@devrouter/cli 0.0.46 → 0.0.48

package/dist/devrouter.js

@@ -44,6 +44,7 @@ function buildDevrouterSection() {
     "",
     "Quick validation sequence:",
     "- Managed devcontainer consumer images contain no devrouter package or helper; `devrouter ensure` delivers the matching helper at runtime.",
+    "- Devsy runtime: run `devrouter setup --yes --workspace-runtime devsy` once; `doctor` then reports verified agent readiness without network access.",
     "- `devrouter up`",
     "- `devrouter tls install` (required when repo defines tcp/postgres apps)",
     "- `devrouter app ls --repo .`",
@@ -322,7 +323,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed \`ensure\` rejects every HTTP/TCP proxy upstream outside that exact alias namespace before it mutates DevPod or routes. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: managed scaffolds list the base compose file, then \`\${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}\`; custom repositories may keep another default overlay. Selecting \`.devcontainer/docker-compose.devrouter.yml\` for linked worktrees must pass \`WORKSPACE\` and \`DEVROUTER_WORKSPACE\` across the combined base/overlay config and bind-mount \`\${DEVROUTER_GIT_COMMON_DIR}\` to the same absolute app-container path. The app exposes \`\${WORKSPACE}-app\`; the proxy uses \`upstream: \${WORKSPACE}-app:<port>\`.
-- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects. A failed Devsy start that reports the agent-binary acquisition failure names the \`DEVSY_AGENT_BINARY\` remediation.
+- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects. For Devsy, run \`devrouter setup --yes --workspace-runtime devsy\` once so Devrouter acquires and verifies the pinned agent in its own machine cache. \`doctor\` reports \`ready\`, \`missing\`, \`stale\`, or \`invalid\` without network access, and \`ensure\` fails before the provider queue when readiness is not \`ready\`. An explicit \`DEVSY_AGENT_BINARY\` remains authoritative and must match a pinned official asset.
 - **Managed process identity**: \`ensure\` executes an exact captured adapter snapshot. Default reuse includes command argv, workspace, and adapter SHA-256. Set \`DEVROUTER_PROCESS_FINGERPRINT_ENV\` only to comma-separated non-secret environment names whose values affect runtime identity; secret-like names are rejected and raw values are never persisted.
 - **Route state**: the versioned Traefik dynamic file is authoritative for both metadata and rendering. JSON is a compatibility mirror; valid headerless generations migrate automatically, while corrupt canonical metadata fails closed.
 - **Cleanup**: \`workspace cleanup --repo . --inactive-for 30d --json\` is a report-only, no-\`--yes\` report for managed linked workspaces. It joins ownership (\`present|missing|locked|conflict\`), workspace runtime registration, runtime state (\`running|stopped|busy|not-found|absent|unknown\`), checkout, route, advisory activity, and integration evidence without mutating the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. Local DevPod/Devsy list/status checks always run; \`--check-merged\` alone enables read-only origin and matching GitHub/GitLab checks. Treat \`not-found\` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit \`gc\`/\`down\` can remove exact stale registration only after expected-ID \`NotFound\` proof and ownership revalidation. GC never removes Git worktrees, branches, or prune state. Git has no worktree-removal hook.
@@ -376,8 +377,9 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter init [--write-agents] [--write-skill]\`: print AI onboarding prompt (non-mutating by default)
 - \`devrouter -V [--repo .]\`: show installed CLI version, local repo version, and next upgrade target
 - \`devrouter upgrade [version] [--repo .]\`: list upgrade targets or print target Agent Adaptation Prompt
-- \`devrouter setup --yes [--repo .] [--json]\`: first-run machine setup plus structured diagnostics
+- \`devrouter setup --yes [--repo .] [--json] [--workspace-runtime <devpod|devsy>]\`: first-run machine setup plus structured diagnostics; explicit Devsy selection acquires its verified agent
 - \`devrouter ensure [path] [--profile <name>] [--open] [--json]\`: canonical startup/reconciliation for primary and linked checkouts; a managed profile selects its independent resource dimensions
+- \`devrouter profile resolve --repo <path> [--profile <selection>] [--json]\`: resolve exact profile resources for automation without starting or inspecting a runtime
 - \`devrouter stop [path] [--delete] [--json]\`: stop the exact workspace runtime and remove exact routes; \`--delete\` explicitly deletes its ownership-proven data without removing the checkout
 - \`devrouter exec [path] -- <command...>\`: literal one-shot command inside the exact running workspace runtime
 - \`devrouter up\` / \`devrouter down\`: start/stop shared Traefik router
@@ -411,6 +413,9 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 
 For devcontainer onboarding:
 
+When Devsy owns the workspace, first run
+\`devrouter setup --repo . --yes --workspace-runtime devsy --json\`.
+
 1. \`devrouter setup --repo . --yes --json\`
 2. \`devrouter doctor --repo . --json\`
 3. \`devrouter repo inspect --repo . --json\`
@@ -720,6 +725,9 @@ function runDockerCompose(args) {
 function startRouterStack() {
   runDockerCompose(["up", "-d"]);
 }
+function restartRouterStack() {
+  runDockerCompose(["restart", "traefik"]);
+}
 function stopRouterStack() {
   runDockerCompose(["down"]);
 }
@@ -1406,6 +1414,12 @@ function hostRouteFromInput(input2, existing, now) {
 function sanitizeKey(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
+function buildHostRouteRouterKey(routeId) {
+  return `host-${sanitizeKey(routeId)}`;
+}
+function buildHostRouteRouterName(repoPath, name) {
+  return `${buildHostRouteRouterKey(buildHostRouteId(repoPath, name))}@file`;
+}
 function tcpTlsOptionName(tcpProtocol) {
   return `devrouter-tcp-${tcpProtocol}`;
 }
@@ -1416,7 +1430,7 @@ function buildHostRoutesDocument(routes, tlsEnabled) {
   const tcpServices = {};
   const tlsOptions = {};
   for (const route of routes) {
-    const key = `host-${sanitizeKey(route.id)}`;
+    const key = buildHostRouteRouterKey(route.id);
     if (route.protocol === "tcp") {
       const alpn = route.tcpProtocol ? TCP_TLS_ALPN_PROTOCOLS[route.tcpProtocol] : void 0;
       let tls = {};
@@ -2654,7 +2668,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.46" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.48" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -3185,6 +3199,7 @@ function buildOnboardingPrompt(options = {}) {
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once so Devrouter acquires and verifies the pinned agent in its own machine cache. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access, and `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match a pinned official asset.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
@@ -3216,7 +3231,7 @@ function buildOnboardingPrompt(options = {}) {
     "- Warning: Do not run migration/seed until env probe confirms expected DB variables and values.",
     "",
     "Required workflow:",
-    "1) Run `devrouter setup --yes --json` for devrouter-owned machine state; use `devrouter doctor --repo <REPO_PATH> --json` to diagnose missing prerequisites without mutation.",
+    "1) Run `devrouter setup --yes --json` for devrouter-owned machine state. When selecting Devsy, use `devrouter setup --yes --workspace-runtime devsy --json` to acquire its verified agent. Use `devrouter doctor --repo <REPO_PATH> --json` to diagnose missing prerequisites without mutation.",
     "2) Run `devrouter repo inspect --repo <REPO_PATH> --json` before editing files.",
     "3) For the supported Node/pnpm/Postgres devcontainer shape, run `devrouter repo devcontainer write --repo <REPO_PATH> --dry-run --json`, review the plan, then run `devrouter repo devcontainer write --repo <REPO_PATH> --yes`.",
     "4) For unsupported shapes or custom existing files, make minimal manual edits and explain the assumptions.",
@@ -3226,6 +3241,7 @@ function buildOnboardingPrompt(options = {}) {
     "",
     "Validation commands to run/report for the devcontainer path:",
     "- devrouter setup --yes --json",
+    "- Devsy runtime setup: devrouter setup --yes --workspace-runtime devsy --json",
     "- devrouter doctor --repo <REPO_PATH> --json",
     "- devrouter repo inspect --repo <REPO_PATH> --json",
     "- devrouter repo devcontainer write --repo <REPO_PATH> --dry-run --json",
@@ -3353,6 +3369,10 @@ var init_ai_prompt = __esm({
         command: "devrouter ensure [path] [--profile <name>] [--open] [--json]",
         purpose: "Canonical startup and proof for an exact primary or linked checkout; atomically publishes routes after readiness."
       },
+      {
+        command: "devrouter profile resolve --repo <path> [--profile <selection>] [--json]",
+        purpose: "Resolve exact profile resources without starting or inspecting a runtime; fail closed on invalid selections or unknown report schemas."
+      },
       {
         command: "devrouter stop [path] [--delete] [--json]",
         purpose: "Stop the exact checkout workspace runtime and routes; --delete explicitly deletes the ownership-proven runtime without removing the checkout."
@@ -4055,6 +4075,384 @@ var init_upgrade2 = __esm({
   }
 });
 
+// src/core/devsy-agent.ts
+function parseVersion(output2) {
+  return output2?.match(
+    /\bv?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\b/
+  )?.[1];
+}
+function devsyAgentRepairSuggestion(inspection) {
+  if (inspection.state === "stale") {
+    return `Install Devsy ${SUPPORTED_DEVSY_VERSION} for a supported host, then run: ${DEVSY_AGENT_SETUP_COMMAND}`;
+  }
+  return inspection.source === "explicit" ? `Fix or unset DEVSY_AGENT_BINARY, then run: ${DEVSY_AGENT_SETUP_COMMAND}` : `Run: ${DEVSY_AGENT_SETUP_COMMAND}`;
+}
+function installedVersionOutput() {
+  const result = (0, import_node_child_process4.spawnSync)("devsy", ["--version"], { encoding: "utf-8" });
+  if (result.error || result.status !== 0) return void 0;
+  return [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || void 0;
+}
+function nativeAssetName(platform, arch) {
+  if (platform !== "darwin") return void 0;
+  if (arch === "arm64") return "devsy-linux-arm64";
+  if (arch === "x64") return "devsy-linux-amd64";
+  return void 0;
+}
+function managedBinaryPath(cacheRoot, asset) {
+  return import_node_path9.default.join(cacheRoot, `v${SUPPORTED_DEVSY_VERSION}`, asset.name);
+}
+function hashOpenFile(file) {
+  const digest = (0, import_node_crypto4.createHash)("sha256");
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  let position = 0;
+  for (; ; ) {
+    const bytesRead = import_node_fs9.default.readSync(file, buffer, 0, buffer.length, position);
+    if (bytesRead === 0) break;
+    digest.update(buffer.subarray(0, bytesRead));
+    position += bytesRead;
+  }
+  return digest.digest("hex");
+}
+function inspectBinary(binaryPath, assets, missingState) {
+  let file;
+  try {
+    file = import_node_fs9.default.openSync(binaryPath, import_node_fs9.default.constants.O_RDONLY | import_node_fs9.default.constants.O_NOFOLLOW);
+    const stat = import_node_fs9.default.fstatSync(file);
+    if (!stat.isFile()) {
+      return { state: "invalid", reason: "the selected source is not a regular file" };
+    }
+    const sizeMatches = assets.filter((asset2) => asset2.size === stat.size);
+    if (sizeMatches.length === 0) {
+      return { state: "invalid", reason: "the selected source has an unexpected size" };
+    }
+    const sha2562 = hashOpenFile(file);
+    const asset = sizeMatches.find((candidate) => candidate.sha256 === sha2562);
+    return asset ? { state: "ready", reason: "the selected source matches the pinned manifest", asset } : { state: "invalid", reason: "the selected source has an unexpected digest" };
+  } catch (error) {
+    const code = error.code;
+    return code === "ENOENT" ? { state: missingState, reason: "the selected source is missing" } : { state: "invalid", reason: "the selected source is not a readable regular file" };
+  } finally {
+    if (file !== void 0) import_node_fs9.default.closeSync(file);
+  }
+}
+function resolvedOptions(options) {
+  return {
+    env: options.env ?? process.env,
+    platform: options.platform ?? process.platform,
+    arch: options.arch ?? process.arch,
+    versionOutput: options.versionOutput ?? installedVersionOutput(),
+    cacheRoot: options.cacheRoot ?? import_node_path9.default.join(CACHE_DIR, "devsy", "agents"),
+    lockPath: options.lockPath ?? DEVSY_AGENT_CACHE_LOCK,
+    assets: options.assets ?? DEVSY_AGENT_ASSETS,
+    nativeAssetName: options.nativeAssetName
+  };
+}
+function inspectDevsyAgent(options = {}) {
+  const resolved = resolvedOptions(options);
+  const installedVersion = parseVersion(resolved.versionOutput);
+  const explicitPath = resolved.env.DEVSY_AGENT_BINARY?.trim();
+  const source = explicitPath ? "explicit" : "managed";
+  if (installedVersion !== SUPPORTED_DEVSY_VERSION) {
+    return {
+      state: "stale",
+      source,
+      reason: installedVersion ? `installed Devsy ${installedVersion} is not supported by this Devrouter release` : "the supported Devsy version is not available",
+      installedVersion
+    };
+  }
+  if (explicitPath) {
+    return {
+      ...inspectBinary(explicitPath, resolved.assets, "invalid"),
+      source,
+      binaryPath: explicitPath,
+      installedVersion
+    };
+  }
+  const expectedName = resolved.nativeAssetName ?? nativeAssetName(resolved.platform, resolved.arch);
+  const asset = resolved.assets.find((candidate) => candidate.name === expectedName);
+  if (!asset) {
+    return {
+      state: "stale",
+      source,
+      reason: `this Devrouter release has no pinned Devsy agent for ${resolved.platform}/${resolved.arch}`,
+      installedVersion
+    };
+  }
+  const binaryPath = managedBinaryPath(resolved.cacheRoot, asset);
+  return {
+    ...inspectBinary(binaryPath, [asset], "missing"),
+    source,
+    binaryPath,
+    asset,
+    installedVersion
+  };
+}
+async function writeAll(handle, chunk, position) {
+  let offset = 0;
+  while (offset < chunk.byteLength) {
+    const { bytesWritten } = await handle.write(
+      chunk,
+      offset,
+      chunk.byteLength - offset,
+      position + offset
+    );
+    if (bytesWritten === 0) throw new Error("Devsy agent download stopped making progress");
+    offset += bytesWritten;
+  }
+}
+function appendBoundedTail(current, chunk) {
+  if (chunk.length >= GITHUB_CLI_STDERR_TAIL_BYTES) {
+    return Buffer.from(chunk.subarray(chunk.length - GITHUB_CLI_STDERR_TAIL_BYTES));
+  }
+  const combined = Buffer.concat([current, chunk]);
+  return combined.length > GITHUB_CLI_STDERR_TAIL_BYTES ? combined.subarray(combined.length - GITHUB_CLI_STDERR_TAIL_BYTES) : combined;
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function downloadWithGitHubCli(asset, writeChunk) {
+  const child = (0, import_node_child_process4.spawn)(
+    "gh",
+    [
+      "api",
+      `repos/devsy-org/devsy/releases/assets/${asset.githubAssetId}`,
+      "-H",
+      "Accept: application/octet-stream"
+    ],
+    { stdio: ["ignore", "pipe", "pipe"] }
+  );
+  if (!child.stdout || !child.stderr) {
+    child.kill();
+    throw new Error("GitHub CLI fallback did not create output pipes");
+  }
+  let stderrTail = Buffer.alloc(0);
+  child.stderr.on("data", (chunk) => {
+    const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    stderrTail = appendBoundedTail(stderrTail, value);
+  });
+  let spawnError;
+  const completion = new Promise((resolve) => {
+    child.once("error", (error) => {
+      spawnError = error;
+    });
+    child.once("close", (status) => {
+      resolve(status);
+    });
+  });
+  try {
+    for await (const chunk of child.stdout) {
+      await writeChunk(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    const status = await completion;
+    if (spawnError) throw spawnError;
+    if (status !== 0) {
+      const details = stderrTail.toString("utf-8").trim();
+      throw new Error(
+        `gh api exited with status ${status ?? "unknown"}${details ? `: ${details}` : ""}`
+      );
+    }
+  } catch (error) {
+    if (child.exitCode === null) child.kill();
+    await completion.catch(() => void 0);
+    throw error;
+  }
+}
+function fsyncDirectory2(directory) {
+  const handle = import_node_fs9.default.openSync(directory, "r");
+  try {
+    import_node_fs9.default.fsyncSync(handle);
+  } finally {
+    import_node_fs9.default.closeSync(handle);
+  }
+}
+async function downloadAndPublish(asset, binaryPath, fetcher, githubCliDownloader) {
+  const directory = import_node_path9.default.dirname(binaryPath);
+  import_node_fs9.default.mkdirSync(directory, { recursive: true, mode: 448 });
+  const temporaryPath = import_node_path9.default.join(
+    directory,
+    `.${import_node_path9.default.basename(binaryPath)}.${process.pid}.${(0, import_node_crypto4.randomUUID)()}.tmp`
+  );
+  let handle;
+  try {
+    let response;
+    let directFailure;
+    try {
+      response = await fetcher(asset.url);
+    } catch (error) {
+      directFailure = error;
+    }
+    handle = await import_node_fs9.default.promises.open(temporaryPath, "wx", 384);
+    const digest = (0, import_node_crypto4.createHash)("sha256");
+    let size = 0;
+    const writeChunk = async (chunk) => {
+      size += chunk.byteLength;
+      if (size > asset.size) {
+        throw new Error("Devsy agent download exceeded the pinned size");
+      }
+      digest.update(chunk);
+      await writeAll(handle, chunk, size - chunk.byteLength);
+    };
+    let transport;
+    if (response) {
+      if (!response.ok) {
+        throw new Error(`Devsy agent download failed with HTTP ${response.status}`);
+      }
+      if (!response.body) throw new Error("Devsy agent download returned no response body");
+      const reader = response.body.getReader();
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          await writeChunk(value);
+        }
+      } catch (error) {
+        await reader.cancel().catch(() => void 0);
+        throw error;
+      }
+      transport = "https";
+    } else {
+      try {
+        await githubCliDownloader(asset, writeChunk);
+      } catch (fallbackError) {
+        throw new Error(
+          `Devsy agent direct HTTPS download failed: ${errorMessage(directFailure)}; GitHub CLI fallback failed: ${errorMessage(fallbackError)}. Restore direct GitHub release access or install and authenticate gh.`
+        );
+      }
+      transport = "github-cli";
+    }
+    if (size !== asset.size) throw new Error("Devsy agent download has an unexpected size");
+    if (digest.digest("hex") !== asset.sha256) {
+      throw new Error("Devsy agent download has an unexpected digest");
+    }
+    await handle.sync();
+    await handle.chmod(448);
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    await import_node_fs9.default.promises.rename(temporaryPath, binaryPath);
+    fsyncDirectory2(directory);
+    return transport;
+  } finally {
+    if (handle) await handle.close();
+    await import_node_fs9.default.promises.rm(temporaryPath, { force: true });
+  }
+}
+async function prepareDevsyAgent(options = {}) {
+  const resolved = resolvedOptions(options);
+  const inspectOptions = resolved;
+  const before = inspectDevsyAgent(inspectOptions);
+  if (before.state === "ready" && before.binaryPath && before.asset) {
+    return {
+      binaryPath: before.binaryPath,
+      source: before.source,
+      asset: before.asset,
+      changed: false,
+      transport: "existing"
+    };
+  }
+  if (before.source === "explicit" || before.state === "stale" || !before.binaryPath || !before.asset) {
+    throw new DevsyAgentReadinessError(before);
+  }
+  const lock = options.withLock ?? ((operation) => {
+    import_node_fs9.default.mkdirSync(import_node_path9.default.dirname(resolved.lockPath), { recursive: true });
+    return withFileLock(
+      resolved.lockPath,
+      {
+        activity: "Devsy agent acquisition",
+        waitMs: DEVSY_AGENT_LOCK_WAIT_MS,
+        fair: true,
+        onWait: createStderrWaitReporter("Devsy agent acquisition", "the managed cache")
+      },
+      operation
+    );
+  });
+  return lock(async () => {
+    const current = inspectDevsyAgent(inspectOptions);
+    if (current.state === "ready" && current.binaryPath && current.asset) {
+      return {
+        binaryPath: current.binaryPath,
+        source: current.source,
+        asset: current.asset,
+        changed: false,
+        transport: "existing"
+      };
+    }
+    if (current.source === "explicit" || current.state === "stale" || !current.binaryPath || !current.asset) {
+      throw new DevsyAgentReadinessError(current);
+    }
+    const transport = await downloadAndPublish(
+      current.asset,
+      current.binaryPath,
+      options.fetcher ?? fetch,
+      options.githubCliDownloader ?? downloadWithGitHubCli
+    );
+    const published = inspectDevsyAgent(inspectOptions);
+    if (published.state !== "ready" || !published.binaryPath || !published.asset) {
+      throw new DevsyAgentReadinessError(published);
+    }
+    return {
+      binaryPath: published.binaryPath,
+      source: published.source,
+      asset: published.asset,
+      changed: true,
+      transport
+    };
+  });
+}
+function requireReadyDevsyAgent(options = {}) {
+  const inspection = inspectDevsyAgent(options);
+  if (inspection.state !== "ready" || !inspection.binaryPath || !inspection.asset) {
+    throw new DevsyAgentReadinessError(inspection);
+  }
+  return {
+    binaryPath: inspection.binaryPath,
+    source: inspection.source,
+    asset: inspection.asset,
+    changed: false,
+    transport: "existing"
+  };
+}
+var import_node_child_process4, import_node_crypto4, import_node_fs9, import_node_path9, SUPPORTED_DEVSY_VERSION, DEVSY_AGENT_SETUP_COMMAND, DEVSY_AGENT_ASSETS, DevsyAgentReadinessError, DEVSY_AGENT_CACHE_LOCK, DEVSY_AGENT_LOCK_WAIT_MS, GITHUB_CLI_STDERR_TAIL_BYTES;
+var init_devsy_agent = __esm({
+  "src/core/devsy-agent.ts"() {
+    "use strict";
+    import_node_child_process4 = require("child_process");
+    import_node_crypto4 = require("crypto");
+    import_node_fs9 = __toESM(require("fs"));
+    import_node_path9 = __toESM(require("path"));
+    init_file_lock();
+    init_router();
+    SUPPORTED_DEVSY_VERSION = "1.16.2";
+    DEVSY_AGENT_SETUP_COMMAND = "devrouter setup --yes --workspace-runtime devsy";
+    DEVSY_AGENT_ASSETS = [
+      {
+        githubAssetId: 529830010,
+        name: "devsy-linux-arm64",
+        size: 124518562,
+        sha256: "31060b96486b5398f2aa3ee0875b2555782a2db0954a799d387be38ed4b4990d",
+        url: "https://github.com/devsy-org/devsy/releases/download/v1.16.2/devsy-linux-arm64"
+      },
+      {
+        githubAssetId: 529830011,
+        name: "devsy-linux-amd64",
+        size: 133505186,
+        sha256: "4983c52a3536c5a91d1b5f356a1c3428778ebf3f896d9897f60bce3978abc839",
+        url: "https://github.com/devsy-org/devsy/releases/download/v1.16.2/devsy-linux-amd64"
+      }
+    ];
+    DevsyAgentReadinessError = class extends Error {
+      constructor(inspection) {
+        super(`Devsy agent is ${inspection.state}: ${inspection.reason}`);
+        this.inspection = inspection;
+        this.name = "DevsyAgentReadinessError";
+      }
+    };
+    DEVSY_AGENT_CACHE_LOCK = import_node_path9.default.join(DEVROUTER_HOME, "devsy-agent-cache.lock");
+    DEVSY_AGENT_LOCK_WAIT_MS = 18e5;
+    GITHUB_CLI_STDERR_TAIL_BYTES = 4096;
+  }
+});
+
 // src/core/docker.ts
 async function getDockerodeConstructor() {
   if (!dockerodeConstructorPromise) {
@@ -4066,7 +4464,7 @@ async function getDockerodeConstructor() {
   return dockerodeConstructorPromise;
 }
 function runDockerContextCommand(args) {
-  const result = (0, import_node_child_process4.spawnSync)("docker", ["context", ...args], {
+  const result = (0, import_node_child_process5.spawnSync)("docker", ["context", ...args], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -4079,7 +4477,7 @@ function getCurrentDockerContext() {
   return runDockerContextCommand(["show"]);
 }
 function getDockerHostFromContext(context) {
-  const result = (0, import_node_child_process4.spawnSync)(
+  const result = (0, import_node_child_process5.spawnSync)(
     "docker",
     ["context", "inspect", context, "--format", "{{ .Endpoints.docker.Host }}"],
     { encoding: "utf-8" }
@@ -4147,11 +4545,11 @@ async function networkExists(name) {
     return false;
   }
 }
-var import_node_child_process4, dockerodeConstructorPromise;
+var import_node_child_process5, dockerodeConstructorPromise;
 var init_docker = __esm({
   "src/core/docker.ts"() {
     "use strict";
-    import_node_child_process4 = require("child_process");
+    import_node_child_process5 = require("child_process");
     dockerodeConstructorPromise = null;
   }
 });
@@ -4178,11 +4576,11 @@ function parseDevcontainerConfig(contents, sourcePath) {
   return parsed;
 }
 function readDevcontainerConfig(repoPath) {
-  const sourcePath = import_node_path9.default.join(repoPath, ".devcontainer", "devcontainer.json");
-  if (!import_node_fs9.default.existsSync(sourcePath) || !import_node_fs9.default.lstatSync(sourcePath).isFile()) {
+  const sourcePath = import_node_path10.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  if (!import_node_fs10.default.existsSync(sourcePath) || !import_node_fs10.default.lstatSync(sourcePath).isFile()) {
     throw new Error(`Managed Dev Container source config does not exist: ${sourcePath}`);
   }
-  const sourceContents = import_node_fs9.default.readFileSync(sourcePath, "utf-8");
+  const sourceContents = import_node_fs10.default.readFileSync(sourcePath, "utf-8");
   return {
     sourcePath,
     sourceContents,
@@ -4198,12 +4596,12 @@ function assertManagedDevcontainerLifecycle(repoPath) {
     `Managed Dev Container source '${sourcePath}' defines postCreateCommand, but waitFor ${actual}. Set waitFor to 'postCreateCommand' or 'postStartCommand' before retrying devrouter ensure.`
   );
 }
-var import_node_fs9, import_node_path9, import_jsonc_parser;
+var import_node_fs10, import_node_path10, import_jsonc_parser;
 var init_devcontainer_config = __esm({
   "src/core/devcontainer-config.ts"() {
     "use strict";
-    import_node_fs9 = __toESM(require("fs"));
-    import_node_path9 = __toESM(require("path"));
+    import_node_fs10 = __toESM(require("fs"));
+    import_node_path10 = __toESM(require("path"));
     import_jsonc_parser = require("jsonc-parser");
   }
 });
@@ -4213,7 +4611,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path10.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path11.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -4237,7 +4635,7 @@ function commandFailure(result) {
   return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
 }
 function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process5.spawnSync)(
+  const result = (0, import_node_child_process6.spawnSync)(
     "docker",
     ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
     { input: contents, encoding: "utf-8" }
@@ -4248,32 +4646,32 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs10.default.existsSync(filePath) || !import_node_fs10.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs10.default.readFileSync(filePath);
+  if (!import_node_fs11.default.existsSync(filePath) || !import_node_fs11.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs11.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto4.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto5.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path10.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path10.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path11.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path11.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs10.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs11.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path10.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path11.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path10.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path10.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path11.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path11.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -4314,7 +4712,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs10.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs11.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -4328,7 +4726,7 @@ function runManagedPostStart(options) {
     options.plan.adapterContents,
     "the managed post-start adapter"
   );
-  const started = (0, import_node_child_process5.spawnSync)(
+  const started = (0, import_node_child_process6.spawnSync)(
     "docker",
     [
       "exec",
@@ -4366,7 +4764,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process5.spawnSync)(
+  const result = (0, import_node_child_process6.spawnSync)(
     "docker",
     [
       "exec",
@@ -4402,14 +4800,14 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process5, import_node_crypto4, import_node_fs10, import_node_path10, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
+var import_node_child_process6, import_node_crypto5, import_node_fs11, import_node_path11, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH, ADAPTER_WRAPPER;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
-    import_node_child_process5 = require("child_process");
-    import_node_crypto4 = require("crypto");
-    import_node_fs10 = __toESM(require("fs"));
-    import_node_path10 = __toESM(require("path"));
+    import_node_child_process6 = require("child_process");
+    import_node_crypto5 = require("crypto");
+    import_node_fs11 = __toESM(require("fs"));
+    import_node_path11 = __toESM(require("path"));
     init_devcontainer_config();
     MANAGED_MARKER = "devrouter:managed devcontainer";
     MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
@@ -4476,7 +4874,7 @@ function isLoopbackHost(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "host.docker.internal";
 }
 function inspectCompose(composeFile, _workspace) {
-  if (!import_node_fs11.default.existsSync(composeFile)) {
+  if (!import_node_fs12.default.existsSync(composeFile)) {
     return {
       aliases: [],
       publishedPorts: [],
@@ -4485,7 +4883,7 @@ function inspectCompose(composeFile, _workspace) {
     };
   }
   try {
-    const raw = import_node_fs11.default.readFileSync(composeFile, "utf-8");
+    const raw = import_node_fs12.default.readFileSync(composeFile, "utf-8");
     const parsed = import_yaml3.default.parse(raw);
     const root = asRecord(parsed);
     const services = asRecord(root?.services);
@@ -4542,11 +4940,11 @@ function routedProxyApps(config) {
   );
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path11.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs11.default.existsSync(devcontainerDir)) {
+  const devcontainerDir = import_node_path12.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs12.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path11.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path12.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -4573,9 +4971,9 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path11.default.join(devcontainerDir, "Dockerfile");
-  const dockerfileExists = import_node_fs11.default.existsSync(dockerfilePath);
-  const dockerfile = dockerfileExists ? import_node_fs11.default.readFileSync(dockerfilePath, "utf-8") : "";
+  const dockerfilePath = import_node_path12.default.join(devcontainerDir, "Dockerfile");
+  const dockerfileExists = import_node_fs12.default.existsSync(dockerfilePath);
+  const dockerfile = dockerfileExists ? import_node_fs12.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
     (artifact) => dockerfile.includes(artifact)
   );
@@ -4630,12 +5028,12 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs11, import_node_path11, import_yaml3;
+var import_node_fs12, import_node_path12, import_yaml3;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
-    import_node_fs11 = __toESM(require("fs"));
-    import_node_path11 = __toESM(require("path"));
+    import_node_fs12 = __toESM(require("fs"));
+    import_node_path12 = __toESM(require("path"));
     import_yaml3 = __toESM(require("yaml"));
     init_managed_post_start();
   }
@@ -4643,18 +5041,18 @@ var init_devcontainer_diagnostics = __esm({
 
 // src/core/paths.ts
 function assertPathWithinRepo(filePath, repoRoot, label) {
-  const resolvedRoot = import_node_path12.default.resolve(repoRoot);
-  const resolved = import_node_path12.default.resolve(repoRoot, filePath);
-  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path12.default.sep)) {
+  const resolvedRoot = import_node_path13.default.resolve(repoRoot);
+  const resolved = import_node_path13.default.resolve(repoRoot, filePath);
+  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path13.default.sep)) {
     throw new Error(`${label} path '${filePath}' escapes the repository root.`);
   }
   return resolved;
 }
-var import_node_path12;
+var import_node_path13;
 var init_paths = __esm({
   "src/core/paths.ts"() {
     "use strict";
-    import_node_path12 = __toESM(require("path"));
+    import_node_path13 = __toESM(require("path"));
   }
 });
 
@@ -4739,11 +5137,11 @@ function reconcileRouteRunConflict(repoPath, app) {
     }
   }
 }
-var import_node_fs12;
+var import_node_fs13;
 var init_route_state = __esm({
   "src/core/route-state.ts"() {
     "use strict";
-    import_node_fs12 = __toESM(require("fs"));
+    import_node_fs13 = __toESM(require("fs"));
     init_host_routes();
     init_workspace();
   }
@@ -4909,10 +5307,10 @@ var init_routes = __esm({
 
 // src/core/managed-runtime-state.ts
 function stateKey(repoPath, workspace) {
-  return (0, import_node_crypto5.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
 function managedRuntimeStatePath(repoPath, workspace) {
-  return import_node_path13.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
+  return import_node_path14.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string") && new Set(value).size === value.length;
@@ -4975,10 +5373,10 @@ function validateState(value, repoPath, workspace) {
 }
 function readManagedRuntimeState(repoPath, workspace) {
   const statePath = managedRuntimeStatePath(repoPath, workspace);
-  if (!import_node_fs13.default.existsSync(statePath)) return void 0;
+  if (!import_node_fs14.default.existsSync(statePath)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs13.default.readFileSync(statePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs14.default.readFileSync(statePath, "utf-8"));
   } catch (error) {
     throw new Error(`Could not parse managed runtime state: ${String(error)}`);
   }
@@ -5000,13 +5398,13 @@ function markManagedRuntimeDegraded(state, transitionPhase) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
-var import_node_crypto5, import_node_fs13, import_node_path13;
+var import_node_crypto6, import_node_fs14, import_node_path14;
 var init_managed_runtime_state = __esm({
   "src/core/managed-runtime-state.ts"() {
     "use strict";
-    import_node_crypto5 = require("crypto");
-    import_node_fs13 = __toESM(require("fs"));
-    import_node_path13 = __toESM(require("path"));
+    import_node_crypto6 = require("crypto");
+    import_node_fs14 = __toESM(require("fs"));
+    import_node_path14 = __toESM(require("path"));
     init_atomic_file();
     init_router();
   }
@@ -5057,14 +5455,14 @@ function resolveComposeFiles(source, repoPath, linked) {
       "managedRuntime requires .devcontainer/devcontainer.json to define dockerComposeFile."
     );
   }
-  const directory = import_node_path14.default.join(repoPath, ".devcontainer");
+  const directory = import_node_path15.default.join(repoPath, ".devcontainer");
   const files = references.map((reference) => {
     const resolved2 = assertPathWithinRepo(
       resolveComposeReference(reference, linked),
       directory,
       "dockerComposeFile"
     );
-    if (!import_node_fs14.default.existsSync(resolved2) || !import_node_fs14.default.lstatSync(resolved2).isFile()) {
+    if (!import_node_fs15.default.existsSync(resolved2) || !import_node_fs15.default.lstatSync(resolved2).isFile()) {
       throw new Error(`Managed Dev Container compose file does not exist: ${resolved2}`);
     }
     return resolved2;
@@ -5072,7 +5470,7 @@ function resolveComposeFiles(source, repoPath, linked) {
   for (const file of files) {
     let parsed;
     try {
-      parsed = import_yaml4.default.parse(import_node_fs14.default.readFileSync(file, "utf-8"));
+      parsed = import_yaml4.default.parse(import_node_fs15.default.readFileSync(file, "utf-8"));
     } catch (error) {
       throw new Error(
         `Could not parse managed Dev Container compose file '${file}': ${String(error)}`
@@ -5083,7 +5481,7 @@ function resolveComposeFiles(source, repoPath, linked) {
     }
   }
   const fileArgs = files.flatMap((file) => ["-f", file]);
-  const resolved = (0, import_node_child_process6.spawnSync)(
+  const resolved = (0, import_node_child_process7.spawnSync)(
     "docker",
     [
       "compose",
@@ -5109,7 +5507,7 @@ function resolveComposeFiles(source, repoPath, linked) {
   return { directory, files, services: services.sort() };
 }
 function assertIgnoredGeneratedPath(repoPath, generatedPath) {
-  const ignored = (0, import_node_child_process6.spawnSync)(
+  const ignored = (0, import_node_child_process7.spawnSync)(
     "git",
     ["-C", repoPath, "check-ignore", "--quiet", "--no-index", "--", generatedPath],
     { encoding: "utf-8" }
@@ -5121,12 +5519,12 @@ function assertIgnoredGeneratedPath(repoPath, generatedPath) {
   }
 }
 function assertGeneratedPathOwnership(generatedPath) {
-  if (!import_node_fs14.default.existsSync(generatedPath)) return;
-  const stat = import_node_fs14.default.lstatSync(generatedPath);
+  if (!import_node_fs15.default.existsSync(generatedPath)) return;
+  const stat = import_node_fs15.default.lstatSync(generatedPath);
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`Managed Dev Container path '${generatedPath}' is not a regular file.`);
   }
-  const firstLine2 = import_node_fs14.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
+  const firstLine2 = import_node_fs15.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
   if (firstLine2 !== MANAGED_DEVCONTAINER_MARKER) {
     throw new Error(
       `Managed Dev Container path '${generatedPath}' exists without the devrouter ownership marker.`
@@ -5137,7 +5535,7 @@ function isWildcard(values) {
   return values?.length === 1 && values[0] === "*";
 }
 function sha256(contents) {
-  return (0, import_node_crypto6.createHash)("sha256").update(contents, "utf-8").digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(contents, "utf-8").digest("hex");
 }
 function safeComposeProject(value) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
@@ -5202,7 +5600,7 @@ function inspectManagedDevcontainerConfig(options) {
   const contents = `${MANAGED_DEVCONTAINER_MARKER}
 ${JSON.stringify(effective, null, 2)}
 `;
-  const generatedPath = import_node_path14.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
+  const generatedPath = import_node_path15.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
   assertIgnoredGeneratedPath(options.repoPath, generatedPath);
   assertGeneratedPathOwnership(generatedPath);
   return {
@@ -5229,13 +5627,13 @@ function writeManagedDevcontainerConfig(plan) {
 function inspectManagedDevcontainerGeneratedConfig(plan) {
   let stat;
   try {
-    stat = import_node_fs14.default.lstatSync(plan.generatedPath);
+    stat = import_node_fs15.default.lstatSync(plan.generatedPath);
   } catch (error) {
     if (error.code === "ENOENT") return { status: "missing" };
     throw error;
   }
   if (!stat.isFile() || stat.isSymbolicLink()) return { status: "foreign" };
-  const contents = import_node_fs14.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs15.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     return { status: "foreign" };
@@ -5247,17 +5645,17 @@ function inspectManagedDevcontainerGeneratedConfig(plan) {
   };
 }
 function removeManagedDevcontainerConfig(plan) {
-  if (!import_node_fs14.default.existsSync(plan.generatedPath)) return;
-  const stat = import_node_fs14.default.lstatSync(plan.generatedPath);
+  if (!import_node_fs15.default.existsSync(plan.generatedPath)) return;
+  const stat = import_node_fs15.default.lstatSync(plan.generatedPath);
   if (!stat.isFile()) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not a regular file.`);
   }
-  const contents = import_node_fs14.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs15.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not devrouter-owned.`);
   }
-  import_node_fs14.default.unlinkSync(plan.generatedPath);
+  import_node_fs15.default.unlinkSync(plan.generatedPath);
 }
 function assertSafeContainerId(containerId) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(containerId)) {
@@ -5284,7 +5682,7 @@ function startExactManagedServices(options) {
     delete env.DEVROUTER_GIT_COMMON_DIR;
     delete env.DEVCONTAINER_COMPOSE_OVERLAY;
   }
-  const result = (0, import_node_child_process6.spawnSync)(
+  const result = (0, import_node_child_process7.spawnSync)(
     "docker",
     [
       "compose",
@@ -5314,7 +5712,7 @@ function startExactManagedServices(options) {
 }
 function stopExactManagedService(containerId, service) {
   assertSafeContainerId(containerId);
-  const result = (0, import_node_child_process6.spawnSync)("docker", ["stop", containerId], {
+  const result = (0, import_node_child_process7.spawnSync)("docker", ["stop", containerId], {
     encoding: "utf-8",
     stdio: "inherit"
   });
@@ -5322,14 +5720,14 @@ function stopExactManagedService(containerId, service) {
     throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
   }
 }
-var import_node_child_process6, import_node_crypto6, import_node_fs14, import_node_path14, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var import_node_child_process7, import_node_crypto7, import_node_fs15, import_node_path15, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
 var init_devcontainer_profile = __esm({
   "src/core/devcontainer-profile.ts"() {
     "use strict";
-    import_node_child_process6 = require("child_process");
-    import_node_crypto6 = require("crypto");
-    import_node_fs14 = __toESM(require("fs"));
-    import_node_path14 = __toESM(require("path"));
+    import_node_child_process7 = require("child_process");
+    import_node_crypto7 = require("crypto");
+    import_node_fs15 = __toESM(require("fs"));
+    import_node_path15 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
     init_atomic_file();
     init_devcontainer_config();
@@ -5343,7 +5741,7 @@ var init_devcontainer_profile = __esm({
 function inspectWorkspaceContainers(options) {
   let ids = options?.ids;
   if (!ids) {
-    const listed = (0, import_node_child_process7.spawnSync)(
+    const listed = (0, import_node_child_process8.spawnSync)(
       "docker",
       [
         "ps",
@@ -5363,7 +5761,7 @@ function inspectWorkspaceContainers(options) {
   }
   if (ids.length === 0) return [];
   const template = options?.withSize ? SIZE_INSPECT_TEMPLATE : SAFE_INSPECT_TEMPLATE;
-  const inspected = (0, import_node_child_process7.spawnSync)(
+  const inspected = (0, import_node_child_process8.spawnSync)(
     "docker",
     ["inspect", ...options?.withSize ? ["--size"] : [], "--format", template, ...ids],
     { encoding: "utf-8" }
@@ -5378,7 +5776,7 @@ function inspectWorkspaceContainers(options) {
 function workspaceAppContainers(containers, repoPath) {
   return containers.filter((container) => {
     const workingDir = container.labels["com.docker.compose.project.working_dir"];
-    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path15.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
+    return Boolean(workingDir && sameWorkspacePath(workingDir, import_node_path16.default.join(repoPath, ".devcontainer"))) && container.mounts.some(
       (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
     );
   });
@@ -5386,7 +5784,7 @@ function workspaceAppContainers(containers, repoPath) {
 function hasExactComposeIdentity(container, options) {
   if (options.composeProject !== void 0 && container.labels["com.docker.compose.project"] !== options.composeProject || container.labels["com.docker.compose.service"] !== options.service || !sameWorkspacePath(
     container.labels["com.docker.compose.project.working_dir"] ?? "",
-    import_node_path15.default.join(options.repoPath, ".devcontainer")
+    import_node_path16.default.join(options.repoPath, ".devcontainer")
   )) {
     return false;
   }
@@ -5423,12 +5821,12 @@ function resolveRunningWorkspaceContainer(repoPath) {
   }
   return { id: container.id, workspacePath: repoMount.Destination };
 }
-var import_node_child_process7, import_node_path15, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
+var import_node_child_process8, import_node_path16, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
 var init_devpod_environment = __esm({
   "src/core/devpod-environment.ts"() {
     "use strict";
-    import_node_child_process7 = require("child_process");
-    import_node_path15 = __toESM(require("path"));
+    import_node_child_process8 = require("child_process");
+    import_node_path16 = __toESM(require("path"));
     init_workspace();
     SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.service":{{json (index .Config.Labels "com.docker.compose.service")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
     SIZE_INSPECT_TEMPLATE = SAFE_INSPECT_TEMPLATE.replace(
@@ -5882,7 +6280,7 @@ function toRepoStatus(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
   const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
-  const configExists = import_node_fs15.default.existsSync(configPath);
+  const configExists = import_node_fs16.default.existsSync(configPath);
   if (!explicitRepo && !configExists) {
     return void 0;
   }
@@ -6030,11 +6428,11 @@ async function collectRouterStatus(repoPath) {
     }
   };
 }
-var import_node_fs15;
+var import_node_fs16;
 var init_status = __esm({
   "src/core/status.ts"() {
     "use strict";
-    import_node_fs15 = __toESM(require("fs"));
+    import_node_fs16 = __toESM(require("fs"));
     init_docker();
     init_managed_runtime_state();
     init_managed_runtime_status();
@@ -6045,7 +6443,7 @@ var init_status = __esm({
 
 // src/core/tls.ts
 function runOrThrow(command, args) {
-  const result = (0, import_node_child_process8.spawnSync)(command, args, {
+  const result = (0, import_node_child_process9.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -6055,7 +6453,7 @@ function runOrThrow(command, args) {
   return result.stdout.trim();
 }
 function commandExists(command) {
-  const result = (0, import_node_child_process8.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
+  const result = (0, import_node_child_process9.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
   return result.status === 0;
 }
 function ensureMkcert() {
@@ -6073,8 +6471,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path16.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs16.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path17.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs17.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -6107,7 +6505,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto7.X509Certificate(pem);
+  const certificate = new import_node_crypto8.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -6175,11 +6573,11 @@ function compactTLSCertificateHosts(hosts) {
   );
 }
 function readCurrentCertificateHosts(options = {}) {
-  if (!import_node_fs16.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs17.default.existsSync(CERT_FILE)) {
     return [];
   }
   try {
-    const pem = import_node_fs16.default.readFileSync(CERT_FILE, "utf-8");
+    const pem = import_node_fs17.default.readFileSync(CERT_FILE, "utf-8");
     return parseCertificateDnsHosts(pem);
   } catch (error) {
     if (options.replaceMalformed) {
@@ -6307,20 +6705,20 @@ Run: ${tlsSetupCommand(options.repoPath)}`
     );
   }
 }
-var import_node_child_process8, import_node_crypto7, import_node_fs16, import_node_path16, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
+var import_node_child_process9, import_node_crypto8, import_node_fs17, import_node_path17, DEFAULT_TLS_CERT_HOSTS, TLS_CERTIFICATE_LOCK_FILE, TLS_CERTIFICATE_LOCK_WAIT_MS, TLS_CERTIFICATE_WRITE_ATTEMPTS;
 var init_tls = __esm({
   "src/core/tls.ts"() {
     "use strict";
-    import_node_child_process8 = require("child_process");
-    import_node_crypto7 = require("crypto");
-    import_node_fs16 = __toESM(require("fs"));
-    import_node_path16 = __toESM(require("path"));
+    import_node_child_process9 = require("child_process");
+    import_node_crypto8 = require("crypto");
+    import_node_fs17 = __toESM(require("fs"));
+    import_node_path17 = __toESM(require("path"));
     init_docker();
     init_file_lock();
     init_host_routes();
     init_router();
     DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
-    TLS_CERTIFICATE_LOCK_FILE = import_node_path16.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+    TLS_CERTIFICATE_LOCK_FILE = import_node_path17.default.join(DEVROUTER_HOME, "tls-certificate.lock");
     TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
     TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
   }
@@ -6328,7 +6726,7 @@ var init_tls = __esm({
 
 // src/core/devpod-registry.ts
 function listDevpodWorkspacesRaw() {
-  const result = (0, import_node_child_process9.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
+  const result = (0, import_node_child_process10.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -6363,17 +6761,17 @@ function listDevpodWorkspacesRaw() {
     return workspace;
   });
 }
-var import_node_child_process9;
+var import_node_child_process10;
 var init_devpod_registry = __esm({
   "src/core/devpod-registry.ts"() {
     "use strict";
-    import_node_child_process9 = require("child_process");
+    import_node_child_process10 = require("child_process");
   }
 });
 
 // src/core/devsy-workspaces.ts
 function listDevsyWorkspaces() {
-  const result = (0, import_node_child_process10.spawnSync)(
+  const result = (0, import_node_child_process11.spawnSync)(
     "devsy",
     ["workspace", "list", "--result-format", "json", "--skip-pro"],
     {
@@ -6439,7 +6837,7 @@ function parseDevsyRuntimeStatus(output2, expectedId) {
   }
 }
 function inspectDevsyRuntimeStatus(devsyId) {
-  const result = (0, import_node_child_process10.spawnSync)("devsy", ["workspace", "status", devsyId, "--result-format", "json"], {
+  const result = (0, import_node_child_process11.spawnSync)("devsy", ["workspace", "status", devsyId, "--result-format", "json"], {
     encoding: "utf-8",
     timeout: 1e4
   });
@@ -6472,11 +6870,11 @@ function selectDevsyWorkspace(workspaces, repoPath) {
   }
   return matches[0];
 }
-var import_node_child_process10;
+var import_node_child_process11;
 var init_devsy_workspaces = __esm({
   "src/core/devsy-workspaces.ts"() {
     "use strict";
-    import_node_child_process10 = require("child_process");
+    import_node_child_process11 = require("child_process");
     init_workspace();
   }
 });
@@ -6493,13 +6891,13 @@ function parseWorkspaceRuntime(value) {
 }
 function isRuntimeInstalled(runtime) {
   const probeArgs = runtime === "devsy" ? ["--version"] : ["version"];
-  const probe = (0, import_node_child_process11.spawnSync)(runtime, probeArgs, { encoding: "utf-8" });
+  const probe = (0, import_node_child_process12.spawnSync)(runtime, probeArgs, { encoding: "utf-8" });
   return probe.status === 0 && !probe.error;
 }
 function readWorkspaceRuntimeConfig() {
   let raw;
   try {
-    raw = JSON.parse(import_node_fs17.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8"));
+    raw = JSON.parse(import_node_fs18.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8"));
   } catch {
     return {};
   }
@@ -6520,7 +6918,7 @@ function readWorkspaceRuntimeConfig() {
 function inspectWorkspaceRuntimeConfig() {
   let rawText;
   try {
-    rawText = import_node_fs17.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8");
+    rawText = import_node_fs18.default.readFileSync(RUNTIME_CONFIG_FILE, "utf-8");
   } catch {
     return { exists: false, config: {}, problems: [] };
   }
@@ -6571,7 +6969,7 @@ function writeWorkspaceRuntimeConfig(config) {
     }
     next.devsyInactivityTimeout = timeout;
   }
-  import_node_fs17.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs18.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   writeFileAtomically(RUNTIME_CONFIG_FILE, `${JSON.stringify(next, null, 2)}
 `);
 }
@@ -6679,20 +7077,20 @@ function resetWorkspaceRuntimeCaches() {
   cachedRuntime = void 0;
   cachedSnapshots = void 0;
 }
-var import_node_child_process11, import_node_fs17, import_node_path17, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
+var import_node_child_process12, import_node_fs18, import_node_path18, SUPPORTED_RUNTIMES2, RUNTIME_CONFIG_FILE, INACTIVITY_TIMEOUT_PATTERN, cachedRuntime, cachedSnapshots, UnsupportedWorkspaceRuntimeError, WorkspaceRuntimeOwnershipError;
 var init_workspace_runtime = __esm({
   "src/core/workspace-runtime.ts"() {
     "use strict";
-    import_node_child_process11 = require("child_process");
-    import_node_fs17 = __toESM(require("fs"));
-    import_node_path17 = __toESM(require("path"));
+    import_node_child_process12 = require("child_process");
+    import_node_fs18 = __toESM(require("fs"));
+    import_node_path18 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_registry();
     init_devsy_workspaces();
     init_router();
     init_workspace();
     SUPPORTED_RUNTIMES2 = ["devpod", "devsy"];
-    RUNTIME_CONFIG_FILE = import_node_path17.default.join(DEVROUTER_HOME, "workspace-runtime.json");
+    RUNTIME_CONFIG_FILE = import_node_path18.default.join(DEVROUTER_HOME, "workspace-runtime.json");
     INACTIVITY_TIMEOUT_PATTERN = /^(?:\d+(?:ms|s|m|h))+$/;
     UnsupportedWorkspaceRuntimeError = class extends Error {
     };
@@ -6713,7 +7111,7 @@ function outputFromResult(result) {
   return output2.length > 0 ? output2 : void 0;
 }
 function runTool(command, args = []) {
-  const result = (0, import_node_child_process12.spawnSync)(command, args, {
+  const result = (0, import_node_child_process13.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.error) {
@@ -6770,12 +7168,12 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path18.default.join(repoPath, "package.json");
-  if (!import_node_fs18.default.existsSync(packagePath)) {
+  const packagePath = import_node_path19.default.join(repoPath, "package.json");
+  if (!import_node_fs19.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs18.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs19.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -6840,7 +7238,44 @@ function nodeToolchainCheck(repoPath) {
     details: details.join(", ")
   };
 }
+function devsyAgentCheck(inspection) {
+  const details = [
+    `state=${inspection.state}`,
+    `source=${inspection.source}`,
+    ...inspection.installedVersion ? [`version=${inspection.installedVersion}`] : [],
+    ...inspection.asset ? [`asset=${inspection.asset.name}`] : []
+  ].join(", ");
+  if (inspection.state === "ready") {
+    return {
+      id: "global.devsy-agent",
+      level: "ok",
+      summary: "Devsy agent source is ready.",
+      details
+    };
+  }
+  const summary = inspection.state === "missing" ? "Managed Devsy agent source is missing." : inspection.state === "stale" ? "Devsy agent source is stale for this Devrouter release." : "Devsy agent source is invalid.";
+  return {
+    id: "global.devsy-agent",
+    level: "error",
+    summary,
+    details: `${details}, ${inspection.reason}`,
+    suggestion: devsyAgentRepairSuggestion(inspection)
+  };
+}
 function buildGlobalToolChecks(repoPath) {
+  const previous = process.env[DEVSY_DISABLE_TELEMETRY];
+  process.env[DEVSY_DISABLE_TELEMETRY] = "true";
+  try {
+    return buildGlobalToolChecksWithoutTelemetry(repoPath);
+  } finally {
+    if (previous === void 0) {
+      delete process.env[DEVSY_DISABLE_TELEMETRY];
+    } else {
+      process.env[DEVSY_DISABLE_TELEMETRY] = previous;
+    }
+  }
+}
+function buildGlobalToolChecksWithoutTelemetry(repoPath) {
   const checks = [];
   const compose = runTool("docker", ["compose", "version"]);
   checks.push({
@@ -6894,6 +7329,13 @@ function buildGlobalToolChecks(repoPath) {
     ].filter(Boolean).join(", "),
     suggestion: runtimeTool.ok ? void 0 : workspaceRuntime === "devsy" ? "Install Devsy for devcontainer workspace flows: brew install devsy-org/homebrew-tap/devsy" : "Install DevPod for devcontainer workspace flows: brew install devpod"
   });
+  if (workspaceRuntime === "devsy") {
+    checks.push(
+      devsyAgentCheck(
+        inspectDevsyAgent({ versionOutput: runtimeTool.ok ? runtimeTool.output : "" })
+      )
+    );
+  }
   const configProblems = [...configInspection.problems];
   const machineResolvedDevpod = workspaceRuntime === "devpod" && (runtimeResolution.source === "auto-detect" || runtimeResolution.source === "default");
   if (machineConfig.devsyInactivityTimeout && machineResolvedDevpod) {
@@ -6915,14 +7357,16 @@ function buildGlobalToolChecks(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process12, import_node_fs18, import_node_path18;
+var import_node_child_process13, import_node_fs19, import_node_path19, DEVSY_DISABLE_TELEMETRY;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
-    import_node_child_process12 = require("child_process");
-    import_node_fs18 = __toESM(require("fs"));
-    import_node_path18 = __toESM(require("path"));
+    import_node_child_process13 = require("child_process");
+    import_node_fs19 = __toESM(require("fs"));
+    import_node_path19 = __toESM(require("path"));
+    init_devsy_agent();
     init_workspace_runtime();
+    DEVSY_DISABLE_TELEMETRY = "DEVSY_DISABLE_TELEMETRY";
   }
 });
 
@@ -6991,7 +7435,7 @@ function inspectDevpodRuntimeStatus(devpodId, repoPath) {
   if (resolveWorkspaceRuntimeOrDefault(repoPath) === "devsy") {
     return inspectDevsyRuntimeStatus(devpodId);
   }
-  const result = (0, import_node_child_process13.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
+  const result = (0, import_node_child_process14.spawnSync)("devpod", ["status", devpodId, "--output", "json", "--timeout", "5s"], {
     encoding: "utf-8"
   });
   if (result.status !== 0 || result.error) return "unknown";
@@ -7024,11 +7468,11 @@ function selectDevpodWorkspace(workspaces, repoPath) {
   }
   return matches[0];
 }
-var import_node_child_process13;
+var import_node_child_process14;
 var init_devpod_workspaces = __esm({
   "src/core/devpod-workspaces.ts"() {
     "use strict";
-    import_node_child_process13 = require("child_process");
+    import_node_child_process14 = require("child_process");
     init_devpod_registry();
     init_devsy_workspaces();
     init_workspace();
@@ -7048,7 +7492,7 @@ function failedStartMayHaveAttached(devsyId, repoPath) {
   }
 }
 function withMutationLock(activity, target, operation) {
-  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -7062,7 +7506,7 @@ function withMutationLock(activity, target, operation) {
   );
 }
 function withMutationLockAsync(activity, target, operation) {
-  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -7080,7 +7524,7 @@ function commandFailure2(result) {
 }
 function runDevsyUp(args, env, quiet) {
   return new Promise((resolve) => {
-    const child = (0, import_node_child_process14.spawn)("devsy", args, {
+    const child = (0, import_node_child_process15.spawn)("devsy", args, {
       stdio: ["inherit", quiet ? 2 : "inherit", "pipe"],
       env
     });
@@ -7112,7 +7556,7 @@ function runDevsyUp(args, env, quiet) {
 }
 function runDevsyAction(action2, devsyId, force = false) {
   const args = action2 === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
-  const result = (0, import_node_child_process14.spawnSync)("devsy", ["workspace", ...args], { encoding: "utf-8" });
+  const result = (0, import_node_child_process15.spawnSync)("devsy", ["workspace", ...args], { encoding: "utf-8" });
   if (result.status !== 0) {
     throw new Error(
       `devsy workspace ${action2}${force ? " --force" : ""} failed for '${devsyId}': ${commandFailure2(result) || "unknown error"}`
@@ -7172,8 +7616,16 @@ function assertDevsyTarget(devsyId, repoPath) {
   }
   return id;
 }
-function startDevsyWorkspace(options) {
+async function startDevsyWorkspace(options) {
   const activity = options.recreate ? "Devsy recreate" : "Devsy start";
+  let agent;
+  try {
+    agent = requireReadyDevsyAgent();
+  } catch (error) {
+    if (!(error instanceof DevsyAgentReadinessError)) throw error;
+    const repair = devsyAgentRepairSuggestion(error.inspection);
+    throw new Error(`${error.message}. ${repair}`);
+  }
   return withMutationLockAsync(activity, options.repoPath, async () => {
     let devsyId = assertDevsyTarget(options.devsyId, options.repoPath);
     if (devsyId && options.recreate) {
@@ -7203,6 +7655,7 @@ function startDevsyWorkspace(options) {
     }
     if (options.recreate) args.push("--recreate");
     const env = { ...process.env };
+    env.DEVSY_AGENT_BINARY = agent.binaryPath;
     if (options.workspace) {
       env.WORKSPACE = options.workspace.token;
       env.DEVROUTER_WORKSPACE = options.workspace.token;
@@ -7219,7 +7672,7 @@ function startDevsyWorkspace(options) {
       let message = `devsy workspace up failed for '${devsyId ?? options.repoPath}'.`;
       if (result.error?.message) message += ` ${result.error.message}`;
       if (AGENT_ACQUISITION_RE.test(result.stderrTail)) {
-        message += " Devsy could not obtain its agent binary; allow Devsy to download it or set DEVSY_AGENT_BINARY to a verified official Devsy agent binary matching this platform and Devsy version.";
+        message += ` Devsy rejected the verified agent source. Run: ${DEVSY_AGENT_SETUP_COMMAND}`;
       }
       if (failedStartMayHaveAttached(devsyId, options.repoPath)) {
         throw new DevsyStartPostconditionError(message);
@@ -7246,17 +7699,18 @@ function startDevsyWorkspace(options) {
     }
   });
 }
-var import_node_child_process14, import_node_fs19, import_node_path19, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError, AGENT_ACQUISITION_RE, DEVSY_STDERR_TAIL_BYTES;
+var import_node_child_process15, import_node_fs20, import_node_path20, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError, AGENT_ACQUISITION_RE, DEVSY_STDERR_TAIL_BYTES;
 var init_devsy_mutation = __esm({
   "src/core/devsy-mutation.ts"() {
     "use strict";
-    import_node_child_process14 = require("child_process");
-    import_node_fs19 = __toESM(require("fs"));
-    import_node_path19 = __toESM(require("path"));
+    import_node_child_process15 = require("child_process");
+    import_node_fs20 = __toESM(require("fs"));
+    import_node_path20 = __toESM(require("path"));
+    init_devsy_agent();
     init_devsy_workspaces();
     init_file_lock();
     init_router();
-    DEVSY_MUTATION_LOCK_FILE = import_node_path19.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_LOCK_FILE = import_node_path20.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
     DEVSY_MUTATION_WAIT_MS = 18e5;
     DevsyStartPostconditionError = class extends Error {
     };
@@ -7267,7 +7721,7 @@ var init_devsy_mutation = __esm({
 
 // src/core/devpod-mutation.ts
 function withMutationLock2(activity, target, operation) {
-  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -7285,7 +7739,7 @@ function commandFailure3(result) {
 }
 function runDevpodAction(action2, devpodId, force = false) {
   const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
-  const result = (0, import_node_child_process15.spawnSync)("devpod", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process16.spawnSync)("devpod", args, { encoding: "utf-8" });
   if (result.status !== 0) {
     throw new Error(
       `devpod ${action2}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure3(result) || "unknown error"}`
@@ -7413,7 +7867,7 @@ async function startDevpodWorkspace(options) {
       delete env.DEVROUTER_GIT_COMMON_DIR;
       delete env.DEVCONTAINER_COMPOSE_OVERLAY;
     }
-    const result = (0, import_node_child_process15.spawnSync)("devpod", args, {
+    const result = (0, import_node_child_process16.spawnSync)("devpod", args, {
       stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
       env
     });
@@ -7441,19 +7895,19 @@ async function startDevpodWorkspace(options) {
     }
   });
 }
-var import_node_child_process15, import_node_fs20, import_node_path20, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
+var import_node_child_process16, import_node_fs21, import_node_path21, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
-    import_node_child_process15 = require("child_process");
-    import_node_fs20 = __toESM(require("fs"));
-    import_node_path20 = __toESM(require("path"));
+    import_node_child_process16 = require("child_process");
+    import_node_fs21 = __toESM(require("fs"));
+    import_node_path21 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
     init_file_lock();
     init_router();
     init_workspace_runtime();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path20.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path21.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
     DEVPOD_MUTATION_WAIT_MS = 18e5;
     DevpodStartPostconditionError = class extends Error {
     };
@@ -7467,7 +7921,7 @@ function commandError(command, repoPath, stderr) {
   );
 }
 function resolveGitCommonDir(repoPath) {
-  const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
+  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -7475,10 +7929,10 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output2) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path21.default.isAbsolute(output2) ? output2 : import_node_path21.default.resolve(repoPath, output2));
+  return comparableWorkspacePath(import_node_path22.default.isAbsolute(output2) ? output2 : import_node_path22.default.resolve(repoPath, output2));
 }
 function resolveGitTopLevel(repoPath) {
-  const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
+  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -7489,7 +7943,7 @@ function resolveGitTopLevel(repoPath) {
   return comparableWorkspacePath(output2);
 }
 function listGitWorktrees(repoPath) {
-  const result = (0, import_node_child_process16.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
+  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
     encoding: "utf-8",
     env: READ_ONLY_GIT_ENV
   });
@@ -7526,7 +7980,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path21.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path22.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -7554,7 +8008,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path21.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path22.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -7574,7 +8028,7 @@ function validateRecord(value, expectedWorkspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs21.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs22.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -7590,7 +8044,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs21.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs22.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -7598,14 +8052,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path21.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path22.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input2) {
   const workspace = validateWorkspace(input2.workspace, "workspace");
   const devpodId = validateWorkspace(input2.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path21.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path22.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record2) => record2.workspace === workspace);
@@ -7641,9 +8095,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input2) {
   return record;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path21.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path22.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs21.default.rmSync(filePath);
+    import_node_fs22.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -7654,7 +8108,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path21.default.join(
+  const filePath = import_node_path22.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -7666,14 +8120,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs21.default.rmSync(filePath);
+  import_node_fs22.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs21.default.mkdirSync(directory, { recursive: true });
+  import_node_fs22.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path21.default.join(directory, ".lock"),
+    import_node_path22.default.join(directory, ".lock"),
     {
       activity: "workspace ownership transaction",
       target: `'${repoPath}'`,
@@ -7706,7 +8160,7 @@ function persistedWorkspaceOwners(repoPath, worktreePath) {
     try {
       workspace = readPersistedWorkspace(worktree.path);
     } catch (error) {
-      if (!import_node_fs21.default.existsSync(worktree.path)) continue;
+      if (!import_node_fs22.default.existsSync(worktree.path)) continue;
       throw error;
     }
     if (!workspace) continue;
@@ -7869,7 +8323,7 @@ function inspectWorkspaceOwnership(record, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs21.default.existsSync(record.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs22.default.existsSync(record.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -7893,20 +8347,20 @@ function listMissingWorkspaceOwnership(repoPath) {
     (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
   );
 }
-var import_node_child_process16, import_node_fs21, import_node_path21, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var import_node_child_process17, import_node_fs22, import_node_path22, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
 var init_workspace_ownership = __esm({
   "src/core/workspace-ownership.ts"() {
     "use strict";
-    import_node_child_process16 = require("child_process");
-    import_node_fs21 = __toESM(require("fs"));
-    import_node_path21 = __toESM(require("path"));
+    import_node_child_process17 = require("child_process");
+    import_node_fs22 = __toESM(require("fs"));
+    import_node_path22 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_workspaces();
     init_file_lock();
     init_workspace();
     READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
     OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path21.default.join("devrouter", "workspaces");
+    OWNERSHIP_DIR = import_node_path22.default.join("devrouter", "workspaces");
   }
 });
 
@@ -7920,10 +8374,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path22.default.join(comparableRepo, "trees") + import_node_path22.default.sep;
+  const localRoot = import_node_path23.default.join(comparableRepo, "trees") + import_node_path23.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path22.default.basename(comparableRepo)}-`;
-  return import_node_path22.default.dirname(comparableWorktree) === import_node_path22.default.dirname(comparableRepo) && import_node_path22.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path23.default.basename(comparableRepo)}-`;
+  return import_node_path23.default.dirname(comparableWorktree) === import_node_path23.default.dirname(comparableRepo) && import_node_path23.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -8175,11 +8629,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path22;
+var import_node_path23;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path22 = __toESM(require("path"));
+    import_node_path23 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -8249,11 +8703,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs22.default.existsSync(absolutePath)) {
+      if (!import_node_fs23.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs22.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs23.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml5.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -8532,7 +8986,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.46" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.48" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -8562,9 +9016,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path23.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path24.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs22.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs23.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -8607,8 +9061,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path23.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs22.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path24.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs23.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -8752,12 +9206,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs22, import_node_path23, import_yaml5, POSTGRES_DEFAULTS;
+var import_node_fs23, import_node_path24, import_yaml5, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs22 = __toESM(require("fs"));
-    import_node_path23 = __toESM(require("path"));
+    import_node_fs23 = __toESM(require("fs"));
+    import_node_path24 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -8864,11 +9318,13 @@ async function runSetup(options = {}) {
       })
     );
   }
+  let requestedWorkspaceRuntime;
   if (options.workspaceRuntime !== void 0 || options.devsyInactivityTimeout !== void 0) {
     try {
       const existing = readWorkspaceRuntimeConfig();
+      requestedWorkspaceRuntime = options.workspaceRuntime ? parseWorkspaceRuntime(options.workspaceRuntime) : void 0;
       const next = {
-        runtime: options.workspaceRuntime ? parseWorkspaceRuntime(options.workspaceRuntime) : existing.runtime,
+        runtime: requestedWorkspaceRuntime ?? existing.runtime,
         devsyInactivityTimeout: options.devsyInactivityTimeout ?? existing.devsyInactivityTimeout
       };
       writeWorkspaceRuntimeConfig(next);
@@ -8890,6 +9346,28 @@ async function runSetup(options = {}) {
       );
     }
   }
+  if (requestedWorkspaceRuntime === "devsy") {
+    try {
+      const prepared = await prepareDevsyAgent();
+      actions.push(
+        action(prepared.changed ? "performed" : "skipped", {
+          id: "global.devsy-agent",
+          summary: prepared.changed ? `Downloaded and verified ${prepared.asset.name} for Devsy.` : `Verified the ${prepared.source} Devsy agent source.`,
+          details: `version=${SUPPORTED_DEVSY_VERSION}, asset=${prepared.asset.name}, source=${prepared.source}, transport=${prepared.transport}`
+        })
+      );
+    } catch (error) {
+      const details = error instanceof DevsyAgentReadinessError ? `state=${error.inspection.state}, source=${error.inspection.source}, ${error.inspection.reason}` : error instanceof Error ? error.message : String(error);
+      actions.push(
+        action("failed", {
+          id: "global.devsy-agent",
+          summary: "Failed to prepare a verified Devsy agent source.",
+          details,
+          suggestion: error instanceof DevsyAgentReadinessError ? devsyAgentRepairSuggestion(error.inspection) : `Run: ${DEVSY_AGENT_SETUP_COMMAND}`
+        })
+      );
+    }
+  }
   try {
     const existed = await networkExists(DEVNET_NAME);
     await ensureNetwork(DEVNET_NAME);
@@ -8979,6 +9457,7 @@ async function runSetup(options = {}) {
 var init_setup = __esm({
   "src/core/setup.ts"() {
     "use strict";
+    init_devsy_agent();
     init_docker();
     init_doctor();
     init_repo_config();
@@ -9047,12 +9526,12 @@ function parseSsPortListeners(stdout, port) {
   return listeners;
 }
 function findPortListeners(port) {
-  const result = (0, import_node_child_process17.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+  const result = (0, import_node_child_process18.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process17.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process18.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsPortListeners(ssResult.stdout, port);
       }
@@ -9081,11 +9560,11 @@ function findPortListeners(port) {
     };
   });
 }
-var import_node_child_process17;
+var import_node_child_process18;
 var init_ports = __esm({
   "src/util/ports.ts"() {
     "use strict";
-    import_node_child_process17 = require("child_process");
+    import_node_child_process18 = require("child_process");
   }
 });
 
@@ -9162,18 +9641,18 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process18.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process19.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
   const details = ok ? `HTTP ${status}` : [status === void 0 ? void 0 : `HTTP ${status}`, result.stderr?.trim()].filter(Boolean).join(": ") || `curl exited with status ${result.status ?? "unknown"}`;
   return { ok, status, details };
 }
-var import_node_child_process18;
+var import_node_child_process19;
 var init_http_route_probe = __esm({
   "src/core/http-route-probe.ts"() {
     "use strict";
-    import_node_child_process18 = require("child_process");
+    import_node_child_process19 = require("child_process");
     init_router();
     init_tls();
   }
@@ -9249,14 +9728,135 @@ var init_route_publication = __esm({
   }
 });
 
+// src/core/traefik-route-health.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function inspectRouterApi(protocol) {
+  const result = (0, import_node_child_process20.spawnSync)(
+    "curl",
+    [
+      "--silent",
+      "--show-error",
+      "--fail",
+      "--max-time",
+      "2",
+      `${ROUTER_API_BASE}/${protocol}/routers`
+    ],
+    { encoding: "utf-8" }
+  );
+  if (result.status !== 0) {
+    return {
+      ok: false,
+      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
+    };
+  }
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
+  }
+  if (!Array.isArray(value)) {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
+  }
+  return {
+    ok: true,
+    names: new Set(
+      value.flatMap((item) => {
+        if (!item || typeof item !== "object") return [];
+        const name = item.name;
+        return typeof name === "string" ? [name] : [];
+      })
+    )
+  };
+}
+function inspectExpectedRoutes(routes) {
+  const missing = [];
+  const failures = [];
+  for (const protocol of ["http", "tcp"]) {
+    const expected = routes.filter((route) => (route.protocol ?? "http") === protocol).map((route) => buildHostRouteRouterName(route.repoPath, route.name));
+    if (expected.length === 0) continue;
+    const result = inspectRouterApi(protocol);
+    if (!result.ok) {
+      failures.push(result.details);
+      missing.push(...expected);
+      continue;
+    }
+    missing.push(...expected.filter((name) => !result.names.has(name)));
+  }
+  return missing.length === 0 ? { ok: true } : {
+    ok: false,
+    missing,
+    details: failures.length > 0 ? failures.join("; ") : "router names are absent"
+  };
+}
+async function waitForExpectedRoutes(routes, timeoutMs, pollIntervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  let result;
+  do {
+    result = inspectExpectedRoutes(routes);
+    if (result.ok) return result;
+    if (Date.now() < deadline) {
+      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
+    }
+  } while (Date.now() < deadline);
+  return result;
+}
+async function ensureTraefikRoutesLoaded(routes, options = {}) {
+  if (routes.length === 0) return { restarted: false };
+  const initialTimeoutMs = options.initialTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
+  const recoveryTimeoutMs = options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS;
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const initial = await waitForExpectedRoutes(routes, initialTimeoutMs, pollIntervalMs);
+  if (initial.ok) return { restarted: false };
+  import_node_fs24.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLock(
+    ROUTER_RELOAD_LOCK_FILE,
+    {
+      activity: "Traefik route reload recovery",
+      waitMs: initialTimeoutMs + recoveryTimeoutMs + 1e4,
+      fair: true,
+      onWait: createStderrWaitReporter("Traefik route reload recovery", "shared router")
+    },
+    async () => {
+      const recheck = await waitForExpectedRoutes(routes, 0, pollIntervalMs);
+      if (recheck.ok) return { restarted: false };
+      restartRouterStack();
+      const recovered = await waitForExpectedRoutes(routes, recoveryTimeoutMs, pollIntervalMs);
+      if (recovered.ok) return { restarted: true };
+      throw new Error(
+        `Traefik did not load file-provider routes after one restart: ${recovered.missing.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
+      );
+    }
+  );
+}
+var import_node_child_process20, import_node_fs24, import_node_path25, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS;
+var init_traefik_route_health = __esm({
+  "src/core/traefik-route-health.ts"() {
+    "use strict";
+    import_node_child_process20 = require("child_process");
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path25 = __toESM(require("path"));
+    init_file_lock();
+    init_host_routes();
+    init_router();
+    ROUTER_API_BASE = "http://127.0.0.1:8080/api";
+    ROUTER_RELOAD_LOCK_FILE = import_node_path25.default.join(DEVROUTER_HOME, "router-reload.lock");
+    DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
+    DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
+    DEFAULT_POLL_INTERVAL_MS = 250;
+  }
+});
+
 // src/core/workspace-ensure.ts
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path24.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path24.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -9330,7 +9930,7 @@ async function waitForManagedServices(plan, repoPath, composeProject, expectedSe
     } catch (error) {
       lastError = error;
     }
-    if (Date.now() < deadline) await sleep(POLL_INTERVAL_MS);
+    if (Date.now() < deadline) await sleep2(POLL_INTERVAL_MS);
   } while (Date.now() < deadline);
   throw lastError instanceof Error ? lastError : new Error(String(lastError));
 }
@@ -9439,7 +10039,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path24.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -9533,7 +10133,7 @@ function validateWorkspaceContainers(containers, options) {
   }
   return { id: appContainer.id, workspacePath: repoMount.Destination };
 }
-function sleep(ms) {
+function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeoutMs) {
@@ -9547,7 +10147,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process19.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process21.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8" }
@@ -9557,7 +10157,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process19.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process21.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8" }
@@ -9568,7 +10168,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process19.spawnSync)(
+      const gitCheck = (0, import_node_child_process21.spawnSync)(
         "docker",
         [
           "exec",
@@ -9589,7 +10189,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
       lastError = error;
     }
     if (Date.now() < deadline) {
-      await sleep(POLL_INTERVAL_MS);
+      await sleep2(POLL_INTERVAL_MS);
     }
   } while (Date.now() < deadline);
   throw lastError instanceof Error ? lastError : new Error(String(lastError));
@@ -9614,7 +10214,7 @@ async function waitForHttpRoutes(repoPath, apps, timeoutMs) {
       return;
     }
     if (Date.now() < deadline) {
-      await sleep(POLL_INTERVAL_MS);
+      await sleep2(POLL_INTERVAL_MS);
     }
   } while (Date.now() < deadline);
   throw new Error(
@@ -9660,14 +10260,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs23.default.statSync(import_node_path24.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs25.default.statSync(import_node_path26.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process19.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process21.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -9706,12 +10306,16 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     let managedConfigWritten = false;
     let managedWorkspaceEnv;
     let firstTransitionBaseline;
+    const routeLoadOptions = {
+      initialTimeoutMs: Math.min(options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS, 3e3),
+      recoveryTimeoutMs: Math.min(options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS, 1e4)
+    };
     try {
       const target = linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path24.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs23.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs25.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -9781,7 +10385,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path24.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path26.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -9945,6 +10549,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         target.workspace
       );
       candidateRoutesPublished = true;
+      await ensureTraefikRoutesLoaded(publication.routes, routeLoadOptions);
       try {
         await waitForHttpRoutes(
           repoPath,
@@ -9968,6 +10573,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         });
         recreated = true;
         replaceHostRoutesForRepo(repoPath, publication.routes);
+        await ensureTraefikRoutesLoaded(publication.routes, routeLoadOptions);
         await waitForHttpRoutes(
           repoPath,
           apps,
@@ -10141,7 +10747,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         }
         if (candidateRoutesPublished) {
           try {
-            replaceHostRoutesForRepo(repoPath, previousRoutes.map(routeInputFromState));
+            const rollbackRoutes = previousRoutes.map(routeInputFromState);
+            replaceHostRoutesForRepo(repoPath, rollbackRoutes);
+            await ensureTraefikRoutesLoaded(rollbackRoutes, routeLoadOptions);
           } catch (rollbackError) {
             rollbackErrors.push(
               `routes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
@@ -10184,7 +10792,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         }
         if (candidateRoutesPublished) {
           try {
-            replaceHostRoutesForRepo(repoPath, previousRoutes.map(routeInputFromState));
+            const rollbackRoutes = previousRoutes.map(routeInputFromState);
+            replaceHostRoutesForRepo(repoPath, rollbackRoutes);
+            await ensureTraefikRoutesLoaded(rollbackRoutes, routeLoadOptions);
           } catch (rollbackError) {
             rollbackErrors.push(
               `routes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
@@ -10213,13 +10823,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
   });
 }
-var import_node_child_process19, import_node_fs23, import_node_path24, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
+var import_node_child_process21, import_node_fs25, import_node_path26, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process19 = require("child_process");
-    import_node_fs23 = __toESM(require("fs"));
-    import_node_path24 = __toESM(require("path"));
+    import_node_child_process21 = require("child_process");
+    import_node_fs25 = __toESM(require("fs"));
+    import_node_path26 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
@@ -10232,6 +10842,7 @@ var init_workspace_ensure = __esm({
     init_repo_config();
     init_route_publication();
     init_router();
+    init_traefik_route_health();
     init_workspace();
     init_workspace_ownership();
     init_workspace_runtime();
@@ -10305,20 +10916,20 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path25.default.join(mainRepo, "trees", ws);
+  return import_node_path27.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process22.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path25.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path25.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path27.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path27.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path25.default.join(import_node_path25.default.dirname(mainRepo), `${import_node_path25.default.basename(mainRepo)}-${ws}`);
+  return import_node_path27.default.join(import_node_path27.default.dirname(mainRepo), `${import_node_path27.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -10430,13 +11041,13 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs24.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs26.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
     );
   }
-  const status = (0, import_node_child_process20.spawnSync)(
+  const status = (0, import_node_child_process22.spawnSync)(
     "git",
     ["-C", target.worktreePath, "status", "--porcelain", "--untracked-files=normal"],
     { encoding: "utf-8" }
@@ -10470,9 +11081,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs24.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs26.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path25.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path27.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -10481,7 +11092,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs24.default.existsSync(selectedPath)) {
+    if (import_node_fs26.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -10500,11 +11111,11 @@ async function workspaceUp(branch, opts = {}) {
       return selectedPath;
     }
     if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
-    const add = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
+    const add = (0, import_node_child_process22.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process20.spawnSync)(
+      const addNew = (0, import_node_child_process22.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
         { encoding: "utf-8" }
@@ -10606,8 +11217,8 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
       opts.quiet
     );
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs24.default.existsSync(resolved.worktreePath)) {
-        const rm = (0, import_node_child_process20.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs26.default.existsSync(resolved.worktreePath)) {
+        const rm = (0, import_node_child_process22.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -10625,7 +11236,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs24.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs26.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
 }
 async function mutateWorkspaceOwnedPath(action2, worktreePath, opts = {}) {
   const mainRepo = resolveRepoPath(opts.repoPath);
@@ -10660,13 +11271,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process20, import_node_fs24, import_node_path25, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process22, import_node_fs26, import_node_path27, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process20 = require("child_process");
-    import_node_fs24 = __toESM(require("fs"));
-    import_node_path25 = __toESM(require("path"));
+    import_node_child_process22 = require("child_process");
+    import_node_fs26 = __toESM(require("fs"));
+    import_node_path27 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_repo_config();
@@ -10795,17 +11406,17 @@ async function devsyExec(repoPath, command) {
     }
     const args = ["workspace", "exec", "--result-format", "plain", workspace.id, "--", ...command];
     return new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process21.spawn)("devsy", args, { stdio: "inherit" });
+      const child = (0, import_node_child_process23.spawn)("devsy", args, { stdio: "inherit" });
       child.once("error", (error) => reject(new Error(`devsy exec failed: ${error.message}`)));
       child.once("close", (code) => resolve(code ?? 1));
     });
   });
 }
-var import_node_child_process21;
+var import_node_child_process23;
 var init_devsy_exec = __esm({
   "src/core/devsy-exec.ts"() {
     "use strict";
-    import_node_child_process21 = require("child_process");
+    import_node_child_process23 = require("child_process");
     init_devsy_workspaces();
     init_workspace();
   }
@@ -10827,7 +11438,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process22.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process24.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -10868,7 +11479,7 @@ async function devpodExec(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto8.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto9.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -10886,7 +11497,7 @@ async function devpodExec(repoPath, command) {
       wrappedCommand
     ];
     return new Promise((resolve, reject) => {
-      const child = (0, import_node_child_process22.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+      const child = (0, import_node_child_process24.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       let pending = Buffer.alloc(0);
       let statusBytes = Buffer.alloc(0);
       let readingStatus = false;
@@ -10945,12 +11556,12 @@ async function devpodExec(repoPath, command) {
     });
   });
 }
-var import_node_child_process22, import_node_crypto8, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
+var import_node_child_process24, import_node_crypto9, DEVPOD_MISSING_EXIT_STATUS_DIAGNOSTIC;
 var init_devpod_exec = __esm({
   "src/core/devpod-exec.ts"() {
     "use strict";
-    import_node_child_process22 = require("child_process");
-    import_node_crypto8 = require("crypto");
+    import_node_child_process24 = require("child_process");
+    import_node_crypto9 = require("crypto");
     init_devpod_environment();
     init_devpod_workspaces();
     init_devsy_exec();
@@ -11136,7 +11747,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process23.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process25.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -11144,11 +11755,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process23;
+var import_node_child_process25;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process23 = require("child_process");
+    import_node_child_process25 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -11171,7 +11782,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process24.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process26.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -11185,17 +11796,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process24.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process26.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process24;
+var import_node_child_process26;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process24 = require("child_process");
+    import_node_child_process26 = require("child_process");
     init_docker();
     init_router();
   }
@@ -11235,17 +11846,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs25.default.existsSync(filePath)) {
+  if (!import_node_fs27.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs25.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs27.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path26.default.relative(repoPath, filePath) || ".";
+  return import_node_path28.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -11286,7 +11897,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs25.default.existsSync(import_node_path26.default.join(repoPath, fileName))) {
+    if (import_node_fs27.default.existsSync(import_node_path28.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -11301,9 +11912,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path26.default.join(repoPath, ".nvmrc");
-  if (import_node_fs25.default.existsSync(nvmrc)) {
-    const version = import_node_fs25.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path28.default.join(repoPath, ".nvmrc");
+  if (import_node_fs27.default.existsSync(nvmrc)) {
+    const version = import_node_fs27.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -11364,7 +11975,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path26.default.isAbsolute(fileName) && !import_node_path26.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path28.default.isAbsolute(fileName) && !import_node_path28.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -11382,7 +11993,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs25.default.existsSync(import_node_path26.default.join(repoPath, fileName))
+    (fileName) => import_node_fs27.default.existsSync(import_node_path28.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -11420,7 +12031,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs25.default.readFileSync(import_node_path26.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs27.default.readFileSync(import_node_path28.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -11455,8 +12066,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs25.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs25.default.readFileSync(import_node_path26.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs27.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs27.default.readFileSync(import_node_path28.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -11470,18 +12081,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path26.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs25.default.existsSync(dir)) {
+  const dir = import_node_path28.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs27.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs25.default.readdirSync(dir).filter((fileName) => import_node_fs25.default.statSync(import_node_path26.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs27.default.readdirSync(dir).filter((fileName) => import_node_fs27.default.statSync(import_node_path28.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs25.default.existsSync(configPath)) {
+  if (!import_node_fs27.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -11525,15 +12136,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs25.default.existsSync(import_node_path26.default.join(repoPath, fileName))) {
+    if (import_node_fs27.default.existsSync(import_node_path28.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path26.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs25.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs25.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path26.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs25.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path28.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs27.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs27.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path28.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs27.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -11576,7 +12187,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path26.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path28.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -11595,12 +12206,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs25, import_node_path26, import_yaml6;
+var import_node_fs27, import_node_path28, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs25 = __toESM(require("fs"));
-    import_node_path26 = __toESM(require("path"));
+    import_node_fs27 = __toESM(require("fs"));
+    import_node_path28 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -11705,7 +12316,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs26.default.existsSync(import_node_path27.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs28.default.existsSync(import_node_path29.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -11924,12 +12535,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs26, import_node_path27;
+var import_node_fs28, import_node_path29;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs26 = __toESM(require("fs"));
-    import_node_path27 = __toESM(require("path"));
+    import_node_fs28 = __toESM(require("fs"));
+    import_node_path29 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -12226,7 +12837,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path28.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path30.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -12271,8 +12882,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path28.default.join(repoPath, file.relativePath);
-  if (!import_node_fs27.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path30.default.join(repoPath, file.relativePath);
+  if (!import_node_fs29.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -12280,7 +12891,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs27.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs29.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -12337,11 +12948,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path28.default.join(repoPath, file.relativePath);
-  import_node_fs27.default.mkdirSync(import_node_path28.default.dirname(absolutePath), { recursive: true });
-  import_node_fs27.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path30.default.join(repoPath, file.relativePath);
+  import_node_fs29.default.mkdirSync(import_node_path30.default.dirname(absolutePath), { recursive: true });
+  import_node_fs29.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs27.default.chmodSync(absolutePath, 493);
+    import_node_fs29.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -12379,12 +12990,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs27, import_node_path28, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs29, import_node_path30, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs27 = __toESM(require("fs"));
-    import_node_path28 = __toESM(require("path"));
+    import_node_fs29 = __toESM(require("fs"));
+    import_node_path30 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -12493,6 +13104,119 @@ var init_repo_devcontainer = __esm({
   }
 });
 
+// src/core/profile-resolution.ts
+function sortedUnique2(values) {
+  return Array.from(new Set(values)).sort();
+}
+function expandsAll(values) {
+  return values?.length === 1 && values[0] === "*";
+}
+function selectedManagedResources(profile, selected, registry) {
+  if (!profile || expandsAll(selected)) return sortedUnique2(registry);
+  return sortedUnique2(selected ?? []);
+}
+function selectedReadiness(config, profileName, profile, routedApps) {
+  const selectedNames = profileName.split(",");
+  if (selectedNames.length === 1) {
+    return sortedUnique2(
+      profile?.readiness ?? routedApps.filter((app) => app.protocol === "http").map((app) => app.name)
+    );
+  }
+  const readiness = /* @__PURE__ */ new Set();
+  for (const selectedName of selectedNames) {
+    const selected = resolveProfile(config, selectedName);
+    const selectedApps = applyProfile(config, selected.profile).apps.filter(
+      (app) => app.kind !== "dependency"
+    );
+    const selectedTargets = selected.profile?.readiness ?? selectedApps.filter((app) => app.protocol === "http").map((app) => app.name);
+    for (const target of selectedTargets) readiness.add(target);
+  }
+  return sortedUnique2(readiness);
+}
+function buildProfileResolutionReport(config, repoPath, profileOverride) {
+  const resolved = resolveProfile(config, profileOverride);
+  const filtered = applyProfile(config, resolved.profile);
+  const routedApps = filtered.apps.filter((app) => app.kind !== "dependency");
+  const dependencies = filtered.apps.filter((app) => app.kind === "dependency");
+  const readiness = selectedReadiness(config, resolved.name, resolved.profile, routedApps);
+  const managedRuntime = config.managedRuntime;
+  const baseServices = sortedUnique2(managedRuntime?.devcontainer.baseServices ?? []);
+  const profileServices = managedRuntime ? selectedManagedResources(
+    resolved.profile,
+    resolved.profile?.devcontainerServices,
+    managedRuntime.devcontainer.profileServices
+  ) : [];
+  const processes = managedRuntime ? selectedManagedResources(
+    resolved.profile,
+    resolved.profile?.processes,
+    managedRuntime.processes
+  ) : [];
+  return {
+    schemaVersion: 1,
+    repoPath,
+    profile: resolved.name,
+    apps: sortedUnique2(routedApps.map((app) => app.name)),
+    dependencies: sortedUnique2(dependencies.map((app) => app.name)),
+    readiness: sortedUnique2(readiness),
+    managedRuntime: {
+      baseServices,
+      profileServices,
+      services: sortedUnique2([...baseServices, ...profileServices]),
+      processes
+    }
+  };
+}
+function resolveProfileReport(options) {
+  const repoPath = resolveRepoPath(options.repo);
+  return buildProfileResolutionReport(loadRepoConfig(repoPath), repoPath, options.profile);
+}
+var init_profile_resolution = __esm({
+  "src/core/profile-resolution.ts"() {
+    "use strict";
+    init_repo_config();
+  }
+});
+
+// src/commands/profile.ts
+var profile_exports = {};
+__export(profile_exports, {
+  runProfileResolveCommand: () => runProfileResolveCommand
+});
+async function runProfileResolveCommand(options) {
+  const report = resolveProfileReport(options);
+  if (options.json) {
+    printJSON(report);
+    return;
+  }
+  printProfileResolutionSummary(report);
+}
+function renderValues(values) {
+  return values.join(", ") || "-";
+}
+function printProfileResolutionSummary(report) {
+  process.stdout.write(`Repo: ${report.repoPath}
+`);
+  process.stdout.write(`Profile: ${report.profile}
+`);
+  process.stdout.write(`Apps: ${renderValues(report.apps)}
+`);
+  process.stdout.write(`Dependencies: ${renderValues(report.dependencies)}
+`);
+  process.stdout.write(`Readiness: ${renderValues(report.readiness)}
+`);
+  process.stdout.write(`Managed services: ${renderValues(report.managedRuntime.services)}
+`);
+  process.stdout.write(`Managed processes: ${renderValues(report.managedRuntime.processes)}
+`);
+}
+var init_profile = __esm({
+  "src/commands/profile.ts"() {
+    "use strict";
+    init_output();
+    init_profile_resolution();
+  }
+});
+
 // src/commands/app-add.ts
 var app_add_exports = {};
 __export(app_add_exports, {
@@ -12775,7 +13499,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto9.createHash)("sha1").update(import_node_path29.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto10.createHash)("sha1").update(import_node_path31.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -12854,11 +13578,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path29.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs28.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path29.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path31.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs30.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path31.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs28.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs30.default.writeFileSync(overlayPath, import_yaml7.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -12872,7 +13596,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process27.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -12900,7 +13624,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process27.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -12926,7 +13650,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process27.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -12952,7 +13676,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process25.spawnSync)("docker", args, {
+  (0, import_node_child_process27.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -12964,7 +13688,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process27.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -12978,14 +13702,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process25, import_node_crypto9, import_node_fs28, import_node_path29, import_yaml7;
+var import_node_child_process27, import_node_crypto10, import_node_fs30, import_node_path31, import_yaml7;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process25 = require("child_process");
-    import_node_crypto9 = require("crypto");
-    import_node_fs28 = __toESM(require("fs"));
-    import_node_path29 = __toESM(require("path"));
+    import_node_child_process27 = require("child_process");
+    import_node_crypto10 = require("crypto");
+    import_node_fs30 = __toESM(require("fs"));
+    import_node_path31 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -13022,7 +13746,7 @@ function resolveSmCommand(command, defaultEnv, overrideEnv) {
   }
   return command.replace(/\{env\}/g, env);
 }
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((resolve) => {
     setTimeout(resolve, ms);
   });
@@ -13075,7 +13799,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process26.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process28.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -13133,7 +13857,7 @@ async function terminateProcessTree(rootPid) {
     if (!isProcessRunning(rootPid)) {
       return;
     }
-    await sleep2(100);
+    await sleep3(100);
   }
   if (isProcessRunning(rootPid)) {
     killProcessTree(rootPid, "SIGKILL");
@@ -13186,12 +13910,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process26.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process28.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process26.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process28.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -13250,7 +13974,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process26.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process28.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -13320,7 +14044,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
           );
         }
       }
-      await sleep2(POLL_INTERVAL_MS2);
+      await sleep3(POLL_INTERVAL_MS2);
     }
   } catch (error) {
     fatalError = toError(error);
@@ -13618,7 +14342,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process26.spawn)(wrapped, {
+        child = (0, import_node_child_process28.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -13632,7 +14356,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process26.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process28.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -13640,7 +14364,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process26.spawn)(options.command[0], {
+      child = (0, import_node_child_process28.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -13648,7 +14372,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process26.spawn)(command, args, {
+      child = (0, import_node_child_process28.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -13669,11 +14393,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process26, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process28, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS2, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process26 = require("child_process");
+    import_node_child_process28 = require("child_process");
     import_node_net = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -13807,13 +14531,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs29.default.lstatSync(worktreePath);
+    rootStat = import_node_fs31.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs29.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs31.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -13839,10 +14563,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path30.default.join(dirPath, entry.name);
+      const entryPath = import_node_path32.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs29.default.lstatSync(entryPath);
+        entryStat = import_node_fs31.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -13852,7 +14576,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs29.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs31.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -13916,12 +14640,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs29, import_node_path30, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs31, import_node_path32, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs29 = __toESM(require("fs"));
-    import_node_path30 = __toESM(require("path"));
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_path32 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -14022,7 +14746,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs30.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs32.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -14547,7 +15271,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers = new Map(worktreePaths.map((path30) => [path30, unknownContainers(reason)]));
+      containers = new Map(worktreePaths.map((path32) => [path32, unknownContainers(reason)]));
     }
   }
   const rows = records.map((record) => {
@@ -14596,12 +15320,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process27, import_node_fs30, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process29, import_node_fs32, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process27 = require("child_process");
-    import_node_fs30 = __toESM(require("fs"));
+    import_node_child_process29 = require("child_process");
+    import_node_fs32 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -14618,7 +15342,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process27.spawnSync)(command, args, {
+      const result = (0, import_node_child_process29.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -14778,7 +15502,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.46" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.48" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -14936,6 +15660,16 @@ repoDevcontainerCommand.command("verify").description("Verify devcontainer onboa
     }
   )
 );
+var profileCommand = program.command("profile").description("Resolve profiles from `.devrouter.yml` without starting a runtime");
+profileCommand.command("resolve").description("Print the exact apps, dependencies, services, and processes for a profile").option("--repo <path>", "Repository path (defaults to current directory)").option(
+  "--profile <name>",
+  "Profile name or comma-separated selection (defaults to configured profile)"
+).option("--json", "Output stable JSON").action(
+  withErrorHandling(async (options) => {
+    const { runProfileResolveCommand: runProfileResolveCommand2 } = await Promise.resolve().then(() => (init_profile(), profile_exports));
+    await runProfileResolveCommand2(options);
+  })
+);
 var appCommand = program.command("app").description("Manage app entries and runtime actions from `.devrouter.yml`");
 appCommand.command("add").description("Add or update one app definition in `.devrouter.yml`").requiredOption("--name <name>", "App name").option("--kind <kind>", "app or dependency", "app").option("--host <host>", "Hostname ending with .localhost (required for --kind app)").option("--protocol <protocol>", "http or tcp (required for --kind app)").option(
   "--runtime <runtime>",