@devrouter/cli 0.0.56 → 0.0.58

package/dist/devrouter-lifecycle-worker.js

@@ -23,7 +23,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/devpod-exec.ts
-var import_node_child_process22 = require("child_process");
+var import_node_child_process23 = require("child_process");
 var import_node_crypto11 = require("crypto");
 
 // src/core/devpod-environment.ts
@@ -1516,7 +1516,7 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 }
 
 // src/core/devsy-exec.ts
-var import_node_child_process21 = require("child_process");
+var import_node_child_process22 = require("child_process");
 
 // src/core/execution-outcome.ts
 var ExecutionOutcomeError = class extends Error {
@@ -2007,6 +2007,9 @@ var RELIABILITY_MAX_ITEMS = 128;
 function isReliabilityId(value) {
   return typeof value === "string" && /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/.test(value);
 }
+function isReliabilityProfile(value) {
+  return typeof value === "string" && value.length <= 4096 && value.split(",").every((name) => isReliabilityId(name.trim()));
+}
 function isReliabilityCounter(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
@@ -2037,7 +2040,7 @@ function validOperation(value) {
 function assertReliabilityState(value) {
   const intentRevision = record(value) ? value.intentRevision : void 0;
   const valid = record(value) && value.contractVersion === RELIABILITY_CONTRACT_VERSION && oneOf(value.executionPolicy, ["manual", "capacity-managed"]) && (value.executionPolicy === "manual" ? value.admission === "not-applicable" && value.chargeHeld === false : value.admission !== "not-applicable") && boundedArray(value.operationHistory) && uniqueIds(value.operationHistory, "key") && uniqueIds(value.operationHistory, "id") && value.operationHistory.every(
-    (entry) => record(entry) && isReliabilityId(entry.profile) && record(entry.consumer) && isReliabilityId(entry.consumer.id) && typeof entry.consumer.pinned === "boolean" && boundedArray(entry.consumer.requiredCapabilities) && entry.consumer.requiredCapabilities.every(isReliabilityId) && new Set(entry.consumer.requiredCapabilities).size === entry.consumer.requiredCapabilities.length && validOperation(entry)
+    (entry) => record(entry) && isReliabilityProfile(entry.profile) && record(entry.consumer) && isReliabilityId(entry.consumer.id) && typeof entry.consumer.pinned === "boolean" && boundedArray(entry.consumer.requiredCapabilities) && entry.consumer.requiredCapabilities.every(isReliabilityId) && new Set(entry.consumer.requiredCapabilities).size === entry.consumer.requiredCapabilities.length && validOperation(entry)
   ) && isReliabilityCounter(value.observationsAfterMs) && isReliabilityId(value.environmentId) && isReliabilityCounter(value.intentRevision) && isReliabilityCounter(value.runtimeGeneration) && isReliabilityCounter(value.controllerEpoch) && oneOf(value.desired, ["running", "parked-for-capacity", "stopped-by-user"]) && oneOf(value.phase, [
     "idle",
     "queued",
@@ -2046,7 +2049,7 @@ function assertReliabilityState(value) {
     "stable",
     "recovering",
     "stopping"
-  ]) && (value.profile === null || isReliabilityId(value.profile)) && oneOf(value.admission, [
+  ]) && (value.profile === null || isReliabilityProfile(value.profile)) && oneOf(value.admission, [
     "admitted",
     "waiting",
     "unknown",
@@ -2055,7 +2058,7 @@ function assertReliabilityState(value) {
   ]) && typeof value.chargeHeld === "boolean" && record(value.stopProof) && typeof value.stopProof.workloadsStopped === "boolean" && typeof value.stopProof.routesRemoved === "boolean" && boundedArray(value.consumers) && uniqueIds(value.consumers, "id") && value.consumers.every(
     (consumer) => record(consumer) && typeof consumer.pinned === "boolean" && boundedArray(consumer.requiredCapabilities) && consumer.requiredCapabilities.every(isReliabilityId) && new Set(consumer.requiredCapabilities).size === consumer.requiredCapabilities.length
   ) && boundedArray(value.requests) && uniqueIds(value.requests, "key") && value.requests.every(
-    (request) => record(request) && oneOf(request.mode, ["start", "attach"]) && isReliabilityId(request.consumerId) && isReliabilityId(request.operationId) && isReliabilityId(request.profile) && isReliabilityCounter(request.intentRevision) && isReliabilityCounter(intentRevision) && request.intentRevision <= intentRevision
+    (request) => record(request) && oneOf(request.mode, ["start", "attach"]) && isReliabilityId(request.consumerId) && isReliabilityId(request.operationId) && isReliabilityProfile(request.profile) && isReliabilityCounter(request.intentRevision) && isReliabilityCounter(intentRevision) && request.intentRevision <= intentRevision
   ) && boundedArray(value.observations) && uniqueIds(value.observations, "capability") && value.observations.every(
     (observation) => record(observation) && oneOf(observation.infrastructure, ["healthy", "failed", "unknown"]) && oneOf(observation.application, ["verified", "unready", "unverified"]) && isReliabilityCounter(observation.observedAtMs) && isReliabilityCounter(observation.validForMs)
   ) && (value.operation === null || validOperation(value.operation)) && (value.executionPolicy !== "manual" || value.desired !== "parked-for-capacity" && value.incident === null) && (value.incident === null || record(value.incident) && isReliabilityId(value.incident.id) && isReliabilityCounter(value.incident.correctiveActionsTaken) && isReliabilityCounter(value.incident.actionLimit) && value.incident.actionLimit > 0 && value.incident.correctiveActionsTaken <= value.incident.actionLimit);
@@ -2124,10 +2127,10 @@ function assertReliabilityEvent(value) {
   let valid = false;
   switch (value.type) {
     case "request":
-      valid = oneOf2(value.mode, ["start", "attach"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityId(value.profile) && isConsumer(value.consumer);
+      valid = oneOf2(value.mode, ["start", "attach"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer);
       break;
     case "operation-request":
-      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityId(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean";
+      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean";
       break;
     case "drained":
       valid = isReliabilityId(value.operationId);
@@ -2866,8 +2869,8 @@ function workerGroupAbsent(pid) {
 }
 
 // src/core/workspace-ensure.ts
-var import_node_child_process20 = require("child_process");
-var import_node_fs21 = __toESM(require("fs"));
+var import_node_child_process21 = require("child_process");
+var import_node_fs22 = __toESM(require("fs"));
 var import_node_path23 = __toESM(require("path"));
 
 // src/core/devcontainer-profile.ts
@@ -3576,6 +3579,8 @@ function assertHostNotTemplated(host, label) {
   }
 }
 var MAX_COMMAND_LENGTH = 4096;
+var MAX_PREPARE_ARGS = 64;
+var MAX_PREPARE_ARG_BYTES = 4096;
 var DEFAULT_HOST_STRATEGY = {
   type: "auto",
   denyPorts: [80, 443, 5432],
@@ -3996,6 +4001,38 @@ function parseRequiredUniqueStringArray(value, pathLabel) {
   }
   return parseUniqueStringArray(value, pathLabel);
 }
+function parsePrepareCommand(value, pathLabel) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(value)) {
+    throw new Error(`${pathLabel} must be a non-empty array of strings.`);
+  }
+  if (value.length === 0) {
+    throw new Error(`${pathLabel} must be a non-empty array of strings.`);
+  }
+  if (value.length > MAX_PREPARE_ARGS) {
+    throw new Error(`${pathLabel} exceeds the maximum of ${MAX_PREPARE_ARGS} arguments.`);
+  }
+  return value.map((item, index) => {
+    if (typeof item !== "string") {
+      throw new Error(`${pathLabel}[${index}] must be a string.`);
+    }
+    if (index === 0 && item.length === 0) {
+      throw new Error(`${pathLabel}[0] must be a non-empty executable.`);
+    }
+    if (item.includes("\0")) {
+      throw new Error(`${pathLabel}[${index}] must not contain null bytes.`);
+    }
+    const byteLength = Buffer.byteLength(item, "utf8");
+    if (byteLength > MAX_PREPARE_ARG_BYTES) {
+      throw new Error(
+        `${pathLabel}[${index}] exceeds the maximum of ${MAX_PREPARE_ARG_BYTES} UTF-8 bytes.`
+      );
+    }
+    return item;
+  });
+}
 function parseManagedRuntime(value, configPath) {
   if (value === void 0) {
     return void 0;
@@ -4008,7 +4045,7 @@ function parseManagedRuntime(value, configPath) {
   );
   ensureAllowedKeys(
     devcontainer,
-    ["baseServices", "profileServices"],
+    ["baseServices", "profileServices", "prepareCommand"],
     `${configPath}.managedRuntime.devcontainer`
   );
   const baseServices = parseRequiredUniqueStringArray(
@@ -4019,6 +4056,10 @@ function parseManagedRuntime(value, configPath) {
     devcontainer.profileServices,
     `${configPath}.managedRuntime.devcontainer.profileServices`
   );
+  const prepareCommand = parsePrepareCommand(
+    devcontainer.prepareCommand,
+    `${configPath}.managedRuntime.devcontainer.prepareCommand`
+  );
   const baseSet = new Set(baseServices);
   const overlappingServices = profileServices.filter((service) => baseSet.has(service));
   if (overlappingServices.length > 0) {
@@ -4039,7 +4080,11 @@ function parseManagedRuntime(value, configPath) {
     );
   }
   return {
-    devcontainer: { baseServices, profileServices },
+    devcontainer: {
+      baseServices,
+      profileServices,
+      ...prepareCommand ? { prepareCommand } : {}
+    },
     processes
   };
 }
@@ -4460,7 +4505,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.56" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.58" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -6136,10 +6181,88 @@ function transportFailure() {
   };
 }
 
-// src/core/managed-post-start.ts
+// src/core/managed-host-preparation.ts
 var import_node_child_process18 = require("child_process");
-var import_node_crypto10 = require("crypto");
 var import_node_fs19 = __toESM(require("fs"));
+var PREPARATION_TIMEOUT_MS = 6e4;
+var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
+var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
+var START_ERROR = "Managed host preparation could not start.";
+var FAILURE_ERROR = "Managed host preparation failed.";
+var TIMEOUT_ERROR = "Managed host preparation timed out after 60 seconds.";
+function runPreparationCommand(argv, cwd) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = (0, import_node_child_process18.spawn)(argv[0], argv.slice(1), {
+        cwd,
+        detached: true,
+        shell: false,
+        stdio: "ignore"
+      });
+    } catch {
+      resolve("start-error");
+      return;
+    }
+    let timedOut = false;
+    const deadline = setTimeout(() => {
+      timedOut = true;
+      if (child.pid !== void 0 && child.exitCode === null && child.signalCode === null) {
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch {
+        }
+      }
+    }, PREPARATION_TIMEOUT_MS);
+    child.once("error", () => {
+      clearTimeout(deadline);
+      resolve("start-error");
+    });
+    child.once("close", (code) => {
+      clearTimeout(deadline);
+      resolve(timedOut ? "timeout" : code === 0 ? "success" : "failure");
+    });
+  });
+}
+function readConfigBytes(configPath) {
+  try {
+    return import_node_fs19.default.readFileSync(configPath);
+  } catch {
+    return void 0;
+  }
+}
+async function runManagedHostPreparation(repoPath, config) {
+  const prepareCommand = config.managedRuntime?.devcontainer.prepareCommand;
+  if (!prepareCommand) return;
+  if (process.platform === "win32") {
+    throw new Error("Managed host preparation requires POSIX process-group ownership.");
+  }
+  const resolvedRepoPath = resolveRepoPath(repoPath);
+  const configPath = getRepoConfigPath(resolvedRepoPath);
+  const before = readConfigBytes(configPath);
+  if (!before) {
+    throw new Error(CONFIG_READ_ERROR);
+  }
+  const result = await runPreparationCommand(prepareCommand, resolvedRepoPath);
+  const after = readConfigBytes(configPath);
+  if (!after?.equals(before)) {
+    throw new Error(CONFIG_CHANGED_ERROR);
+  }
+  if (result === "start-error") {
+    throw new Error(START_ERROR);
+  }
+  if (result === "timeout") {
+    throw new Error(TIMEOUT_ERROR);
+  }
+  if (result === "failure") {
+    throw new Error(FAILURE_ERROR);
+  }
+}
+
+// src/core/managed-post-start.ts
+var import_node_child_process19 = require("child_process");
+var import_node_crypto10 = require("crypto");
+var import_node_fs20 = __toESM(require("fs"));
 var import_node_path21 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
 var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
@@ -6177,7 +6300,7 @@ function commandFailure3(result) {
   return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
 }
 function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process18.spawnSync)(
+  const result = (0, import_node_child_process19.spawnSync)(
     "docker",
     ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
     { input: contents, encoding: "utf-8" }
@@ -6188,8 +6311,8 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs19.default.existsSync(filePath) || !import_node_fs19.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs19.default.readFileSync(filePath);
+  if (!import_node_fs20.default.existsSync(filePath) || !import_node_fs20.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs20.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
@@ -6202,7 +6325,7 @@ function resolveProcessHelperPath() {
     import_node_path21.default.resolve(__dirname, "..", "bin", "devrouter-process"),
     import_node_path21.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs19.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs20.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
@@ -6254,7 +6377,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs19.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs20.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -6268,7 +6391,7 @@ function runManagedPostStart(options) {
     options.plan.adapterContents,
     "the managed post-start adapter"
   );
-  const started = (0, import_node_child_process18.spawnSync)(
+  const started = (0, import_node_child_process19.spawnSync)(
     "docker",
     [
       "exec",
@@ -6306,7 +6429,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process18.spawnSync)(
+  const result = (0, import_node_child_process19.spawnSync)(
     "docker",
     [
       "exec",
@@ -6770,8 +6893,8 @@ function collectManagedRuntimeStatus(options) {
 }
 
 // src/core/traefik-route-health.ts
-var import_node_child_process19 = require("child_process");
-var import_node_fs20 = __toESM(require("fs"));
+var import_node_child_process20 = require("child_process");
+var import_node_fs21 = __toESM(require("fs"));
 var import_node_path22 = __toESM(require("path"));
 var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
 var ROUTER_RELOAD_LOCK_FILE = import_node_path22.default.join(DEVROUTER_HOME, "router-reload.lock");
@@ -6784,7 +6907,7 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function inspectRouterApi(protocol) {
-  const result = (0, import_node_child_process19.spawnSync)(
+  const result = (0, import_node_child_process20.spawnSync)(
     "curl",
     [
       "--silent",
@@ -6827,7 +6950,7 @@ function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function inspectNamedRouterApi(protocol, resource, name) {
-  const result = (0, import_node_child_process19.spawnSync)(
+  const result = (0, import_node_child_process20.spawnSync)(
     "curl",
     [
       "--silent",
@@ -7038,7 +7161,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -7397,7 +7520,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process20.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process21.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8" }
@@ -7407,7 +7530,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process20.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process21.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8" }
@@ -7418,7 +7541,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process20.spawnSync)(
+      const gitCheck = (0, import_node_child_process21.spawnSync)(
         "docker",
         [
           "exec",
@@ -7629,12 +7752,14 @@ function assertRepairBaseline(options) {
   )?.Destination;
   if (!workspacePath) throw new Error("Repair cannot prove the primary workspace mount.");
   for (const name of primary.state.Running ? config.managedRuntime?.processes ?? [] : []) {
-    if (!processes.includes(name) && runManagedProcessAction({
+    if (processes.includes(name) && !options.verifyRetainedProcesses) continue;
+    const processStatus = runManagedProcessAction({
       container: { id: primary.id, workspacePath },
       name,
       action: "status",
       quiet: true
-    }) !== "stopped") {
+    });
+    if (processStatus !== "stopped" && !(processes.includes(name) && processStatus === "running")) {
       throw new Error(`Repair refuses unexpected or unproven process '${name}'.`);
     }
   }
@@ -7671,14 +7796,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs21.default.statSync(import_node_path23.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs22.default.statSync(import_node_path23.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process20.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process21.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -7730,7 +7855,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
         const overlayPath = import_node_path23.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs21.default.existsSync(overlayPath)) {
+        if (!import_node_fs22.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -7884,7 +8009,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               repairMutationStarted = true;
               transitionPhase = "service-start";
               claimLifecycleEffect();
-              const result = (0, import_node_child_process20.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+              const result = (0, import_node_child_process21.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 encoding: "utf-8",
                 timeout: DEFAULT_READINESS_TIMEOUT_MS,
                 stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit"
@@ -8211,27 +8336,29 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           );
         }
         try {
-          const previousAllServices = [
-            managedPlan.primaryService,
-            ...managedPlan.baseServices,
-            ...previousServices
-          ];
-          claimLifecycleEffect();
-          startExactManagedServices({
-            plan: managedPlan,
-            composeProject: managedComposeProject,
-            services: previousAllServices,
-            quiet: options.quiet,
-            workspace: managedWorkspaceEnv
-          });
-          await waitForManagedServices(
-            managedPlan,
-            repoPath,
-            managedComposeProject,
-            previousAllServices,
-            managedContainer.id,
-            options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS
-          );
+          if (previousManagedState?.status !== "degraded") {
+            const previousAllServices = [
+              managedPlan.primaryService,
+              ...managedPlan.baseServices,
+              ...previousServices
+            ];
+            claimLifecycleEffect();
+            startExactManagedServices({
+              plan: managedPlan,
+              composeProject: managedComposeProject,
+              services: previousAllServices,
+              quiet: options.quiet,
+              workspace: managedWorkspaceEnv
+            });
+            await waitForManagedServices(
+              managedPlan,
+              repoPath,
+              managedComposeProject,
+              previousAllServices,
+              managedContainer.id,
+              options.containerTimeoutMs ?? DEFAULT_READINESS_TIMEOUT_MS
+            );
+          }
         } catch (rollbackError) {
           rollbackErrors.push(
             `services: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
@@ -8241,14 +8368,16 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           if (!managedPostStartPlan) {
             throw new Error("Managed post-start plan disappeared during rollback.");
           }
-          claimLifecycleEffect();
-          runManagedPostStart({
-            plan: managedPostStartPlan,
-            container: managedContainer,
-            quiet: options.quiet,
-            profile: previousManagedState?.profile ?? "full",
-            processes: previousProcesses
-          });
+          if (previousManagedState?.status !== "degraded") {
+            claimLifecycleEffect();
+            runManagedPostStart({
+              plan: managedPostStartPlan,
+              container: managedContainer,
+              quiet: options.quiet,
+              profile: previousManagedState?.profile ?? "full",
+              processes: previousProcesses
+            });
+          }
           for (const process2 of managedProcessRegistry) {
             if (previousProcessSet.has(process2)) continue;
             claimLifecycleEffect();
@@ -8317,7 +8446,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
             );
           }
         }
-        if (rollbackErrors.length > 0 && previousManagedState) {
+        if (previousManagedState && (rollbackErrors.length > 0 || previousManagedState.status === "degraded")) {
           try {
             markManagedRuntimeDegraded(previousManagedState, failedPhase);
           } catch (stateError) {
@@ -8327,7 +8456,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           }
         }
         const original = error instanceof Error ? error.message : String(error);
-        const suffix = rollbackErrors.length > 0 ? ` Rollback left degraded drift: ${rollbackErrors.join("; ")}.` : " Candidate runtime was rolled back.";
+        const suffix = rollbackErrors.length > 0 ? ` Rollback left degraded drift: ${rollbackErrors.join("; ")}.` : previousManagedState?.status === "degraded" ? " Candidate resources were reconciled; the retained runtime remains degraded." : " Candidate runtime was rolled back.";
         throw new Error(`${original}${suffix}`);
       }
       if (managedPlan) {
@@ -8392,9 +8521,15 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
   };
   return withLifecycleOperationLock(repoPath, async () => {
+    const preparationConfig = loadRepoConfig(repoPath);
+    if (preparationConfig.managedRuntime?.devcontainer.prepareCommand) {
+      claimLifecycleEffect();
+      await runManagedHostPreparation(repoPath, preparationConfig);
+      claimLifecycleEffect();
+    }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs22.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
         import_node_path23.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
@@ -8418,6 +8553,35 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       linked ? workspace : "",
       requestedOptions.profile
     ).profile;
+    if (desiredProfile !== retained.profile) {
+      const target = resolveRepairTarget(repoPath, linked);
+      const baseline = loadRuntimeConfig(repoPath, linked ? workspace : "", retained.profile);
+      const plan = inspectManagedDevcontainerConfig({
+        repoPath,
+        config: baseline.config,
+        profile: baseline.resolvedProfile,
+        linked
+      });
+      if (!baseline.config.managedRuntime)
+        throw new Error("Recovery requires the retained managed configuration.");
+      assertRepairBaseline({
+        repoPath,
+        target,
+        state: retained,
+        plan,
+        config: baseline.config,
+        profile: baseline.profile,
+        processes: desiredManagedProcesses(
+          baseline.config.managedRuntime,
+          baseline.resolvedProfile
+        ),
+        routes: listHostRouteState().filter((route) => sameWorkspacePath(route.repoPath, repoPath)),
+        verifyRetainedProcesses: true,
+        workspace: target.kind === "linked" ? { token: target.workspace, gitCommonDir: target.gitCommonDir } : void 0
+      });
+      claimLifecycleEffect();
+      return ensureLocked();
+    }
     options = { ...requestedOptions, repair: true, profile: retained.profile, open: false };
     let repaired;
     try {
@@ -8679,7 +8843,7 @@ async function devsyExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process21.spawn)("devsy", args, { stdio: "inherit" });
+        child = (0, import_node_child_process22.spawn)("devsy", args, { stdio: "inherit" });
       } catch (error) {
         reject(
           new ExecutionOutcomeError(`devsy exec failed: ${errorMessage(error)}`, {
@@ -8725,7 +8889,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process22.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process23.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -8904,7 +9068,7 @@ async function devpodExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process22.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+        child = (0, import_node_child_process23.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       } catch (error) {
         settled = true;
         reject(
@@ -8961,12 +9125,12 @@ async function devpodExecOutcome(repoPath, command) {
 }
 
 // src/core/workspace-lifecycle.ts
-var import_node_child_process23 = require("child_process");
-var import_node_fs23 = __toESM(require("fs"));
+var import_node_child_process24 = require("child_process");
+var import_node_fs24 = __toESM(require("fs"));
 var import_node_path25 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs22 = __toESM(require("fs"));
+var import_node_fs23 = __toESM(require("fs"));
 function removeWorkspaceRoutesForWorktree(workspace, worktreePath) {
   return removeHostRoutesWhere(
     (route) => route.workspace === workspace && sameWorkspacePath(route.repoPath, worktreePath)