12 +11595,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs25, import_node_path25, import_yaml6;
+var import_node_fs25, import_node_path26, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
     import_node_fs25 = __toESM(require("fs"));
-    import_node_path25 = __toESM(require("path"));
+    import_node_path26 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -11286,7 +11705,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs26.default.existsSync(import_node_path26.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs26.default.existsSync(import_node_path27.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -11505,12 +11924,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs26, import_node_path26;
+var import_node_fs26, import_node_path27;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
     import_node_fs26 = __toESM(require("fs"));
-    import_node_path26 = __toESM(require("path"));
+    import_node_path27 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -11807,7 +12226,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path27.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path28.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -11852,7 +12271,7 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path27.default.join(repoPath, file.relativePath);
+  const absolutePath = import_node_path28.default.join(repoPath, file.relativePath);
   if (!import_node_fs27.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
@@ -11918,8 +12337,8 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path27.default.join(repoPath, file.relativePath);
-  import_node_fs27.default.mkdirSync(import_node_path27.default.dirname(absolutePath), { recursive: true });
+  const absolutePath = import_node_path28.default.join(repoPath, file.relativePath);
+  import_node_fs27.default.mkdirSync(import_node_path28.default.dirname(absolutePath), { recursive: true });
   import_node_fs27.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
     import_node_fs27.default.chmodSync(absolutePath, 493);
@@ -11960,12 +12379,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs27, import_node_path27, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs27, import_node_path28, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
     import_node_fs27 = __toESM(require("fs"));
-    import_node_path27 = __toESM(require("path"));
+    import_node_path28 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -12356,7 +12775,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto8.createHash)("sha1").update(import_node_path28.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto9.createHash)("sha1").update(import_node_path29.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -12435,9 +12854,9 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path28.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  const cachePath = import_node_path29.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
   import_node_fs28.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path28.default.join(cachePath, "compose.devrouter.yml");
+  const overlayPath = import_node_path29.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
   import_node_fs28.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
@@ -12559,14 +12978,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process25, import_node_crypto8, import_node_fs28, import_node_path28, import_yaml7;
+var import_node_child_process25, import_node_crypto9, import_node_fs28, import_node_path29, import_yaml7;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process25 = require("child_process");
-    import_node_crypto8 = require("crypto");
+    import_node_crypto9 = require("crypto");
     import_node_fs28 = __toESM(require("fs"));
-    import_node_path28 = __toESM(require("path"));
+    import_node_path29 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -13420,7 +13839,7 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path29.default.join(dirPath, entry.name);
+      const entryPath = import_node_path30.default.join(dirPath, entry.name);
       let entryStat;
       try {
         entryStat = import_node_fs29.default.lstatSync(entryPath);
@@ -13497,12 +13916,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs29, import_node_path29, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs29, import_node_path30, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
     import_node_fs29 = __toESM(require("fs"));
-    import_node_path29 = __toESM(require("path"));
+    import_node_path30 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -14128,7 +14547,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers = new Map(worktreePaths.map((path29) => [path29, unknownContainers(reason)]));
+      containers = new Map(worktreePaths.map((path30) => [path30, unknownContainers(reason)]));
     }
   }
   const rows = records.map((record) => {
@@ -14359,7 +14778,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.44" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.46" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {