@devrouter/cli 0.0.51 → 0.0.53

package/dist/devrouter.js

@@ -249,6 +249,8 @@ profiles:
 - Validation is strict at config load: unknown keys, non-routed \`apps\`, non-dependency \`dependencies\`, \`readiness\` outside the profile's apps, and multiple defaults are rejected.
 - Selection: \`devrouter ensure <path> --profile <name>\`. Comma-separated selections (\`--profile manage,pwa\`) merge with deduplication; the canonical name is sorted-unique so order never affects identity or fingerprints. A wildcard member collapses to everything.
 - Managed adapters receive \`DEVROUTER_PROFILE\` (canonical resolved name) in the post-start env; profile switches replace the owned process group via the fingerprint.
+- Adapters may pass \`--prepare-command <command>\` to \`devrouter-process ensure\` for synchronous dependency preparation under the process lock before application launch. Unchanged owned processes skip preparation; preparation participates in default fingerprints and must not daemonize or detach.
+- Exact managed Devsy stop proves the complete retained container population, ownership and configuration before stopping residual services after a stopped primary. Unknown evidence blocks cleanup, and an original provider failure remains an error even if residual cleanup succeeds.
 
 ### Managed devcontainer resources
 
@@ -400,7 +402,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter -V [--repo .]\`: show installed CLI version, local repo version, and next upgrade target
 - \`devrouter upgrade [version] [--repo .]\`: list upgrade targets or print target Agent Adaptation Prompt
 - \`devrouter setup --yes [--repo .] [--json] [--workspace-runtime <devpod|devsy>]\`: first-run machine setup plus structured diagnostics; explicit Devsy selection acquires its verified agent
-- \`devrouter ensure [path] [--profile <name>] [--open] [--json]\`: canonical startup/reconciliation for primary and linked checkouts; a managed profile selects its independent resource dimensions
+- \`devrouter ensure [path] [--profile <name>] [--repair] [--open] [--json]\`: canonical startup/reconciliation for primary and linked checkouts; explicit repair uses the recorded degraded profile and unchanged retained configuration
 - \`devrouter profile resolve --repo <path> [--profile <selection>] [--json]\`: resolve exact profile resources for automation without starting or inspecting a runtime
 - \`devrouter profile plan --repo <path> [--profile <selection>] --contract <repo-relative-yaml> [--output <path>] [--json]\`: validate repository-owned resource policy and emit literal bindings without runtime access
 - \`devrouter stop [path] [--delete] [--json]\`: stop the exact workspace runtime and remove exact routes; \`--delete\` explicitly deletes its ownership-proven data without removing the checkout
@@ -425,7 +427,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter app exec <name> [--shell] [--env <env>] [--workspace <slug>] -- <cmd>\`: one-shot command with resolved dep env
 - \`devrouter app rm <name> [--keep-config]\`: remove app entry (\`--keep-config\` frees only the live route/hostname, leaves \`.devrouter.yml\` untouched)
 - \`devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]\`: create a worktree and start/prove it unless create-only mode is requested
-- \`devrouter workspace ensure [path] [--profile <name>] [--open] [--json]\`: compatibility alias of \`devrouter ensure\`
+- \`devrouter workspace ensure [path] [--profile <name>] [--repair] [--open] [--json]\`: compatibility alias of \`devrouter ensure\`
 - \`devrouter workspace ls [--json]\`: list ownership, Git, workspace runtime, route, path, and branch evidence
 - \`devrouter workspace cleanup [--repo .] [--inactive-for 30d] [--check-merged] [--measure-size] [--json]\`: report-only cleanup evidence and exact guarded suggestions; no \`--yes\` or apply mode
 - \`devrouter workspace stop <workspace|branch>\`: stop DevPod and routes; preserve checkout, owner record, and data
@@ -2691,7 +2693,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.51" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.53" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -3227,6 +3229,8 @@ function buildOnboardingPrompt(options = {}) {
     "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once so Devrouter acquires and verifies the pinned agent in its own machine cache. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access, and `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match a pinned official asset.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
+    "- Managed adapters may use devrouter-process ensure --prepare-command <command> for synchronous dependency preparation under the process lock before app launch. Unchanged owned processes skip preparation; it participates in default fingerprints and must not daemonize or detach.",
+    "- Exact managed Devsy stop validates complete retained container membership, ownership and configuration before stopping residual services after a stopped primary. Unknown evidence blocks cleanup; original provider failures remain errors even after successful residual cleanup.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
     "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, workspace runtime registration, runtime state (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod/Devsy list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. Runtime `lastUsed` remains advisory.",
     '- `--measure-size` adds per-workspace storage consumption and stays read-only, but walks each worktree and runs `docker ps` / `docker inspect --size`, so leave it off for a quick report. Each row reports `worktree` and `containerWritable` bytes, which are reclaimable; `imageShared` bytes, which are not, because those image layers are shared with other containers and overlap across rows; and `reclaimable`, the sum of the reclaimable fields. Never add `imageShared` across rows. Any figure that cannot be trusted reports `{"status": "unknown", "reason": ...}` rather than zero, and a workspace with no container reports a measured `0`.',
@@ -3273,6 +3277,7 @@ function buildOnboardingPrompt(options = {}) {
     "- devrouter repo devcontainer write --repo <REPO_PATH> --yes",
     "- devrouter repo devcontainer verify --repo <REPO_PATH> --json",
     "- Normal primary or linked startup: devrouter ensure <REPO_PATH> --json",
+    "- Degraded recovery: explicit devrouter ensure <REPO_PATH> --repair --json validates the recorded profile and unchanged retained configuration; stopped primary requires all project containers stopped and zero checkout routes. It starts only retained IDs, never provider bootstrap/recreation. Inspect failures before retrying.",
     "- Managed selective startup: devrouter ensure <REPO_PATH> --profile <name> --json",
     "- Container seed/migration: devrouter exec <REPO_PATH> -- <command...>",
     "- Compatibility verification only after ensure: devrouter repo devcontainer verify --repo <REPO_PATH> --live --yes --json",
@@ -3391,7 +3396,7 @@ var init_ai_prompt = __esm({
         purpose: "Write/update devrouter section in the repo's AGENTS.md and install the devrouter skill."
       },
       {
-        command: "devrouter ensure [path] [--profile <name>] [--open] [--json]",
+        command: "devrouter ensure [path] [--profile <name>] [--repair] [--open] [--json]",
         purpose: "Canonical startup and proof for an exact primary or linked checkout; atomically publishes routes after readiness."
       },
       {
@@ -5691,19 +5696,12 @@ function assertSafeContainerId(containerId) {
     throw new Error(`Container '${containerId}' is not a safe exact identifier.`);
   }
 }
-function startExactManagedServices(options) {
-  if (options.services.length === 0) return;
-  const project = safeComposeProject(options.composeProject);
-  const services = Array.from(new Set(options.services));
-  if (services.some((service) => !options.plan.composeServices.includes(service))) {
-    throw new Error("Exact Compose startup contains a service outside the validated model.");
-  }
-  const fileArgs = options.plan.composeFiles.flatMap((file) => ["-f", file]);
+function managedComposeEnvironment(workspace) {
   const env = { ...process.env };
-  if (options.workspace) {
-    env.WORKSPACE = options.workspace.token;
-    env.DEVROUTER_WORKSPACE = options.workspace.token;
-    env.DEVROUTER_GIT_COMMON_DIR = options.workspace.gitCommonDir;
+  if (workspace) {
+    env.WORKSPACE = workspace.token;
+    env.DEVROUTER_WORKSPACE = workspace.token;
+    env.DEVROUTER_GIT_COMMON_DIR = workspace.gitCommonDir;
     env.DEVCONTAINER_COMPOSE_OVERLAY = "docker-compose.devrouter.yml";
   } else {
     delete env.WORKSPACE;
@@ -5711,6 +5709,87 @@ function startExactManagedServices(options) {
     delete env.DEVROUTER_GIT_COMMON_DIR;
     delete env.DEVCONTAINER_COMPOSE_OVERLAY;
   }
+  return env;
+}
+function assertReadableComposeFile(file) {
+  try {
+    if (!import_node_fs15.default.statSync(file).isFile()) throw new Error("not a regular file");
+    import_node_fs15.default.accessSync(file, import_node_fs15.default.constants.R_OK);
+  } catch {
+    throw new Error("Managed container Compose configuration contains an unreadable file.");
+  }
+}
+function assertManagedContainerConfigUnchanged(options) {
+  if (options.containers.length === 0) {
+    throw new Error("Managed container configuration cannot be verified without containers.");
+  }
+  for (const container of options.containers) {
+    const project = container.labels["com.docker.compose.project"];
+    const service = container.labels["com.docker.compose.service"];
+    const workingDirectory = container.labels["com.docker.compose.project.working_dir"];
+    const recordedConfigFiles = container.labels["com.docker.compose.project.config_files"];
+    const expectedHash = container.labels["com.docker.compose.config-hash"];
+    if (!project || !service || !workingDirectory || !recordedConfigFiles || !expectedHash || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(service) || !/^[a-f0-9]{64}$/.test(expectedHash)) {
+      throw new Error("Managed container is missing valid Compose identity and hash labels.");
+    }
+    const composeProject = safeComposeProject(project);
+    const configFiles = recordedConfigFiles.split(",").map((file) => file.trim());
+    if (configFiles.some((file) => file.length === 0)) {
+      throw new Error("Managed container has an invalid recorded Compose file list.");
+    }
+    if (options.plan.composeFiles.some(
+      (expected) => !configFiles.some((actual) => sameWorkspacePath(actual, expected))
+    )) {
+      throw new Error("Managed container Compose files do not include the managed plan files.");
+    }
+    for (const file of configFiles) assertReadableComposeFile(file);
+    const fileArgs = configFiles.flatMap((file) => ["-f", file]);
+    const result = (() => {
+      try {
+        return (0, import_node_child_process7.spawnSync)(
+          "docker",
+          [
+            "compose",
+            "--project-name",
+            composeProject,
+            "--project-directory",
+            workingDirectory,
+            ...fileArgs,
+            "config",
+            "--hash",
+            service
+          ],
+          {
+            cwd: workingDirectory,
+            encoding: "utf-8",
+            env: managedComposeEnvironment(options.workspace),
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: COMPOSE_HASH_TIMEOUT_MS
+          }
+        );
+      } catch {
+        throw new Error(`Could not verify managed Compose configuration for service '${service}'.`);
+      }
+    })();
+    if (result.status !== 0 || result.error) {
+      throw new Error(`Could not verify managed Compose configuration for service '${service}'.`);
+    }
+    const output2 = typeof result.stdout === "string" ? result.stdout.trim() : "";
+    const match = /^(\S+)\s+([a-f0-9]{64})$/.exec(output2);
+    if (!match || match[1] !== service || match[2] !== expectedHash) {
+      throw new Error(`Managed Compose configuration changed for service '${service}'.`);
+    }
+  }
+}
+function startExactManagedServices(options) {
+  if (options.services.length === 0) return;
+  const project = safeComposeProject(options.composeProject);
+  const services = Array.from(new Set(options.services));
+  if (services.some((service) => !options.plan.composeServices.includes(service))) {
+    throw new Error("Exact Compose startup contains a service outside the validated model.");
+  }
+  const fileArgs = options.plan.composeFiles.flatMap((file) => ["-f", file]);
+  const env = managedComposeEnvironment(options.workspace);
   const result = (0, import_node_child_process7.spawnSync)(
     "docker",
     [
@@ -5739,17 +5818,18 @@ function startExactManagedServices(options) {
     );
   }
 }
-function stopExactManagedService(containerId, service) {
+function stopExactManagedService(containerId, service, options) {
   assertSafeContainerId(containerId);
   const result = (0, import_node_child_process7.spawnSync)("docker", ["stop", containerId], {
     encoding: "utf-8",
-    stdio: "inherit"
+    stdio: "inherit",
+    ...options ? { timeout: options.timeoutMs } : {}
   });
-  if (result.status !== 0) {
+  if (result.status !== 0 || result.error) {
     throw new Error(`Could not stop exact managed service '${service}' (${containerId}).`);
   }
 }
-var import_node_child_process7, import_node_crypto7, import_node_fs15, import_node_path15, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER;
+var import_node_child_process7, import_node_crypto7, import_node_fs15, import_node_path15, import_yaml4, MANAGED_DEVCONTAINER_PATH, MANAGED_DEVCONTAINER_MARKER, COMPOSE_HASH_TIMEOUT_MS;
 var init_devcontainer_profile = __esm({
   "src/core/devcontainer-profile.ts"() {
     "use strict";
@@ -5761,12 +5841,206 @@ var init_devcontainer_profile = __esm({
     init_atomic_file();
     init_devcontainer_config();
     init_paths();
+    init_workspace();
     MANAGED_DEVCONTAINER_PATH = ".devcontainer/devcontainer.devrouter.json";
     MANAGED_DEVCONTAINER_MARKER = "// devrouter:managed devcontainer profile";
+    COMPOSE_HASH_TIMEOUT_MS = 1e4;
   }
 });
 
 // src/core/devpod-environment.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertFullContainerId(value) {
+  if (typeof value !== "string" || !FULL_CONTAINER_ID_PATTERN.test(value)) {
+    throw new Error("Managed stop Docker inspection returned an invalid container id.");
+  }
+}
+function assertUniqueContainerIds(ids) {
+  if (new Set(ids).size !== ids.length) {
+    throw new Error("Managed stop Docker inspection returned duplicate container ids.");
+  }
+}
+function parseDockerLines(stdout) {
+  const lines = stdout.split(/\r?\n/);
+  while (lines.at(-1) === "") lines.pop();
+  if (lines.some((line) => line === "")) {
+    throw new Error("Managed stop Docker inspection returned an empty record.");
+  }
+  return lines;
+}
+function runManagedStopDocker(args) {
+  const result = (0, import_node_child_process8.spawnSync)("docker", args, {
+    encoding: "utf-8",
+    timeout: MANAGED_STOP_DOCKER_TIMEOUT_MS,
+    maxBuffer: MANAGED_STOP_DOCKER_MAX_BUFFER
+  });
+  if (result.error || result.status !== 0) {
+    throw new Error("Managed stop Docker inspection failed.");
+  }
+  if (typeof result.stdout !== "string") {
+    throw new Error("Managed stop Docker inspection returned invalid output.");
+  }
+  return result.stdout;
+}
+function listManagedStopContainerIds(composeProject) {
+  const stdout = runManagedStopDocker([
+    "ps",
+    "-a",
+    "--no-trunc",
+    "--filter",
+    `label=${MANAGED_STOP_COMPOSE_LABEL}=${composeProject}`,
+    "--format",
+    "{{.ID}}"
+  ]);
+  const ids = parseDockerLines(stdout);
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  return ids;
+}
+function assertString(value) {
+  if (typeof value !== "string") {
+    throw new Error("Managed stop Docker inspection returned an invalid field.");
+  }
+}
+function validateManagedStopSnapshot(value, composeProject) {
+  if (!isRecord2(value)) {
+    throw new Error("Managed stop Docker inspection returned an invalid record.");
+  }
+  assertFullContainerId(value.id);
+  if (!isRecord2(value.state)) {
+    throw new Error("Managed stop Docker inspection returned an invalid state.");
+  }
+  const status = value.state.Status;
+  if (status !== "running" && status !== "exited" && status !== "created") {
+    throw new Error("Managed stop Docker inspection returned an invalid state status.");
+  }
+  if (typeof value.state.Running !== "boolean") {
+    throw new Error("Managed stop Docker inspection returned an invalid running flag.");
+  }
+  if (typeof value.state.Paused !== "boolean" || value.state.Paused) {
+    throw new Error("Managed stop Docker inspection returned an invalid paused flag.");
+  }
+  if (typeof value.state.Restarting !== "boolean" || value.state.Restarting) {
+    throw new Error("Managed stop Docker inspection returned an invalid restarting flag.");
+  }
+  if (typeof value.state.Dead !== "boolean" || value.state.Dead) {
+    throw new Error("Managed stop Docker inspection returned an invalid dead flag.");
+  }
+  if (status === "running" !== value.state.Running) {
+    throw new Error("Managed stop Docker inspection returned contradictory state.");
+  }
+  let health;
+  if (value.state.Health !== void 0 && value.state.Health !== null) {
+    if (!isRecord2(value.state.Health)) {
+      throw new Error("Managed stop Docker inspection returned an invalid health field.");
+    }
+    assertString(value.state.Health.Status);
+    health = { Status: value.state.Health.Status };
+  }
+  if (!isRecord2(value.labels)) {
+    throw new Error("Managed stop Docker inspection returned invalid labels.");
+  }
+  for (const label of MANAGED_STOP_IDENTITY_LABELS) {
+    assertString(value.labels[label]);
+  }
+  if (value.labels[MANAGED_STOP_COMPOSE_LABEL] !== composeProject) {
+    throw new Error("Managed stop Docker inspection returned a foreign Compose project.");
+  }
+  if (!Array.isArray(value.mounts)) {
+    throw new Error("Managed stop Docker inspection returned invalid mounts.");
+  }
+  const mounts = value.mounts.map((mount) => {
+    if (!isRecord2(mount)) {
+      throw new Error("Managed stop Docker inspection returned an invalid mount.");
+    }
+    assertString(mount.Type);
+    assertString(mount.Source);
+    assertString(mount.Destination);
+    return {
+      Type: mount.Type,
+      Source: mount.Source,
+      Destination: mount.Destination
+    };
+  });
+  if (!isRecord2(value.networks)) {
+    throw new Error("Managed stop Docker inspection returned invalid networks.");
+  }
+  return {
+    id: value.id,
+    state: {
+      ...health ? { Health: health } : {},
+      Status: status,
+      Running: value.state.Running,
+      Paused: false,
+      Restarting: false,
+      Dead: false
+    },
+    labels: {
+      "com.docker.compose.project": value.labels["com.docker.compose.project"],
+      "com.docker.compose.service": value.labels["com.docker.compose.service"],
+      "com.docker.compose.project.working_dir": value.labels["com.docker.compose.project.working_dir"],
+      "com.docker.compose.project.config_files": value.labels["com.docker.compose.project.config_files"],
+      "com.docker.compose.config-hash": value.labels["com.docker.compose.config-hash"]
+    },
+    mounts,
+    networks: {}
+  };
+}
+function inspectManagedStopPopulation(ids, composeProject) {
+  const stdout = runManagedStopDocker([
+    "inspect",
+    "--format",
+    MANAGED_STOP_INSPECT_TEMPLATE,
+    ...ids
+  ]);
+  const lines = parseDockerLines(stdout);
+  if (lines.length !== ids.length) {
+    throw new Error("Managed stop Docker inspection returned an incomplete population.");
+  }
+  const expected = new Set(ids);
+  const seen = /* @__PURE__ */ new Set();
+  const snapshots = lines.map((line) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      throw new Error("Managed stop Docker inspection returned malformed JSON.");
+    }
+    const snapshot = validateManagedStopSnapshot(parsed, composeProject);
+    if (!expected.has(snapshot.id) || seen.has(snapshot.id)) {
+      throw new Error("Managed stop Docker inspection returned an unexpected population.");
+    }
+    seen.add(snapshot.id);
+    return snapshot;
+  });
+  return snapshots;
+}
+function requireSameContainerPopulation(expected, actual) {
+  if (expected.length !== actual.length) {
+    throw new Error("Managed stop Docker inspection observed a changed population.");
+  }
+  const expectedSet = new Set(expected);
+  if (actual.some((id) => !expectedSet.has(id))) {
+    throw new Error("Managed stop Docker inspection observed a changed population.");
+  }
+}
+function inspectManagedStopContainers(composeProject) {
+  if (typeof composeProject !== "string" || composeProject.length === 0 || composeProject !== composeProject.trim() || !MANAGED_STOP_PROJECT_PATTERN.test(composeProject)) {
+    throw new Error("Managed stop Docker inspection requires a safe Compose project.");
+  }
+  const listedIds = listManagedStopContainerIds(composeProject);
+  if (listedIds.length === 0) {
+    const confirmedIds2 = listManagedStopContainerIds(composeProject);
+    requireSameContainerPopulation(listedIds, confirmedIds2);
+    return [];
+  }
+  const snapshots = inspectManagedStopPopulation(listedIds, composeProject);
+  const confirmedIds = listManagedStopContainerIds(composeProject);
+  requireSameContainerPopulation(listedIds, confirmedIds);
+  return snapshots;
+}
 function inspectWorkspaceContainers(options) {
   let ids = options?.ids;
   if (!ids) {
@@ -5850,18 +6124,31 @@ function resolveRunningWorkspaceContainer(repoPath) {
   }
   return { id: container.id, workspacePath: repoMount.Destination };
 }
-var import_node_child_process8, import_node_path16, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE;
+var import_node_child_process8, import_node_path16, SAFE_INSPECT_TEMPLATE, SIZE_INSPECT_TEMPLATE, MANAGED_STOP_INSPECT_TEMPLATE, MANAGED_STOP_PROJECT_PATTERN, FULL_CONTAINER_ID_PATTERN, MANAGED_STOP_DOCKER_TIMEOUT_MS, MANAGED_STOP_DOCKER_MAX_BUFFER, MANAGED_STOP_COMPOSE_LABEL, MANAGED_STOP_IDENTITY_LABELS;
 var init_devpod_environment = __esm({
   "src/core/devpod-environment.ts"() {
     "use strict";
     import_node_child_process8 = require("child_process");
     import_node_path16 = __toESM(require("path"));
     init_workspace();
-    SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.service":{{json (index .Config.Labels "com.docker.compose.service")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
+    SAFE_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Running":{{json .State.Running}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.service":{{json (index .Config.Labels "com.docker.compose.service")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}},"com.docker.compose.config-hash":{{json (index .Config.Labels "com.docker.compose.config-hash")}}},"mounts":{{json .Mounts}},"networks":{{json .NetworkSettings.Networks}}}';
     SIZE_INSPECT_TEMPLATE = SAFE_INSPECT_TEMPLATE.replace(
       /}$/,
       ',"sizeRw":{{json (index . "SizeRw")}},"sizeRootFs":{{json (index . "SizeRootFs")}}}'
     );
+    MANAGED_STOP_INSPECT_TEMPLATE = '{"id":{{json .Id}},"state":{"Status":{{json .State.Status}},"Running":{{json .State.Running}},"Paused":{{json .State.Paused}},"Restarting":{{json .State.Restarting}},"Dead":{{json .State.Dead}},"Health":{{with (index .State "Health")}}{"Status":{{json .Status}}}{{else}}null{{end}}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.service":{{json (index .Config.Labels "com.docker.compose.service")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}},"com.docker.compose.project.config_files":{{json (index .Config.Labels "com.docker.compose.project.config_files")}},"com.docker.compose.config-hash":{{json (index .Config.Labels "com.docker.compose.config-hash")}}},"mounts":[{{range $index, $mount := .Mounts}}{{if $index}},{{end}}{"Type":{{json $mount.Type}},"Source":{{json $mount.Source}},"Destination":{{json $mount.Destination}}}{{end}}],"networks":{}}';
+    MANAGED_STOP_PROJECT_PATTERN = /^[a-z0-9][a-z0-9_-]*$/;
+    FULL_CONTAINER_ID_PATTERN = /^[0-9a-f]{64}$/;
+    MANAGED_STOP_DOCKER_TIMEOUT_MS = 5e3;
+    MANAGED_STOP_DOCKER_MAX_BUFFER = 1024 * 1024;
+    MANAGED_STOP_COMPOSE_LABEL = "com.docker.compose.project";
+    MANAGED_STOP_IDENTITY_LABELS = [
+      "com.docker.compose.project",
+      "com.docker.compose.service",
+      "com.docker.compose.project.working_dir",
+      "com.docker.compose.project.config_files",
+      "com.docker.compose.config-hash"
+    ];
   }
 });
 
@@ -6172,7 +6459,7 @@ function collectManagedRuntimeStatus(options) {
   let state;
   let stateReadFailed = false;
   try {
-    state = readManagedRuntimeState(options.repoPath, options.workspace);
+    state = options.candidateState ?? readManagedRuntimeState(options.repoPath, options.workspace);
   } catch {
     stateReadFailed = true;
   }
@@ -6830,7 +7117,8 @@ function listDevsyWorkspaces() {
     }
     const workspace = {
       id: candidate.id,
-      source: { localFolder: source.localFolder }
+      source: { localFolder: source.localFolder },
+      ...typeof candidate.context === "string" ? { context: candidate.context } : {}
     };
     if ("lastUsed" in candidate) {
       if (typeof candidate.lastUsed === "string") {
@@ -7509,372 +7797,898 @@ var init_devpod_workspaces = __esm({
   }
 });
 
-// src/core/devsy-mutation.ts
-function failedStartMayHaveAttached(devsyId, repoPath) {
-  try {
-    const attached = listDevsyWorkspaces();
-    const attachedId = devsyId ?? selectDevsyWorkspace(attached, repoPath)?.id;
-    if (!attachedId) return false;
-    return inspectDevsyWorkspaceOwnership(attached, attachedId, repoPath).status !== "absent";
-  } catch {
-    return true;
-  }
-}
-function withMutationLock(activity, target, operation) {
-  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  return withFileLockSync(
-    DEVSY_MUTATION_LOCK_FILE,
-    {
-      activity,
-      target: `'${target}'`,
-      waitMs: DEVSY_MUTATION_WAIT_MS,
-      fair: true,
-      onWait: createStderrWaitReporter(activity, `'${target}'`)
-    },
-    operation
-  );
+// src/core/route-publication.ts
+function routedAppsFromConfig(config) {
+  return config.apps.filter((app) => app.kind !== "dependency");
 }
-function withMutationLockAsync(activity, target, operation) {
-  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  return withFileLock(
-    DEVSY_MUTATION_LOCK_FILE,
-    {
-      activity,
-      target: `'${target}'`,
-      waitMs: DEVSY_MUTATION_WAIT_MS,
-      fair: true,
-      onWait: createStderrWaitReporter(activity, `'${target}'`)
-    },
-    operation
+function configuredProxyAppsFromConfig(config) {
+  return routedAppsFromConfig(config).filter(
+    (app) => app.runtime === "proxy"
   );
 }
-function commandFailure2(result) {
-  return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-}
-function runDevsyUp(args, env, quiet) {
-  return new Promise((resolve) => {
-    const child = (0, import_node_child_process15.spawn)("devsy", args, {
-      stdio: ["inherit", quiet ? 2 : "inherit", "pipe"],
-      env
-    });
-    const stderr = child.stderr;
-    if (!stderr) throw new Error("Devsy startup stderr pipe was not created.");
-    let stderrTail = Buffer.alloc(0);
-    let spawnError;
-    stderr.on("data", (chunk) => {
-      const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      const writable = process.stderr.write(value);
-      if (!writable) {
-        stderr.pause();
-        process.stderr.once("drain", () => stderr.resume());
-      }
-      if (value.length >= DEVSY_STDERR_TAIL_BYTES) {
-        stderrTail = Buffer.from(value.subarray(value.length - DEVSY_STDERR_TAIL_BYTES));
-      } else {
-        const combined = Buffer.concat([stderrTail, value]);
-        stderrTail = combined.length > DEVSY_STDERR_TAIL_BYTES ? combined.subarray(combined.length - DEVSY_STDERR_TAIL_BYTES) : combined;
-      }
-    });
-    child.once("error", (error) => {
-      spawnError = error;
-    });
-    child.once("close", (status) => {
-      resolve({ status, error: spawnError, stderrTail: stderrTail.toString("utf-8") });
-    });
-  });
-}
-function runDevsyAction(action2, devsyId, force = false) {
-  const args = action2 === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
-  const result = (0, import_node_child_process15.spawnSync)("devsy", ["workspace", ...args], { encoding: "utf-8" });
-  if (result.status !== 0) {
+function proxyAppsFromConfig(config) {
+  const routedApps = routedAppsFromConfig(config);
+  const proxyApps = configuredProxyAppsFromConfig(config);
+  const unsupported = routedApps.filter((app) => app.runtime !== "proxy");
+  if (unsupported.length > 0) {
     throw new Error(
-      `devsy workspace ${action2}${force ? " --force" : ""} failed for '${devsyId}': ${commandFailure2(result) || "unknown error"}`
+      `Environment reconciliation supports proxy runtime apps only; unsupported: ${unsupported.map((app) => `${app.name} (${app.runtime})`).join(", ")}`
     );
   }
+  return proxyApps;
 }
-function inspectExactOwnership(devsyId, worktreePath) {
-  const ownership = inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, worktreePath);
-  if (ownership.status === "conflict") throw new Error(ownership.reason);
-  return ownership;
-}
-function mutateOwnedDevsyWorkspace(action2, devsyId, worktreePath) {
-  return withMutationLock(`Devsy ${action2}`, worktreePath, () => {
-    const before = inspectExactOwnership(devsyId, worktreePath);
-    if (before.status === "absent") return { status: "absent" };
-    runDevsyAction(action2, devsyId);
-    let after = inspectExactOwnership(devsyId, worktreePath);
-    if (action2 === "stop" && after.status !== "owned") {
-      throw new Error(
-        `Devsy workspace '${devsyId}' no longer owns '${worktreePath}' after provider stop.`
-      );
-    }
-    if (action2 === "delete" && after.status === "owned") {
-      const runtime = inspectDevsyRuntimeStatus(devsyId);
-      if (runtime !== "not-found") {
-        throw new Error(
-          `Devsy workspace '${devsyId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
-        );
-      }
-      after = inspectExactOwnership(devsyId, worktreePath);
-      if (after.status === "owned") {
-        runDevsyAction("delete", devsyId, true);
-        after = inspectExactOwnership(devsyId, worktreePath);
-      }
-      if (after.status !== "absent") {
+async function ensureRouteInfrastructure(apps, options = {}) {
+  ensureRouterFiles();
+  await ensureNetwork(DEVNET_NAME);
+  const tlsCoverage = await ensureTLSHostsCovered(
+    apps.map((app) => app.host),
+    options
+  );
+  for (const app of apps) {
+    if (app.protocol === "tcp") {
+      if (!isTLSEnabled()) {
         throw new Error(
-          `Devsy workspace '${devsyId}' still owns '${worktreePath}' after forced provider delete.`
+          `TCP route '${app.name}' requires TLS. Run: ${tlsSetupCommand(options.repoPath)}`
         );
       }
+      activateTcpProtocol(app.tcpProtocol);
     }
-    return { status: "changed" };
-  });
-}
-function stopOwnedDevsyWorkspace(devsyId, worktreePath) {
-  return mutateOwnedDevsyWorkspace("stop", devsyId, worktreePath);
-}
-function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
-  return mutateOwnedDevsyWorkspace("delete", devsyId, worktreePath);
-}
-function assertDevsyTarget(devsyId, repoPath) {
-  const workspaces = listDevsyWorkspaces();
-  const existing = selectDevsyWorkspace(workspaces, repoPath);
-  const id = devsyId ?? existing?.id;
-  if (id) {
-    const before = inspectDevsyWorkspaceOwnership(workspaces, id, repoPath);
-    if (before.status === "conflict") throw new Error(before.reason);
   }
-  return id;
+  startRouterStack();
+  return tlsCoverage;
 }
-async function startDevsyWorkspace(options) {
-  const activity = options.recreate ? "Devsy recreate" : "Devsy start";
-  let agent;
+async function replacePublishedProxyRoutes(repoPath, config, workspace, options = {}) {
+  const apps = proxyAppsFromConfig(config);
+  const tlsCoverage = options.prepareInfrastructure === false ? { refreshed: false } : await ensureRouteInfrastructure(apps, { repoPath });
+  const routes = apps.map((app) => {
+    const upstream = parseUpstream(app.upstream);
+    return {
+      name: app.name,
+      host: app.host,
+      protocol: app.protocol,
+      tcpProtocol: app.protocol === "tcp" ? app.tcpProtocol : void 0,
+      repoPath,
+      port: upstream.port,
+      mode: "proxy",
+      upstreamHost: upstream.upstreamHost,
+      workspace
+    };
+  });
+  replaceHostRoutesForRepo(repoPath, routes);
+  return { routes, tlsRefreshed: tlsCoverage.refreshed };
+}
+var init_route_publication = __esm({
+  "src/core/route-publication.ts"() {
+    "use strict";
+    init_docker();
+    init_host_routes();
+    init_router();
+    init_tls();
+  }
+});
+
+// src/core/workspace-ownership.ts
+function commandError(command, repoPath, stderr) {
+  return new Error(
+    `${command} failed for '${repoPath}': ${stderr?.trim() || "not a Git repository"}`
+  );
+}
+function resolveGitCommonDir(repoPath) {
+  const result = (0, import_node_child_process15.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
+    encoding: "utf-8",
+    env: READ_ONLY_GIT_ENV
+  });
+  const output2 = result.stdout.trim();
+  if (result.status !== 0 || !output2) {
+    throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
+  }
+  return comparableWorkspacePath(import_node_path20.default.isAbsolute(output2) ? output2 : import_node_path20.default.resolve(repoPath, output2));
+}
+function resolveGitTopLevel(repoPath) {
+  const result = (0, import_node_child_process15.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
+    encoding: "utf-8",
+    env: READ_ONLY_GIT_ENV
+  });
+  const output2 = result.stdout.trim();
+  if (result.status !== 0 || !output2) {
+    throw commandError("Could not resolve the Git checkout root", repoPath, result.stderr);
+  }
+  return comparableWorkspacePath(output2);
+}
+function listGitWorktrees(repoPath) {
+  const result = (0, import_node_child_process15.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
+    encoding: "utf-8",
+    env: READ_ONLY_GIT_ENV
+  });
+  if (result.status !== 0) {
+    throw commandError("git worktree list", repoPath, result.stderr);
+  }
+  const worktrees = [];
+  let current = {};
+  const finish = () => {
+    if (!current.path) return;
+    worktrees.push({
+      path: comparableWorkspacePath(current.path),
+      branch: current.branch,
+      locked: current.locked ?? false,
+      prunable: current.prunable ?? false
+    });
+    current = {};
+  };
+  for (const line of `${result.stdout}
+`.split("\n")) {
+    if (line.startsWith("worktree ")) {
+      finish();
+      current.path = line.slice("worktree ".length).trim();
+    } else if (line.startsWith("branch ")) {
+      current.branch = line.slice("branch ".length).trim().replace(/^refs\/heads\//, "");
+    } else if (line === "locked" || line.startsWith("locked ")) {
+      current.locked = true;
+    } else if (line === "prunable" || line.startsWith("prunable ")) {
+      current.prunable = true;
+    } else if (line === "") {
+      finish();
+    }
+  }
+  return worktrees;
+}
+function ownershipDirectory(repoPath) {
+  return import_node_path20.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+}
+function validateWorkspace(value, label) {
+  if (typeof value !== "string" || wsFromBranch(value) !== value) {
+    throw new Error(`invalid workspace ownership ${label}`);
+  }
+  return value;
+}
+function validateTimestamp(value, label) {
+  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) {
+    throw new Error(`invalid workspace ownership ${label}`);
+  }
+  return value;
+}
+function validateRecord(value, expectedWorkspace) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("invalid workspace ownership record");
+  }
+  const candidate = value;
+  if (candidate.version !== OWNERSHIP_VERSION) {
+    throw new Error(`unsupported workspace ownership version '${String(candidate.version)}'`);
+  }
+  const workspace = validateWorkspace(candidate.workspace, "workspace");
+  if (expectedWorkspace && workspace !== expectedWorkspace) {
+    throw new Error(
+      `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
+    );
+  }
+  if (typeof candidate.worktreePath !== "string" || !import_node_path20.default.isAbsolute(candidate.worktreePath)) {
+    throw new Error("invalid workspace ownership worktreePath");
+  }
+  if (candidate.branch !== null && typeof candidate.branch !== "string") {
+    throw new Error("invalid workspace ownership branch");
+  }
+  const devpodId = validateWorkspace(candidate.devpodId, "devpodId");
+  return {
+    version: OWNERSHIP_VERSION,
+    workspace,
+    worktreePath: comparableWorkspacePath(candidate.worktreePath),
+    branch: candidate.branch,
+    devpodId,
+    createdAt: validateTimestamp(candidate.createdAt, "createdAt"),
+    updatedAt: validateTimestamp(candidate.updatedAt, "updatedAt")
+  };
+}
+function recordPath(repoPath, workspace) {
+  return import_node_path20.default.join(
+    ownershipDirectory(repoPath),
+    `${validateWorkspace(workspace, "workspace")}.json`
+  );
+}
+function readRecordFile(filePath, expectedWorkspace) {
+  let parsed;
   try {
-    agent = requireReadyDevsyAgent();
+    parsed = JSON.parse(import_node_fs20.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
-    if (!(error instanceof DevsyAgentReadinessError)) throw error;
-    const repair = devsyAgentRepairSuggestion(error.inspection);
-    throw new Error(`${error.message}. ${repair}`);
+    if (error instanceof SyntaxError) {
+      throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
+    }
+    throw error;
   }
-  return withMutationLockAsync(activity, options.repoPath, async () => {
-    let devsyId = assertDevsyTarget(options.devsyId, options.repoPath);
-    if (devsyId && options.recreate) {
-      const attached = listDevsyWorkspaces();
-      const ownership = inspectDevsyWorkspaceOwnership(attached, devsyId, options.repoPath);
-      if (ownership.status !== "owned") {
-        throw new Error(`Cannot recreate Devsy workspace '${devsyId}' without one exact owner.`);
+  return validateRecord(parsed, expectedWorkspace);
+}
+function readWorkspaceOwnership(repoPath, workspace) {
+  const filePath = recordPath(repoPath, workspace);
+  try {
+    return readRecordFile(filePath, workspace);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+function listWorkspaceOwnership(repoPath) {
+  const directory = ownershipDirectory(repoPath);
+  return listWorkspaceOwnershipInDirectory(directory);
+}
+function listWorkspaceOwnershipInDirectory(directory) {
+  let entries;
+  try {
+    entries = import_node_fs20.default.readdirSync(directory, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
+    const workspace = entry.name.slice(0, -".json".length);
+    validateWorkspace(workspace, "filename");
+    return readRecordFile(import_node_path20.default.join(directory, entry.name), workspace);
+  });
+}
+function writeWorkspaceOwnershipInDirectory(directory, input2) {
+  const workspace = validateWorkspace(input2.workspace, "workspace");
+  const devpodId = validateWorkspace(input2.devpodId, "devpodId");
+  const worktreePath = comparableWorkspacePath(input2.worktreePath);
+  const filePath = import_node_path20.default.join(directory, `${workspace}.json`);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const records = listWorkspaceOwnershipInDirectory(directory);
+  const existing = records.find((record2) => record2.workspace === workspace);
+  if (existing && !sameWorkspacePath(existing.worktreePath, worktreePath)) {
+    throw new Error(
+      `Workspace '${workspace}' already belongs to '${existing.worktreePath}', refusing '${worktreePath}'.`
+    );
+  }
+  const pathOwner = records.find(
+    (record2) => record2.workspace !== workspace && sameWorkspacePath(record2.worktreePath, worktreePath)
+  );
+  if (pathOwner) {
+    throw new Error(
+      `Worktree '${worktreePath}' is already owned by workspace '${pathOwner.workspace}'.`
+    );
+  }
+  if (existing && existing.devpodId !== devpodId) {
+    throw new Error(
+      `Workspace '${workspace}' already owns DevPod '${existing.devpodId}', refusing '${devpodId}'.`
+    );
+  }
+  const record = {
+    version: OWNERSHIP_VERSION,
+    workspace,
+    worktreePath,
+    branch: input2.branch ?? null,
+    devpodId,
+    createdAt: existing?.createdAt ?? validateTimestamp(now, "createdAt"),
+    updatedAt: validateTimestamp(now, "updatedAt")
+  };
+  writeFileAtomically(filePath, `${JSON.stringify(record, null, 2)}
+`);
+  return record;
+}
+function removeWorkspaceOwnershipInDirectory(directory, workspace) {
+  const filePath = import_node_path20.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  try {
+    import_node_fs20.default.rmSync(filePath);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+function sameOwnershipRecord(left, right) {
+  return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
+}
+function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
+  const filePath = import_node_path20.default.join(
+    directory,
+    `${validateWorkspace(expected.workspace, "workspace")}.json`
+  );
+  let current;
+  try {
+    current = readRecordFile(filePath, expected.workspace);
+  } catch (error) {
+    if (error.code === "ENOENT") return "absent";
+    throw error;
+  }
+  if (!sameOwnershipRecord(current, expected)) return "changed";
+  import_node_fs20.default.rmSync(filePath);
+  return "removed";
+}
+function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
+  const directory = ownershipDirectory(repoPath);
+  import_node_fs20.default.mkdirSync(directory, { recursive: true });
+  return withFileLockSync(
+    import_node_path20.default.join(directory, ".lock"),
+    {
+      activity: "workspace ownership transaction",
+      target: `'${repoPath}'`,
+      waitMs: options.waitMs ?? 5e3
+    },
+    () => operation({
+      list: () => listWorkspaceOwnershipInDirectory(directory),
+      write: (input2) => writeWorkspaceOwnershipInDirectory(directory, input2),
+      remove: (workspace) => removeWorkspaceOwnershipInDirectory(directory, workspace),
+      removeIfMatches: (expected) => removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected)
+    })
+  );
+}
+function providerPathOwner(providerWorkspaces, worktreePath) {
+  const owners = providerWorkspaces.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, worktreePath)
+  );
+  if (owners.length > 1) {
+    throw new Error(
+      `Worktree '${worktreePath}' is registered by multiple workspace runtimes; no identity was claimed.`
+    );
+  }
+  return owners[0];
+}
+function persistedWorkspaceOwners(repoPath, worktreePath) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const worktree of listGitWorktrees(repoPath)) {
+    if (sameWorkspacePath(worktree.path, worktreePath)) continue;
+    let workspace;
+    try {
+      workspace = readPersistedWorkspace(worktree.path);
+    } catch (error) {
+      if (!import_node_fs20.default.existsSync(worktree.path)) continue;
+      throw error;
+    }
+    if (!workspace) continue;
+    const existing = owners.get(workspace);
+    if (existing && !sameWorkspacePath(existing, worktree.path)) {
+      throw new Error(`Persisted workspace identity '${workspace}' belongs to multiple worktrees.`);
+    }
+    owners.set(workspace, worktree.path);
+  }
+  return owners;
+}
+function claimConflict(workspace, devpodId, worktreePath, records, providerWorkspaces, persistedOwners, exactRecord) {
+  const recordOwner = records.find(
+    (record) => record !== exactRecord && (record.workspace === workspace || record.devpodId === devpodId)
+  );
+  if (recordOwner) {
+    return `workspace owner record '${recordOwner.workspace}' for '${recordOwner.worktreePath}'`;
+  }
+  const providerOwner = providerWorkspaces.find(
+    (providerWorkspace) => providerWorkspace.id === devpodId && !sameWorkspacePath(providerWorkspace.source.localFolder, worktreePath)
+  );
+  if (providerOwner) {
+    return `workspace runtime identity '${providerOwner.id}' already belongs to '${providerOwner.source.localFolder}'`;
+  }
+  const persistedOwner = persistedOwners.get(workspace);
+  if (persistedOwner) {
+    return `persisted checkout metadata for '${persistedOwner}'`;
+  }
+  return void 0;
+}
+function claimWorkspaceIdentity(repoPath, input2) {
+  const worktreePath = comparableWorkspacePath(repoPath);
+  const exactProvider = providerPathOwner(input2.providerWorkspaces, worktreePath);
+  return withWorkspaceOwnershipTransaction(repoPath, (transaction) => {
+    const records = transaction.list();
+    const exactRecords = records.filter(
+      (record) => sameWorkspacePath(record.worktreePath, worktreePath)
+    );
+    if (exactRecords.length > 1) {
+      throw new Error(
+        `Worktree '${worktreePath}' has multiple workspace owner records; no identity was claimed.`
+      );
+    }
+    const exactRecord = exactRecords[0];
+    const persisted = readPersistedWorkspace(worktreePath);
+    const persistedOwners = persistedWorkspaceOwners(repoPath, worktreePath);
+    if (exactRecord) {
+      if (persisted && persisted !== exactRecord.workspace) {
+        throw new Error(
+          `Persisted workspace identity '${persisted}' disagrees with owner record '${exactRecord.workspace}'.`
+        );
+      }
+      if (exactProvider && exactProvider.id !== exactRecord.devpodId) {
+        throw new Error(
+          `Workspace runtime '${exactProvider.id}' disagrees with owner record '${exactRecord.devpodId}'.`
+        );
       }
+      const conflict2 = claimConflict(
+        exactRecord.workspace,
+        exactRecord.devpodId,
+        worktreePath,
+        records,
+        input2.providerWorkspaces,
+        persistedOwners,
+        exactRecord
+      );
+      if (conflict2) {
+        throw new Error(
+          `Workspace '${exactRecord.workspace}' conflicts with ${conflict2}; no identity was claimed.`
+        );
+      }
+      if (!persisted) persistWorkspace(worktreePath, exactRecord.workspace);
+      return transaction.write({
+        workspace: exactRecord.workspace,
+        worktreePath,
+        branch: input2.branch ?? null,
+        devpodId: exactRecord.devpodId
+      });
     }
-    if (!devsyId && options.recreate) {
-      throw new Error("Cannot recreate a Devsy workspace before its exact id is known.");
+    if (persisted && exactProvider && persisted !== exactProvider.id) {
+      throw new Error(
+        `Persisted workspace identity '${persisted}' disagrees with workspace runtime '${exactProvider.id}'.`
+      );
     }
-    const args = ["workspace", "up", options.repoPath];
-    if (devsyId) args.push("--id", devsyId);
-    if (options.devcontainerPath) args.push("--devcontainer", options.devcontainerPath);
-    args.push("--ide-launch", "skip");
-    if (options.workspace) {
-      args.push(
-        "--workspace-env",
-        `WORKSPACE=${options.workspace.token}`,
-        "--workspace-env",
-        `DEVROUTER_WORKSPACE=${options.workspace.token}`
+    let workspace = persisted ?? exactProvider?.id;
+    let devpodId = exactProvider?.id ?? persisted;
+    if (!workspace || !devpodId) {
+      if (input2.unavailableRuntimes.length > 0) {
+        throw new Error(
+          `Cannot claim a new workspace identity because these runtime registries are unavailable: ${input2.unavailableRuntimes.join(", ")}.`
+        );
+      }
+      const candidate = workspaceIdentityCandidates(input2.source).find(
+        (next) => !claimConflict(
+          next,
+          next,
+          worktreePath,
+          records,
+          input2.providerWorkspaces,
+          persistedOwners
+        )
       );
+      if (!candidate) {
+        throw new Error(
+          `Could not allocate a collision-safe workspace identity for '${worktreePath}'.`
+        );
+      }
+      workspace = candidate;
+      devpodId = candidate;
+    }
+    const conflict = claimConflict(
+      workspace,
+      devpodId,
+      worktreePath,
+      records,
+      input2.providerWorkspaces,
+      persistedOwners
+    );
+    if (conflict) {
+      throw new Error(
+        `Workspace '${workspace}' conflicts with ${conflict}; no identity was claimed.`
+      );
+    }
+    const written = transaction.write({
+      workspace,
+      worktreePath,
+      branch: input2.branch ?? null,
+      devpodId
+    });
+    try {
+      persistWorkspace(worktreePath, workspace);
+    } catch (error) {
+      const cleanup = transaction.removeIfMatches(written);
+      if (cleanup !== "removed") {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `Could not persist workspace identity and owner-record rollback was '${cleanup}': ${detail}`
+        );
+      }
+      throw error;
+    }
+    return written;
+  });
+}
+function removeWorkspaceOwnership(repoPath, workspace) {
+  return withWorkspaceOwnershipTransaction(
+    repoPath,
+    (transaction) => transaction.remove(workspace)
+  );
+}
+function inspectWorkspaceOwnership(record, worktrees, devpods) {
+  const worktree = worktrees.find(
+    (candidate) => sameWorkspacePath(candidate.path, record.worktreePath)
+  );
+  const devpodOwnership = devpods ? inspectDevpodWorkspaceOwnership(devpods, record.devpodId, record.worktreePath) : void 0;
+  const devpodStatus = devpodOwnership?.status ?? "unknown";
+  if (devpodStatus === "conflict") {
+    return { ownerStatus: "conflict", devpodStatus, worktree };
+  }
+  if (worktree?.locked) {
+    return { ownerStatus: "locked", devpodStatus, worktree };
+  }
+  if ((!worktree || worktree.prunable) && import_node_fs20.default.existsSync(record.worktreePath)) {
+    return { ownerStatus: "conflict", devpodStatus, worktree };
+  }
+  if (!worktree || worktree.prunable) {
+    return { ownerStatus: "missing", devpodStatus, worktree };
+  }
+  let persisted;
+  try {
+    persisted = readPersistedWorkspace(worktree.path);
+  } catch {
+    return { ownerStatus: "conflict", devpodStatus, worktree };
+  }
+  return {
+    ownerStatus: persisted === record.workspace ? "present" : "conflict",
+    devpodStatus,
+    worktree
+  };
+}
+function listMissingWorkspaceOwnership(repoPath) {
+  const worktrees = listGitWorktrees(repoPath);
+  return listWorkspaceOwnership(repoPath).filter(
+    (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
+  );
+}
+var import_node_child_process15, import_node_fs20, import_node_path20, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
+var init_workspace_ownership = __esm({
+  "src/core/workspace-ownership.ts"() {
+    "use strict";
+    import_node_child_process15 = require("child_process");
+    import_node_fs20 = __toESM(require("fs"));
+    import_node_path20 = __toESM(require("path"));
+    init_atomic_file();
+    init_devpod_workspaces();
+    init_file_lock();
+    init_workspace();
+    READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
+    OWNERSHIP_VERSION = 1;
+    OWNERSHIP_DIR = import_node_path20.default.join("devrouter", "workspaces");
+  }
+});
+
+// src/core/managed-devsy-stop.ts
+function sameSet(left, right) {
+  return JSON.stringify([...left].sort()) === JSON.stringify([...right].sort());
+}
+function containerIdentity(container) {
+  return JSON.stringify({ id: container.id, labels: container.labels, mounts: container.mounts });
+}
+function stopRetainedManagedDevsyWorkspace(options) {
+  const { repoPath, devsyId } = options;
+  const linked = isLinkedWorktree(repoPath);
+  const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+  const retainedState = readManagedRuntimeState(repoPath, workspace);
+  if (!retainedState) return false;
+  const state = retainedState;
+  if (state.devpodId !== devsyId || linked && !workspace) {
+    throw new Error("Managed stop requires the exact retained workspace identity.");
+  }
+  const workspaceEnv = workspace ? { token: workspace, gitCommonDir: resolveGitCommonDir(repoPath) } : void 0;
+  function registration() {
+    resetWorkspaceRuntimeCaches();
+    if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy") {
+      throw new Error("Managed stop provider selection changed.");
+    }
+    const owner = inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, repoPath);
+    if (owner.status !== "owned") {
+      throw new Error("Managed stop requires one exact retained Devsy registration.");
+    }
+    if (workspace) {
+      const record = readWorkspaceOwnership(repoPath, workspace);
+      if (!record || record.devpodId !== devsyId || !sameWorkspacePath(record.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace || resolveGitCommonDir(repoPath) !== workspaceEnv?.gitCommonDir) {
+        throw new Error("Managed stop workspace ownership changed.");
+      }
     }
-    if (options.inactivityTimeout) {
-      args.push("--provider-option", `INACTIVITY_TIMEOUT=${options.inactivityTimeout}`);
+    return owner.workspace;
+  }
+  const context = registration().context;
+  if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
+    throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
+  }
+  const devsyRoot = import_node_path21.default.resolve(process.env.DEVSY_HOME || import_node_path21.default.join(import_node_os2.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path21.default.join(
+    devsyRoot,
+    "contexts",
+    context,
+    "workspaces",
+    devsyId,
+    "agent",
+    ".docker-compose"
+  );
+  function prove(previous) {
+    if (registration().context !== context || JSON.stringify(readManagedRuntimeState(repoPath, workspace)) !== JSON.stringify(state)) {
+      throw new Error("Managed stop retained context or runtime record changed.");
     }
-    if (options.recreate) args.push("--recreate");
-    const env = { ...process.env };
-    env.DEVSY_AGENT_BINARY = agent.binaryPath;
-    if (options.workspace) {
-      env.WORKSPACE = options.workspace.token;
-      env.DEVROUTER_WORKSPACE = options.workspace.token;
-      env.DEVROUTER_GIT_COMMON_DIR = options.workspace.gitCommonDir;
-      env.DEVCONTAINER_COMPOSE_OVERLAY = "docker-compose.devrouter.yml";
-    } else {
-      delete env.WORKSPACE;
-      delete env.DEVROUTER_WORKSPACE;
-      delete env.DEVROUTER_GIT_COMMON_DIR;
-      delete env.DEVCONTAINER_COMPOSE_OVERLAY;
+    const runtime = loadRuntimeConfig(repoPath, workspace ?? "", state.profile);
+    const managed = runtime.config.managedRuntime;
+    if (!managed || runtime.profile !== state.profile || runtime.workspace !== workspace) {
+      throw new Error("Managed stop requires the recorded managed profile.");
     }
-    const result = await runDevsyUp(args, env, options.quiet ?? false);
-    if (result.status !== 0) {
-      let message = `devsy workspace up failed for '${devsyId ?? options.repoPath}'.`;
-      if (result.error?.message) message += ` ${result.error.message}`;
-      if (AGENT_ACQUISITION_RE.test(result.stderrTail)) {
-        message += ` Devsy rejected the verified agent source. Run: ${DEVSY_AGENT_SETUP_COMMAND}`;
+    const plan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config: runtime.config,
+      profile: runtime.resolvedProfile,
+      linked
+    });
+    const selectedProcesses = runtime.resolvedProfile?.processes;
+    const processes = !runtime.resolvedProfile || selectedProcesses?.length === 1 && selectedProcesses[0] === "*" ? managed.processes : selectedProcesses ?? [];
+    if (state.sourceConfigSha256 !== plan.sourceConfigSha256 || state.effectiveConfigSha256 !== plan.effectiveConfigSha256 || !sameSet(
+      state.desired.apps,
+      proxyAppsFromConfig(runtime.config).map((app) => app.name)
+    ) || !sameSet(state.desired.services, plan.desiredProfileServices) || !sameSet(state.desired.processes, processes) || inspectManagedDevcontainerGeneratedConfig(plan).status !== "valid") {
+      throw new Error("Managed stop requires unchanged recorded resources and configuration.");
+    }
+    const containers = inspectManagedStopContainers(state.composeProject);
+    const services = /* @__PURE__ */ new Set();
+    for (const container of containers) {
+      const service = container.labels["com.docker.compose.service"] ?? "";
+      if (!plan.nativeRunServices.includes(service) || services.has(service) || container.labels["com.docker.compose.project"] !== state.composeProject || !sameWorkspacePath(
+        container.labels["com.docker.compose.project.working_dir"] ?? "",
+        plan.composeDirectory
+      )) {
+        throw new Error("Managed stop found unexpected or duplicate project membership.");
       }
-      if (failedStartMayHaveAttached(devsyId, options.repoPath)) {
-        throw new DevsyStartPostconditionError(message);
+      services.add(service);
+      const files = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim());
+      if (files.some((file) => !file || !import_node_path21.default.isAbsolute(file)) || new Set(files.map((file) => import_node_path21.default.resolve(file))).size !== files.length || files.length < plan.composeFiles.length || plan.composeFiles.some((file, index) => !sameWorkspacePath(file, files[index]))) {
+        throw new Error("Managed stop Compose file identity changed.");
       }
-      throw new Error(message);
+      for (const file of files.slice(plan.composeFiles.length)) {
+        if (import_node_path21.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
+          import_node_path21.default.basename(file)
+        ) || import_node_fs21.default.realpathSync(file) !== import_node_path21.default.join(import_node_fs21.default.realpathSync(devsyRoot), import_node_path21.default.relative(devsyRoot, file))) {
+          throw new Error("Managed stop refuses a foreign or escaped provider Compose file.");
+        }
+      }
+      if (previous) {
+        const retained = previous.find((entry) => entry.id === container.id);
+        if (!retained || containerIdentity(retained) !== containerIdentity(container) || !retained.state.Running && container.state.Running) {
+          throw new Error("Managed stop container identity or quiescent state changed.");
+        }
+      }
+    }
+    if (plan.desiredServices.some((service) => !services.has(service)) || previous && !sameSet(
+      previous.map((c) => c.id),
+      containers.map((c) => c.id)
+    )) {
+      throw new Error("Managed stop cannot prove the complete retained service population.");
+    }
+    const primary = containers.find(
+      (c) => c.labels["com.docker.compose.service"] === plan.primaryService
+    );
+    if (primary?.mounts.filter(
+      (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+    ).length !== 1) {
+      throw new Error("Managed stop cannot prove the exact primary workspace mount.");
     }
+    assertManagedContainerConfigUnchanged({ plan, containers, workspace: workspaceEnv });
+    if (registration().context !== context) {
+      throw new Error("Managed stop provider context changed during inspection.");
+    }
+    const status = inspectDevsyRuntimeStatus(devsyId);
+    if (status !== "running" && status !== "stopped" || status === "running" !== primary.state.Running) {
+      throw new Error("Managed stop requires consistent provider and primary container state.");
+    }
+    return { containers, primary, status };
+  }
+  const initial = prove();
+  let providerError;
+  let providerFailed = false;
+  if (initial.status === "running") {
     try {
-      const attached = listDevsyWorkspaces();
-      devsyId ??= selectDevsyWorkspace(attached, options.repoPath)?.id;
-      if (!devsyId) {
-        throw new Error(`Devsy did not attach '${options.repoPath}' after startup.`);
+      options.stopProvider();
+    } catch (error) {
+      providerFailed = true;
+      providerError = error;
+    }
+  }
+  try {
+    const stopped = () => {
+      const current = prove(initial.containers);
+      if (current.status !== "stopped" || current.primary.state.Running) {
+        throw new Error("Managed stop has not stopped the exact primary container.");
       }
-      const ownership = inspectDevsyWorkspaceOwnership(attached, devsyId, options.repoPath);
-      if (ownership.status === "conflict") throw new Error(ownership.reason);
-      if (ownership.status !== "owned") {
-        throw new Error(
-          `Devsy did not attach '${options.repoPath}' as '${devsyId}' after startup.`
-        );
+      return current.containers;
+    };
+    stopped();
+    for (const retained of initial.containers) {
+      if (!retained.state.Running || retained.id === initial.primary.id) continue;
+      const current = stopped().find((entry) => entry.id === retained.id);
+      if (current?.state.Running) {
+        stopExactManagedService(current.id, current.labels["com.docker.compose.service"] ?? "", {
+          timeoutMs: 3e4
+        });
       }
-      return devsyId;
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      throw new DevsyStartPostconditionError(message);
     }
-  });
+    if (stopped().some((container) => container.state.Running)) {
+      throw new Error("Managed stop left a retained service running.");
+    }
+  } catch (error) {
+    if (providerFailed) {
+      throw new AggregateError(
+        [providerError, error],
+        "Devsy provider stop failed; complete retained shutdown could not be verified.",
+        { cause: providerError }
+      );
+    }
+    throw error;
+  }
+  if (providerFailed) throw providerError;
+  return true;
 }
-var import_node_child_process15, import_node_fs20, import_node_path20, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError, AGENT_ACQUISITION_RE, DEVSY_STDERR_TAIL_BYTES;
-var init_devsy_mutation = __esm({
-  "src/core/devsy-mutation.ts"() {
+var import_node_fs21, import_node_os2, import_node_path21;
+var init_managed_devsy_stop = __esm({
+  "src/core/managed-devsy-stop.ts"() {
     "use strict";
-    import_node_child_process15 = require("child_process");
-    import_node_fs20 = __toESM(require("fs"));
-    import_node_path20 = __toESM(require("path"));
-    init_devsy_agent();
+    import_node_fs21 = __toESM(require("fs"));
+    import_node_os2 = __toESM(require("os"));
+    import_node_path21 = __toESM(require("path"));
+    init_devcontainer_profile();
+    init_devpod_environment();
     init_devsy_workspaces();
-    init_file_lock();
-    init_router();
-    DEVSY_MUTATION_LOCK_FILE = import_node_path20.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
-    DEVSY_MUTATION_WAIT_MS = 18e5;
-    DevsyStartPostconditionError = class extends Error {
-    };
-    AGENT_ACQUISITION_RE = /inject agent.*agent binary not found/i;
-    DEVSY_STDERR_TAIL_BYTES = 8192;
+    init_managed_runtime_state();
+    init_repo_config();
+    init_route_publication();
+    init_workspace();
+    init_workspace_ownership();
+    init_workspace_runtime();
   }
 });
 
-// src/core/devpod-mutation.ts
-function withMutationLock2(activity, target, operation) {
-  import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+// src/core/devsy-mutation.ts
+function failedStartMayHaveAttached(devsyId, repoPath) {
+  try {
+    const attached = listDevsyWorkspaces();
+    const attachedId = devsyId ?? selectDevsyWorkspace(attached, repoPath)?.id;
+    if (!attachedId) return false;
+    return inspectDevsyWorkspaceOwnership(attached, attachedId, repoPath).status !== "absent";
+  } catch {
+    return true;
+  }
+}
+function withMutationLock(activity, target, operation) {
+  import_node_fs22.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
-    DEVPOD_MUTATION_LOCK_FILE,
+    DEVSY_MUTATION_LOCK_FILE,
     {
       activity,
       target: `'${target}'`,
-      waitMs: DEVPOD_MUTATION_WAIT_MS,
+      waitMs: DEVSY_MUTATION_WAIT_MS,
       fair: true,
       onWait: createStderrWaitReporter(activity, `'${target}'`)
     },
     operation
   );
 }
-function commandFailure3(result) {
+function withMutationLockAsync(activity, target, operation) {
+  import_node_fs22.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLock(
+    DEVSY_MUTATION_LOCK_FILE,
+    {
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVSY_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
+    },
+    operation
+  );
+}
+function commandFailure2(result) {
   return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
 }
-function runDevpodAction(action2, devpodId, force = false) {
-  const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
-  const result = (0, import_node_child_process16.spawnSync)("devpod", args, { encoding: "utf-8" });
+function runDevsyUp(args, env, quiet) {
+  return new Promise((resolve) => {
+    const child = (0, import_node_child_process16.spawn)("devsy", args, {
+      stdio: ["inherit", quiet ? 2 : "inherit", "pipe"],
+      env
+    });
+    const stderr = child.stderr;
+    if (!stderr) throw new Error("Devsy startup stderr pipe was not created.");
+    let stderrTail = Buffer.alloc(0);
+    let spawnError;
+    stderr.on("data", (chunk) => {
+      const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      const writable = process.stderr.write(value);
+      if (!writable) {
+        stderr.pause();
+        process.stderr.once("drain", () => stderr.resume());
+      }
+      if (value.length >= DEVSY_STDERR_TAIL_BYTES) {
+        stderrTail = Buffer.from(value.subarray(value.length - DEVSY_STDERR_TAIL_BYTES));
+      } else {
+        const combined = Buffer.concat([stderrTail, value]);
+        stderrTail = combined.length > DEVSY_STDERR_TAIL_BYTES ? combined.subarray(combined.length - DEVSY_STDERR_TAIL_BYTES) : combined;
+      }
+    });
+    child.once("error", (error) => {
+      spawnError = error;
+    });
+    child.once("close", (status) => {
+      resolve({ status, error: spawnError, stderrTail: stderrTail.toString("utf-8") });
+    });
+  });
+}
+function runDevsyAction(action2, devsyId, force = false) {
+  const args = action2 === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
+  const result = (0, import_node_child_process16.spawnSync)("devsy", ["workspace", ...args], { encoding: "utf-8" });
   if (result.status !== 0) {
     throw new Error(
-      `devpod ${action2}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure3(result) || "unknown error"}`
+      `devsy workspace ${action2}${force ? " --force" : ""} failed for '${devsyId}': ${commandFailure2(result) || "unknown error"}`
     );
   }
 }
-function inspectExactOwnership2(devpodId, worktreePath) {
-  const ownership = inspectDevpodWorkspaceOwnership(
-    listDevpodWorkspaces(worktreePath),
-    devpodId,
-    worktreePath
-  );
+function inspectExactOwnership(devsyId, worktreePath) {
+  const ownership = inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, worktreePath);
   if (ownership.status === "conflict") throw new Error(ownership.reason);
   return ownership;
 }
-function mutateOwnedDevpodWorkspace(action2, devpodId, worktreePath) {
-  return withMutationLock2(`DevPod ${action2}`, worktreePath, () => {
-    const before = inspectExactOwnership2(devpodId, worktreePath);
+function mutateOwnedDevsyWorkspace(action2, devsyId, worktreePath) {
+  return withMutationLock(`Devsy ${action2}`, worktreePath, () => {
+    if (action2 === "stop" && stopRetainedManagedDevsyWorkspace({
+      repoPath: worktreePath,
+      devsyId,
+      stopProvider: () => runDevsyAction("stop", devsyId)
+    }))
+      return { status: "changed" };
+    const before = inspectExactOwnership(devsyId, worktreePath);
     if (before.status === "absent") return { status: "absent" };
-    runDevpodAction(action2, devpodId);
-    let after = inspectExactOwnership2(devpodId, worktreePath);
+    runDevsyAction(action2, devsyId);
+    let after = inspectExactOwnership(devsyId, worktreePath);
     if (action2 === "stop" && after.status !== "owned") {
-      throw new Error(`DevPod '${devpodId}' no longer owns '${worktreePath}' after provider stop.`);
+      throw new Error(
+        `Devsy workspace '${devsyId}' no longer owns '${worktreePath}' after provider stop.`
+      );
     }
     if (action2 === "delete" && after.status === "owned") {
-      const runtime = inspectDevpodRuntimeStatus(devpodId, worktreePath);
+      const runtime = inspectDevsyRuntimeStatus(devsyId);
       if (runtime !== "not-found") {
         throw new Error(
-          `DevPod '${devpodId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
+          `Devsy workspace '${devsyId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
         );
       }
-      after = inspectExactOwnership2(devpodId, worktreePath);
+      after = inspectExactOwnership(devsyId, worktreePath);
       if (after.status === "owned") {
-        runDevpodAction("delete", devpodId, true);
-        after = inspectExactOwnership2(devpodId, worktreePath);
+        runDevsyAction("delete", devsyId, true);
+        after = inspectExactOwnership(devsyId, worktreePath);
       }
       if (after.status !== "absent") {
         throw new Error(
-          `DevPod '${devpodId}' still owns '${worktreePath}' after forced provider delete.`
+          `Devsy workspace '${devsyId}' still owns '${worktreePath}' after forced provider delete.`
         );
       }
     }
     return { status: "changed" };
   });
 }
-function stopOwnedDevpodWorkspace(devpodId, worktreePath) {
-  if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
-    const result2 = stopOwnedDevsyWorkspace(devpodId, worktreePath);
-    resetWorkspaceRuntimeCaches();
-    return result2;
-  }
-  const result = mutateOwnedDevpodWorkspace("stop", devpodId, worktreePath);
-  resetWorkspaceRuntimeCaches();
-  return result;
+function stopOwnedDevsyWorkspace(devsyId, worktreePath) {
+  return mutateOwnedDevsyWorkspace("stop", devsyId, worktreePath);
 }
-function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
-  if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
-    const result2 = deleteOwnedDevsyWorkspace(devpodId, worktreePath);
-    resetWorkspaceRuntimeCaches();
-    return result2;
-  }
-  const result = mutateOwnedDevpodWorkspace("delete", devpodId, worktreePath);
-  resetWorkspaceRuntimeCaches();
-  return result;
+function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
+  return mutateOwnedDevsyWorkspace("delete", devsyId, worktreePath);
 }
-async function startDevpodWorkspace(options) {
-  if (resolveWorkspaceRuntimeOrDefault(options.repoPath) === "devsy") {
-    try {
-      const result = await startDevsyWorkspace({
-        repoPath: options.repoPath,
-        devsyId: options.devpodId,
-        devcontainerPath: options.devcontainerPath,
-        recreate: options.recreate,
-        quiet: options.quiet,
-        workspace: options.workspace,
-        inactivityTimeout: readWorkspaceRuntimeConfig().devsyInactivityTimeout
-      });
-      resetWorkspaceRuntimeCaches();
-      return result;
-    } catch (error) {
-      if (error instanceof DevsyStartPostconditionError) {
-        resetWorkspaceRuntimeCaches();
-        throw new DevpodStartPostconditionError(error.message);
-      }
-      throw error;
-    }
+function assertDevsyTarget(devsyId, repoPath) {
+  const workspaces = listDevsyWorkspaces();
+  const existing = selectDevsyWorkspace(workspaces, repoPath);
+  const id = devsyId ?? existing?.id;
+  if (id) {
+    const before = inspectDevsyWorkspaceOwnership(workspaces, id, repoPath);
+    if (before.status === "conflict") throw new Error(before.reason);
   }
-  const activity = options.recreate ? "DevPod recreate" : "DevPod start";
-  return withMutationLock2(activity, options.repoPath, () => {
-    const workspaces = listDevpodWorkspaces(options.repoPath);
-    let devpodId = options.devpodId ?? selectDevpodWorkspace(workspaces, options.repoPath)?.id;
-    if (devpodId) {
-      const before = inspectDevpodWorkspaceOwnership(workspaces, devpodId, options.repoPath);
-      if (before.status === "conflict") throw new Error(before.reason);
-      if (options.recreate && before.status !== "owned") {
-        throw new Error(`Cannot recreate DevPod '${devpodId}' without one exact owner.`);
+  return id;
+}
+async function startDevsyWorkspace(options) {
+  const activity = options.recreate ? "Devsy recreate" : "Devsy start";
+  let agent;
+  try {
+    agent = requireReadyDevsyAgent();
+  } catch (error) {
+    if (!(error instanceof DevsyAgentReadinessError)) throw error;
+    const repair = devsyAgentRepairSuggestion(error.inspection);
+    throw new Error(`${error.message}. ${repair}`);
+  }
+  return withMutationLockAsync(activity, options.repoPath, async () => {
+    let devsyId = assertDevsyTarget(options.devsyId, options.repoPath);
+    if (devsyId && options.recreate) {
+      const attached = listDevsyWorkspaces();
+      const ownership = inspectDevsyWorkspaceOwnership(attached, devsyId, options.repoPath);
+      if (ownership.status !== "owned") {
+        throw new Error(`Cannot recreate Devsy workspace '${devsyId}' without one exact owner.`);
       }
-    } else if (options.recreate) {
-      throw new Error("Cannot recreate a DevPod before its exact id is known.");
     }
-    const args = ["up", options.repoPath];
-    if (devpodId) args.push("--id", devpodId);
-    if (options.devcontainerPath) {
-      args.push("--devcontainer-path", options.devcontainerPath);
+    if (!devsyId && options.recreate) {
+      throw new Error("Cannot recreate a Devsy workspace before its exact id is known.");
     }
-    args.push("--open-ide=false");
+    const args = ["workspace", "up", options.repoPath];
+    if (devsyId) args.push("--id", devsyId);
+    if (options.devcontainerPath) args.push("--devcontainer", options.devcontainerPath);
+    args.push("--ide-launch", "skip");
     if (options.workspace) {
       args.push(
         "--workspace-env",
@@ -7883,8 +8697,12 @@ async function startDevpodWorkspace(options) {
         `DEVROUTER_WORKSPACE=${options.workspace.token}`
       );
     }
+    if (options.inactivityTimeout) {
+      args.push("--provider-option", `INACTIVITY_TIMEOUT=${options.inactivityTimeout}`);
+    }
     if (options.recreate) args.push("--recreate");
     const env = { ...process.env };
+    env.DEVSY_AGENT_BINARY = agent.binaryPath;
     if (options.workspace) {
       env.WORKSPACE = options.workspace.token;
       env.DEVROUTER_WORKSPACE = options.workspace.token;
@@ -7896,500 +8714,252 @@ async function startDevpodWorkspace(options) {
       delete env.DEVROUTER_GIT_COMMON_DIR;
       delete env.DEVCONTAINER_COMPOSE_OVERLAY;
     }
-    const result = (0, import_node_child_process16.spawnSync)("devpod", args, {
-      stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
-      env
-    });
+    const result = await runDevsyUp(args, env, options.quiet ?? false);
     if (result.status !== 0) {
-      throw new Error(`devpod up failed for '${devpodId ?? options.repoPath}'.`);
-    }
-    try {
-      const attached = listDevpodWorkspaces(options.repoPath);
-      devpodId ??= selectDevpodWorkspace(attached, options.repoPath)?.id;
-      if (!devpodId) {
-        throw new Error(`DevPod did not attach '${options.repoPath}' after startup.`);
-      }
-      const ownership = inspectDevpodWorkspaceOwnership(attached, devpodId, options.repoPath);
-      if (ownership.status === "conflict") throw new Error(ownership.reason);
-      if (ownership.status !== "owned") {
-        throw new Error(
-          `DevPod did not attach '${options.repoPath}' as '${devpodId}' after startup.`
-        );
-      }
-      resetWorkspaceRuntimeCaches();
-      return devpodId;
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      throw new DevpodStartPostconditionError(message);
-    }
-  });
-}
-var import_node_child_process16, import_node_fs21, import_node_path21, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
-var init_devpod_mutation = __esm({
-  "src/core/devpod-mutation.ts"() {
-    "use strict";
-    import_node_child_process16 = require("child_process");
-    import_node_fs21 = __toESM(require("fs"));
-    import_node_path21 = __toESM(require("path"));
-    init_devpod_workspaces();
-    init_devsy_mutation();
-    init_file_lock();
-    init_router();
-    init_workspace_runtime();
-    DEVPOD_MUTATION_LOCK_FILE = import_node_path21.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
-    DEVPOD_MUTATION_WAIT_MS = 18e5;
-    DevpodStartPostconditionError = class extends Error {
-    };
-  }
-});
-
-// src/core/workspace-ownership.ts
-function commandError(command, repoPath, stderr) {
-  return new Error(
-    `${command} failed for '${repoPath}': ${stderr?.trim() || "not a Git repository"}`
-  );
-}
-function resolveGitCommonDir(repoPath) {
-  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "rev-parse", "--git-common-dir"], {
-    encoding: "utf-8",
-    env: READ_ONLY_GIT_ENV
-  });
-  const output2 = result.stdout.trim();
-  if (result.status !== 0 || !output2) {
-    throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
-  }
-  return comparableWorkspacePath(import_node_path22.default.isAbsolute(output2) ? output2 : import_node_path22.default.resolve(repoPath, output2));
-}
-function resolveGitTopLevel(repoPath) {
-  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "rev-parse", "--show-toplevel"], {
-    encoding: "utf-8",
-    env: READ_ONLY_GIT_ENV
-  });
-  const output2 = result.stdout.trim();
-  if (result.status !== 0 || !output2) {
-    throw commandError("Could not resolve the Git checkout root", repoPath, result.stderr);
-  }
-  return comparableWorkspacePath(output2);
-}
-function listGitWorktrees(repoPath) {
-  const result = (0, import_node_child_process17.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
-    encoding: "utf-8",
-    env: READ_ONLY_GIT_ENV
-  });
-  if (result.status !== 0) {
-    throw commandError("git worktree list", repoPath, result.stderr);
-  }
-  const worktrees = [];
-  let current = {};
-  const finish = () => {
-    if (!current.path) return;
-    worktrees.push({
-      path: comparableWorkspacePath(current.path),
-      branch: current.branch,
-      locked: current.locked ?? false,
-      prunable: current.prunable ?? false
-    });
-    current = {};
-  };
-  for (const line of `${result.stdout}
-`.split("\n")) {
-    if (line.startsWith("worktree ")) {
-      finish();
-      current.path = line.slice("worktree ".length).trim();
-    } else if (line.startsWith("branch ")) {
-      current.branch = line.slice("branch ".length).trim().replace(/^refs\/heads\//, "");
-    } else if (line === "locked" || line.startsWith("locked ")) {
-      current.locked = true;
-    } else if (line === "prunable" || line.startsWith("prunable ")) {
-      current.prunable = true;
-    } else if (line === "") {
-      finish();
-    }
-  }
-  return worktrees;
-}
-function ownershipDirectory(repoPath) {
-  return import_node_path22.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
-}
-function validateWorkspace(value, label) {
-  if (typeof value !== "string" || wsFromBranch(value) !== value) {
-    throw new Error(`invalid workspace ownership ${label}`);
-  }
-  return value;
-}
-function validateTimestamp(value, label) {
-  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) {
-    throw new Error(`invalid workspace ownership ${label}`);
-  }
-  return value;
-}
-function validateRecord(value, expectedWorkspace) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("invalid workspace ownership record");
-  }
-  const candidate = value;
-  if (candidate.version !== OWNERSHIP_VERSION) {
-    throw new Error(`unsupported workspace ownership version '${String(candidate.version)}'`);
-  }
-  const workspace = validateWorkspace(candidate.workspace, "workspace");
-  if (expectedWorkspace && workspace !== expectedWorkspace) {
-    throw new Error(
-      `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
-    );
-  }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path22.default.isAbsolute(candidate.worktreePath)) {
-    throw new Error("invalid workspace ownership worktreePath");
-  }
-  if (candidate.branch !== null && typeof candidate.branch !== "string") {
-    throw new Error("invalid workspace ownership branch");
-  }
-  const devpodId = validateWorkspace(candidate.devpodId, "devpodId");
-  return {
-    version: OWNERSHIP_VERSION,
-    workspace,
-    worktreePath: comparableWorkspacePath(candidate.worktreePath),
-    branch: candidate.branch,
-    devpodId,
-    createdAt: validateTimestamp(candidate.createdAt, "createdAt"),
-    updatedAt: validateTimestamp(candidate.updatedAt, "updatedAt")
-  };
-}
-function readRecordFile(filePath, expectedWorkspace) {
-  let parsed;
-  try {
-    parsed = JSON.parse(import_node_fs22.default.readFileSync(filePath, "utf-8"));
-  } catch (error) {
-    if (error instanceof SyntaxError) {
-      throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
-    }
-    throw error;
-  }
-  return validateRecord(parsed, expectedWorkspace);
-}
-function listWorkspaceOwnership(repoPath) {
-  const directory = ownershipDirectory(repoPath);
-  return listWorkspaceOwnershipInDirectory(directory);
-}
-function listWorkspaceOwnershipInDirectory(directory) {
-  let entries;
-  try {
-    entries = import_node_fs22.default.readdirSync(directory, { withFileTypes: true });
-  } catch (error) {
-    if (error.code === "ENOENT") return [];
-    throw error;
-  }
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
-    const workspace = entry.name.slice(0, -".json".length);
-    validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path22.default.join(directory, entry.name), workspace);
-  });
-}
-function writeWorkspaceOwnershipInDirectory(directory, input2) {
-  const workspace = validateWorkspace(input2.workspace, "workspace");
-  const devpodId = validateWorkspace(input2.devpodId, "devpodId");
-  const worktreePath = comparableWorkspacePath(input2.worktreePath);
-  const filePath = import_node_path22.default.join(directory, `${workspace}.json`);
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const records = listWorkspaceOwnershipInDirectory(directory);
-  const existing = records.find((record2) => record2.workspace === workspace);
-  if (existing && !sameWorkspacePath(existing.worktreePath, worktreePath)) {
-    throw new Error(
-      `Workspace '${workspace}' already belongs to '${existing.worktreePath}', refusing '${worktreePath}'.`
-    );
-  }
-  const pathOwner = records.find(
-    (record2) => record2.workspace !== workspace && sameWorkspacePath(record2.worktreePath, worktreePath)
-  );
-  if (pathOwner) {
-    throw new Error(
-      `Worktree '${worktreePath}' is already owned by workspace '${pathOwner.workspace}'.`
-    );
-  }
-  if (existing && existing.devpodId !== devpodId) {
-    throw new Error(
-      `Workspace '${workspace}' already owns DevPod '${existing.devpodId}', refusing '${devpodId}'.`
-    );
-  }
-  const record = {
-    version: OWNERSHIP_VERSION,
-    workspace,
-    worktreePath,
-    branch: input2.branch ?? null,
-    devpodId,
-    createdAt: existing?.createdAt ?? validateTimestamp(now, "createdAt"),
-    updatedAt: validateTimestamp(now, "updatedAt")
-  };
-  writeFileAtomically(filePath, `${JSON.stringify(record, null, 2)}
-`);
-  return record;
-}
-function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path22.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
-  try {
-    import_node_fs22.default.rmSync(filePath);
-    return true;
-  } catch (error) {
-    if (error.code === "ENOENT") return false;
-    throw error;
-  }
-}
-function sameOwnershipRecord(left, right) {
-  return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
+      let message = `devsy workspace up failed for '${devsyId ?? options.repoPath}'.`;
+      if (result.error?.message) message += ` ${result.error.message}`;
+      if (AGENT_ACQUISITION_RE.test(result.stderrTail)) {
+        message += ` Devsy rejected the verified agent source. Run: ${DEVSY_AGENT_SETUP_COMMAND}`;
+      }
+      if (failedStartMayHaveAttached(devsyId, options.repoPath)) {
+        throw new DevsyStartPostconditionError(message);
+      }
+      throw new Error(message);
+    }
+    try {
+      const attached = listDevsyWorkspaces();
+      devsyId ??= selectDevsyWorkspace(attached, options.repoPath)?.id;
+      if (!devsyId) {
+        throw new Error(`Devsy did not attach '${options.repoPath}' after startup.`);
+      }
+      const ownership = inspectDevsyWorkspaceOwnership(attached, devsyId, options.repoPath);
+      if (ownership.status === "conflict") throw new Error(ownership.reason);
+      if (ownership.status !== "owned") {
+        throw new Error(
+          `Devsy did not attach '${options.repoPath}' as '${devsyId}' after startup.`
+        );
+      }
+      return devsyId;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new DevsyStartPostconditionError(message);
+    }
+  });
 }
-function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path22.default.join(
-    directory,
-    `${validateWorkspace(expected.workspace, "workspace")}.json`
-  );
-  let current;
-  try {
-    current = readRecordFile(filePath, expected.workspace);
-  } catch (error) {
-    if (error.code === "ENOENT") return "absent";
-    throw error;
+var import_node_child_process16, import_node_fs22, import_node_path22, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS, DevsyStartPostconditionError, AGENT_ACQUISITION_RE, DEVSY_STDERR_TAIL_BYTES;
+var init_devsy_mutation = __esm({
+  "src/core/devsy-mutation.ts"() {
+    "use strict";
+    import_node_child_process16 = require("child_process");
+    import_node_fs22 = __toESM(require("fs"));
+    import_node_path22 = __toESM(require("path"));
+    init_devsy_agent();
+    init_devsy_workspaces();
+    init_file_lock();
+    init_managed_devsy_stop();
+    init_router();
+    DEVSY_MUTATION_LOCK_FILE = import_node_path22.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+    DEVSY_MUTATION_WAIT_MS = 18e5;
+    DevsyStartPostconditionError = class extends Error {
+    };
+    AGENT_ACQUISITION_RE = /inject agent.*agent binary not found/i;
+    DEVSY_STDERR_TAIL_BYTES = 8192;
   }
-  if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs22.default.rmSync(filePath);
-  return "removed";
-}
-function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
-  const directory = ownershipDirectory(repoPath);
-  import_node_fs22.default.mkdirSync(directory, { recursive: true });
+});
+
+// src/core/devpod-mutation.ts
+function withMutationLock2(activity, target, operation) {
+  import_node_fs23.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
-    import_node_path22.default.join(directory, ".lock"),
+    DEVPOD_MUTATION_LOCK_FILE,
     {
-      activity: "workspace ownership transaction",
-      target: `'${repoPath}'`,
-      waitMs: options.waitMs ?? 5e3
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVPOD_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
     },
-    () => operation({
-      list: () => listWorkspaceOwnershipInDirectory(directory),
-      write: (input2) => writeWorkspaceOwnershipInDirectory(directory, input2),
-      remove: (workspace) => removeWorkspaceOwnershipInDirectory(directory, workspace),
-      removeIfMatches: (expected) => removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected)
-    })
+    operation
   );
 }
-function providerPathOwner(providerWorkspaces, worktreePath) {
-  const owners = providerWorkspaces.filter(
-    (workspace) => sameWorkspacePath(workspace.source.localFolder, worktreePath)
-  );
-  if (owners.length > 1) {
+function commandFailure3(result) {
+  return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+}
+function runDevpodAction(action2, devpodId, force = false) {
+  const args = action2 === "delete" ? [action2, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action2, devpodId];
+  const result = (0, import_node_child_process17.spawnSync)("devpod", args, { encoding: "utf-8" });
+  if (result.status !== 0) {
     throw new Error(
-      `Worktree '${worktreePath}' is registered by multiple workspace runtimes; no identity was claimed.`
+      `devpod ${action2}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure3(result) || "unknown error"}`
     );
   }
-  return owners[0];
-}
-function persistedWorkspaceOwners(repoPath, worktreePath) {
-  const owners = /* @__PURE__ */ new Map();
-  for (const worktree of listGitWorktrees(repoPath)) {
-    if (sameWorkspacePath(worktree.path, worktreePath)) continue;
-    let workspace;
-    try {
-      workspace = readPersistedWorkspace(worktree.path);
-    } catch (error) {
-      if (!import_node_fs22.default.existsSync(worktree.path)) continue;
-      throw error;
-    }
-    if (!workspace) continue;
-    const existing = owners.get(workspace);
-    if (existing && !sameWorkspacePath(existing, worktree.path)) {
-      throw new Error(`Persisted workspace identity '${workspace}' belongs to multiple worktrees.`);
-    }
-    owners.set(workspace, worktree.path);
-  }
-  return owners;
 }
-function claimConflict(workspace, devpodId, worktreePath, records, providerWorkspaces, persistedOwners, exactRecord) {
-  const recordOwner = records.find(
-    (record) => record !== exactRecord && (record.workspace === workspace || record.devpodId === devpodId)
-  );
-  if (recordOwner) {
-    return `workspace owner record '${recordOwner.workspace}' for '${recordOwner.worktreePath}'`;
-  }
-  const providerOwner = providerWorkspaces.find(
-    (providerWorkspace) => providerWorkspace.id === devpodId && !sameWorkspacePath(providerWorkspace.source.localFolder, worktreePath)
+function inspectExactOwnership2(devpodId, worktreePath) {
+  const ownership = inspectDevpodWorkspaceOwnership(
+    listDevpodWorkspaces(worktreePath),
+    devpodId,
+    worktreePath
   );
-  if (providerOwner) {
-    return `workspace runtime identity '${providerOwner.id}' already belongs to '${providerOwner.source.localFolder}'`;
-  }
-  const persistedOwner = persistedOwners.get(workspace);
-  if (persistedOwner) {
-    return `persisted checkout metadata for '${persistedOwner}'`;
-  }
-  return void 0;
+  if (ownership.status === "conflict") throw new Error(ownership.reason);
+  return ownership;
 }
-function claimWorkspaceIdentity(repoPath, input2) {
-  const worktreePath = comparableWorkspacePath(repoPath);
-  const exactProvider = providerPathOwner(input2.providerWorkspaces, worktreePath);
-  return withWorkspaceOwnershipTransaction(repoPath, (transaction) => {
-    const records = transaction.list();
-    const exactRecords = records.filter(
-      (record) => sameWorkspacePath(record.worktreePath, worktreePath)
-    );
-    if (exactRecords.length > 1) {
-      throw new Error(
-        `Worktree '${worktreePath}' has multiple workspace owner records; no identity was claimed.`
-      );
+function mutateOwnedDevpodWorkspace(action2, devpodId, worktreePath) {
+  return withMutationLock2(`DevPod ${action2}`, worktreePath, () => {
+    const before = inspectExactOwnership2(devpodId, worktreePath);
+    if (before.status === "absent") return { status: "absent" };
+    runDevpodAction(action2, devpodId);
+    let after = inspectExactOwnership2(devpodId, worktreePath);
+    if (action2 === "stop" && after.status !== "owned") {
+      throw new Error(`DevPod '${devpodId}' no longer owns '${worktreePath}' after provider stop.`);
     }
-    const exactRecord = exactRecords[0];
-    const persisted = readPersistedWorkspace(worktreePath);
-    const persistedOwners = persistedWorkspaceOwners(repoPath, worktreePath);
-    if (exactRecord) {
-      if (persisted && persisted !== exactRecord.workspace) {
+    if (action2 === "delete" && after.status === "owned") {
+      const runtime = inspectDevpodRuntimeStatus(devpodId, worktreePath);
+      if (runtime !== "not-found") {
         throw new Error(
-          `Persisted workspace identity '${persisted}' disagrees with owner record '${exactRecord.workspace}'.`
+          `DevPod '${devpodId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
         );
       }
-      if (exactProvider && exactProvider.id !== exactRecord.devpodId) {
-        throw new Error(
-          `Workspace runtime '${exactProvider.id}' disagrees with owner record '${exactRecord.devpodId}'.`
-        );
+      after = inspectExactOwnership2(devpodId, worktreePath);
+      if (after.status === "owned") {
+        runDevpodAction("delete", devpodId, true);
+        after = inspectExactOwnership2(devpodId, worktreePath);
       }
-      const conflict2 = claimConflict(
-        exactRecord.workspace,
-        exactRecord.devpodId,
-        worktreePath,
-        records,
-        input2.providerWorkspaces,
-        persistedOwners,
-        exactRecord
-      );
-      if (conflict2) {
+      if (after.status !== "absent") {
         throw new Error(
-          `Workspace '${exactRecord.workspace}' conflicts with ${conflict2}; no identity was claimed.`
+          `DevPod '${devpodId}' still owns '${worktreePath}' after forced provider delete.`
         );
       }
-      if (!persisted) persistWorkspace(worktreePath, exactRecord.workspace);
-      return transaction.write({
-        workspace: exactRecord.workspace,
-        worktreePath,
-        branch: input2.branch ?? null,
-        devpodId: exactRecord.devpodId
-      });
     }
-    if (persisted && exactProvider && persisted !== exactProvider.id) {
-      throw new Error(
-        `Persisted workspace identity '${persisted}' disagrees with workspace runtime '${exactProvider.id}'.`
-      );
+    return { status: "changed" };
+  });
+}
+function stopOwnedDevpodWorkspace(devpodId, worktreePath) {
+  try {
+    resetWorkspaceRuntimeCaches();
+    if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
+      return stopOwnedDevsyWorkspace(devpodId, worktreePath);
     }
-    let workspace = persisted ?? exactProvider?.id;
-    let devpodId = exactProvider?.id ?? persisted;
-    if (!workspace || !devpodId) {
-      if (input2.unavailableRuntimes.length > 0) {
-        throw new Error(
-          `Cannot claim a new workspace identity because these runtime registries are unavailable: ${input2.unavailableRuntimes.join(", ")}.`
-        );
-      }
-      const candidate = workspaceIdentityCandidates(input2.source).find(
-        (next) => !claimConflict(
-          next,
-          next,
-          worktreePath,
-          records,
-          input2.providerWorkspaces,
-          persistedOwners
-        )
-      );
-      if (!candidate) {
-        throw new Error(
-          `Could not allocate a collision-safe workspace identity for '${worktreePath}'.`
-        );
+    return mutateOwnedDevpodWorkspace("stop", devpodId, worktreePath);
+  } finally {
+    resetWorkspaceRuntimeCaches();
+  }
+}
+function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
+  if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
+    const result2 = deleteOwnedDevsyWorkspace(devpodId, worktreePath);
+    resetWorkspaceRuntimeCaches();
+    return result2;
+  }
+  const result = mutateOwnedDevpodWorkspace("delete", devpodId, worktreePath);
+  resetWorkspaceRuntimeCaches();
+  return result;
+}
+async function startDevpodWorkspace(options) {
+  if (resolveWorkspaceRuntimeOrDefault(options.repoPath) === "devsy") {
+    try {
+      const result = await startDevsyWorkspace({
+        repoPath: options.repoPath,
+        devsyId: options.devpodId,
+        devcontainerPath: options.devcontainerPath,
+        recreate: options.recreate,
+        quiet: options.quiet,
+        workspace: options.workspace,
+        inactivityTimeout: readWorkspaceRuntimeConfig().devsyInactivityTimeout
+      });
+      resetWorkspaceRuntimeCaches();
+      return result;
+    } catch (error) {
+      if (error instanceof DevsyStartPostconditionError) {
+        resetWorkspaceRuntimeCaches();
+        throw new DevpodStartPostconditionError(error.message);
       }
-      workspace = candidate;
-      devpodId = candidate;
+      throw error;
     }
-    const conflict = claimConflict(
-      workspace,
-      devpodId,
-      worktreePath,
-      records,
-      input2.providerWorkspaces,
-      persistedOwners
-    );
-    if (conflict) {
-      throw new Error(
-        `Workspace '${workspace}' conflicts with ${conflict}; no identity was claimed.`
+  }
+  const activity = options.recreate ? "DevPod recreate" : "DevPod start";
+  return withMutationLock2(activity, options.repoPath, () => {
+    const workspaces = listDevpodWorkspaces(options.repoPath);
+    let devpodId = options.devpodId ?? selectDevpodWorkspace(workspaces, options.repoPath)?.id;
+    if (devpodId) {
+      const before = inspectDevpodWorkspaceOwnership(workspaces, devpodId, options.repoPath);
+      if (before.status === "conflict") throw new Error(before.reason);
+      if (options.recreate && before.status !== "owned") {
+        throw new Error(`Cannot recreate DevPod '${devpodId}' without one exact owner.`);
+      }
+    } else if (options.recreate) {
+      throw new Error("Cannot recreate a DevPod before its exact id is known.");
+    }
+    const args = ["up", options.repoPath];
+    if (devpodId) args.push("--id", devpodId);
+    if (options.devcontainerPath) {
+      args.push("--devcontainer-path", options.devcontainerPath);
+    }
+    args.push("--open-ide=false");
+    if (options.workspace) {
+      args.push(
+        "--workspace-env",
+        `WORKSPACE=${options.workspace.token}`,
+        "--workspace-env",
+        `DEVROUTER_WORKSPACE=${options.workspace.token}`
       );
     }
-    const written = transaction.write({
-      workspace,
-      worktreePath,
-      branch: input2.branch ?? null,
-      devpodId
+    if (options.recreate) args.push("--recreate");
+    const env = { ...process.env };
+    if (options.workspace) {
+      env.WORKSPACE = options.workspace.token;
+      env.DEVROUTER_WORKSPACE = options.workspace.token;
+      env.DEVROUTER_GIT_COMMON_DIR = options.workspace.gitCommonDir;
+      env.DEVCONTAINER_COMPOSE_OVERLAY = "docker-compose.devrouter.yml";
+    } else {
+      delete env.WORKSPACE;
+      delete env.DEVROUTER_WORKSPACE;
+      delete env.DEVROUTER_GIT_COMMON_DIR;
+      delete env.DEVCONTAINER_COMPOSE_OVERLAY;
+    }
+    const result = (0, import_node_child_process17.spawnSync)("devpod", args, {
+      stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
+      env
     });
+    if (result.status !== 0) {
+      throw new Error(`devpod up failed for '${devpodId ?? options.repoPath}'.`);
+    }
     try {
-      persistWorkspace(worktreePath, workspace);
-    } catch (error) {
-      const cleanup = transaction.removeIfMatches(written);
-      if (cleanup !== "removed") {
-        const detail = error instanceof Error ? error.message : String(error);
+      const attached = listDevpodWorkspaces(options.repoPath);
+      devpodId ??= selectDevpodWorkspace(attached, options.repoPath)?.id;
+      if (!devpodId) {
+        throw new Error(`DevPod did not attach '${options.repoPath}' after startup.`);
+      }
+      const ownership = inspectDevpodWorkspaceOwnership(attached, devpodId, options.repoPath);
+      if (ownership.status === "conflict") throw new Error(ownership.reason);
+      if (ownership.status !== "owned") {
         throw new Error(
-          `Could not persist workspace identity and owner-record rollback was '${cleanup}': ${detail}`
+          `DevPod did not attach '${options.repoPath}' as '${devpodId}' after startup.`
         );
       }
-      throw error;
+      resetWorkspaceRuntimeCaches();
+      return devpodId;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new DevpodStartPostconditionError(message);
     }
-    return written;
   });
 }
-function removeWorkspaceOwnership(repoPath, workspace) {
-  return withWorkspaceOwnershipTransaction(
-    repoPath,
-    (transaction) => transaction.remove(workspace)
-  );
-}
-function inspectWorkspaceOwnership(record, worktrees, devpods) {
-  const worktree = worktrees.find(
-    (candidate) => sameWorkspacePath(candidate.path, record.worktreePath)
-  );
-  const devpodOwnership = devpods ? inspectDevpodWorkspaceOwnership(devpods, record.devpodId, record.worktreePath) : void 0;
-  const devpodStatus = devpodOwnership?.status ?? "unknown";
-  if (devpodStatus === "conflict") {
-    return { ownerStatus: "conflict", devpodStatus, worktree };
-  }
-  if (worktree?.locked) {
-    return { ownerStatus: "locked", devpodStatus, worktree };
-  }
-  if ((!worktree || worktree.prunable) && import_node_fs22.default.existsSync(record.worktreePath)) {
-    return { ownerStatus: "conflict", devpodStatus, worktree };
-  }
-  if (!worktree || worktree.prunable) {
-    return { ownerStatus: "missing", devpodStatus, worktree };
-  }
-  let persisted;
-  try {
-    persisted = readPersistedWorkspace(worktree.path);
-  } catch {
-    return { ownerStatus: "conflict", devpodStatus, worktree };
-  }
-  return {
-    ownerStatus: persisted === record.workspace ? "present" : "conflict",
-    devpodStatus,
-    worktree
-  };
-}
-function listMissingWorkspaceOwnership(repoPath) {
-  const worktrees = listGitWorktrees(repoPath);
-  return listWorkspaceOwnership(repoPath).filter(
-    (record) => inspectWorkspaceOwnership(record, worktrees, void 0).ownerStatus === "missing"
-  );
-}
-var import_node_child_process17, import_node_fs22, import_node_path22, READ_ONLY_GIT_ENV, OWNERSHIP_VERSION, OWNERSHIP_DIR;
-var init_workspace_ownership = __esm({
-  "src/core/workspace-ownership.ts"() {
+var import_node_child_process17, import_node_fs23, import_node_path23, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS, DevpodStartPostconditionError;
+var init_devpod_mutation = __esm({
+  "src/core/devpod-mutation.ts"() {
     "use strict";
     import_node_child_process17 = require("child_process");
-    import_node_fs22 = __toESM(require("fs"));
-    import_node_path22 = __toESM(require("path"));
-    init_atomic_file();
+    import_node_fs23 = __toESM(require("fs"));
+    import_node_path23 = __toESM(require("path"));
     init_devpod_workspaces();
+    init_devsy_mutation();
     init_file_lock();
-    init_workspace();
-    READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
-    OWNERSHIP_VERSION = 1;
-    OWNERSHIP_DIR = import_node_path22.default.join("devrouter", "workspaces");
+    init_router();
+    init_workspace_runtime();
+    DEVPOD_MUTATION_LOCK_FILE = import_node_path23.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+    DEVPOD_MUTATION_WAIT_MS = 18e5;
+    DevpodStartPostconditionError = class extends Error {
+    };
   }
 });
 
@@ -8403,10 +8973,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path23.default.join(comparableRepo, "trees") + import_node_path23.default.sep;
+  const localRoot = import_node_path24.default.join(comparableRepo, "trees") + import_node_path24.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path23.default.basename(comparableRepo)}-`;
-  return import_node_path23.default.dirname(comparableWorktree) === import_node_path23.default.dirname(comparableRepo) && import_node_path23.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path24.default.basename(comparableRepo)}-`;
+  return import_node_path24.default.dirname(comparableWorktree) === import_node_path24.default.dirname(comparableRepo) && import_node_path24.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -8658,11 +9228,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path23;
+var import_node_path24;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path23 = __toESM(require("path"));
+    import_node_path24 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -8732,11 +9302,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs23.default.existsSync(absolutePath)) {
+      if (!import_node_fs24.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs23.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs24.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml5.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -9015,7 +9585,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.51" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.53" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -9045,9 +9615,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path24.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path25.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs23.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs24.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -9090,8 +9660,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path24.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs23.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path25.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs24.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -9235,12 +9805,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs23, import_node_path24, import_yaml5, POSTGRES_DEFAULTS;
+var import_node_fs24, import_node_path25, import_yaml5, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs23 = __toESM(require("fs"));
-    import_node_path24 = __toESM(require("path"));
+    import_node_fs24 = __toESM(require("fs"));
+    import_node_path25 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -9687,81 +10257,54 @@ var init_http_route_probe = __esm({
   }
 });
 
-// src/core/route-publication.ts
-function routedAppsFromConfig(config) {
-  return config.apps.filter((app) => app.kind !== "dependency");
-}
-function configuredProxyAppsFromConfig(config) {
-  return routedAppsFromConfig(config).filter(
-    (app) => app.runtime === "proxy"
-  );
-}
-function proxyAppsFromConfig(config) {
-  const routedApps = routedAppsFromConfig(config);
-  const proxyApps = configuredProxyAppsFromConfig(config);
-  const unsupported = routedApps.filter((app) => app.runtime !== "proxy");
-  if (unsupported.length > 0) {
-    throw new Error(
-      `Environment reconciliation supports proxy runtime apps only; unsupported: ${unsupported.map((app) => `${app.name} (${app.runtime})`).join(", ")}`
-    );
-  }
-  return proxyApps;
+// src/core/traefik-route-health.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function ensureRouteInfrastructure(apps, options = {}) {
-  ensureRouterFiles();
-  await ensureNetwork(DEVNET_NAME);
-  const tlsCoverage = await ensureTLSHostsCovered(
-    apps.map((app) => app.host),
-    options
+function inspectRouterApi(protocol) {
+  const result = (0, import_node_child_process20.spawnSync)(
+    "curl",
+    [
+      "--silent",
+      "--show-error",
+      "--fail",
+      "--max-time",
+      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
+      `${ROUTER_API_BASE}/${protocol}/routers?per_page=${ROUTER_API_PAGE_SIZE}`
+    ],
+    { encoding: "utf-8" }
   );
-  for (const app of apps) {
-    if (app.protocol === "tcp") {
-      if (!isTLSEnabled()) {
-        throw new Error(
-          `TCP route '${app.name}' requires TLS. Run: ${tlsSetupCommand(options.repoPath)}`
-        );
-      }
-      activateTcpProtocol(app.tcpProtocol);
-    }
-  }
-  startRouterStack();
-  return tlsCoverage;
-}
-async function replacePublishedProxyRoutes(repoPath, config, workspace) {
-  const apps = proxyAppsFromConfig(config);
-  const tlsCoverage = await ensureRouteInfrastructure(apps, { repoPath });
-  const routes = apps.map((app) => {
-    const upstream = parseUpstream(app.upstream);
+  if (result.status !== 0) {
     return {
-      name: app.name,
-      host: app.host,
-      protocol: app.protocol,
-      tcpProtocol: app.protocol === "tcp" ? app.tcpProtocol : void 0,
-      repoPath,
-      port: upstream.port,
-      mode: "proxy",
-      upstreamHost: upstream.upstreamHost,
-      workspace
+      ok: false,
+      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
     };
-  });
-  replaceHostRoutesForRepo(repoPath, routes);
-  return { routes, tlsRefreshed: tlsCoverage.refreshed };
-}
-var init_route_publication = __esm({
-  "src/core/route-publication.ts"() {
-    "use strict";
-    init_docker();
-    init_host_routes();
-    init_router();
-    init_tls();
   }
-});
-
-// src/core/traefik-route-health.ts
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
+  }
+  if (!Array.isArray(value)) {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
+  }
+  return {
+    ok: true,
+    reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
+    names: new Set(
+      value.flatMap((item) => {
+        if (!item || typeof item !== "object") return [];
+        const name = item.name;
+        return typeof name === "string" ? [name] : [];
+      })
+    )
+  };
+}
+function isRecord3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function inspectRouterApi(protocol) {
+function inspectNamedRouterApi(protocol, resource, name) {
   const result = (0, import_node_child_process20.spawnSync)(
     "curl",
     [
@@ -9769,8 +10312,8 @@ function inspectRouterApi(protocol) {
       "--show-error",
       "--fail",
       "--max-time",
-      "2",
-      `${ROUTER_API_BASE}/${protocol}/routers?per_page=${ROUTER_API_PAGE_SIZE}`
+      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
+      `${ROUTER_API_BASE}/${protocol}/${resource}/${encodeURIComponent(name)}`
     ],
     { encoding: "utf-8" }
   );
@@ -9784,23 +10327,135 @@ function inspectRouterApi(protocol) {
   try {
     value = JSON.parse(result.stdout);
   } catch {
-    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned invalid JSON`
+    };
   }
-  if (!Array.isArray(value)) {
-    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
+  if (!isRecord3(value)) {
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned a non-object`
+    };
+  }
+  return { ok: true, value };
+}
+function renderExpectedRoute(route) {
+  const protocol = route.protocol ?? "http";
+  const routerName = buildHostRouteRouterName(route.repoPath, route.name);
+  const routeState = {
+    id: buildHostRouteId(route.repoPath, route.name),
+    name: route.name,
+    host: route.host,
+    protocol,
+    tcpProtocol: route.tcpProtocol,
+    repoPath: route.repoPath,
+    port: route.port,
+    mode: route.mode,
+    upstreamHost: route.upstreamHost,
+    pid: route.pid,
+    command: route.command,
+    workspace: route.workspace,
+    createdAt: "",
+    updatedAt: ""
+  };
+  const document = buildHostRoutesDocument([routeState], false);
+  const protocolDocument = document[protocol];
+  if (!isRecord3(protocolDocument)) return void 0;
+  const routers = protocolDocument.routers;
+  const services = protocolDocument.services;
+  if (!isRecord3(routers) || !isRecord3(services)) return void 0;
+  const routerKey = routerName.slice(0, routerName.lastIndexOf("@"));
+  const router = routers[routerKey];
+  const service = services[routerKey];
+  if (!isRecord3(router) || !isRecord3(service)) return void 0;
+  const rule = router.rule;
+  const serviceReference = router.service;
+  const loadBalancer = service.loadBalancer;
+  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
+  if (typeof rule !== "string" || serviceReference !== routerKey || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(servers[0])) {
+    return void 0;
   }
+  const serverField = protocol === "http" ? "url" : "address";
+  const server = servers[0][serverField];
+  if (typeof server !== "string") return void 0;
+  const provider = routerName.slice(routerName.lastIndexOf("@")).trim();
+  if (!provider.startsWith("@")) return void 0;
   return {
-    ok: true,
-    reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
-    names: new Set(
-      value.flatMap((item) => {
-        if (!item || typeof item !== "object") return [];
-        const name = item.name;
-        return typeof name === "string" ? [name] : [];
-      })
-    )
+    protocol,
+    routerName,
+    serviceKey: routerKey,
+    serviceName: `${routerKey}${provider}`,
+    rule,
+    serverField,
+    server
+  };
+}
+function inspectExpectedRouteMatch(route) {
+  const expected = renderExpectedRoute(route);
+  const routeName = buildHostRouteRouterName(route.repoPath, route.name);
+  if (!expected) {
+    return {
+      ok: false,
+      routes: [routeName],
+      details: "host-route renderer returned an incomplete route configuration"
+    };
+  }
+  const routerResult = inspectNamedRouterApi(expected.protocol, "routers", expected.routerName);
+  if (!routerResult.ok) {
+    return { ok: false, routes: [routeName], details: routerResult.details };
+  }
+  if (routerResult.value.status !== "enabled" || routerResult.value.name !== expected.routerName || routerResult.value.rule !== expected.rule || routerResult.value.service !== expected.serviceKey && routerResult.value.service !== expected.serviceName) {
+    return {
+      ok: false,
+      routes: [routeName],
+      details: "active Traefik router does not match the rendered route"
+    };
+  }
+  const serviceResult = inspectNamedRouterApi(expected.protocol, "services", expected.serviceName);
+  if (!serviceResult.ok) {
+    return { ok: false, routes: [routeName], details: serviceResult.details };
+  }
+  const loadBalancer = serviceResult.value.loadBalancer;
+  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
+  const server = Array.isArray(servers) && servers.length === 1 ? servers[0] : void 0;
+  if (serviceResult.value.status !== "enabled" || serviceResult.value.name !== expected.serviceName || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(server) || server[expected.serverField] !== expected.server) {
+    return {
+      ok: false,
+      routes: [routeName],
+      details: "active Traefik service does not match the rendered route"
+    };
+  }
+  return { ok: true };
+}
+function inspectExpectedRouteMatches(routes) {
+  const mismatched = [];
+  const failures = [];
+  for (const route of routes) {
+    const result = inspectExpectedRouteMatch(route);
+    if (!result.ok) {
+      mismatched.push(...result.routes);
+      failures.push(result.details);
+    }
+  }
+  return mismatched.length === 0 ? { ok: true } : {
+    ok: false,
+    routes: mismatched,
+    details: failures.join("; ")
   };
 }
+async function waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  let result;
+  do {
+    result = inspectExpectedRouteMatches(routes);
+    if (result.ok) return result;
+    if (Date.now() < deadline) {
+      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
+    }
+  } while (Date.now() < deadline);
+  return result;
+}
 function inspectExpectedRoutes(routes, expectation) {
   const mismatched = [];
   const failures = [];
@@ -9857,7 +10512,11 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     pollIntervalMs
   );
   if (initial.ok) return { restarted: false };
-  import_node_fs24.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  if (options.allowRestart === false)
+    throw new Error(
+      "Traefik routes did not reload; shared router restart is disabled for this operation."
+    );
+  import_node_fs25.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -9887,21 +10546,33 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
 async function ensureTraefikRoutesLoaded(routes, options = {}) {
   return ensureTraefikRouteExpectation(routes, "loaded", options);
 }
+async function ensureTraefikRoutesMatch(routes, options = {}) {
+  if (routes.length === 0) return;
+  const timeoutMs = options.initialTimeoutMs ?? options.recoveryTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const result = await waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs);
+  if (!result.ok) {
+    throw new Error(
+      `Traefik route configuration did not match rendered routes: ${result.routes.join(", ")} (${result.details})`
+    );
+  }
+}
 async function ensureTraefikRoutesRemoved(routes, options = {}) {
   return ensureTraefikRouteExpectation(routes, "removed", options);
 }
-var import_node_child_process20, import_node_fs24, import_node_path25, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
+var import_node_child_process20, import_node_fs25, import_node_path26, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
 var init_traefik_route_health = __esm({
   "src/core/traefik-route-health.ts"() {
     "use strict";
     import_node_child_process20 = require("child_process");
-    import_node_fs24 = __toESM(require("fs"));
-    import_node_path25 = __toESM(require("path"));
+    import_node_fs25 = __toESM(require("fs"));
+    import_node_path26 = __toESM(require("path"));
     init_file_lock();
     init_host_routes();
     init_router();
     ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-    ROUTER_RELOAD_LOCK_FILE = import_node_path25.default.join(DEVROUTER_HOME, "router-reload.lock");
+    ROUTER_RELOAD_LOCK_FILE = import_node_path26.default.join(DEVROUTER_HOME, "router-reload.lock");
+    ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
     DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
     DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
     DEFAULT_POLL_INTERVAL_MS = 250;
@@ -9912,11 +10583,11 @@ var init_traefik_route_health = __esm({
 // src/core/workspace-ensure.ts
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path27.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path27.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -10106,7 +10777,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path27.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -10165,7 +10836,7 @@ function validateWorkspaceContainers(containers, options) {
   if (options.target.kind === "linked") {
     assertOverlay(appContainer, options.repoPath);
   }
-  assertReady(appContainer, "Workspace app");
+  if (!options.allowStopped) assertReady(appContainer, "Workspace app");
   if (options.target.kind === "linked") {
     const gitCommonDir = options.target.gitCommonDir;
     const gitMount = appContainer.mounts.find(
@@ -10317,6 +10988,142 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
+function resolveRepairTarget(repoPath, linked) {
+  const workspace = linked ? readPersistedWorkspace(repoPath) : void 0;
+  if (linked && !workspace) throw new Error("Repair requires an existing workspace identity.");
+  const state = readManagedRuntimeState(repoPath, workspace);
+  if (state?.status !== "degraded") {
+    throw new Error("Repair requires a persisted degraded managed runtime.");
+  }
+  resetWorkspaceRuntimeCaches();
+  const snapshots = getWorkspaceRegistrySnapshots();
+  if (snapshots.unavailable.length) throw new Error("Repair cannot read every provider registry.");
+  const matches = [...snapshots.devpod ?? [], ...snapshots.devsy ?? []].filter(
+    (entry) => entry.id === state.devpodId || sameWorkspacePath(entry.source.localFolder, repoPath)
+  );
+  if (matches.length !== 1 || matches[0].id !== state.devpodId || !sameWorkspacePath(matches[0].source.localFolder, repoPath)) {
+    throw new Error("Repair requires one exact retained provider registration.");
+  }
+  const selected = snapshots[resolveWorkspaceRuntimeOrDefault(repoPath)] ?? [];
+  if (!selected.some(
+    (entry) => entry.id === state.devpodId && sameWorkspacePath(entry.source.localFolder, repoPath)
+  )) {
+    throw new Error("Repair provider selection does not own the retained workspace.");
+  }
+  if (workspace) {
+    const owner = readWorkspaceOwnership(repoPath, workspace);
+    if (!owner || owner.devpodId !== state.devpodId || !sameWorkspacePath(owner.worktreePath, repoPath)) {
+      throw new Error("Repair requires the existing exact workspace owner record.");
+    }
+    return {
+      kind: "linked",
+      workspace,
+      devpodId: state.devpodId,
+      hadExactDevpod: true,
+      gitCommonDir: resolveGitCommonDir(repoPath)
+    };
+  }
+  return { kind: "primary", devpodId: state.devpodId, hadExactDevpod: true };
+}
+function assertRepairBaseline(options) {
+  const { repoPath, target, state, plan, config, profile, processes } = options;
+  const desired = {
+    apps: proxyAppsFromConfig(config).map((app) => app.name),
+    services: plan.desiredProfileServices,
+    processes
+  };
+  if (state.profile !== profile || state.sourceConfigSha256 !== plan.sourceConfigSha256 || state.effectiveConfigSha256 !== plan.effectiveConfigSha256 || Object.keys(desired).some((key) => {
+    const resource = key;
+    return JSON.stringify([...desired[resource]].sort()) !== JSON.stringify([...state.desired[resource]].sort());
+  }) || inspectManagedDevcontainerGeneratedConfig(plan).status !== "valid") {
+    throw new Error(
+      "Repair requires the recorded profile, resource sets, and unchanged managed configuration."
+    );
+  }
+  if (options.routes.some(
+    (route) => route.workspace !== target.workspace || !desired.apps.includes(route.name)
+  )) {
+    throw new Error("Repair refuses unexpected active routes.");
+  }
+  const containers = inspectWorkspaceContainers();
+  const retained = plan.desiredServices.map((service) => {
+    const matches = exactWorkspaceServiceContainers(
+      containers,
+      repoPath,
+      state.composeProject,
+      service,
+      plan.composeFiles
+    );
+    if (matches.length !== 1)
+      throw new Error(`Repair requires one retained container for '${service}'.`);
+    return matches[0];
+  });
+  const primary = retained.find(
+    (c) => c.labels["com.docker.compose.service"] === plan.primaryService
+  );
+  if (!primary) throw new Error("Repair cannot identify the retained primary container.");
+  if (!primary.state.Running && (options.routes.length > 0 || containers.some(
+    (container) => container.labels["com.docker.compose.project"] === state.composeProject && container.state.Running !== false
+  ))) {
+    throw new Error(
+      "Repair of a stopped primary requires all exact project containers stopped and no checkout routes."
+    );
+  }
+  validateWorkspaceContainers(containers, {
+    repoPath,
+    target,
+    upstreamHosts: [],
+    allowStopped: !primary.state.Running
+  });
+  for (const container of containers) {
+    if (container.labels["com.docker.compose.project"] !== state.composeProject) continue;
+    const service = container.labels["com.docker.compose.service"] ?? "";
+    if (typeof container.state.Running !== "boolean" || !hasExactComposeIdentity(container, {
+      repoPath,
+      service,
+      composeProject: state.composeProject,
+      composeFiles: plan.composeFiles
+    }) || container.state.Running && !plan.desiredServices.includes(service)) {
+      throw new Error("Repair refuses foreign or unexpected active Compose resources.");
+    }
+  }
+  const workspacePath = primary.mounts.find(
+    (m) => m.Type === "bind" && sameWorkspacePath(m.Source, repoPath)
+  )?.Destination;
+  if (!workspacePath) throw new Error("Repair cannot prove the primary workspace mount.");
+  for (const name of primary.state.Running ? config.managedRuntime?.processes ?? [] : []) {
+    if (!processes.includes(name) && runManagedProcessAction({
+      container: { id: primary.id, workspacePath },
+      name,
+      action: "status",
+      quiet: true
+    }) !== "stopped") {
+      throw new Error(`Repair refuses unexpected or unproven process '${name}'.`);
+    }
+  }
+  assertManagedContainerConfigUnchanged({
+    plan,
+    containers: retained,
+    workspace: options.workspace
+  });
+  return retained;
+}
+function assertRetainedRepairContainers(repoPath, plan, retained) {
+  const current = inspectWorkspaceContainers();
+  for (const previous of retained) {
+    const service = previous.labels["com.docker.compose.service"] ?? "";
+    const matches = exactWorkspaceServiceContainers(
+      current,
+      repoPath,
+      previous.labels["com.docker.compose.project"] ?? "",
+      service,
+      plan.composeFiles
+    );
+    if (matches.length !== 1 || matches[0].id !== previous.id) {
+      throw new Error(`Repair lost retained container identity for '${service}'.`);
+    }
+  }
+}
 function resolvePrimaryTarget(repoPath) {
   const existingDevpod = selectDevpodWorkspace(listDevpodWorkspaces(repoPath), repoPath);
   return {
@@ -10327,7 +11134,7 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs25.default.statSync(import_node_path26.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs26.default.statSync(import_node_path27.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
@@ -10358,7 +11165,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       );
     }
   }
-  return withWorkspaceLifecycleLock(repoPath, async () => {
+  const ensureLocked = async () => {
+    let repairMutationStarted = false;
+    let retainedRepairContainers = [];
     let environmentStarted = false;
     let managedPlan;
     let previousManagedState;
@@ -10376,25 +11185,30 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     let firstTransitionBaseline;
     const routeLoadOptions = {
       initialTimeoutMs: Math.min(options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS, 3e3),
-      recoveryTimeoutMs: Math.min(options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS, 1e4)
+      recoveryTimeoutMs: Math.min(options.httpTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS, 1e4),
+      ...options.repair ? { allowRestart: false } : {}
     };
     try {
-      const target = linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
+      const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs25.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path27.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs26.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
       const managedPostStart = resolveManagedPostStartPlan(repoPath);
       managedPostStartPlan = managedPostStart;
+      if (options.repair)
+        previousManagedState = readManagedRuntimeState(repoPath, target.workspace);
       const runtime = loadRuntimeConfig(
         repoPath,
         target.kind === "primary" ? "" : target.workspace,
-        options.profile
+        options.profile ?? (options.repair ? previousManagedState?.profile : void 0)
       );
       const managedRuntime = runtime.config.managedRuntime;
+      if (options.repair && !managedRuntime)
+        throw new Error("Repair requires managedRuntime configuration.");
       previousRoutes = listHostRouteState().filter(
         (route) => sameWorkspacePath(route.repoPath, repoPath)
       );
@@ -10403,12 +11217,12 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const desiredProcesses = managedRuntime ? desiredManagedProcesses(managedRuntime, runtime.resolvedProfile) : [];
       if (managedRuntime) {
         previousManagedState = readManagedRuntimeState(repoPath, target.workspace);
-        if (previousManagedState && !hasExactManagedComposeProject(repoPath, previousManagedState)) {
+        if (!options.repair && previousManagedState && !hasExactManagedComposeProject(repoPath, previousManagedState)) {
           previousManagedState = void 0;
         }
-        if (previousManagedState?.status === "degraded") {
+        if (!options.repair && previousManagedState?.status === "degraded") {
           throw new Error(
-            "Managed runtime state is degraded; refusing a new profile transition until drift is repaired."
+            "Managed runtime state is degraded; refusing a new profile transition until drift is repaired. Inspect status, then use ensure --repair for the recorded profile."
           );
         }
         if (previousManagedState && previousManagedState.devpodId !== target.devpodId) {
@@ -10453,7 +11267,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path26.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path27.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -10462,7 +11276,20 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           );
         }
       }
-      if (managedPlan) {
+      if (options.repair && managedPlan && previousManagedState) {
+        retainedRepairContainers = assertRepairBaseline({
+          repoPath,
+          target,
+          state: previousManagedState,
+          plan: managedPlan,
+          config: runtime.config,
+          profile: runtime.profile,
+          processes: desiredProcesses,
+          routes: previousRoutes,
+          workspace: managedWorkspaceEnv
+        });
+      }
+      if (managedPlan && !options.repair) {
         writeManagedDevcontainerConfig(managedPlan);
         managedConfigWritten = true;
       }
@@ -10498,7 +11325,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       let recreated = false;
       let container;
       try {
-        await startAndProveAttachment();
+        if (!options.repair) await startAndProveAttachment();
       } catch (error) {
         if (managedPlan || !target.hadExactDevpod) {
           throw error;
@@ -10508,7 +11335,45 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       if (!container) {
         try {
-          container = await preflight(0);
+          if (options.repair && managedPlan && previousManagedState) {
+            assertRetainedRepairContainers(repoPath, managedPlan, retainedRepairContainers);
+            const primaryService = managedPlan.primaryService;
+            const primary = retainedRepairContainers.find(
+              (entry) => entry.labels["com.docker.compose.service"] === primaryService
+            );
+            if (!primary) throw new Error("Repair lost its retained primary container.");
+            const stopped = retainedRepairContainers.filter((entry) => !entry.state.Running);
+            for (const entry of stopped) {
+              if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(entry.id))
+                throw new Error("Repair found an invalid retained container ID.");
+            }
+            if (stopped.length > 0) {
+              repairMutationStarted = true;
+              transitionPhase = "service-start";
+              const result = (0, import_node_child_process21.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+                encoding: "utf-8",
+                timeout: DEFAULT_READINESS_TIMEOUT_MS,
+                stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit"
+              });
+              if (result.status !== 0)
+                throw new Error("Could not start retained repair containers.");
+              assertRetainedRepairContainers(repoPath, managedPlan, retainedRepairContainers);
+            }
+            await waitForManagedServices(
+              managedPlan,
+              repoPath,
+              previousManagedState.composeProject,
+              managedPlan.desiredServices,
+              primary.id,
+              options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS
+            );
+          }
+          container = options.repair ? await waitForContainerPreflight(
+            repoPath,
+            currentTarget(),
+            [],
+            options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS
+          ) : await preflight(0);
         } catch (error) {
           if (managedPlan || !target.hadExactDevpod) {
             throw error;
@@ -10549,13 +11414,18 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           }
           if (!matches[0]?.state.Running) missingServices.push(service);
         }
-        startExactManagedServices({
-          plan: managedPlan,
-          composeProject: managedComposeProject,
-          services: missingServices,
-          quiet: options.quiet,
-          workspace: managedWorkspaceEnv
-        });
+        if (options.repair) {
+          assertRetainedRepairContainers(repoPath, managedPlan, retainedRepairContainers);
+          repairMutationStarted = true;
+        }
+        if (!options.repair)
+          startExactManagedServices({
+            plan: managedPlan,
+            composeProject: managedComposeProject,
+            services: missingServices,
+            quiet: options.quiet,
+            workspace: managedWorkspaceEnv
+          });
         await waitForManagedServices(
           managedPlan,
           repoPath,
@@ -10567,6 +11437,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         container = await preflight(options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS);
         managedContainer = container;
       }
+      if (options.repair && managedPlan)
+        assertRetainedRepairContainers(repoPath, managedPlan, retainedRepairContainers);
       transitionPhase = "process-start";
       runManagedPostStart({
         plan: managedPostStart,
@@ -10580,6 +11452,17 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         const desiredProcessSet = new Set(desiredProcesses);
         for (const process2 of processRegistry) {
           if (desiredProcessSet.has(process2)) continue;
+          if (options.repair) {
+            if (runManagedProcessAction({
+              container,
+              name: process2,
+              action: "status",
+              quiet: options.quiet
+            }) !== "stopped") {
+              throw new Error(`Repair found unexpected process '${process2}' after adapter replay.`);
+            }
+            continue;
+          }
           runManagedProcessAction({
             container,
             name: process2,
@@ -10599,7 +11482,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           }
         }
         transitionPhase = "service-stop";
-        stopDroppedManagedServices(managedPlan, repoPath, managedComposeProject);
+        if (!options.repair)
+          stopDroppedManagedServices(managedPlan, repoPath, managedComposeProject);
         assertDroppedManagedServicesStopped(managedPlan, repoPath, managedComposeProject);
         await waitForManagedServices(
           managedPlan,
@@ -10614,11 +11498,13 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const publication = await replacePublishedProxyRoutes(
         repoPath,
         runtime.config,
-        target.workspace
+        target.workspace,
+        options.repair ? { prepareInfrastructure: false } : void 0
       );
       candidateRoutes = publication.routes;
       candidateRoutesPublished = true;
-      await ensureTraefikRoutesLoaded(publication.routes, routeLoadOptions);
+      if (options.repair) await ensureTraefikRoutesMatch(publication.routes, routeLoadOptions);
+      else await ensureTraefikRoutesLoaded(publication.routes, routeLoadOptions);
       await ensureTraefikRoutesRemoved(
         removedRoutesForReplacement(previousRoutes.map(routeInputFromState), publication.routes),
         routeLoadOptions
@@ -10665,8 +11551,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       if (!devpodId) {
         throw new Error(`DevPod id for '${repoPath}' was not resolved after startup.`);
       }
+      let candidateState;
       if (managedPlan && managedComposeProject) {
-        writeManagedRuntimeState({
+        candidateState = {
           version: 1,
           repoPath,
           ...target.workspace !== void 0 ? { workspace: target.workspace } : {},
@@ -10682,15 +11569,24 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           effectiveConfigSha256: managedPlan.effectiveConfigSha256,
           status: "ready",
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
+        };
+        if (!options.repair) writeManagedRuntimeState(candidateState);
       }
       const managedRuntimeStatus = managedPlan ? collectManagedRuntimeStatus({
         repoPath,
         workspace: target.workspace,
         config: runtime.config,
         profile: runtime.profile,
-        resolvedProfile: runtime.resolvedProfile
+        resolvedProfile: runtime.resolvedProfile,
+        ...options.repair ? { candidateState } : {}
       }) : void 0;
+      if (options.repair && candidateState && managedPlan) {
+        assertRetainedRepairContainers(repoPath, managedPlan, retainedRepairContainers);
+        resolveRepairTarget(repoPath, linked);
+        if (managedRuntimeStatus?.status !== "ready")
+          throw new Error("Repaired candidate runtime did not pass final readiness validation.");
+        writeManagedRuntimeState(candidateState);
+      }
       return {
         kind: target.kind,
         repoPath,
@@ -10703,6 +11599,37 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
         ...managedRuntimeStatus ? { managedRuntime: managedRuntimeStatus } : {}
       };
     } catch (error) {
+      if (options.repair && !repairMutationStarted) throw error;
+      if (options.repair && repairMutationStarted && previousManagedState && managedPlan) {
+        const failures = [];
+        if (transitionPhase === "route-publication") {
+          try {
+            const currentRoutes = listHostRouteState().filter((route) => sameWorkspacePath(route.repoPath, repoPath)).map(routeInputFromState);
+            const rollbackRoutes = previousRoutes.map(routeInputFromState);
+            replaceHostRoutesForRepo(repoPath, rollbackRoutes);
+            await ensureTraefikRoutesMatch(rollbackRoutes, routeLoadOptions);
+            await ensureTraefikRoutesRemoved(
+              removedRoutesForReplacement(currentRoutes, rollbackRoutes),
+              routeLoadOptions
+            );
+          } catch (rollbackError) {
+            failures.push(
+              `routes: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+            );
+          }
+        }
+        try {
+          markManagedRuntimeDegraded(previousManagedState, transitionPhase);
+        } catch (stateError) {
+          failures.push(
+            `state: ${stateError instanceof Error ? stateError.message : String(stateError)}`
+          );
+        }
+        const original = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `${original} Repair failed; owned resources may remain running.${failures.length ? ` Recovery errors: ${failures.join("; ")}.` : " State remains degraded."}`
+        );
+      }
       if (managedPlan && managedContainer && managedComposeProject) {
         const rollbackErrors = [];
         const failedPhase = transitionPhase;
@@ -10904,19 +11831,36 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       throw error;
     }
+  };
+  return withWorkspaceLifecycleLock(repoPath, async () => {
+    if (!options.repair) return ensureLocked();
+    const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
+    import_node_fs26.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+    return withFileLock(
+      import_node_path27.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+      {
+        activity: "Managed runtime repair",
+        target: repoPath,
+        fair: true,
+        waitMs: 18e5,
+        onWait: createStderrWaitReporter("Managed runtime repair", repoPath)
+      },
+      ensureLocked
+    );
   });
 }
-var import_node_child_process21, import_node_fs25, import_node_path26, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
+var import_node_child_process21, import_node_fs26, import_node_path27, DEVCONTAINER_OVERLAY, DEFAULT_READINESS_TIMEOUT_MS, POLL_INTERVAL_MS;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
     import_node_child_process21 = require("child_process");
-    import_node_fs25 = __toESM(require("fs"));
-    import_node_path26 = __toESM(require("path"));
+    import_node_fs26 = __toESM(require("fs"));
+    import_node_path27 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
     init_devpod_workspaces();
+    init_file_lock();
     init_host_routes();
     init_http_route_probe();
     init_managed_post_start();
@@ -10964,7 +11908,8 @@ async function runEnsureCommand(options) {
   const result = await workspaceEnsure(repoPath, {
     open: options.open,
     quiet: Boolean(options.json),
-    profile: options.profile
+    profile: options.profile,
+    ...options.repair ? { repair: true } : {}
   });
   if (options.json) {
     process.stdout.write(`${JSON.stringify(result, null, 2)}
@@ -10999,7 +11944,7 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path27.default.join(mainRepo, "trees", ws);
+  return import_node_path28.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
   const ignored = (0, import_node_child_process22.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
@@ -11007,12 +11952,12 @@ function assertDefaultWorktreeRootIgnored(mainRepo) {
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path27.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path27.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path28.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path28.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path27.default.join(import_node_path27.default.dirname(mainRepo), `${import_node_path27.default.basename(mainRepo)}-${ws}`);
+  return import_node_path28.default.join(import_node_path28.default.dirname(mainRepo), `${import_node_path28.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -11124,7 +12069,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs26.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs27.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -11164,9 +12109,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs26.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs27.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path27.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path28.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -11175,7 +12120,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs26.default.existsSync(selectedPath)) {
+    if (import_node_fs27.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -11269,6 +12214,11 @@ async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = fals
   assertDevpodTargetSafe(resolved, worktrees, devpods);
   const devpodId = resolved.record?.devpodId ?? resolved.workspace;
   const mutation = action2 === "stop" ? stopOwnedDevpodWorkspace(devpodId, resolved.worktreePath) : deleteOwnedDevpodWorkspace(devpodId, resolved.worktreePath);
+  if (action2 === "stop" && mutation.status === "absent" && readManagedRuntimeState(resolved.worktreePath, resolved.workspace)) {
+    throw new Error(
+      "Retained managed runtime has no exact provider registration; routes were preserved."
+    );
+  }
   const routes = removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
   await ensureTraefikRoutesRemoved(routes);
   if (!quiet) {
@@ -11301,7 +12251,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
       opts.quiet
     );
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs26.default.existsSync(resolved.worktreePath)) {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs27.default.existsSync(resolved.worktreePath)) {
         const rm = (0, import_node_child_process22.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
@@ -11320,7 +12270,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs26.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs27.default.existsSync(resolved.worktreePath) ? withWorkspaceLifecycleLock(resolved.worktreePath, operation) : operation();
 }
 async function mutateWorkspaceOwnedPath(action2, worktreePath, opts = {}) {
   const mainRepo = resolveRepoPath(opts.repoPath);
@@ -11355,15 +12305,16 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process22, import_node_fs26, import_node_path27, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process22, import_node_fs27, import_node_path28, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
     import_node_child_process22 = require("child_process");
-    import_node_fs26 = __toESM(require("fs"));
-    import_node_path27 = __toESM(require("path"));
+    import_node_fs27 = __toESM(require("fs"));
+    import_node_path28 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
+    init_managed_runtime_state();
     init_repo_config();
     init_route_state();
     init_traefik_route_health();
@@ -11415,6 +12366,11 @@ async function environmentStop(repoPath, options = {}) {
   return withWorkspaceLifecycleLock(repoPath, async () => {
     const devpod = selectDevpodWorkspace(listDevpodWorkspaces(repoPath), repoPath);
     const mutation = devpod ? options.delete ? deleteOwnedDevpodWorkspace(devpod.id, repoPath) : stopOwnedDevpodWorkspace(devpod.id, repoPath) : { status: "absent" };
+    if (!options.delete && mutation.status === "absent" && readManagedRuntimeState(repoPath, workspace)) {
+      throw new Error(
+        "Retained managed runtime has no exact provider registration; routes were preserved."
+      );
+    }
     const removedRoutes = removeHostRoutesWhere(
       (route) => sameWorkspacePath(route.repoPath, repoPath)
     );
@@ -11436,6 +12392,7 @@ var init_environment_stop = __esm({
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
+    init_managed_runtime_state();
     init_traefik_route_health();
     init_workspace();
     init_workspace_lifecycle();
@@ -11933,17 +12890,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs27.default.existsSync(filePath)) {
+  if (!import_node_fs28.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs27.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs28.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path28.default.relative(repoPath, filePath) || ".";
+  return import_node_path29.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -11984,7 +12941,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs27.default.existsSync(import_node_path28.default.join(repoPath, fileName))) {
+    if (import_node_fs28.default.existsSync(import_node_path29.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -11999,9 +12956,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path28.default.join(repoPath, ".nvmrc");
-  if (import_node_fs27.default.existsSync(nvmrc)) {
-    const version = import_node_fs27.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path29.default.join(repoPath, ".nvmrc");
+  if (import_node_fs28.default.existsSync(nvmrc)) {
+    const version = import_node_fs28.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -12062,7 +13019,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path28.default.isAbsolute(fileName) && !import_node_path28.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path29.default.isAbsolute(fileName) && !import_node_path29.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -12080,7 +13037,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs27.default.existsSync(import_node_path28.default.join(repoPath, fileName))
+    (fileName) => import_node_fs28.default.existsSync(import_node_path29.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -12118,7 +13075,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs27.default.readFileSync(import_node_path28.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs28.default.readFileSync(import_node_path29.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -12153,8 +13110,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs27.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs27.default.readFileSync(import_node_path28.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs28.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs28.default.readFileSync(import_node_path29.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -12168,18 +13125,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path28.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs27.default.existsSync(dir)) {
+  const dir = import_node_path29.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs28.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs27.default.readdirSync(dir).filter((fileName) => import_node_fs27.default.statSync(import_node_path28.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs28.default.readdirSync(dir).filter((fileName) => import_node_fs28.default.statSync(import_node_path29.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs27.default.existsSync(configPath)) {
+  if (!import_node_fs28.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -12223,15 +13180,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs27.default.existsSync(import_node_path28.default.join(repoPath, fileName))) {
+    if (import_node_fs28.default.existsSync(import_node_path29.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path28.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs27.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs27.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path28.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs27.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path29.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs28.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs28.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path29.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs28.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -12274,7 +13231,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path28.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path29.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -12293,12 +13250,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs27, import_node_path28, import_yaml6;
+var import_node_fs28, import_node_path29, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs27 = __toESM(require("fs"));
-    import_node_path28 = __toESM(require("path"));
+    import_node_fs28 = __toESM(require("fs"));
+    import_node_path29 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -12403,7 +13360,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs28.default.existsSync(import_node_path29.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs29.default.existsSync(import_node_path30.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -12622,12 +13579,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs28, import_node_path29;
+var import_node_fs29, import_node_path30;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs28 = __toESM(require("fs"));
-    import_node_path29 = __toESM(require("path"));
+    import_node_fs29 = __toESM(require("fs"));
+    import_node_path30 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -12924,7 +13881,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path30.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path31.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -12969,8 +13926,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path30.default.join(repoPath, file.relativePath);
-  if (!import_node_fs29.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path31.default.join(repoPath, file.relativePath);
+  if (!import_node_fs30.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -12978,7 +13935,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs29.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs30.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -13035,11 +13992,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path30.default.join(repoPath, file.relativePath);
-  import_node_fs29.default.mkdirSync(import_node_path30.default.dirname(absolutePath), { recursive: true });
-  import_node_fs29.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path31.default.join(repoPath, file.relativePath);
+  import_node_fs30.default.mkdirSync(import_node_path31.default.dirname(absolutePath), { recursive: true });
+  import_node_fs30.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs29.default.chmodSync(absolutePath, 493);
+    import_node_fs30.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -13077,12 +14034,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs29, import_node_path30, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs30, import_node_path31, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs29 = __toESM(require("fs"));
-    import_node_path30 = __toESM(require("path"));
+    import_node_fs30 = __toESM(require("fs"));
+    import_node_path31 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -13268,11 +14225,11 @@ var init_profile_resolution = __esm({
 function fail(message) {
   throw new Error(message);
 }
-function isRecord2(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requireRecord(value, label) {
-  if (!isRecord2(value)) fail(`${label} must be a mapping.`);
+  if (!isRecord4(value)) fail(`${label} must be a mapping.`);
   return value;
 }
 function requireExactKeys(value, allowed, label) {
@@ -13489,13 +14446,13 @@ function buildProfilePlanReport(options) {
   return { ...report, contractPath, bindings };
 }
 function loadContract(repoPath, contractPath) {
-  if (import_node_path31.default.isAbsolute(contractPath)) {
+  if (import_node_path32.default.isAbsolute(contractPath)) {
     fail("profile plan contract path must be relative to the repository.");
   }
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs30.default.lstatSync(absolutePath);
+    metadata = import_node_fs31.default.lstatSync(absolutePath);
   } catch (error) {
     fail(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -13505,16 +14462,16 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs30.default.realpathSync(repoPath);
-  const realContract = import_node_fs30.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs31.default.realpathSync(repoPath);
+  const realContract = import_node_fs31.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs30.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs31.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
   return {
     contract: parseProfilePlanContract(source),
-    contractPath: import_node_path31.default.relative(repoPath, absolutePath).split(import_node_path31.default.sep).join("/")
+    contractPath: import_node_path32.default.relative(repoPath, absolutePath).split(import_node_path32.default.sep).join("/")
   };
 }
 function resolveProfilePlan(options) {
@@ -13528,12 +14485,12 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs30, import_node_path31, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs31, import_node_path32, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs30 = __toESM(require("fs"));
-    import_node_path31 = __toESM(require("path"));
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_path32 = __toESM(require("path"));
     import_yaml7 = require("yaml");
     init_paths();
     init_profile_resolution();
@@ -13565,7 +14522,7 @@ async function runProfileResolveCommand(options) {
 async function runProfilePlanCommand(options) {
   const report = resolveProfilePlan(options);
   if (options.output) {
-    writeFileAtomically(import_node_path32.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
+    writeFileAtomically(import_node_path33.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
 `);
   }
   if (options.json) {
@@ -13601,14 +14558,14 @@ function printProfilePlanSummary(report, output2) {
     process.stdout.write(`Binding ${key}: ${renderValues(report.bindings[key] ?? [])}
 `);
   }
-  if (output2) process.stdout.write(`Output: ${import_node_path32.default.resolve(output2)}
+  if (output2) process.stdout.write(`Output: ${import_node_path33.default.resolve(output2)}
 `);
 }
-var import_node_path32;
+var import_node_path33;
 var init_profile = __esm({
   "src/commands/profile.ts"() {
     "use strict";
-    import_node_path32 = __toESM(require("path"));
+    import_node_path33 = __toESM(require("path"));
     init_atomic_file();
     init_output();
     init_profile_plan();
@@ -13898,7 +14855,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto10.createHash)("sha1").update(import_node_path33.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto10.createHash)("sha1").update(import_node_path34.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -13977,11 +14934,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path33.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs31.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path33.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path34.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs32.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path34.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs31.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs32.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -14101,14 +15058,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process27, import_node_crypto10, import_node_fs31, import_node_path33, import_yaml8;
+var import_node_child_process27, import_node_crypto10, import_node_fs32, import_node_path34, import_yaml8;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process27 = require("child_process");
     import_node_crypto10 = require("crypto");
-    import_node_fs31 = __toESM(require("fs"));
-    import_node_path33 = __toESM(require("path"));
+    import_node_fs32 = __toESM(require("fs"));
+    import_node_path34 = __toESM(require("path"));
     import_yaml8 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -14930,13 +15887,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs32.default.lstatSync(worktreePath);
+    rootStat = import_node_fs33.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs32.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs33.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -14962,10 +15919,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path34.default.join(dirPath, entry.name);
+      const entryPath = import_node_path35.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs32.default.lstatSync(entryPath);
+        entryStat = import_node_fs33.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -14975,7 +15932,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs32.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs33.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -15039,12 +15996,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs32, import_node_path34, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs33, import_node_path35, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs32 = __toESM(require("fs"));
-    import_node_path34 = __toESM(require("path"));
+    import_node_fs33 = __toESM(require("fs"));
+    import_node_path35 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -15052,7 +16009,7 @@ var init_workspace_consumption = __esm({
 });
 
 // src/core/workspace-cleanup.ts
-function isRecord3(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isSha(value) {
@@ -15145,7 +16102,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs33.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs34.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -15196,14 +16153,14 @@ function parseGitHubChanges(value, project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord3(item)) return void 0;
-    const repository = isRecord3(item.repository) ? item.repository.nameWithOwner : void 0;
-    const headRepository = isRecord3(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
+    if (!isRecord5(item)) return void 0;
+    const repository = isRecord5(item.repository) ? item.repository.nameWithOwner : void 0;
+    const headRepository = isRecord5(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
     if (repository !== project || headRepository !== project || item.headRefName !== branch || !isSha(item.headRefOid) || typeof item.baseRefName !== "string") {
       continue;
     }
     const merged = item.state === "MERGED" && validTimestamp(item.mergedAt);
-    const mergeCommit = isRecord3(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
+    const mergeCommit = isRecord5(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
     const baseSha = isSha(item.baseRefOid) ? item.baseRefOid : void 0;
     changes.push({
       sourceBranch: branch,
@@ -15220,14 +16177,14 @@ function parseGitLabChanges(value, _project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord3(item)) return void 0;
+    if (!isRecord5(item)) return void 0;
     const sourceProjectId = item.source_project_id;
     const targetProjectId = item.target_project_id;
     const sameProject = typeof sourceProjectId === "number" && typeof targetProjectId === "number" && sourceProjectId === targetProjectId;
     if (!sameProject || item.source_branch !== branch || !isSha(item.sha) || typeof item.target_branch !== "string") {
       continue;
     }
-    const diffRefs = isRecord3(item.diff_refs) ? item.diff_refs : void 0;
+    const diffRefs = isRecord5(item.diff_refs) ? item.diff_refs : void 0;
     const mergeCommitSha = isSha(item.merge_commit_sha) ? item.merge_commit_sha : void 0;
     const baseSha = diffRefs && isSha(diffRefs.base_sha) ? diffRefs.base_sha : void 0;
     changes.push({
@@ -15670,7 +16627,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers = new Map(worktreePaths.map((path34) => [path34, unknownContainers(reason)]));
+      containers = new Map(worktreePaths.map((path35) => [path35, unknownContainers(reason)]));
     }
   }
   const rows = records.map((record) => {
@@ -15719,12 +16676,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process29, import_node_fs33, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process29, import_node_fs34, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
     import_node_child_process29 = require("child_process");
-    import_node_fs33 = __toESM(require("fs"));
+    import_node_fs34 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -15901,7 +16858,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.51" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.53" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -15956,13 +16913,14 @@ program.command("up").description("Ensure devnet and start shared Traefik (reser
     await runUpCommand2();
   })
 );
-program.command("ensure").description("Start and prove a primary or linked checkout's environment and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+program.command("ensure").description("Start and prove a primary or linked checkout's environment and routes").argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(async (repoPath, _options, command) => {
     const options = command.opts();
     const { runEnsureCommand: runEnsureCommand2 } = await Promise.resolve().then(() => (init_ensure(), ensure_exports));
     await runEnsureCommand2({
       path: repoPath,
       profile: options.profile,
+      repair: options.repair,
       open: Boolean(options.open),
       json: Boolean(options.json)
     });
@@ -16184,7 +17142,7 @@ workspaceCommand2.command("up").description(
 );
 workspaceCommand2.command("ensure").description(
   "Start and prove a primary or linked checkout's workspace runtime, upstreams, and routes"
-).argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
+).argument("[path]", "Git checkout path (defaults to current directory)").option("--profile <name>", "Start only this profile's apps/dependencies from .devrouter.yml").option("--repair", "Repair a degraded managed runtime from its recorded profile").option("--open", "Open HTTP routes after readiness succeeds").option("--json", "Output JSON").action(
   withErrorHandling(
     async (worktreePath, _options, command) => {
       const options = command.opts();
@@ -16192,6 +17150,7 @@ workspaceCommand2.command("ensure").description(
       await runEnsureCommand2({
         path: worktreePath,
         profile: options.profile,
+        repair: options.repair,
         open: Boolean(options.open),
         json: Boolean(options.json)
       });