@devrouter/cli 0.0.45 → 0.0.48

package/dist/devrouter.js

@@ -44,6 +44,7 @@ function buildDevrouterSection() {
     "",
     "Quick validation sequence:",
     "- Managed devcontainer consumer images contain no devrouter package or helper; `devrouter ensure` delivers the matching helper at runtime.",
+    "- Devsy runtime: run `devrouter setup --yes --workspace-runtime devsy` once; `doctor` then reports verified agent readiness without network access.",
     "- `devrouter up`",
     "- `devrouter tls install` (required when repo defines tcp/postgres apps)",
     "- `devrouter app ls --repo .`",
@@ -322,7 +323,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed \`ensure\` rejects every HTTP/TCP proxy upstream outside that exact alias namespace before it mutates DevPod or routes. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: managed scaffolds list the base compose file, then \`\${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}\`; custom repositories may keep another default overlay. Selecting \`.devcontainer/docker-compose.devrouter.yml\` for linked worktrees must pass \`WORKSPACE\` and \`DEVROUTER_WORKSPACE\` across the combined base/overlay config and bind-mount \`\${DEVROUTER_GIT_COMMON_DIR}\` to the same absolute app-container path. The app exposes \`\${WORKSPACE}-app\`; the proxy uses \`upstream: \${WORKSPACE}-app:<port>\`.
-- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects.
+- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects. For Devsy, run \`devrouter setup --yes --workspace-runtime devsy\` once so Devrouter acquires and verifies the pinned agent in its own machine cache. \`doctor\` reports \`ready\`, \`missing\`, \`stale\`, or \`invalid\` without network access, and \`ensure\` fails before the provider queue when readiness is not \`ready\`. An explicit \`DEVSY_AGENT_BINARY\` remains authoritative and must match a pinned official asset.
 - **Managed process identity**: \`ensure\` executes an exact captured adapter snapshot. Default reuse includes command argv, workspace, and adapter SHA-256. Set \`DEVROUTER_PROCESS_FINGERPRINT_ENV\` only to comma-separated non-secret environment names whose values affect runtime identity; secret-like names are rejected and raw values are never persisted.
 - **Route state**: the versioned Traefik dynamic file is authoritative for both metadata and rendering. JSON is a compatibility mirror; valid headerless generations migrate automatically, while corrupt canonical metadata fails closed.
 - **Cleanup**: \`workspace cleanup --repo . --inactive-for 30d --json\` is a report-only, no-\`--yes\` report for managed linked workspaces. It joins ownership (\`present|missing|locked|conflict\`), workspace runtime registration, runtime state (\`running|stopped|busy|not-found|absent|unknown\`), checkout, route, advisory activity, and integration evidence without mutating the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. Local DevPod/Devsy list/status checks always run; \`--check-merged\` alone enables read-only origin and matching GitHub/GitLab checks. Treat \`not-found\` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit \`gc\`/\`down\` can remove exact stale registration only after expected-ID \`NotFound\` proof and ownership revalidation. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
@@ -376,8 +377,9 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter init [--write-agents] [--write-skill]\`: print AI onboarding prompt (non-mutating by default)
 - \`devrouter -V [--repo .]\`: show installed CLI version, local repo version, and next upgrade target
 - \`devrouter upgrade [version] [--repo .]\`: list upgrade targets or print target Agent Adaptation Prompt
-- \`devrouter setup --yes [--repo .] [--json]\`: first-run machine setup plus structured diagnostics
+- \`devrouter setup --yes [--repo .] [--json] [--workspace-runtime <devpod|devsy>]\`: first-run machine setup plus structured diagnostics; explicit Devsy selection acquires its verified agent
 - \`devrouter ensure [path] [--profile <name>] [--open] [--json]\`: canonical startup/reconciliation for primary and linked checkouts; a managed profile selects its independent resource dimensions
+- \`devrouter profile resolve --repo <path> [--profile <selection>] [--json]\`: resolve exact profile resources for automation without starting or inspecting a runtime
 - \`devrouter stop [path] [--delete] [--json]\`: stop the exact workspace runtime and remove exact routes; \`--delete\` explicitly deletes its ownership-proven data without removing the checkout
 - \`devrouter exec [path] -- <command...>\`: literal one-shot command inside the exact running workspace runtime
 - \`devrouter up\` / \`devrouter down\`: start/stop shared Traefik router
@@ -411,6 +413,9 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 
 For devcontainer onboarding:
 
+When Devsy owns the workspace, first run
+\`devrouter setup --repo . --yes --workspace-runtime devsy --json\`.
+
 1. \`devrouter setup --repo . --yes --json\`
 2. \`devrouter doctor --repo . --json\`
 3. \`devrouter repo inspect --repo . --json\`
@@ -720,6 +725,9 @@ function runDockerCompose(args) {
 function startRouterStack() {
   runDockerCompose(["up", "-d"]);
 }
+function restartRouterStack() {
+  runDockerCompose(["restart", "traefik"]);
+}
 function stopRouterStack() {
   runDockerCompose(["down"]);
 }
@@ -898,16 +906,65 @@ function parseLockOwner(value) {
     return { pid };
   }
 }
-function isLockOwnerLive(owner) {
-  if (!isProcessAlive(owner.pid)) return false;
+function parseCanonicalLockOwner(value) {
+  const trimmed = value.trim();
+  return CANONICAL_OWNER_RE.test(trimmed) ? parseLockOwner(trimmed) : void 0;
+}
+function parseLockRecord(value) {
+  const trimmed = value.trim();
+  const lastColon = trimmed.lastIndexOf(":");
+  if (lastColon >= 0 && CANONICAL_OWNER_RE.test(trimmed.slice(0, lastColon))) {
+    const tail = Number(trimmed.slice(lastColon + 1));
+    if (Number.isInteger(tail) && tail > 0) {
+      return { owner: parseLockOwner(trimmed.slice(0, lastColon)), acquiredAtMs: tail };
+    }
+  }
+  return { owner: parseLockOwner(trimmed) };
+}
+function isLockOwnerLive(owner, cache, now = Date.now()) {
+  const cacheKey = `${owner.pid}:${owner.processBirth ?? "legacy"}`;
+  if (!isProcessAlive(owner.pid)) {
+    cache.delete(cacheKey);
+    return false;
+  }
   if (!owner.processBirth) return true;
+  const cached = cache.get(cacheKey);
+  if (cached && now - cached.checkedAtMs < PROCESS_BIRTH_RECHECK_INTERVAL_MS) {
+    return cached.live;
+  }
   const currentBirth = processBirthIdentity(owner.pid);
-  return currentBirth === void 0 || currentBirth === owner.processBirth;
+  const live = currentBirth === void 0 || currentBirth === owner.processBirth;
+  cache.set(cacheKey, { checkedAtMs: now, live });
+  return live;
 }
 function sameFile(left, right) {
   return left.dev === right.dev && left.ino === right.ino;
 }
-function tryReclaimStaleLock(lockPath, staleLinkPath) {
+function inspectFairQueue(lockPath, ownTicketPath, livenessCache) {
+  const directory = import_node_path4.default.dirname(lockPath);
+  const prefix = `${import_node_path4.default.basename(lockPath)}.queue.`;
+  for (; ; ) {
+    const names = import_node_fs4.default.readdirSync(directory).filter((name) => name.startsWith(prefix)).sort();
+    const ownName = import_node_path4.default.basename(ownTicketPath);
+    const position = names.indexOf(ownName);
+    if (position < 0) {
+      throw new Error("provider mutation queue ticket disappeared before acquisition");
+    }
+    const leaderPath = import_node_path4.default.join(directory, names[0]);
+    let leader;
+    try {
+      leader = parseCanonicalLockOwner(import_node_fs4.default.readFileSync(leaderPath, "utf-8"));
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    if (leader && isLockOwnerLive(leader, livenessCache)) {
+      return { leaderPid: leader.pid, position: position + 1 };
+    }
+    import_node_fs4.default.rmSync(leaderPath, { force: true });
+  }
+}
+function tryReclaimStaleLock(lockPath, staleLinkPath, livenessCache) {
   let fd;
   try {
     fd = import_node_fs4.default.openSync(lockPath, "r");
@@ -918,9 +975,9 @@ function tryReclaimStaleLock(lockPath, staleLinkPath) {
     throw error;
   }
   try {
-    const owner = parseLockOwner(import_node_fs4.default.readFileSync(fd, "utf-8").trim());
-    if (owner && isLockOwnerLive(owner)) {
-      return { kind: "live", pid: owner.pid };
+    const record = parseLockRecord(import_node_fs4.default.readFileSync(fd, "utf-8"));
+    if (record.owner && isLockOwnerLive(record.owner, livenessCache)) {
+      return { kind: "live", pid: record.owner.pid, acquiredAtMs: record.acquiredAtMs };
     }
     const staleStat = import_node_fs4.default.fstatSync(fd);
     if (staleStat.nlink !== 1) {
@@ -965,28 +1022,87 @@ function acquireFileLock(lockPath, options) {
   const owner = `${process.pid}:${Buffer.from(processBirth).toString("base64url")}:${ownerId}`;
   const candidatePath = `${lockPath}.${process.pid}.${ownerId}.candidate`;
   const staleLinkPath = `${candidatePath}.stale`;
+  const enqueuedAtMs = Date.now();
+  const queueTicketPath = `${lockPath}.queue.${String(enqueuedAtMs).padStart(13, "0")}.${String(process.pid).padStart(10, "0")}.${ownerId}`;
+  const queueCandidatePath = `${queueTicketPath}.candidate`;
   const deadline = Date.now() + (options.waitMs ?? 0);
+  const waitStartedAt = Date.now();
+  const progressIntervalMs = options.progressIntervalMs ?? DEFAULT_WAIT_PROGRESS_INTERVAL_MS;
+  let lastProgressAt = waitStartedAt;
   let reclaimAttempts = 0;
+  const livenessCache = /* @__PURE__ */ new Map();
   import_node_fs4.default.writeFileSync(candidatePath, `${owner}
+`, {
+    encoding: "utf-8",
+    flag: "wx"
+  });
+  if (options.fair) {
+    import_node_fs4.default.writeFileSync(queueCandidatePath, `${owner}
 `, { encoding: "utf-8", flag: "wx" });
+    import_node_fs4.default.renameSync(queueCandidatePath, queueTicketPath);
+  }
   try {
     for (; ; ) {
+      let queueState;
+      if (options.fair) {
+        queueState = inspectFairQueue(lockPath, queueTicketPath, livenessCache);
+      }
+      if (queueState && queueState.position > 1) {
+        const now = Date.now();
+        if (now >= deadline) {
+          const target = options.target ? ` for ${options.target}` : "";
+          const waitedSeconds = Math.round((now - waitStartedAt) / 1e3);
+          throw new Error(
+            `${options.activity} is still queued${target} (position ${queueState.position}, ahead PID ${queueState.leaderPid}); gave up after waiting ${waitedSeconds}s`
+          );
+        }
+        if (options.onWait && now - lastProgressAt >= progressIntervalMs) {
+          lastProgressAt = now;
+          options.onWait({
+            waitingMs: now - waitStartedAt,
+            holderPid: queueState.leaderPid,
+            queuePosition: queueState.position,
+            waitingOn: "queue"
+          });
+        }
+        sleepSync(20);
+        continue;
+      }
+      const acquiredAtMs = Date.now();
+      const record = `${owner}:${acquiredAtMs}`;
+      import_node_fs4.default.writeFileSync(candidatePath, `${record}
+`, "utf-8");
       try {
         import_node_fs4.default.linkSync(candidatePath, lockPath);
-        return owner;
+        return record;
       } catch (error) {
         if (error.code !== "EEXIST") {
           throw error;
         }
       }
-      const state = tryReclaimStaleLock(lockPath, staleLinkPath);
+      const state = tryReclaimStaleLock(lockPath, staleLinkPath, livenessCache);
       if (state.kind === "reclaimed") {
         continue;
       }
       if (state.kind === "live") {
-        if (Date.now() >= deadline) {
+        const now = Date.now();
+        if (now >= deadline) {
           const target = options.target ? ` for ${options.target}` : "";
-          throw new Error(`${options.activity} is already running${target} (PID ${state.pid})`);
+          const waitedSeconds = Math.round((now - waitStartedAt) / 1e3);
+          const heldSeconds = state.acquiredAtMs !== void 0 ? `, held for ${Math.round((now - state.acquiredAtMs) / 1e3)}s` : "";
+          throw new Error(
+            `${options.activity} is already running${target} (PID ${state.pid}${heldSeconds}); gave up after waiting ${waitedSeconds}s`
+          );
+        }
+        if (options.onWait && now - lastProgressAt >= progressIntervalMs) {
+          lastProgressAt = now;
+          options.onWait({
+            waitingMs: now - waitStartedAt,
+            holderPid: state.pid,
+            holderHeldMs: state.acquiredAtMs !== void 0 ? Math.max(0, now - state.acquiredAtMs) : void 0,
+            queuePosition: queueState?.position,
+            waitingOn: "lock"
+          });
         }
         sleepSync(20);
         continue;
@@ -1002,6 +1118,8 @@ function acquireFileLock(lockPath, options) {
   } finally {
     import_node_fs4.default.rmSync(candidatePath, { force: true });
     import_node_fs4.default.rmSync(staleLinkPath, { force: true });
+    import_node_fs4.default.rmSync(queueCandidatePath, { force: true });
+    import_node_fs4.default.rmSync(queueTicketPath, { force: true });
   }
 }
 function releaseFileLock(lockPath, owner) {
@@ -1031,19 +1149,33 @@ async function withFileLock(lockPath, options, operation) {
     releaseFileLock(lockPath, owner);
   }
 }
-var import_node_child_process2, import_node_crypto2, import_node_fs4;
+function createStderrWaitReporter(activity, target) {
+  return (progress) => {
+    const heldSeconds = progress.holderHeldMs !== void 0 ? `, held for ${Math.round(progress.holderHeldMs / 1e3)}s` : "";
+    const status = progress.waitingOn === "queue" ? `waiting in provider queue position ${progress.queuePosition} led by PID ${progress.holderPid}` : progress.queuePosition !== void 0 && progress.queuePosition > 1 ? `waiting in provider queue position ${progress.queuePosition}; provider lock held by PID ${progress.holderPid}${heldSeconds}` : `waiting for the provider lock held by PID ${progress.holderPid}${heldSeconds}`;
+    process.stderr.write(
+      `${activity} for ${target}: ${status}; waited ${Math.round(progress.waitingMs / 1e3)}s so far
+`
+    );
+  };
+}
+var import_node_child_process2, import_node_crypto2, import_node_fs4, import_node_path4, DEFAULT_WAIT_PROGRESS_INTERVAL_MS, PROCESS_BIRTH_RECHECK_INTERVAL_MS, CANONICAL_OWNER_RE;
 var init_file_lock = __esm({
   "src/core/file-lock.ts"() {
     "use strict";
     import_node_child_process2 = require("child_process");
     import_node_crypto2 = require("crypto");
     import_node_fs4 = __toESM(require("fs"));
+    import_node_path4 = __toESM(require("path"));
+    DEFAULT_WAIT_PROGRESS_INTERVAL_MS = 1e4;
+    PROCESS_BIRTH_RECHECK_INTERVAL_MS = 1e3;
+    CANONICAL_OWNER_RE = /^[0-9]+:[A-Za-z0-9_-]+:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
   }
 });
 
 // src/core/workspace.ts
 function comparableWorkspacePath(filePath) {
-  const resolved = import_node_path4.default.resolve(filePath);
+  const resolved = import_node_path5.default.resolve(filePath);
   try {
     return import_node_fs5.default.realpathSync.native(resolved);
   } catch {
@@ -1073,7 +1205,7 @@ function workspaceIdentityCandidates(source) {
   return candidates;
 }
 function isLinkedWorktree(repoPath) {
-  const gitPath = import_node_path4.default.join(repoPath, ".git");
+  const gitPath = import_node_path5.default.join(repoPath, ".git");
   let stat;
   try {
     stat = import_node_fs5.default.statSync(gitPath);
@@ -1097,7 +1229,7 @@ function isLinkedWorktree(repoPath) {
   return /(^|\/)worktrees\//.test(gitdir);
 }
 function gitMetadataDir(repoPath) {
-  const gitPath = import_node_path4.default.join(repoPath, ".git");
+  const gitPath = import_node_path5.default.join(repoPath, ".git");
   let stat;
   try {
     stat = import_node_fs5.default.statSync(gitPath);
@@ -1114,7 +1246,7 @@ function gitMetadataDir(repoPath) {
   if (!match) {
     return void 0;
   }
-  return import_node_path4.default.resolve(repoPath, match[1].trim());
+  return import_node_path5.default.resolve(repoPath, match[1].trim());
 }
 function validatePersistedWorkspace(value) {
   const workspace = value.trim();
@@ -1128,7 +1260,7 @@ function readPersistedWorkspace(repoPath) {
   if (!gitDir) {
     return void 0;
   }
-  const metadataPath = import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE);
+  const metadataPath = import_node_path5.default.join(gitDir, WORKSPACE_METADATA_FILE);
   try {
     return validatePersistedWorkspace(import_node_fs5.default.readFileSync(metadataPath, "utf-8"));
   } catch (error) {
@@ -1153,7 +1285,7 @@ function persistWorkspace(repoPath, value) {
   if (!gitDir) {
     throw new Error(`cannot persist workspace identity: '${repoPath}' is not a Git checkout`);
   }
-  writeFileAtomically(import_node_path4.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
+  writeFileAtomically(import_node_path5.default.join(gitDir, WORKSPACE_METADATA_FILE), `${workspace}
 `);
   return workspace;
 }
@@ -1162,7 +1294,7 @@ async function withWorkspaceLifecycleLock(repoPath, operation) {
   if (!gitDir) {
     throw new Error(`cannot lock workspace lifecycle: '${repoPath}' is not a Git checkout`);
   }
-  const lockPath = import_node_path4.default.join(gitDir, WORKSPACE_LOCK_FILE);
+  const lockPath = import_node_path5.default.join(gitDir, WORKSPACE_LOCK_FILE);
   return withFileLock(
     lockPath,
     { activity: "workspace lifecycle", target: `'${repoPath}'` },
@@ -1190,7 +1322,7 @@ function deriveLinkedWorktreeWorkspace(repoPath, linkedWorktreeBranch) {
     return void 0;
   }
   const branch = currentBranch(repoPath);
-  return wsFromBranch(branch ?? import_node_path4.default.basename(import_node_path4.default.resolve(repoPath)));
+  return wsFromBranch(branch ?? import_node_path5.default.basename(import_node_path5.default.resolve(repoPath)));
 }
 function resolveWorktreeWorkspace(repoPath, linkedWorktreeBranch) {
   return readPersistedWorkspace(repoPath) ?? deriveLinkedWorktreeWorkspace(repoPath, linkedWorktreeBranch);
@@ -1213,14 +1345,14 @@ function resolveWorkspace(repoPath, override) {
   }
   return deriveLinkedWorktreeWorkspace(repoPath);
 }
-var import_node_child_process3, import_node_crypto3, import_node_fs5, import_node_path4, MAX_WORKSPACE_LENGTH, WORKSPACE_IDENTITY_CANDIDATE_LIMIT, WORKSPACE_IDENTITY_HASH_LENGTH, WORKSPACE_IDENTITY_PREFIX_LENGTH, WORKSPACE_IDENTITY_HASH_DOMAIN, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
+var import_node_child_process3, import_node_crypto3, import_node_fs5, import_node_path5, MAX_WORKSPACE_LENGTH, WORKSPACE_IDENTITY_CANDIDATE_LIMIT, WORKSPACE_IDENTITY_HASH_LENGTH, WORKSPACE_IDENTITY_PREFIX_LENGTH, WORKSPACE_IDENTITY_HASH_DOMAIN, WORKSPACE_METADATA_FILE, WORKSPACE_LOCK_FILE;
 var init_workspace = __esm({
   "src/core/workspace.ts"() {
     "use strict";
     import_node_child_process3 = require("child_process");
     import_node_crypto3 = require("crypto");
     import_node_fs5 = __toESM(require("fs"));
-    import_node_path4 = __toESM(require("path"));
+    import_node_path5 = __toESM(require("path"));
     init_atomic_file();
     init_file_lock();
     MAX_WORKSPACE_LENGTH = 32;
@@ -1282,6 +1414,12 @@ function hostRouteFromInput(input2, existing, now) {
 function sanitizeKey(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
+function buildHostRouteRouterKey(routeId) {
+  return `host-${sanitizeKey(routeId)}`;
+}
+function buildHostRouteRouterName(repoPath, name) {
+  return `${buildHostRouteRouterKey(buildHostRouteId(repoPath, name))}@file`;
+}
 function tcpTlsOptionName(tcpProtocol) {
   return `devrouter-tcp-${tcpProtocol}`;
 }
@@ -1292,7 +1430,7 @@ function buildHostRoutesDocument(routes, tlsEnabled) {
   const tcpServices = {};
   const tlsOptions = {};
   for (const route of routes) {
-    const key = `host-${sanitizeKey(route.id)}`;
+    const key = buildHostRouteRouterKey(route.id);
     if (route.protocol === "tcp") {
       const alpn = route.tcpProtocol ? TCP_TLS_ALPN_PROTOCOLS[route.tcpProtocol] : void 0;
       let tls = {};
@@ -1644,7 +1782,7 @@ function listHostRoutes(tlsEnabled) {
       protocol: isTcp ? `tcp/${tcpProtocol}` : "http",
       appName: route.name,
       serviceName: route.name,
-      projectName: import_node_path5.default.basename(route.repoPath),
+      projectName: import_node_path6.default.basename(route.repoPath),
       hosts: [route.host],
       // TCP routes are reached via an SNI-aware client on the shared protocol
       // port; surface a protocol-scheme URL rather than http(s)://.
@@ -1659,12 +1797,12 @@ function listHostRoutes(tlsEnabled) {
     };
   });
 }
-var import_node_fs6, import_node_path5, import_node_util, import_yaml, LOOPBACK_HOSTS, UPSTREAM_RE, TCP_TLS_ALPN_PROTOCOLS, ROUTE_METADATA_PREFIX, ROUTE_METADATA_FAMILY_PREFIX, STATE_LOCK_FILE;
+var import_node_fs6, import_node_path6, import_node_util, import_yaml, LOOPBACK_HOSTS, UPSTREAM_RE, TCP_TLS_ALPN_PROTOCOLS, ROUTE_METADATA_PREFIX, ROUTE_METADATA_FAMILY_PREFIX, STATE_LOCK_FILE;
 var init_host_routes = __esm({
   "src/core/host-routes.ts"() {
     "use strict";
     import_node_fs6 = __toESM(require("fs"));
-    import_node_path5 = __toESM(require("path"));
+    import_node_path6 = __toESM(require("path"));
     import_node_util = require("util");
     import_yaml = __toESM(require("yaml"));
     init_atomic_file();
@@ -2512,10 +2650,10 @@ function appToNodeValue(app) {
   return value;
 }
 function resolveRepoPath(repoPath) {
-  return import_node_path6.default.resolve(repoPath ?? process.cwd());
+  return import_node_path7.default.resolve(repoPath ?? process.cwd());
 }
 function getRepoConfigPath(repoPath) {
-  return import_node_path6.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
+  return import_node_path7.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
 }
 function loadRepoConfig(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
@@ -2530,7 +2668,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.45" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.48" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -2563,7 +2701,7 @@ function initRepoConfig(repoPath, options = {}) {
       }
     } : {},
     project: {
-      name: import_node_path6.default.basename(resolvedRepoPath)
+      name: import_node_path7.default.basename(resolvedRepoPath)
     },
     apps: []
   };
@@ -2792,7 +2930,7 @@ function namespaceHost(host, workspace) {
   return `${base}.${workspace}${suffix}`;
 }
 function applyWorkspace(config, workspace, repoPath) {
-  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path6.default.basename(import_node_path6.default.resolve(repoPath))) ?? "app";
+  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path7.default.basename(import_node_path7.default.resolve(repoPath))) ?? "app";
   const substitutionToken = workspace ?? defaultToken;
   const next = structuredClone(config);
   for (const app of next.apps) {
@@ -2874,12 +3012,12 @@ function resolveAppDependencies(config, app) {
   }
   return results;
 }
-var import_node_fs7, import_node_path6, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY, PROFILE_NAME_RE, MAX_PROFILES;
+var import_node_fs7, import_node_path7, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY, PROFILE_NAME_RE, MAX_PROFILES;
 var init_repo_config = __esm({
   "src/core/repo-config.ts"() {
     "use strict";
     import_node_fs7 = __toESM(require("fs"));
-    import_node_path6 = __toESM(require("path"));
+    import_node_path7 = __toESM(require("path"));
     import_yaml2 = __toESM(require("yaml"));
     init_capabilities();
     init_host_routes();
@@ -3060,7 +3198,8 @@ function buildOnboardingPrompt(options = {}) {
     "- The owner record survives linked-worktree removal and binds the exact path to its workspace-runtime ID. First use reconciles persisted metadata, the exact-path owner record, and both DevPod and Devsy registries. It preserves an established agreement, uses the readable sanitized identity when free, or claims a deterministic hash-suffixed fallback on collision before provider or route mutation. Later flags or `DEVROUTER_WORKSPACE` may repeat but cannot rename it. Unreadable or conflicting evidence fails closed. The primary checkout stays non-namespaced.",
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
-    "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once so Devrouter acquires and verifies the pinned agent in its own machine cache. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access, and `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match a pinned official asset.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
@@ -3092,7 +3231,7 @@ function buildOnboardingPrompt(options = {}) {
     "- Warning: Do not run migration/seed until env probe confirms expected DB variables and values.",
     "",
     "Required workflow:",
-    "1) Run `devrouter setup --yes --json` for devrouter-owned machine state; use `devrouter doctor --repo <REPO_PATH> --json` to diagnose missing prerequisites without mutation.",
+    "1) Run `devrouter setup --yes --json` for devrouter-owned machine state. When selecting Devsy, use `devrouter setup --yes --workspace-runtime devsy --json` to acquire its verified agent. Use `devrouter doctor --repo <REPO_PATH> --json` to diagnose missing prerequisites without mutation.",
     "2) Run `devrouter repo inspect --repo <REPO_PATH> --json` before editing files.",
     "3) For the supported Node/pnpm/Postgres devcontainer shape, run `devrouter repo devcontainer write --repo <REPO_PATH> --dry-run --json`, review the plan, then run `devrouter repo devcontainer write --repo <REPO_PATH> --yes`.",
     "4) For unsupported shapes or custom existing files, make minimal manual edits and explain the assumptions.",
@@ -3102,6 +3241,7 @@ function buildOnboardingPrompt(options = {}) {
     "",
     "Validation commands to run/report for the devcontainer path:",
     "- devrouter setup --yes --json",
+    "- Devsy runtime setup: devrouter setup --yes --workspace-runtime devsy --json",
     "- devrouter doctor --repo <REPO_PATH> --json",
     "- devrouter repo inspect --repo <REPO_PATH> --json",
     "- devrouter repo devcontainer write --repo <REPO_PATH> --dry-run --json",
@@ -3229,6 +3369,10 @@ var init_ai_prompt = __esm({
         command: "devrouter ensure [path] [--profile <name>] [--open] [--json]",
         purpose: "Canonical startup and proof for an exact primary or linked checkout; atomically publishes routes after readiness."
       },
+      {
+        command: "devrouter profile resolve --repo <path> [--profile <selection>] [--json]",
+        purpose: "Resolve exact profile resources without starting or inspecting a runtime; fail closed on invalid selections or unknown report schemas."
+      },
       {
         command: "devrouter stop [path] [--delete] [--json]",
         purpose: "Stop the exact checkout workspace runtime and routes; --delete explicitly deletes the ownership-proven runtime without removing the checkout."
@@ -3787,7 +3931,7 @@ function readPromptDirectory(promptDirPath) {
       continue;
     }
     const version = normalizeVersion(basename);
-    const promptPath = import_node_path7.default.join(promptDirPath, file.name);
+    const promptPath = import_node_path8.default.join(promptDirPath, file.name);
     const prompt = import_node_fs8.default.readFileSync(promptPath, "utf-8").trim();
     releases.push({ version, prompt, promptPath });
   }
@@ -3809,17 +3953,17 @@ function listAvailableUpgradeTargets(currentVersion, releases) {
 }
 function resolvePromptDirectory(explicitPath) {
   if (explicitPath) {
-    return import_node_path7.default.resolve(explicitPath);
+    return import_node_path8.default.resolve(explicitPath);
   }
-  const entryFile = process.argv[1] ? import_node_path7.default.resolve(process.argv[1]) : __filename;
-  const entryDir = import_node_path7.default.dirname(entryFile);
-  const resolvedEntryDir = import_node_fs8.default.existsSync(entryFile) ? import_node_path7.default.dirname(import_node_fs8.default.realpathSync(entryFile)) : entryDir;
+  const entryFile = process.argv[1] ? import_node_path8.default.resolve(process.argv[1]) : __filename;
+  const entryDir = import_node_path8.default.dirname(entryFile);
+  const resolvedEntryDir = import_node_fs8.default.existsSync(entryFile) ? import_node_path8.default.dirname(import_node_fs8.default.realpathSync(entryFile)) : entryDir;
   const candidates = [
-    import_node_path7.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path7.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path7.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path7.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
-    import_node_path7.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
+    import_node_path8.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path8.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path8.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path8.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
+    import_node_path8.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
   ];
   const existing = candidates.find((candidate) => import_node_fs8.default.existsSync(candidate));
   return existing ?? candidates[0];
@@ -3837,12 +3981,12 @@ function loadUpgradeCatalog(options = {}) {
     releases
   };
 }
-var import_node_fs8, import_node_path7, SEMVER_RE, UPGRADE_PROMPTS_DIR;
+var import_node_fs8, import_node_path8, SEMVER_RE, UPGRADE_PROMPTS_DIR;
 var init_upgrade = __esm({
   "src/core/upgrade.ts"() {
     "use strict";
     import_node_fs8 = __toESM(require("fs"));
-    import_node_path7 = __toESM(require("path"));
+    import_node_path8 = __toESM(require("path"));
     init_repo_config();
     SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
     UPGRADE_PROMPTS_DIR = "upgrade-prompts";
@@ -3931,6 +4075,384 @@ var init_upgrade2 = __esm({
   }
 });
 
+// src/core/devsy-agent.ts
+function parseVersion(output2) {
+  return output2?.match(
+    /\bv?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\b/
+  )?.[1];
+}
+function devsyAgentRepairSuggestion(inspection) {
+  if (inspection.state === "stale") {
+    return `Install Devsy ${SUPPORTED_DEVSY_VERSION} for a supported host, then run: ${DEVSY_AGENT_SETUP_COMMAND}`;
+  }
+  return inspection.source === "explicit" ? `Fix or unset DEVSY_AGENT_BINARY, then run: ${DEVSY_AGENT_SETUP_COMMAND}` : `Run: ${DEVSY_AGENT_SETUP_COMMAND}`;
+}
+function installedVersionOutput() {
+  const result = (0, import_node_child_process4.spawnSync)("devsy", ["--version"], { encoding: "utf-8" });
+  if (result.error || result.status !== 0) return void 0;
+  return [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || void 0;
+}
+function nativeAssetName(platform, arch) {
+  if (platform !== "darwin") return void 0;
+  if (arch === "arm64") return "devsy-linux-arm64";
+  if (arch === "x64") return "devsy-linux-amd64";
+  return void 0;
+}
+function managedBinaryPath(cacheRoot, asset) {
+  return import_node_path9.default.join(cacheRoot, `v${SUPPORTED_DEVSY_VERSION}`, asset.name);
+}
+function hashOpenFile(file) {
+  const digest = (0, import_node_crypto4.createHash)("sha256");
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  let position = 0;
+  for (; ; ) {
+    const bytesRead = import_node_fs9.default.readSync(file, buffer, 0, buffer.length, position);
+    if (bytesRead === 0) break;
+    digest.update(buffer.subarray(0, bytesRead));
+    position += bytesRead;
+  }
+  return digest.digest("hex");
+}
+function inspectBinary(binaryPath, assets, missingState) {
+  let file;
+  try {
+    file = import_node_fs9.default.openSync(binaryPath, import_node_fs9.default.constants.O_RDONLY | import_node_fs9.default.constants.O_NOFOLLOW);
+    const stat = import_node_fs9.default.fstatSync(file);
+    if (!stat.isFile()) {
+      return { state: "invalid", reason: "the selected source is not a regular file" };
+    }
+    const sizeMatches = assets.filter((asset2) => asset2.size === stat.size);
+    if (sizeMatches.length === 0) {
+      return { state: "invalid", reason: "the selected source has an unexpected size" };
+    }
+    const sha2562 = hashOpenFile(file);
+    const asset = sizeMatches.find((candidate) => candidate.sha256 === sha2562);
+    return asset ? { state: "ready", reason: "the selected source matches the pinned manifest", asset } : { state: "invalid", reason: "the selected source has an unexpected digest" };
+  } catch (error) {
+    const code = error.code;
+    return code === "ENOENT" ? { state: missingState, reason: "the selected source is missing" } : { state: "invalid", reason: "the selected source is not a readable regular file" };
+  } finally {
+    if (file !== void 0) import_node_fs9.default.closeSync(file);
+  }
+}
+function resolvedOptions(options) {
+  return {
+    env: options.env ?? process.env,
+    platform: options.platform ?? process.platform,
+    arch: options.arch ?? process.arch,
+    versionOutput: options.versionOutput ?? installedVersionOutput(),
+    cacheRoot: options.cacheRoot ?? import_node_path9.default.join(CACHE_DIR, "devsy", "agents"),
+    lockPath: options.lockPath ?? DEVSY_AGENT_CACHE_LOCK,
+    assets: options.assets ?? DEVSY_AGENT_ASSETS,
+    nativeAssetName: options.nativeAssetName
+  };
+}
+function inspectDevsyAgent(options = {}) {
+  const resolved = resolvedOptions(options);
+  const installedVersion = parseVersion(resolved.versionOutput);
+  const explicitPath = resolved.env.DEVSY_AGENT_BINARY?.trim();
+  const source = explicitPath ? "explicit" : "managed";
+  if (installedVersion !== SUPPORTED_DEVSY_VERSION) {
+    return {
+      state: "stale",
+      source,
+      reason: installedVersion ? `installed Devsy ${installedVersion} is not supported by this Devrouter release` : "the supported Devsy version is not available",
+      installedVersion
+    };
+  }
+  if (explicitPath) {
+    return {
+      ...inspectBinary(explicitPath, resolved.assets, "invalid"),
+      source,
+      binaryPath: explicitPath,
+      installedVersion
+    };
+  }
+  const expectedName = resolved.nativeAssetName ?? nativeAssetName(resolved.platform, resolved.arch);
+  const asset = resolved.assets.find((candidate) => candidate.name === expectedName);
+  if (!asset) {
+    return {
+      state: "stale",
+      source,
+      reason: `this Devrouter release has no pinned Devsy agent for ${resolved.platform}/${resolved.arch}`,
+      installedVersion
+    };
+  }
+  const binaryPath = managedBinaryPath(resolved.cacheRoot, asset);
+  return {
+    ...inspectBinary(binaryPath, [asset], "missing"),
+    source,
+    binaryPath,
+    asset,
+    installedVersion
+  };
+}
+async function writeAll(handle, chunk, position) {
+  let offset = 0;
+  while (offset < chunk.byteLength) {
+    const { bytesWritten } = await handle.write(
+      chunk,
+      offset,
+      chunk.byteLength - offset,
+      position + offset
+    );
+    if (bytesWritten === 0) throw new Error("Devsy agent download stopped making progress");
+    offset += bytesWritten;
+  }
+}
+function appendBoundedTail(current, chunk) {
+  if (chunk.length >= GITHUB_CLI_STDERR_TAIL_BYTES) {
+    return Buffer.from(chunk.subarray(chunk.length - GITHUB_CLI_STDERR_TAIL_BYTES));
+  }
+  const combined = Buffer.concat([current, chunk]);
+  return combined.length > GITHUB_CLI_STDERR_TAIL_BYTES ? combined.subarray(combined.length - GITHUB_CLI_STDERR_TAIL_BYTES) : combined;
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function downloadWithGitHubCli(asset, writeChunk) {
+  const child = (0, import_node_child_process4.spawn)(
+    "gh",
+    [
+      "api",
+      `repos/devsy-org/devsy/releases/assets/${asset.githubAssetId}`,
+      "-H",
+      "Accept: application/octet-stream"
+    ],
+    { stdio: ["ignore", "pipe", "pipe"] }
+  );
+  if (!child.stdout || !child.stderr) {
+    child.kill();
+    throw new Error("GitHub CLI fallback did not create output pipes");
+  }
+  let stderrTail = Buffer.alloc(0);
+  child.stderr.on("data", (chunk) => {
+    const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    stderrTail = appendBoundedTail(stderrTail, value);
+  });
+  let spawnError;
+  const completion = new Promise((resolve) => {
+    child.once("error", (error) => {
+      spawnError = error;
+    });
+    child.once("close", (status) => {
+      resolve(status);
+    });
+  });
+  try {
+    for await (const chunk of child.stdout) {
+      await writeChunk(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    const status = await completion;
+    if (spawnError) throw spawnError;
+    if (status !== 0) {
+      const details = stderrTail.toString("utf-8").trim();
+      throw new Error(
+        `gh api exited with status ${status ?? "unknown"}${details ? `: ${details}` : ""}`
+      );
+    }
+  } catch (error) {
+    if (child.exitCode === null) child.kill();
+    await completion.catch(() => void 0);
+    throw error;
+  }
+}
+function fsyncDirectory2(directory) {
+  const handle = import_node_fs9.default.openSync(directory, "r");
+  try {
+    import_node_fs9.default.fsyncSync(handle);
+  } finally {
+    import_node_fs9.default.closeSync(handle);
+  }
+}
+async function downloadAndPublish(asset, binaryPath, fetcher, githubCliDownloader) {
+  const directory = import_node_path9.default.dirname(binaryPath);
+  import_node_fs9.default.mkdirSync(directory, { recursive: true, mode: 448 });
+  const temporaryPath = import_node_path9.default.join(
+    directory,
+    `.${import_node_path9.default.basename(binaryPath)}.${process.pid}.${(0, import_node_crypto4.randomUUID)()}.tmp`
+  );
+  let handle;
+  try {
+    let response;
+    let directFailure;
+    try {
+      response = await fetcher(asset.url);
+    } catch (error) {
+      directFailure = error;
+    }
+    handle = await import_node_fs9.default.promises.open(temporaryPath, "wx", 384);
+    const digest = (0, import_node_crypto4.createHash)("sha256");
+    let size = 0;
+    const writeChunk = async (chunk) => {
+      size += chunk.byteLength;
+      if (size > asset.size) {
+        throw new Error("Devsy agent download exceeded the pinned size");
+      }
+      digest.update(chunk);
+      await writeAll(handle, chunk, size - chunk.byteLength);
+    };
+    let transport;
+    if (response) {
+      if (!response.ok) {
+        throw new Error(`Devsy agent download failed with HTTP ${response.status}`);
+      }
+      if (!response.body) throw new Error("Devsy agent download returned no response body");
+      const reader = response.body.getReader();
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          await writeChunk(value);
+        }
+      } catch (error) {
+        await reader.cancel().catch(() => void 0);
+        throw error;
+      }
+      transport = "https";
+    } else {
+      try {
+        await githubCliDownloader(asset, writeChunk);
+      } catch (fallbackError) {
+        throw new Error(
+          `Devsy agent direct HTTPS download failed: ${errorMessage(directFailure)}; GitHub CLI fallback failed: ${errorMessage(fallbackError)}. Restore direct GitHub release access or install and authenticate gh.`
+        );
+      }
+      transport = "github-cli";
+    }
+    if (size !== asset.size) throw new Error("Devsy agent download has an unexpected size");
+    if (digest.digest("hex") !== asset.sha256) {
+      throw new Error("Devsy agent download has an unexpected digest");
+    }
+    await handle.sync();
+    await handle.chmod(448);
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    await import_node_fs9.default.promises.rename(temporaryPath, binaryPath);
+    fsyncDirectory2(directory);
+    return transport;
+  } finally {
+    if (handle) await handle.close();
+    await import_node_fs9.default.promises.rm(temporaryPath, { force: true });
+  }
+}
+async function prepareDevsyAgent(options = {}) {
+  const resolved = resolvedOptions(options);
+  const inspectOptions = resolved;
+  const before = inspectDevsyAgent(inspectOptions);
+  if (before.state === "ready" && before.binaryPath && before.asset) {
+    return {
+      binaryPath: before.binaryPath,
+      source: before.source,
+      asset: before.asset,
+      changed: false,
+      transport: "existing"
+    };
+  }
+  if (before.source === "explicit" || before.state === "stale" || !before.binaryPath || !before.asset) {
+    throw new DevsyAgentReadinessError(before);
+  }
+  const lock = options.withLock ?? ((operation) => {
+    import_node_fs9.default.mkdirSync(import_node_path9.default.dirname(resolved.lockPath), { recursive: true });
+    return withFileLock(
+      resolved.lockPath,
+      {
+        activity: "Devsy agent acquisition",
+        waitMs: DEVSY_AGENT_LOCK_WAIT_MS,
+        fair: true,
+        onWait: createStderrWaitReporter("Devsy agent acquisition", "the managed cache")
+      },
+      operation
+    );
+  });
+  return lock(async () => {
+    const current = inspectDevsyAgent(inspectOptions);
+    if (current.state === "ready" && current.binaryPath && current.asset) {
+      return {
+        binaryPath: current.binaryPath,
+        source: current.source,
+        asset: current.asset,
+        changed: false,
+        transport: "existing"
+      };
+    }
+    if (current.source === "explicit" || current.state === "stale" || !current.binaryPath || !current.asset) {
+      throw new DevsyAgentReadinessError(current);
+    }
+    const transport = await downloadAndPublish(
+      current.asset,
+      current.binaryPath,
+      options.fetcher ?? fetch,
+      options.githubCliDownloader ?? downloadWithGitHubCli
+    );
+    const published = inspectDevsyAgent(inspectOptions);
+    if (published.state !== "ready" || !published.binaryPath || !published.asset) {
+      throw new DevsyAgentReadinessError(published);
+    }
+    return {
+      binaryPath: published.binaryPath,
+      source: published.source,
+      asset: published.asset,
+      changed: true,
+      transport
+    };
+  });
+}
+function requireReadyDevsyAgent(options = {}) {
+  const inspection = inspectDevsyAgent(options);
+  if (inspection.state !== "ready" || !inspection.binaryPath || !inspection.asset) {
+    throw new DevsyAgentReadinessError(inspection);
+  }
+  return {
+    binaryPath: inspection.binaryPath,
+    source: inspection.source,
+    asset: inspection.asset,
+    changed: false,
+    transport: "existing"
+  };
+}
+var import_node_child_process4, import_node_crypto4, import_node_fs9, import_node_path9, SUPPORTED_DEVSY_VERSION, DEVSY_AGENT_SETUP_COMMAND, DEVSY_AGENT_ASSETS, DevsyAgentReadinessError, DEVSY_AGENT_CACHE_LOCK, DEVSY_AGENT_LOCK_WAIT_MS, GITHUB_CLI_STDERR_TAIL_BYTES;
+var init_devsy_agent = __esm({
+  "src/core/devsy-agent.ts"() {
+    "use strict";
+    import_node_child_process4 = require("child_process");
+    import_node_crypto4 = require("crypto");
+    import_node_fs9 = __toESM(require("fs"));
+    import_node_path9 = __toESM(require("path"));
+    init_file_lock();
+    init_router();
+    SUPPORTED_DEVSY_VERSION = "1.16.2";
+    DEVSY_AGENT_SETUP_COMMAND = "devrouter setup --yes --workspace-runtime devsy";
+    DEVSY_AGENT_ASSETS = [
+      {
+        githubAssetId: 529830010,
+        name: "devsy-linux-arm64",
+        size: 124518562,
+        sha256: "31060b96486b5398f2aa3ee0875b2555782a2db0954a799d387be38ed4b4990d",
+        url: "https://github.com/devsy-org/devsy/releases/download/v1.16.2/devsy-linux-arm64"
+      },
+      {
+        githubAssetId: 529830011,
+        name: "devsy-linux-amd64",
+        size: 133505186,
+        sha256: "4983c52a3536c5a91d1b5f356a1c3428778ebf3f896d9897f60bce3978abc839",
+        url: "https://github.com/devsy-org/devsy/releases/download/v1.16.2/devsy-linux-amd64"
+      }
+    ];
+    DevsyAgentReadinessError = class extends Error {
+      constructor(inspection) {
+        super(`Devsy agent is ${inspection.state}: ${inspection.reason}`);
+        this.inspection = inspection;
+        this.name = "DevsyAgentReadinessError";
+      }
+    };
+    DEVSY_AGENT_CACHE_LOCK = import_node_path9.default.join(DEVROUTER_HOME, "devsy-agent-cache.lock");
+    DEVSY_AGENT_LOCK_WAIT_MS = 18e5;
+    GITHUB_CLI_STDERR_TAIL_BYTES = 4096;
+  }
+});
+
 // src/core/docker.ts
 async function getDockerodeConstructor() {
   if (!dockerodeConstructorPromise) {
@@ -3942,7 +4464,7 @@ async function getDockerodeConstructor() {
   return dockerodeConstructorPromise;
 }
 function runDockerContextCommand(args) {
-  const result = (0, import_node_child_process4.spawnSync)("docker", ["context", ...args], {
+  const result = (0, import_node_child_process5.spawnSync)("docker", ["context", ...args], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -3955,7 +4477,7 @@ function getCurrentDockerContext() {
   return runDockerContextCommand(["show"]);
 }
 function getDockerHostFromContext(context) {
-  const result = (0, import_node_child_process4.spawnSync)(
+  const result = (0, import_node_child_process5.spawnSync)(
     "docker",
     ["context", "inspect", context, "--format", "{{ .Endpoints.docker.Host }}"],
     { encoding: "utf-8" }
@@ -4023,11 +4545,11 @@ async function networkExists(name) {
     return false;
   }
 }
-var import_node_child_process4, dockerodeConstructorPromise;
+var import_node_child_process5, dockerodeConstructorPromise;
 var init_docker = __esm({
   "src/core/docker.ts"() {
     "use strict";
-    import_node_child_process4 = require("child_process");
+    import_node_child_process5 = require("child_process");
     dockerodeConstructorPromise = null;
   }
 });
@@ -4054,11 +4576,11 @@ function parseDevcontainerConfig(contents, sourcePath) {
   return parsed;
 }
 function readDevcontainerConfig(repoPath) {
-  const sourcePath = import_node_path8.default.join(repoPath, ".devcontainer", "devcontainer.json");
-  if (!import_node_fs9.default.existsSync(sourcePath) || !import_node_fs9.default.lstatSync(sourcePath).isFile()) {
+  const sourcePath = import_node_path10.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  if (!import_node_fs10.default.existsSync(sourcePath) || !import_node_fs10.default.lstatSync(sourcePath).isFile()) {
     throw new Error(`Managed Dev Container source config does not exist: ${sourcePath}`);
   }
-  const sourceContents = import_node_fs9.default.readFileSync(sourcePath, "utf-8");
+  const sourceContents = import_node_fs10.default.readFileSync(sourcePath, "utf-8");
   return {
     sourcePath,
     sourceContents,
@@ -4074,12 +4596,12 @@ function assertManagedDevcontainerLifecycle(repoPath) {
     `Managed Dev Container source '${sourcePath}' defines postCreateCommand, but waitFor ${actual}. Set waitFor to 'postCreateCommand' or 'postStartCommand' before retrying devrouter ensure.`
   );
 }
-var import_node_fs9, import_node_path8, import_jsonc_parser;
+var import_node_fs10, import_node_path10, import_jsonc_parser;
 var init_devcontainer_config = __esm({
   "src/core/devcontainer-config.ts"() {
     "use strict";
-    import_node_fs9 = __toESM(require("fs"));
-    import_node_path8 = __toESM(require("path"));
+    import_node_fs10 = __toESM(require("fs"));
+    import_node_path10 = __toESM(require("path"));
     import_jsonc_parser = require("jsonc-parser");
   }
 });
@@ -4089,7 +4611,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path9.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path11.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -4113,7 +4635,7 @@ function commandFailure(result) {
   return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
 }
 function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process5.spawnSync)(
+  const result = (0, import_node_child_process6.spawnSync)(
     "docker",
     ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
     { input: contents, encoding: "utf-8" }
@@ -4124,32 +4646,32 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs10.default.existsSync(filePath) || !import_node_fs10.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs10.default.readFileSync(filePath);
+  if (!import_node_fs11.default.existsSync(filePath) || !import_node_fs11.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs11.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto4.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto5.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path9.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path9.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path11.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path11.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs10.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs11.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path9.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path11.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path9.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path9.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path11.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path11.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -4190,7 +4712,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs10.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs11.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -4204,7 +4726,7 @@ function runManagedPostStart(options) {
     options.plan.adapterContents,
     "the managed post-start adapter"
   );
-  const started = (0, import_node_child_process5.spawnSync)(
+  const started = (0, import_node_child_process6.spawnSync)(
     "docker",
     [
       "exec",
@@ -4242,7 +4764,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process5.spawnSync)(
+  const result = (0, import_node_child_process6.spawnSync)(
     "docker",
     [
       "exec",
@@ -4278,14 +4800,14 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process5, import_node_crypto4, import_node_fs10, import_node_path9, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
+var import_node_child_process6, import_node_crypto5, import_node_fs11, import_node_path11, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
-    import_node_child_process5 = require("child_process");
-    import_node_crypto4 = require("crypto");
-    import_node_fs10 = __toESM(require("fs"));
-    import_node_path9 = __toESM(require("path"));
+    import_node_child_process6 = require("child_process");
+    import_node_crypto5 = require("crypto");
+    import_node_fs11 = __toESM(require("fs"));
+    import_node_path11 = __toESM(require("path"));
     init_devcontainer_config();
     MANAGED_MARKER = "devrouter:managed devcontainer";
     MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
@@ -4352,7 +4874,7 @@ function isLoopbackHost(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "host.docker.internal";
 }
 function inspectCompose(composeFile, _workspace) {
-  if (!import_node_fs11.default.existsSync(composeFile)) {
+  if (!import_node_fs12.default.existsSync(composeFile)) {
     return {
       aliases: [],
       publishedPorts: [],
@@ -4361,7 +4883,7 @@ function inspectCompose(composeFile, _workspace) {
     };
   }
   try {
-    const raw = import_node_fs11.default.readFileSync(composeFile, "utf-8");
+    const raw = import_node_fs12.default.readFileSync(composeFile, "utf-8");
     const parsed = import_yaml3.default.parse(raw);
     const root = asRecord(parsed);
     const services = asRecord(root?.services);
@@ -4418,11 +4940,11 @@ function routedProxyApps(config) {
   );
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path10.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs11.default.existsSync(devcontainerDir)) {
+  const devcontainerDir = import_node_path12.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs12.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path10.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path12.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -4449,9 +4971,9 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path10.default.join(devcontainerDir, "Dockerfile");
-  const dockerfileExists = import_node_fs11.default.existsSync(dockerfilePath);
-  const dockerfile = dockerfileExists ? import_node_fs11.default.readFileSync(dockerfilePath, "utf-8") : "";
+  const dockerfilePath = import_node_path12.default.join(devcontainerDir, "Dockerfile");
+  const dockerfileExists = import_node_fs12.default.existsSync(dockerfilePath);
+  const dockerfile = dockerfileExists ? import_node_fs12.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
     (artifact) => dockerfile.includes(artifact)
   );
@@ -4506,12 +5028,12 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs11, import_node_path10, import_yaml3;
+var import_node_fs12, import_node_path12, import_yaml3;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
-    import_node_fs11 = __toESM(require("fs"));
-    import_node_path10 = __toESM(require("path"));
+    import_node_fs12 = __toESM(require("fs"));
+    import_node_path12 = __toESM(require("path"));
     import_yaml3 = __toESM(require("yaml"));
     init_managed_post_start();
   }
@@ -4519,18 +5041,18 @@ var init_devcontainer_diagnostics = __esm({
 
 // src/core/paths.ts
 function assertPathWithinRepo(filePath, repoRoot, label) {
-  const resolvedRoot = import_node_path11.default.resolve(repoRoot);
-  const resolved = import_node_path11.default.resolve(repoRoot, filePath);
-  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path11.default.sep)) {
+  const resolvedRoot = import_node_path13.default.resolve(repoRoot);
+  const resolved = import_node_path13.default.resolve(repoRoot, filePath);
+  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path13.default.sep)) {
     throw new Error(`${label} path '${filePath}' escapes the repository root.`);
   }
   return resolved;
 }
-var import_node_path11;
+var import_node_path13;
 var init_paths = __esm({
   "src/core/paths.ts"() {
     "use strict";
-    import_node_path11 = __toESM(require("path"));
+    import_node_path13 = __toESM(require("path"));
   }
 });
 
@@ -4615,11 +5137,11 @@ function reconcileRouteRunConflict(repoPath, app) {
     }
   }
 }
-var import_node_fs12;
+var import_node_fs13;
 var init_route_state = __esm({
   "src/core/route-state.ts"() {
     "use strict";
-    import_node_fs12 = __toESM(require("fs"));
+    import_node_fs13 = __toESM(require("fs"));
     init_host_routes();
     init_workspace();
   }
@@ -4785,10 +5307,10 @@ var init_routes = __esm({
 
 // src/core/managed-runtime-state.ts
 function stateKey(repoPath, workspace) {
-  return (0, import_node_crypto5.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
 function managedRuntimeStatePath(repoPath, workspace) {
-  return import_node_path12.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
+  return import_node_path14.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string") && new Set(value).size === value.length;
@@ -4851,10 +5373,10 @@ function validateState(value, repoPath, workspace) {
 }
 function readManagedRuntimeState(repoPath, workspace) {
   const statePath = managedRuntimeStatePath(repoPath, workspace);
-  if (!import_node_fs13.default.existsSync(statePath)) return void 0;
+  if (!import_node_fs14.default.existsSync(statePath)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs13.default.readFileSync(statePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs14.default.readFileSync(statePath, "utf-8"));
   } catch (error) {
     throw new Error(`Could not parse managed runtime state: ${String(error)}`);
   }
@@ -4876,13 +5398,13 @@ function markManagedRuntimeDegraded(state, transitionPhase) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
-var import_node_crypto5, import_node_fs13, import_node_path12;
+var import_node_crypto6, import_node_fs14, import_node_path14;
 var init_managed_runtime_state = __esm({
   "src/core/managed-runtime-state.ts"() {
     "use strict";
-    import_node_crypto5 = require("crypto");
-    import_node_fs13 = __toESM(require("fs"));
-    import_node_path12 = __toESM(require("path"));
+    import_node_crypto6 = require("crypto");
+    import_node_fs14 = __toESM(require("fs"));
+    import_node_path14 = __toESM(require("path"));
     init_atomic_file();
     init_router();
   }
@@ -4933,14 +5455,14 @@ function resolveComposeFiles(source, repoPath, linked) {
       "managedRuntime requires .devcontainer/devcontainer.json to define dockerComposeFile."
     );
   }
-  const directory = import_node_path13.default.join(repoPath, ".devcontainer");
+  const directory = import_node_path15.default.join(repoPath, ".devcontainer");
   const files = references.map((reference) => {
     const resolved2 = assertPathWithinRepo(
       resolveComposeReference(reference, linked),
       directory,
       "dockerComposeFile"
     );
-    if (!import_node_fs14.default.existsSync(resolved2) || !import_node_fs14.default.lstatSync(resolved2).isFile()) {
+    if (!import_node_fs15.default.existsSync(resolved2) || !import_node_fs15.default.lstatSync(resolved2).isFile()) {
       throw new Error(`Managed Dev Container compose file does not exist: ${resolved2}`);
     }
     return resolved2;
@@ -4948,7 +5470,7 @@ function resolveComposeFiles(source, repoPath, linked) {
   for (const file of files) {
     let parsed;
     try {
-      parsed = import_yaml4.default.parse(import_node_fs14.default.readFileSync(file, "utf-8"));
+      parsed = import_yaml4.default.parse(import_node_fs15.default.readFileSync(file, "utf-8"));
     } catch (error) {
       throw new Error(
         `Could not parse managed Dev Container compose file '${file}': ${String(error)}`
@@ -4959,7 +5481,7 @@ function resolveComposeFiles(source, repoPath, linked) {
     }
   }
   const fileArgs = files.flatMap((file) => ["-f", file]);
-  const resolved = (0, import_node_child_process6.spawnSync)(
+  const resolved = (0, import_node_child_process7.spawnSync)(
     "docker",
     [
       "compose",
@@ -4985,7 +5507,7 @@ function resolveComposeFiles(source, repoPath, linked) {
   return { directory, files, services: services.sort() };
 }
 function assertIgnoredGeneratedPath(repoPath, generatedPath) {
-  const ignored = (0, import_node_child_process6.spawnSync)(
+  const ignored = (0, import_node_child_process7.spawnSync)(
     "git",
     ["-C", repoPath, "check-ignore", "--quiet", "--no-index", "--", generatedPath],
     { encoding: "utf-8" }
@@ -4997,12 +5519,12 @@ function assertIgnoredGeneratedPath(repoPath, generatedPath) {
   }
 }
 function assertGeneratedPathOwnership(generatedPath) {
-  if (!import_node_fs14.default.existsSync(generatedPath)) return;
-  const stat = import_node_fs14.default.lstatSync(generatedPath);
+  if (!import_node_fs15.default.existsSync(generatedPath)) return;
+  const stat = import_node_fs15.default.lstatSync(generatedPath);
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`Managed Dev Container path '${generatedPath}' is not a regular file.`);
   }
-  const firstLine2 = import_node_fs14.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
+  const firstLine2 = import_node_fs15.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
   if (firstLine2 !== MANAGED_DEVCONTAINER_MARKER) {
     throw new Error(
       `Managed Dev Container path '${generatedPath}' exists without the devrouter ownership marker.`
@@ -5013,7 +5535,7 @@ function isWildcard(values) {
   return values?.length === 1 && values[0] === "*";
 }
 function sha256(contents) {
-  return (0, import_node_crypto6.createHash)("sha256").update(contents, "utf-8").digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(contents, "utf-8").digest("hex");
 }
 function safeComposeProject(value) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
@@ -5078,7 +5600,7 @@ function inspectManagedDevcontainerConfig(options) {
   const contents = `${MANAGED_DEVCONTAINER_MARKER}
 ${JSON.stringify(effective, null, 2)}
 `;
-  const generatedPath = import_node_path13.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
+  const generatedPath = import_node_path15.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
   assertIgnoredGeneratedPath(options.repoPath, generatedPath);
   assertGeneratedPathOwnership(generatedPath);
   return {
@@ -5105,13 +5627,13 @@ function writeManagedDevcontainerConfig(plan) {
 function inspectManagedDevcontainerGeneratedConfig(plan) {
   let stat;
   try {
-    stat = import_node_fs14.default.lstatSync(plan.generatedPath);
+    stat = import_node_fs15.default.lstatSync(plan.generatedPath);
   } catch (error) {
     if (error.code === "ENOENT") return { status: "missing" };
     throw error;
   }
   if (!stat.isFile() || stat.isSymbolicLink()) return { status: "foreign" };
-  const contents = import_node_fs14.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs15.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     return { status: "foreign" };
@@ -5123,17 +5645,17 @@ function inspectManagedDevcontainerGeneratedConfig(plan) {
   };
 }
 function removeManagedDevcontainerConfig(plan) {
-  if (!import_node_fs14.default.existsSync(plan.generatedPath)) return;
-  const stat = import_node_fs14.default.lstatSync(plan.generatedPath);
+  if (!import_node_fs15.default.existsSync(plan.generatedPath)) return;
+  const stat = import_node_fs15.default.lstatSync(plan.generatedPath);
   if (!stat.isFile()) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not a regular file.`);
   }
-  const contents = import_node_fs14.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs15.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not devrouter-owned.`);
   }
-  import_node_fs14.default.unlinkSync(plan.generatedPath);
+  import_node_fs15.default.unlinkSync(plan.generatedPath);
 }
 function assertSafeContainerId(containerId) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(containerId)) {
@@ -5160,7 +5682,7 @@ function startExactManagedServices(options) {
     delete env.DEVROUTER_GIT_COMMON_DIR;
     delete env.DEVCONTAINER_COMPOSE_OVERLAY;
   }
-  const result = (0, import_node_child_process6.spawnSync)(
+  const result = (0, import_node_child_process7.spawnSync)(
     "docker",
     [
       "compose",
@@ -5190,7 +5712,7 @@ function startExactManagedServices(options) {
 }
 function stopExactManagedService(containerId, service) {
   assertSafeContainerId(containerId);
-  const result = (0, import_node_child_process6.spawnSync)("docker", ["stop", containerId], {
+  const result = (0, import_node_child_process7.spawnSync)("docker", ["stop", containerId], {
     encoding: "utf-8",
     stdio: "inherit"
   });
@@ -5198,14 +5720,14 @@ function stopExactManagedService(containerId, service) {
     throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
   }
 }
-var import_node_child_process6, import_node_crypto6, import_node_fs14, import_node_path13, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var import_node_child_process7, import_node_crypto7, import_node_fs15, import_node_path15, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
 var init_devcontainer_profile = __esm({
   "src/core/devcontainer-profile.ts"() {
     "use strict";
-    import_node_child_process6 = require("child_process");
-    import_node_crypto6 = require("crypto");
-    import_node_fs14 = __toESM(require("fs"));
-    import_node_path13 = __toESM(require("path"));
+    import_node_child_process7 = require("child_process");
+    import_node_crypto7 = require("crypto");
+    import_node_fs15 = __toESM(require("fs"));
+    import_node_path15 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
     init_atomic_file();
     init_devcontainer_config();
@@ -5219,9 +5741,17 @@ var init_devcontainer_profile = __esm({
 function inspectWorkspaceContainers(options) {
   let ids = options?.ids;
   if (!ids) {
-    const listed = (0, import_node_child_process7.spawnSync)("docker", ["ps", "-a", "--format", "{{.ID}}"], {
-      encoding: "utf-8"
-    });
+    const listed = (0, import_node_child_process8.spawnSync)(
+      "docker",
+      [
+        "ps",
+        "-a",
+        ...options?.composeProject ? ["--filter", `label=com.docker.compose.project=${options.composeProject}`] : [],
+        "--format",
+        "{{.ID}}"
+      ],
+      { encoding: "utf-8" }
+    );
     if (listed.status !== 0) {
       throw new Error(
         `docker ps failed: ${(listed.stderr || listed.stdout || listed.error?.message || "unknown error").trim()}`
@@ -5231,7 +5761,7 @@ function inspectWorkspaceContainers(options) {
   }
   if (ids.length === 0) return [];
   const template = options?.withSize ? SIZE_INSPECT_TEMPLATE : SAFE_INSPECT_TEMPLATE;
-  const inspected = (0, import_node_child_process7.spawnSync)(
+  const inspected = (0, import_node_child_process8.spawnSync)(
     "docker",
     ["inspect", ...options?.withSize ? ["--size"] : [], "--format", template, ...ids],
     { encoding: "utf-8" }
@@ -5246,7 +5776,7 @@ function inspectWorkspaceContainers(options) {
 function workspaceAppContainers(containers, repoPath) {
   return containers.filter((container) => {
     const workingDir = container.labels["com.docker.compose.project.working_dir"];
-    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path14.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
+    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path16.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
       (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
     );
   });
@@ -5254,7 +5784,7 @@ function workspaceAppContainers(containers, repoPath) {
 function hasExactComposeIdentity(container, options) {
   if (options.composeProject !== void 0 && container.labels["com.docker.compose.project"] !== options.composeProject || container.labels["com.docker.compose.service"] !== options.service || !sameWorkspacePath(
     container.labels["com.docker.compose.project.working_dir"] ?? "",
-    import_node_path14.default.join(options.repoPath, ".devcontainer")
+    import_node_path16.default.join(options.repoPath, ".devcontainer")
   )) {
     return false;
   }
@@ -5291,12 +5821,12 @@ function resolveRunningWorkspaceContainer(repoPath) {
   }
   return { id: container.id, workspacePath: repoMount.Destination };
 }
-var import_node_child_process7, import_node_path14, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
+var import_node_child_process8, import_node_path16, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
 var init_devpod_environment = __esm({
   "src/core/devpod-environment.ts"() {
     "use strict";
-    import_node_child_process7 = require("child_process");
-    import_node_path14 = __toESM(require("path"));
+    import_node_child_process8 = require("child_process");
+    import_node_path16 = __toESM(require("path"));
     init_workspace();
     SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.service":{{json (index .Config.Labels "com.docker.compose.service")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
     SIZE_INSPECT_TEMPLATE = SAFE_INSPECT_TEMPLATE.replace(
@@ -5750,7 +6280,7 @@ function toRepoStatus(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
   const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
-  const configExists = import_node_fs15.default.existsSync(configPath);
+  const configExists = import_node_fs16.default.existsSync(configPath);
   if (!explicitRepo && !configExists) {
     return void 0;
   }
@@ -5898,11 +6428,11 @@ async function collectRouterStatus(repoPath) {
     }
   };
 }
-var import_node_fs15;
+var import_node_fs16;
 var init_status = __esm({
   "src/core/status.ts"() {
     "use strict";
-    import_node_fs15 = __toESM(require("fs"));
+    import_node_fs16 = __toESM(require("fs"));
     init_docker();
     init_managed_runtime_state();
     init_managed_runtime_status();
@@ -5913,7 +6443,7 @@ var init_status = __esm({
 
 // src/core/tls.ts
 function runOrThrow(command, args) {
-  const result = (0, import_node_child_process8.spawnSync)(command, args, {
+  const result = (0, import_node_child_process9.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -5923,7 +6453,7 @@ function runOrThrow(command, args) {
   return result.stdout.trim();
 }
 function commandExists(command) {
-  const result = (0, import_node_child_process8.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
+  const result = (0, import_node_child_process9.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
   return result.status === 0;
 }
 function ensureMkcert() {
@@ -5941,8 +6471,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path15.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs16.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path17.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs17.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -5975,7 +6505,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto7.X509Certificate(pem);
+  const certificate = new import_node_crypto8.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -6043,11 +6573,11 @@ function compactTLSCertificateHosts(hosts) {
   );
 }
 function readCurrentCertificateHosts(options = {}) {
-  if (!import_node_fs16.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs17.default.existsSync(CERT_FILE)) {
     return [];
   }
   try {
-    const pem = import_node_fs16.default.readFileSync(CERT_FILE, "utf-8");
+    const pem = import_node_fs17.default.readFileSync(CERT_FILE, "utf-8");
     return parseCertificateDnsHosts(pem);
   } catch (error) {
     if (options.replaceMalformed) {
@@ -6175,20 +6705,20 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process8, import_node_crypto7, import_node_fs16, import_node_path15, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
+var import_node_child_process9, import_node_crypto8, import_node_fs17, import_node_path17, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
-    import_node_child_process8 = require("child_process");
-    import_node_crypto7 = require("crypto");
-    import_node_fs16 = __toESM(require("fs"));
-    import_node_path15 = __toESM(require("path"));
+    import_node_child_process9 = require("child_process");
+    import_node_crypto8 = require("crypto");
+    import_node_fs17 = __toESM(require("fs"));
+    import_node_path17 = __toESM(require("path"));
     init_docker();
     init_file_lock();
     init_host_routes();
     init_router();
     DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
-    TLS_CERTIFICATE_LOCK_FILE = import_node_path15.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+    TLS_CERTIFICATE_LOCK_FILE = import_node_path17.default.join(DEVROUTER_HOME, "tls-certificate.lock");
     TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
     TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
   }
@@ -6196,7 +6726,7 @@ var init_tls = __esm({
 
 // src/core/devpod-registry.ts
 function listDevpodWorkspacesRaw() {
-  const result = (0, import_node_child_process9.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
+  const result = (0, import_node_child_process10.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -6231,17 +6761,17 @@ function listDevpodWorkspacesRaw() {
     return workspace;
   });
 }
-var import_node_child_process9;
+var import_node_child_process10;
 var init_devpod_registry = __esm({
   "src/core/devpod-registry.ts"() {
     "use strict";
-    import_node_child_process9 = require("child_process");
+    import_node_child_process10 = require("child_process");
   }
 });
 
 // src/core/devsy-workspaces.ts
 function listDevsyWorkspaces() {
-  const result = (0, import_node_child_process10.spawnSync)(
+  const result = (0, import_node_child_process11.spawnSync)(
     "devsy",
     ["workspace", "list", "--result-format", "json", "--skip-pro"],
     {
@@ -6307,7 +6837,7 @@ function parseDevsyRuntimeStatus(output2, expectedId) {
   }
 }
 function inspectDevsyRuntimeStatus(devsyId) {
-  const result = (0, import_node_child_process10.spawnSync)("devsy", ["workspace", "status", devsyId, "--result-format", "json"], {
+  const result = (0, import_node_child_process11.spawnSync)("devsy", ["workspace", "status", devsyId, "--result-format", "json"], {
     encoding: "utf-8",
     timeout: 1e4
   });
@@ -6340,11 +6870,11 @@ function selectDevsyWorkspace(workspaces, repoPath) {
   }
   return matches[0];
 }
-var import_node_child_process10;
+var import_node_child_process11;
 var init_devsy_workspaces = __esm({
   "src/core/devsy-workspaces.ts"() {
     "use strict";
-    import_node_child_process10 = require("child_process");
+    import_node_child_process11 = require("child_process");
     init_workspace();
   }
 });
@@ -6361,13 +6891,13 @@ function parseWorkspaceRuntime(value) {
 }
 function isRuntimeInstalled(runtime) {
   const probeArgs = runtime === "devsy" ? ["--version"] : ["version"];
-  const probe = (0, import_node_child_process11.spawnSync)(runtime, probeArgs, { encoding: "utf-8" });
+  const probe = (0, import_node_child_process12.spawnSync)(runtime, probeArgs, { encoding: "utf-8" });
   return probe.status === 0 && !probe.error;
 }
 function readWorkspaceRuntimeConfig() {
   let raw;
   try {
-    raw = JSON.parse(import_node_fs17.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8"));
+    raw = JSON.parse(import_node_fs18.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -6388,7 +6918,7 @@ function readWorkspaceRuntimeConfig() {
 function inspectWorkspaceRuntimeConfig() {
   let rawText;
   try {
-    rawText = import_node_fs17.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8");
+    rawText = import_node_fs18.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8");
   } catch {
     return { exists: false, config: {}, problems: [] };
   }
@@ -6439,7 +6969,7 @@ function writeWorkspaceRuntimeConfig(config) {
     }
     next.devsyInactivityTimeout = timeout;
   }
-  import_node_fs17.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs18.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   writeFileAtomically(RUNTIME_CONFIG_FILE, `${JSON.stringify(next, null, 2)}
 `);
 }
@@ -6547,20 +7077,20 @@ function resetWorkspaceRuntimeCaches() {
   cachedRuntime = void 0;
   cachedSnapshots = void 0;
 }
-var import_node_child_process11, import_node_fs17, import_node_path16, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
+var import_node_child_process12, import_node_fs18, import_node_path18, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
 var init_workspace_runtime = __esm({
   "src/core/workspace-runtime.ts"() {
     "use strict";
-    import_node_child_process11 = require("child_process");
-    import_node_fs17 = __toESM(require("fs"));
-    import_node_path16 = __toESM(require("path"));
+    import_node_child_process12 = require("child_process");
+    import_node_fs18 = __toESM(require("fs"));
+    import_node_path18 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_registry();
     init_devsy_workspaces();
     init_router();
     init_workspace();
     SUPPORTED_RUNTIMES2 = ["devpod", "devsy"];
-    RUNTIME_CONFIG_FILE = import_node_path16.default.join(DEVROUTER_HOME, "workspace-runtime.json");
+    RUNTIME_CONFIG_FILE = import_node_path18.default.join(DEVROUTER_HOME, "workspace-runtime.json");
     INACTIVITY_TIMEOUT_PATTERN = /^(?:\d+(?:ms|s|m|h))+$/;
     UnsupportedWorkspaceRuntimeError = class extends Error {
     };
@@ -6581,7 +7111,7 @@ function outputFromResult(result) {
   return output2.length > 0 ? output2 : void 0;
 }
 function runTool(command, args = []) {
-  const result = (0, import_node_child_process12.spawnSync)(command, args, {
+  const result = (0, import_node_child_process13.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.error) {
@@ -6638,12 +7168,12 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path17.default.join(repoPath, "package.json");
-  if (!import_node_fs18.default.existsSync(packagePath)) {
+  const packagePath = import_node_path19.default.join(repoPath, "package.json");
+  if (!import_node_fs19.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs18.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs19.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -6708,7 +7238,44 @@ function nodeToolchainCheck(repoPath) {
     details: details.join(", ")
   };
 }
+function devsyAgentCheck(inspection) {
+  const details = [
+    `state=${inspection.state}`,
+    `source=${inspection.source}`,
+    ...inspection.installedVersion ? [`version=${inspection.installedVersion}`] : [],
+    ...inspection.asset ? [`asset=${inspection.asset.name}`] : []
+  ].join(", ");
+  if (inspection.state === "ready") {
+    return {
+      id: "global.devsy-agent",
+      level: "ok",
+      summary: "Devsy agent source is ready.",
+      details
+    };
+  }
+  const summary = inspection.state === "missing" ? "Managed Devsy agent source is missing." : inspection.state === "stale" ? "Devsy agent source is stale for this Devrouter release." : "Devsy agent source is invalid.";
+  return {
+    id: "global.devsy-agent",
+    level: "error",
+    summary,
+    details: `${details}, ${inspection.reason}`,
+    suggestion: devsyAgentRepairSuggestion(inspection)
+  };
+}
 function buildGlobalToolChecks(repoPath) {
+  const previous = process.env[DEVSY_DISABLE_TELEMETRY];
+  process.env[DEVSY_DISABLE_TELEMETRY] = "true";
+  try {
+    return buildGlobalToolChecksWithoutTelemetry(repoPath);
+  } finally {
+    if (previous === void 0) {
+      delete process.env[DEVSY_DISABLE_TELEMETRY];
+    } else {
+      process.env[DEVSY_DISABLE_TELEMETRY] = previous;
+    }
+  }
+}
+function buildGlobalToolChecksWithoutTelemetry(repoPath) {
   const checks = [];
   const compose = runTool("docker", ["compose", "version"]);
   checks.push({
@@ -6762,6 +7329,13 @@ function buildGlobalToolChecks(repoPath) {
     ].filter(Boolean).join(", "),
     suggestion: runtimeTool.ok ? void 0 : workspaceRuntime === "devsy" ? "Install Devsy for devcontainer workspace flows: brew install devsy-org/homebrew-tap/devsy" : "Install DevPod for devcontainer workspace flows: brew install devpod"
   });
+  if (workspaceRuntime === "devsy") {
+    checks.push(
+      devsyAgentCheck(
+        inspectDevsyAgent({ versionOutput: runtimeTool.ok ? runtimeTool.output : "" })
+      )
+    );
+  }
   const configProblems = [...configInspection.problems];
   const machineResolvedDevpod = workspaceRuntime === "devpod" && (runtimeResolution.source === "auto-detect" || runtimeResolution.source === "default");
   if (machineConfig.devsyInactivityTimeout && machineResolvedDevpod) {
@@ -6783,14 +7357,16 @@ function buildGlobalToolChecks(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process12, import_node_fs18, import_node_path17;
+var import_node_child_process13, import_node_fs19, import_node_path19, DEVSY_DISABLE_TELEMETRY;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
-    import_node_child_process12 = require("child_process");
-    import_node_fs18 = __toESM(require("fs"));
-    import_node_path17 = __toESM(require("path"));
+    import_node_child_process13 = require("child_process");
+    import_node_fs19 = __toESM(require("fs"));
+    import_node_path19 = __toESM(require("path"));
+    init_devsy_agent();
     init_workspace_runtime();
+    DEVSY_DISABLE_TELEMETRY = "DEVSY_DISABLE_TELEMETRY";
   }
 });
 
@@ -6859,7 +7435,7 @@ function inspectDevpodRuntimeStatus(devpodId, repoPath) {
   if (resolveWorkspaceRuntimeOrDefault(repoPath) === "devsy") {
     return inspectDevsyRuntimeStatus(devpodId);
   }
-  const result = (0, import_node_child_process13.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
+  const result = (0, import_node_child_process14.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
     encoding: "utf-8"
   });
   if (result.status !== 0 || result.error) return "unknown";
@@ -6892,11 +7468,11 @@ function selectDevpodWorkspace(workspaces, repoPath) {
   }
   return matches[0];
 }
-var import_node_child_process13;
+var import_node_child_process14;
 var init_devpod_workspaces = __esm({
   "src/core/devpod-workspaces.ts"() {
     "use strict";
-    import_node_child_process13 = require("child_process");
+    import_node_child_process14 = require("child_process");
     init_devpod_registry();
     init_devsy_workspaces();
     init_workspace();
@@ -6916,19 +7492,71 @@ function failedStartMayHaveAttached(devsyId, repoPath) {
   }
 }
 function withMutationLock(activity, target, operation) {
-  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
-    { activity, target: `'${target}'`, waitMs: DEVSY_MUTATION_WAIT_MS },
+    {
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVSY_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
+    },
+    operation
+  );
+}
+function withMutationLockAsync(activity, target, operation) {
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLock(
+    DEVSY_MUTATION_LOCK_FILE,
+    {
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVSY_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
+    },
     operation
   );
 }
 function commandFailure2(result) {
   return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
 }
+function runDevsyUp(args, env, quiet) {
+  return new Promise((resolve) => {
+    const child = (0, import_node_child_process15.spawn)("devsy", args, {
+      stdio: ["inherit", quiet ? 2 : "inherit", "pipe"],
+      env
+    });
+    const stderr = child.stderr;
+    if (!stderr) throw new Error("Devsy startup stderr pipe was not created.");
+    let stderrTail = Buffer.alloc(0);
+    let spawnError;
+    stderr.on("data", (chunk) => {
+      const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      const writable = process.stderr.write(value);
+      if (!writable) {
+        stderr.pause();
+        process.stderr.once("drain", () => stderr.resume());
+      }
+      if (value.length >= DEVSY_STDERR_TAIL_BYTES) {
+        stderrTail = Buffer.from(value.subarray(value.length - DEVSY_STDERR_TAIL_BYTES));
+      } else {
+        const combined = Buffer.concat([stderrTail, value]);
+        stderrTail = combined.length > DEVSY_STDERR_TAIL_BYTES ? combined.subarray(combined.length - DEVSY_STDERR_TAIL_BYTES) : combined;
+      }
+    });
+    child.once("error", (error) => {
+      spawnError = error;
+    });
+    child.once("close", (status) => {
+      resolve({ status, error: spawnError, stderrTail: stderrTail.toString("utf-8") });
+    });
+  });
+}
 function runDevsyAction(action2, devsyId, force = false) {
   const args = action2 === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
-  const result = (0, import_node_child_process14.spawnSync)("devsy", ["workspace", ...args], { encoding: "utf-8" });
+  const result = (0, import_node_child_process15.spawnSync)("devsy", ["workspace", ...args], { encoding: "utf-8" });
   if (result.status !== 0) {
     throw new Error(
       `devsy workspace ${action2}${force ? " --force" : ""} failed for '${devsyId}': ${commandFailure2(result) || "unknown error"}`
@@ -6988,9 +7616,17 @@ function assertDevsyTarget(devsyId, repoPath) {
   }
   return id;
 }
-function startDevsyWorkspace(options) {
+async function startDevsyWorkspace(options) {
   const activity = options.recreate ? "Devsy recreate" : "Devsy start";
-  return withMutationLock(activity, options.repoPath, () => {
+  let agent;
+  try {
+    agent = requireReadyDevsyAgent();
+  } catch (error) {
+    if (!(error instanceof DevsyAgentReadinessError)) throw error;
+    const repair = devsyAgentRepairSuggestion(error.inspection);
+    throw new Error(`${error.message}. ${repair}`);
+  }
+  return withMutationLockAsync(activity, options.repoPath, async () => {
     let devsyId = assertDevsyTarget(options.devsyId, options.repoPath);
     if (devsyId && options.recreate) {
       const attached = listDevsyWorkspaces();
@@ -7019,6 +7655,7 @@ function startDevsyWorkspace(options) {
     }
     if (options.recreate) args.push("--recreate");
     const env = { ...process.env };
+    env.DEVSY_AGENT_BINARY = agent.binaryPath;
     if (options.workspace) {
       env.WORKSPACE = options.workspace.token;
       env.DEVROUTER_WORKSPACE = options.workspace.token;
@@ -7030,12 +7667,13 @@ function startDevsyWorkspace(options) {
       delete env.DEVROUTER_GIT_COMMON_DIR;
       delete env.DEVCONTAINER_COMPOSE_OVERLAY;
     }
-    const result = (0, import_node_child_process14.spawnSync)("devsy", args, {
-      stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
-      env
-    });
+    const result = await runDevsyUp(args, env, options.quiet ?? false);
     if (result.status !== 0) {
-      const message = `devsy workspace up failed for '${devsyId ?? options.repoPath}'.`;
+      let message = `devsy workspace up failed for '${devsyId ?? options.repoPath}'.`;
+      if (result.error?.message) message += ` ${result.error.message}`;
+      if (AGENT_ACQUISITION_RE.test(result.stderrTail)) {
+        message += ` Devsy rejected the verified agent source. Run: ${DEVSY_AGENT_SETUP_COMMAND}`;
+      }
       if (failedStartMayHaveAttached(devsyId, options.repoPath)) {
         throw new DevsyStartPostconditionError(message);
       }
@@ -7061,29 +7699,38 @@ function startDevsyWorkspace(options) {
     }
   });
 }
-var import_node_child_process14, import_node_fs19, import_node_path18, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError;
+var import_node_child_process15, import_node_fs20, import_node_path20, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError, AGENT_ACQUISITION_RE, DEVSY_STDERR_TAIL_BYTES;
 var init_devsy_mutation = __esm({
   "src/core/devsy-mutation.ts"() {
     "use strict";
-    import_node_child_process14 = require("child_process");
-    import_node_fs19 = __toESM(require("fs"));
-    import_node_path18 = __toESM(require("path"));
+    import_node_child_process15 = require("child_process");
+    import_node_fs20 = __toESM(require("fs"));
+    import_node_path20 = __toESM(require("path"));
+    init_devsy_agent();
     init_devsy_workspaces();
     init_file_lock();
     init_router();
-    DEVSY_MUTATION_LOCK_FILE = import_node_path18.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
-    DEVSY_MUTATION_WAIT_MS = 6e4;
+    DEVSY_MUTATION_LOCK_FILE = import_node_path20.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_WAIT_MS = 18e5;
     DevsyStartPostconditionError = class extends Error {
     };
+    AGENT_ACQUISITION_RE = /inject agent.*agent binary not found/i;
+    DEVSY_STDERR_TAIL_BYTES = 8192;
   }
 });
 
 // src/core/devpod-mutation.ts
 function withMutationLock2(activity, target, operation) {
-  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
-    { activity, target: `'${target}'`, waitMs: DEVPOD_MUTATION_WAIT_MS },
+    {
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVPOD_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
+    },
     operation
   );
 }
@@ -7092,7 +7739,7 @@ function commandFailure3(result) {
 }
 function runDevpodAction(action2, devpodId, force = false) {
   const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
-  const result = (0, import_node_child_process15.spawnSync)("devpod", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process16.spawnSync)("devpod", args, { encoding: "utf-8" });
   if (result.status !== 0) {
     throw new Error(
       `devpod ${action2}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure3(result) || "unknown error"}`
@@ -7158,10 +7805,10 @@ function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
   resetWorkspaceRuntimeCaches();
   return result;
 }
-function startDevpodWorkspace(options) {
+async function startDevpodWorkspace(options) {
   if (resolveWorkspaceRuntimeOrDefault(options.repoPath) === "devsy") {
     try {
-      const result = startDevsyWorkspace({
+      const result = await startDevsyWorkspace({
         repoPath: options.repoPath,
         devsyId: options.devpodId,
         devcontainerPath: options.devcontainerPath,
@@ -7220,7 +7867,7 @@ function startDevpodWorkspace(options) {
       delete env.DEVROUTER_GIT_COMMON_DIR;
       delete env.DEVCONTAINER_COMPOSE_OVERLAY;
     }
-    const result = (0, import_node_child_process15.spawnSync)("devpod", args, {
+    const result = (0, import_node_child_process16.spawnSync)("devpod", args, {
       stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
       env
     });
@@ -7248,20 +7895,20 @@ function startDevpodWorkspace(options) {
     }
   });
 }
-var import_node_child_process15, import_node_fs20, import_node_path19, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
+var import_node_child_process16, import_node_fs21, import_node_path21, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
-    import_node_child_process15 = require("child_process");
-    import_node_fs20 = __toESM(require("fs"));
-    import_node_path19 = __toESM(require("path"));
+    import_node_child_process16 = require("child_process");
+    import_node_fs21 = __toESM(require("fs"));
+    import_node_path21 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
     init_file_lock();
     init_router();
     init_workspace_runtime();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path19.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
-    DEVPOD_MUTATION_WAIT_MS = 6e4;
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path21.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_WAIT_MS = 18e5;
     DevpodStartPostconditionError = class extends Error {
     };
   }
@@ -7274,7 +7921,7 @@ function commandError(command, repoPath, stderr) {
   );
 }
 function resolveGitCommonDir(repoPath) {
-  const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
+  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -7282,10 +7929,10 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path20.default.isAbsolute(output2) ? output2 : import_node_path20.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path22.default.isAbsolute(output2) ? output2 : import_node_path22.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
-  const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
+  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -7296,7 +7943,7 @@ function resolveGitTopLevel(repoPath) {
   return comparableWorkspacePath(output2);
 }
 function listGitWorktrees(repoPath) {
-  const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
+  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -7333,7 +7980,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path20.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path22.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -7361,7 +8008,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path20.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path22.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -7381,7 +8028,7 @@ function validateRecord(value, expectedWorkspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs21.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs22.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -7397,7 +8044,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs21.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs22.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -7405,14 +8052,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path20.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path22.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path20.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path22.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record2) => record2.workspace === workspace);
@@ -7448,9 +8095,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
   return record;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path20.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path22.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs21.default.rmSync(filePath);
+    import_node_fs22.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -7461,7 +8108,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path20.default.join(
+  const filePath = import_node_path22.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -7473,14 +8120,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs21.default.rmSync(filePath);
+  import_node_fs22.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs21.default.mkdirSync(directory, { recursive: true });
+  import_node_fs22.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path20.default.join(directory, ".lock"),
+    import_node_path22.default.join(directory, ".lock"),
     {
       activity: "workspace ownership transaction",
       target: `'${repoPath}'`,
@@ -7513,7 +8160,7 @@ function persistedWorkspaceOwners(repoPath, worktreePath) {
     try {
       workspace = readPersistedWorkspace(worktree.path);
     } catch (error) {
-      if (!import_node_fs21.default.existsSync(worktree.path)) continue;
+      if (!import_node_fs22.default.existsSync(worktree.path)) continue;
       throw error;
     }
     if (!workspace) continue;
@@ -7676,7 +8323,7 @@ function inspectWorkspaceOwnership(record, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs21.default.existsSync(record.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs22.default.existsSync(record.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -7700,20 +8347,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process16, import_node_fs21, import_node_path20, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process17, import_node_fs22, import_node_path22, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
-    import_node_child_process16 = require("child_process");
-    import_node_fs21 = __toESM(require("fs"));
-    import_node_path20 = __toESM(require("path"));
+    import_node_child_process17 = require("child_process");
+    import_node_fs22 = __toESM(require("fs"));
+    import_node_path22 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path20.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path22.default.join("devrouter", "workspaces");
   }
 });
 
@@ -7727,10 +8374,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path21.default.join(comparableRepo, "trees") + import_node_path21.default.sep;
+  const localRoot = import_node_path23.default.join(comparableRepo, "trees") + import_node_path23.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path21.default.basename(comparableRepo)}-`;
-  return import_node_path21.default.dirname(comparableWorktree) === import_node_path21.default.dirname(comparableRepo) && import_node_path21.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path23.default.basename(comparableRepo)}-`;
+  return import_node_path23.default.dirname(comparableWorktree) === import_node_path23.default.dirname(comparableRepo) && import_node_path23.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -7982,11 +8629,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path21;
+var import_node_path23;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path21 = __toESM(require("path"));
+    import_node_path23 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -8056,11 +8703,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs22.default.existsSync(absolutePath)) {
+      if (!import_node_fs23.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs22.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs23.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml5.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -8339,7 +8986,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.45" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.48" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -8369,9 +9016,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path22.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path24.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs22.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs23.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -8414,8 +9061,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path22.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs22.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path24.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs23.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -8559,12 +9206,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs22, import_node_path22, import_yaml5, POSTGRES_DEFAULTS;
+var import_node_fs23, import_node_path24, import_yaml5, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs22 = __toESM(require("fs"));
-    import_node_path22 = __toESM(require("path"));
+    import_node_fs23 = __toESM(require("fs"));
+    import_node_path24 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -8671,11 +9318,13 @@ async function runSetup(options = {}) {
       })
     );
   }
+  let requestedWorkspaceRuntime;
   if (options.workspaceRuntime !== void 0 || options.devsyInactivityTimeout !== void 0) {
     try {
       const existing = readWorkspaceRuntimeConfig();
+      requestedWorkspaceRuntime = options.workspaceRuntime ? parseWorkspaceRuntime(options.workspaceRuntime) : void 0;
       const next = {
-        runtime: options.workspaceRuntime ? parseWorkspaceRuntime(options.workspaceRuntime) : existing.runtime,
+        runtime: requestedWorkspaceRuntime ?? existing.runtime,
         devsyInactivityTimeout: options.devsyInactivityTimeout ?? existing.devsyInactivityTimeout
       };
       writeWorkspaceRuntimeConfig(next);
@@ -8697,6 +9346,28 @@ async function runSetup(options = {}) {
       );
     }
   }
+  if (requestedWorkspaceRuntime === "devsy") {
+    try {
+      const prepared = await prepareDevsyAgent();
+      actions.push(
+        action(prepared.changed ? "performed" : "skipped", {
+          id: "global.devsy-agent",
+          summary: prepared.changed ? `Downloaded and verified ${prepared.asset.name} for Devsy.` : `Verified the ${prepared.source} Devsy agent source.`,
+          details: `version=${SUPPORTED_DEVSY_VERSION}, asset=${prepared.asset.name}, source=${prepared.source}, transport=${prepared.transport}`
+        })
+      );
+    } catch (error) {
+      const details = error instanceof DevsyAgentReadinessError ? `state=${error.inspection.state}, source=${error.inspection.source}, ${error.inspection.reason}` : error instanceof Error ? error.message : String(error);
+      actions.push(
+        action("failed", {
+          id: "global.devsy-agent",
+          summary: "Failed to prepare a verified Devsy agent source.",
+          details,
+          suggestion: error instanceof DevsyAgentReadinessError ? devsyAgentRepairSuggestion(error.inspection) : `Run: ${DEVSY_AGENT_SETUP_COMMAND}`
+        })
+      );
+    }
+  }
   try {
     const existed = await networkExists(DEVNET_NAME);
     await ensureNetwork(DEVNET_NAME);
@@ -8786,6 +9457,7 @@ async function runSetup(options = {}) {
 var init_setup = __esm({
   "src/core/setup.ts"() {
     "use strict";
+    init_devsy_agent();
     init_docker();
     init_doctor();
     init_repo_config();
@@ -8854,12 +9526,12 @@ function parseSsPortListeners(stdout, port) {
   return listeners;
 }
 function findPortListeners(port) {
-  const result = (0, import_node_child_process17.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+  const result = (0, import_node_child_process18.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process17.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process18.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsPortListeners(ssResult.stdout, port);
       }
@@ -8888,11 +9560,11 @@ function findPortListeners(port) {
     };
   });
 }
-var import_node_child_process17;
+var import_node_child_process18;
 var init_ports = __esm({
   "src/util/ports.ts"() {
     "use strict";
-    import_node_child_process17 = require("child_process");
+    import_node_child_process18 = require("child_process");
   }
 });
 
@@ -8969,18 +9641,18 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process18.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process19.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
   const details = ok ? `HTTP ${status}` : [status === void 0 ? void 0 : `HTTP ${status}`, result.stderr?.trim()].filter(Boolean).join(": ") || `curl exited with status ${result.status ?? "unknown"}`;
   return { ok, status, details };
 }
-var import_node_child_process18;
+var import_node_child_process19;
 var init_http_route_probe = __esm({
   "src/core/http-route-probe.ts"() {
     "use strict";
-    import_node_child_process18 = require("child_process");
+    import_node_child_process19 = require("child_process");
     init_router();
     init_tls();
   }
@@ -9056,14 +9728,135 @@ var init_route_publication = __esm({
   }
 });
 
+// src/core/traefik-route-health.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function inspectRouterApi(protocol) {
+  const result = (0, import_node_child_process20.spawnSync)(
+    "curl",
+    [
+      "--silent",
+      "--show-error",
+      "--fail",
+      "--max-time",
+      "2",
+      `${ROUTER_API_BASE}/${protocol}/routers`
+    ],
+    { encoding: "utf-8" }
+  );
+  if (result.status !== 0) {
+    return {
+      ok: false,
+      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
+    };
+  }
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
+  }
+  if (!Array.isArray(value)) {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
+  }
+  return {
+    ok: true,
+    names: new Set(
+      value.flatMap((item) => {
+        if (!item || typeof item !== "object") return [];
+        const name = item.name;
+        return typeof name === "string" ? [name] : [];
+      })
+    )
+  };
+}
+function inspectExpectedRoutes(routes) {
+  const missing = [];
+  const failures = [];
+  for (const protocol of ["http", "tcp"]) {
+    const expected = routes.filter((route) => (route.protocol ?? "http") === protocol).map((route) => buildHostRouteRouterName(route.repoPath, route.name));
+    if (expected.length === 0) continue;
+    const result = inspectRouterApi(protocol);
+    if (!result.ok) {
+      failures.push(result.details);
+      missing.push(...expected);
+      continue;
+    }
+    missing.push(...expected.filter((name) => !result.names.has(name)));
+  }
+  return missing.length === 0 ? { ok: true } : {
+    ok: false,
+    missing,
+    details: failures.length > 0 ? failures.join("; ") : "router names are absent"
+  };
+}
+async function waitForExpectedRoutes(routes, timeoutMs, pollIntervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  let result;
+  do {
+    result = inspectExpectedRoutes(routes);
+    if (result.ok) return result;
+    if (Date.now() < deadline) {
+      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
+    }
+  } while (Date.now() < deadline);
+  return result;
+}
+async function ensureTraefikRoutesLoaded(routes, options = {}) {
+  if (routes.length === 0) return { restarted: false };
+  const initialTimeoutMs = options.initialTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
+  const recoveryTimeoutMs = options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS;
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const initial = await waitForExpectedRoutes(routes, initialTimeoutMs, pollIntervalMs);
+  if (initial.ok) return { restarted: false };
+  import_node_fs24.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLock(
+    ROUTER_RELOAD_LOCK_FILE,
+    {
+      activity: "Traefik route reload recovery",
+      waitMs: initialTimeoutMs + recoveryTimeoutMs + 1e4,
+      fair: true,
+      onWait: createStderrWaitReporter("Traefik route reload recovery", "shared router")
+    },
+    async () => {
+      const recheck = await waitForExpectedRoutes(routes, 0, pollIntervalMs);
+      if (recheck.ok) return { restarted: false };
+      restartRouterStack();
+      const recovered = await waitForExpectedRoutes(routes, recoveryTimeoutMs, pollIntervalMs);
+      if (recovered.ok) return { restarted: true };
+      throw new Error(
+        `Traefik did not load file-provider routes after one restart: ${recovered.missing.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
+      );
+    }
+  );
+}
+var import_node_child_process20, import_node_fs24, import_node_path25, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS;
+var init_traefik_route_health = __esm({
+  "src/core/traefik-route-health.ts"() {
+    "use strict";
+    import_node_child_process20 = require("child_process");
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path25 = __toESM(require("path"));
+    init_file_lock();
+    init_host_routes();
+    init_router();
+    ROUTER_API_BASE = "http://127.0.0.1:8080/api";
+    ROUTER_RELOAD_LOCK_FILE = import_node_path25.default.join(DEVROUTER_HOME, "router-reload.lock");
+    DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
+    DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
+    DEFAULT_POLL_INTERVAL_MS = 250;
+  }
+});
+
 // src/core/workspace-ensure.ts
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path23.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path23.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -9137,7 +9930,7 @@ async function waitForManagedServices(plan, repoPath, composeProject, expectedSe
     } catch (error) {
       lastError = error;
     }
-    if (Date.now() < deadline) await sleep(POLL_INTERVAL_MS);
+    if (Date.now() < deadline) await sleep2(POLL_INTERVAL_MS);
   } while (Date.now() < deadline);
   throw lastError instanceof Error ? lastError : new Error(String(lastError));
 }
@@ -9239,6 +10032,20 @@ function isWarmWorkspaceActive(repoPath) {
     return true;
   }
 }
+function hasExactManagedComposeProject(repoPath, state) {
+  try {
+    return inspectWorkspaceContainers({
+      composeProject: state.composeProject
+    }).some((container) => {
+      const workingDir = container.labels["com.docker.compose.project.working_dir"];
+      return Boolean(
+        workingDir && sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))
+      );
+    });
+  } catch {
+    return true;
+  }
+}
 function captureFirstTransitionBaseline(options) {
   const containers = inspectWorkspaceContainers();
   const runningPrimary = workspaceAppContainers(containers, options.repoPath).filter(
@@ -9326,7 +10133,7 @@ function validateWorkspaceContainers(containers, options) {
   }
   return { id: appContainer.id, workspacePath: repoMount.Destination };
 }
-function sleep(ms) {
+function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeoutMs) {
@@ -9340,7 +10147,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process19.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process21.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8" }
@@ -9350,7 +10157,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process19.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process21.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8" }
@@ -9361,7 +10168,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process19.spawnSync)(
+      const gitCheck = (0, import_node_child_process21.spawnSync)(
         "docker",
         [
           "exec",
@@ -9382,7 +10189,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
       lastError = error;
     }
     if (Date.now() < deadline) {
-      await sleep(POLL_INTERVAL_MS);
+      await sleep2(POLL_INTERVAL_MS);
     }
   } while (Date.now() < deadline);
   throw lastError instanceof Error ? lastError : new Error(String(lastError));
@@ -9407,7 +10214,7 @@ async function waitForHttpRoutes(repoPath, apps, timeoutMs) {
       return;
     }
     if (Date.now() < deadline) {
-      await sleep(POLL_INTERVAL_MS);
+      await sleep2(POLL_INTERVAL_MS);
     }
   } while (Date.now() < deadline);
   throw new Error(
@@ -9453,14 +10260,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs23.default.statSync(import_node_path23.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs25.default.statSync(import_node_path26.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process19.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process21.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -9499,12 +10306,16 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     let managedConfigWritten = false;
     let managedWorkspaceEnv;
     let firstTransitionBaseline;
+    const routeLoadOptions = {
+      initialTimeoutMs: Math.min(options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS, 3e3),
+      recoveryTimeoutMs: Math.min(options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS, 1e4)
+    };
     try {
       const target = linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path23.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs23.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs25.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -9521,6 +10332,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const desiredProcesses = managedRuntime ? desiredManagedProcesses(managedRuntime, runtime.resolvedProfile) : [];
       if (managedRuntime) {
         previousManagedState = readManagedRuntimeState(repoPath, target.workspace);
+        if (previousManagedState && !hasExactManagedComposeProject(repoPath, previousManagedState)) {
+          previousManagedState = void 0;
+        }
         if (previousManagedState?.status === "degraded") {
           throw new Error(
             "Managed runtime state is degraded; refusing a new profile transition until drift is repaired."
@@ -9571,7 +10385,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path23.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path26.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -9586,10 +10400,10 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const upstreamHosts = parsedUpstreams.map((upstream) => upstream.host);
       const currentTarget = () => target.kind === "linked" ? target : { ...target, devpodId };
-      const startAndProveAttachment = (recreate = false) => {
+      const startAndProveAttachment = async (recreate = false) => {
         const requestedTarget = currentTarget();
         try {
-          devpodId = startDevpodWorkspace({
+          devpodId = await startDevpodWorkspace({
             repoPath,
             devpodId: requestedTarget.devpodId,
             devcontainerPath: managedPlan?.generatedRelativePath,
@@ -9610,13 +10424,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       };
       const preflight = (timeoutMs) => waitForContainerPreflight(repoPath, currentTarget(), upstreamHosts, timeoutMs);
       const recreateAndPreflight = async () => {
-        startAndProveAttachment(true);
+        await startAndProveAttachment(true);
         return preflight(options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS);
       };
       let recreated = false;
       let container;
       try {
-        startAndProveAttachment();
+        await startAndProveAttachment();
       } catch (error) {
         if (managedPlan || !target.hadExactDevpod) {
           throw error;
@@ -9735,6 +10549,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         target.workspace
       );
       candidateRoutesPublished = true;
+      await ensureTraefikRoutesLoaded(publication.routes, routeLoadOptions);
       try {
         await waitForHttpRoutes(
           repoPath,
@@ -9758,6 +10573,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         });
         recreated = true;
         replaceHostRoutesForRepo(repoPath, publication.routes);
+        await ensureTraefikRoutesLoaded(publication.routes, routeLoadOptions);
         await waitForHttpRoutes(
           repoPath,
           apps,
@@ -9931,7 +10747,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         }
         if (candidateRoutesPublished) {
           try {
-            replaceHostRoutesForRepo(repoPath, previousRoutes.map(routeInputFromState));
+            const rollbackRoutes = previousRoutes.map(routeInputFromState);
+            replaceHostRoutesForRepo(repoPath, rollbackRoutes);
+            await ensureTraefikRoutesLoaded(rollbackRoutes, routeLoadOptions);
           } catch (rollbackError) {
             rollbackErrors.push(
               `routes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
@@ -9974,7 +10792,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         }
         if (candidateRoutesPublished) {
           try {
-            replaceHostRoutesForRepo(repoPath, previousRoutes.map(routeInputFromState));
+            const rollbackRoutes = previousRoutes.map(routeInputFromState);
+            replaceHostRoutesForRepo(repoPath, rollbackRoutes);
+            await ensureTraefikRoutesLoaded(rollbackRoutes, routeLoadOptions);
           } catch (rollbackError) {
             rollbackErrors.push(
               `routes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
@@ -10003,13 +10823,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
   });
 }
-var import_node_child_process19, import_node_fs23, import_node_path23, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
+var import_node_child_process21, import_node_fs25, import_node_path26, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process19 = require("child_process");
-    import_node_fs23 = __toESM(require("fs"));
-    import_node_path23 = __toESM(require("path"));
+    import_node_child_process21 = require("child_process");
+    import_node_fs25 = __toESM(require("fs"));
+    import_node_path26 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
@@ -10022,6 +10842,7 @@ var init_workspace_ensure = __esm({
     init_repo_config();
     init_route_publication();
     init_router();
+    init_traefik_route_health();
     init_workspace();
     init_workspace_ownership();
     init_workspace_runtime();
@@ -10095,20 +10916,20 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path24.default.join(mainRepo, "trees", ws);
+  return import_node_path27.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process22.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path24.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path24.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path27.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path27.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path24.default.join(import_node_path24.default.dirname(mainRepo), `${import_node_path24.default.basename(mainRepo)}-${ws}`);
+  return import_node_path27.default.join(import_node_path27.default.dirname(mainRepo), `${import_node_path27.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -10220,13 +11041,13 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs24.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs26.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
     );
   }
-  const status = (0, import_node_child_process20.spawnSync)(
+  const status = (0, import_node_child_process22.spawnSync)(
     "git",
     ["-C", target.worktreePath, "status", "--porcelain", "--untracked-files=normal"],
     { encoding: "utf-8" }
@@ -10260,9 +11081,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs24.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs26.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path24.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path27.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -10271,7 +11092,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs24.default.existsSync(selectedPath)) {
+    if (import_node_fs26.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -10290,11 +11111,11 @@ async function workspaceUp(branch, opts = {}) {
       return selectedPath;
     }
     if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
-    const add = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
+    const add = (0, import_node_child_process22.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process20.spawnSync)(
+      const addNew = (0, import_node_child_process22.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
         { encoding: "utf-8" }
@@ -10396,8 +11217,8 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
       opts.quiet
     );
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs24.default.existsSync(resolved.worktreePath)) {
-        const rm = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs26.default.existsSync(resolved.worktreePath)) {
+        const rm = (0, import_node_child_process22.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -10415,7 +11236,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs24.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs26.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
 }
 async function mutateWorkspaceOwnedPath(action2, worktreePath, opts = {}) {
   const mainRepo = resolveRepoPath(opts.repoPath);
@@ -10450,13 +11271,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process20, import_node_fs24, import_node_path24, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process22, import_node_fs26, import_node_path27, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process20 = require("child_process");
-    import_node_fs24 = __toESM(require("fs"));
-    import_node_path24 = __toESM(require("path"));
+    import_node_child_process22 = require("child_process");
+    import_node_fs26 = __toESM(require("fs"));
+    import_node_path27 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_repo_config();
@@ -10585,17 +11406,17 @@ async function devsyExec(repoPath, command) {
     }
     const args = ["workspace", "exec", "--result-format", "plain", workspace.id, "--", ...command];
     return new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process21.spawn)("devsy", args, { stdio: "inherit" });
+      const child = (0, import_node_child_process23.spawn)("devsy", args, { stdio: "inherit" });
       child.once("error", (error) => reject(new Error(`devsy exec failed: ${error.message}`)));
       child.once("close", (code) => resolve(code ?? 1));
     });
   });
 }
-var import_node_child_process21;
+var import_node_child_process23;
 var init_devsy_exec = __esm({
   "src/core/devsy-exec.ts"() {
     "use strict";
-    import_node_child_process21 = require("child_process");
+    import_node_child_process23 = require("child_process");
     init_devsy_workspaces();
     init_workspace();
   }
@@ -10617,7 +11438,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process22.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process24.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -10658,7 +11479,7 @@ async function devpodExec(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto8.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto9.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -10676,7 +11497,7 @@ async function devpodExec(repoPath, command) {
       wrappedCommand
     ];
     return new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process22.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+      const child = (0, import_node_child_process24.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       let pending = Buffer.alloc(0);
       let statusBytes = Buffer.alloc(0);
       let readingStatus = false;
@@ -10735,12 +11556,12 @@ async function devpodExec(repoPath, command) {
     });
   });
 }
-var import_node_child_process22, import_node_crypto8, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
+var import_node_child_process24, import_node_crypto9, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
 var init_devpod_exec = __esm({
   "src/core/devpod-exec.ts"() {
     "use strict";
-    import_node_child_process22 = require("child_process");
-    import_node_crypto8 = require("crypto");
+    import_node_child_process24 = require("child_process");
+    import_node_crypto9 = require("crypto");
     init_devpod_environment();
     init_devpod_workspaces();
     init_devsy_exec();
@@ -10926,7 +11747,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process23.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process25.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -10934,11 +11755,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process23;
+var import_node_child_process25;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process23 = require("child_process");
+    import_node_child_process25 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -10961,7 +11782,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process24.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process26.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -10975,17 +11796,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process24.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process26.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process24;
+var import_node_child_process26;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process24 = require("child_process");
+    import_node_child_process26 = require("child_process");
     init_docker();
     init_router();
   }
@@ -11025,17 +11846,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs25.default.existsSync(filePath)) {
+  if (!import_node_fs27.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs25.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs27.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path25.default.relative(repoPath, filePath) || ".";
+  return import_node_path28.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -11076,7 +11897,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName))) {
+    if (import_node_fs27.default.existsSync(import_node_path28.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -11091,9 +11912,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path25.default.join(repoPath, ".nvmrc");
-  if (import_node_fs25.default.existsSync(nvmrc)) {
-    const version = import_node_fs25.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path28.default.join(repoPath, ".nvmrc");
+  if (import_node_fs27.default.existsSync(nvmrc)) {
+    const version = import_node_fs27.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -11154,7 +11975,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path25.default.isAbsolute(fileName) && !import_node_path25.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path28.default.isAbsolute(fileName) && !import_node_path28.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -11172,7 +11993,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName))
+    (fileName) => import_node_fs27.default.existsSync(import_node_path28.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -11210,7 +12031,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs25.default.readFileSync(import_node_path25.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs27.default.readFileSync(import_node_path28.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -11245,8 +12066,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs25.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs25.default.readFileSync(import_node_path25.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs27.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs27.default.readFileSync(import_node_path28.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -11260,18 +12081,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path25.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs25.default.existsSync(dir)) {
+  const dir = import_node_path28.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs27.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs25.default.readdirSync(dir).filter((fileName) => import_node_fs25.default.statSync(import_node_path25.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs27.default.readdirSync(dir).filter((fileName) => import_node_fs27.default.statSync(import_node_path28.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs25.default.existsSync(configPath)) {
+  if (!import_node_fs27.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -11315,15 +12136,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs25.default.existsSync(import_node_path25.default.join(repoPath, fileName))) {
+    if (import_node_fs27.default.existsSync(import_node_path28.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path25.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs25.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs25.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path25.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs25.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path28.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs27.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs27.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path28.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs27.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -11366,7 +12187,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path25.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path28.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -11385,12 +12206,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs25, import_node_path25, import_yaml6;
+var import_node_fs27, import_node_path28, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs25 = __toESM(require("fs"));
-    import_node_path25 = __toESM(require("path"));
+    import_node_fs27 = __toESM(require("fs"));
+    import_node_path28 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -11495,7 +12316,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs26.default.existsSync(import_node_path26.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs28.default.existsSync(import_node_path29.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -11714,12 +12535,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs26, import_node_path26;
+var import_node_fs28, import_node_path29;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs26 = __toESM(require("fs"));
-    import_node_path26 = __toESM(require("path"));
+    import_node_fs28 = __toESM(require("fs"));
+    import_node_path29 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -12016,7 +12837,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path27.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path30.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -12061,8 +12882,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path27.default.join(repoPath, file.relativePath);
-  if (!import_node_fs27.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path30.default.join(repoPath, file.relativePath);
+  if (!import_node_fs29.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -12070,7 +12891,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs27.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs29.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -12127,11 +12948,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path27.default.join(repoPath, file.relativePath);
-  import_node_fs27.default.mkdirSync(import_node_path27.default.dirname(absolutePath), { recursive: true });
-  import_node_fs27.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path30.default.join(repoPath, file.relativePath);
+  import_node_fs29.default.mkdirSync(import_node_path30.default.dirname(absolutePath), { recursive: true });
+  import_node_fs29.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs27.default.chmodSync(absolutePath, 493);
+    import_node_fs29.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -12169,12 +12990,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs27, import_node_path27, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs29, import_node_path30, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs27 = __toESM(require("fs"));
-    import_node_path27 = __toESM(require("path"));
+    import_node_fs29 = __toESM(require("fs"));
+    import_node_path30 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -12283,6 +13104,119 @@ var init_repo_devcontainer = __esm({
   }
 });
 
+// src/core/profile-resolution.ts
+function sortedUnique2(values) {
+  return Array.from(new Set(values)).sort();
+}
+function expandsAll(values) {
+  return values?.length === 1 && values[0] === "*";
+}
+function selectedManagedResources(profile, selected, registry) {
+  if (!profile || expandsAll(selected)) return sortedUnique2(registry);
+  return sortedUnique2(selected ?? []);
+}
+function selectedReadiness(config, profileName, profile, routedApps) {
+  const selectedNames = profileName.split(",");
+  if (selectedNames.length === 1) {
+    return sortedUnique2(
+      profile?.readiness ?? routedApps.filter((app) => app.protocol === "http").map((app) => app.name)
+    );
+  }
+  const readiness = /* @__PURE__ */ new Set();
+  for (const selectedName of selectedNames) {
+    const selected = resolveProfile(config, selectedName);
+    const selectedApps = applyProfile(config, selected.profile).apps.filter(
+      (app) => app.kind !== "dependency"
+    );
+    const selectedTargets = selected.profile?.readiness ?? selectedApps.filter((app) => app.protocol === "http").map((app) => app.name);
+    for (const target of selectedTargets) readiness.add(target);
+  }
+  return sortedUnique2(readiness);
+}
+function buildProfileResolutionReport(config, repoPath, profileOverride) {
+  const resolved = resolveProfile(config, profileOverride);
+  const filtered = applyProfile(config, resolved.profile);
+  const routedApps = filtered.apps.filter((app) => app.kind !== "dependency");
+  const dependencies = filtered.apps.filter((app) => app.kind === "dependency");
+  const readiness = selectedReadiness(config, resolved.name, resolved.profile, routedApps);
+  const managedRuntime = config.managedRuntime;
+  const baseServices = sortedUnique2(managedRuntime?.devcontainer.baseServices ?? []);
+  const profileServices = managedRuntime ? selectedManagedResources(
+    resolved.profile,
+    resolved.profile?.devcontainerServices,
+    managedRuntime.devcontainer.profileServices
+  ) : [];
+  const processes = managedRuntime ? selectedManagedResources(
+    resolved.profile,
+    resolved.profile?.processes,
+    managedRuntime.processes
+  ) : [];
+  return {
+    schemaVersion: 1,
+    repoPath,
+    profile: resolved.name,
+    apps: sortedUnique2(routedApps.map((app) => app.name)),
+    dependencies: sortedUnique2(dependencies.map((app) => app.name)),
+    readiness: sortedUnique2(readiness),
+    managedRuntime: {
+      baseServices,
+      profileServices,
+      services: sortedUnique2([...baseServices, ...profileServices]),
+      processes
+    }
+  };
+}
+function resolveProfileReport(options) {
+  const repoPath = resolveRepoPath(options.repo);
+  return buildProfileResolutionReport(loadRepoConfig(repoPath), repoPath, options.profile);
+}
+var init_profile_resolution = __esm({
+  "src/core/profile-resolution.ts"() {
+    "use strict";
+    init_repo_config();
+  }
+});
+
+// src/commands/profile.ts
+var profile_exports = {};
+__export(profile_exports, {
+  runProfileResolveCommand: () => runProfileResolveCommand
+});
+async function runProfileResolveCommand(options) {
+  const report = resolveProfileReport(options);
+  if (options.json) {
+    printJSON(report);
+    return;
+  }
+  printProfileResolutionSummary(report);
+}
+function renderValues(values) {
+  return values.join(", ") || "-";
+}
+function printProfileResolutionSummary(report) {
+  process.stdout.write(`Repo: ${report.repoPath}
+`);
+  process.stdout.write(`Profile: ${report.profile}
+`);
+  process.stdout.write(`Apps: ${renderValues(report.apps)}
+`);
+  process.stdout.write(`Dependencies: ${renderValues(report.dependencies)}
+`);
+  process.stdout.write(`Readiness: ${renderValues(report.readiness)}
+`);
+  process.stdout.write(`Managed services: ${renderValues(report.managedRuntime.services)}
+`);
+  process.stdout.write(`Managed processes: ${renderValues(report.managedRuntime.processes)}
+`);
+}
+var init_profile = __esm({
+  "src/commands/profile.ts"() {
+    "use strict";
+    init_output();
+    init_profile_resolution();
+  }
+});
+
 // src/commands/app-add.ts
 var app_add_exports = {};
 __export(app_add_exports, {
@@ -12565,7 +13499,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto9.createHash)("sha1").update(import_node_path28.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto10.createHash)("sha1").update(import_node_path31.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -12644,11 +13578,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path28.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs28.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path28.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path31.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs30.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path31.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs28.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs30.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -12662,7 +13596,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process27.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -12690,7 +13624,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process27.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -12716,7 +13650,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process27.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -12742,7 +13676,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process25.spawnSync)("docker", args, {
+  (0, import_node_child_process27.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -12754,7 +13688,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process27.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -12768,14 +13702,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process25, import_node_crypto9, import_node_fs28, import_node_path28, import_yaml7;
+var import_node_child_process27, import_node_crypto10, import_node_fs30, import_node_path31, import_yaml7;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process25 = require("child_process");
-    import_node_crypto9 = require("crypto");
-    import_node_fs28 = __toESM(require("fs"));
-    import_node_path28 = __toESM(require("path"));
+    import_node_child_process27 = require("child_process");
+    import_node_crypto10 = require("crypto");
+    import_node_fs30 = __toESM(require("fs"));
+    import_node_path31 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -12812,7 +13746,7 @@ function resolveSmCommand(command, defaultEnv, overrideEnv) {
   }
   return command.replace(/\{env\}/g, env);
 }
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((resolve) => {
     setTimeout(resolve, ms);
   });
@@ -12865,7 +13799,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process26.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process28.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -12923,7 +13857,7 @@ async function terminateProcessTree(rootPid) {
     if (!isProcessRunning(rootPid)) {
       return;
     }
-    await sleep2(100);
+    await sleep3(100);
   }
   if (isProcessRunning(rootPid)) {
     killProcessTree(rootPid, "SIGKILL");
@@ -12976,12 +13910,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process26.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process28.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process26.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process28.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -13040,7 +13974,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process26.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process28.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -13110,7 +14044,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
           );
         }
       }
-      await sleep2(POLL_INTERVAL_MS2);
+      await sleep3(POLL_INTERVAL_MS2);
     }
   } catch (error) {
     fatalError = toError(error);
@@ -13408,7 +14342,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process26.spawn)(wrapped, {
+        child = (0, import_node_child_process28.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -13422,7 +14356,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process26.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process28.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -13430,7 +14364,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process26.spawn)(options.command[0], {
+      child = (0, import_node_child_process28.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -13438,7 +14372,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process26.spawn)(command, args, {
+      child = (0, import_node_child_process28.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -13459,11 +14393,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process26, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process28, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process26 = require("child_process");
+    import_node_child_process28 = require("child_process");
     import_node_net = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -13597,13 +14531,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs29.default.lstatSync(worktreePath);
+    rootStat = import_node_fs31.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs29.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs31.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -13629,10 +14563,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path29.default.join(dirPath, entry.name);
+      const entryPath = import_node_path32.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs29.default.lstatSync(entryPath);
+        entryStat = import_node_fs31.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -13642,7 +14576,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs29.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs31.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -13706,12 +14640,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs29, import_node_path29, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs31, import_node_path32, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs29 = __toESM(require("fs"));
-    import_node_path29 = __toESM(require("path"));
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_path32 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -13812,7 +14746,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs30.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs32.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -14337,7 +15271,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers = new Map(worktreePaths.map((path29) => [path29, unknownContainers(reason)]));
+      containers = new Map(worktreePaths.map((path32) => [path32, unknownContainers(reason)]));
     }
   }
   const rows = records.map((record) => {
@@ -14386,12 +15320,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process27, import_node_fs30, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process29, import_node_fs32, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process27 = require("child_process");
-    import_node_fs30 = __toESM(require("fs"));
+    import_node_child_process29 = require("child_process");
+    import_node_fs32 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -14408,7 +15342,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process27.spawnSync)(command, args, {
+      const result = (0, import_node_child_process29.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -14568,7 +15502,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.45" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.48" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -14726,6 +15660,16 @@ repoDevcontainerCommand.command("verify").description("Verify devcontainer onboa
     }
   )
 );
+var profileCommand = program.command("profile").description("Resolve profiles from `.devrouter.yml` without starting a runtime");
+profileCommand.command("resolve").description("Print the exact apps, dependencies, services, and processes for a profile").option("--repo <path>", "Repository path (defaults to current directory)").option(
+  "--profile <name>",
+  "Profile name or comma-separated selection (defaults to configured profile)"
+).option("--json", "Output stable JSON").action(
+  withErrorHandling(async (options) => {
+    const { runProfileResolveCommand: runProfileResolveCommand2 } = await Promise.resolve().then(() => (init_profile(), profile_exports));
+    await runProfileResolveCommand2(options);
+  })
+);
 var appCommand = program.command("app").description("Manage app entries and runtime actions from `.devrouter.yml`");
 appCommand.command("add").description("Add or update one app definition in `.devrouter.yml`").requiredOption("--name <name>", "App name").option("--kind <kind>", "app or dependency", "app").option("--host <host>", "Hostname ending with .localhost (required for --kind app)").option("--protocol <protocol>", "http or tcp (required for --kind app)").option(
   "--runtime <runtime>",