@devrouter/cli 0.0.57 → 0.0.59

package/dist/devrouter.js

@@ -2291,6 +2291,38 @@ function parseRequiredUniqueStringArray(value, pathLabel) {
   }
   return parseUniqueStringArray(value, pathLabel);
 }
+function parsePrepareCommand(value, pathLabel) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(value)) {
+    throw new Error(`${pathLabel} must be a non-empty array of strings.`);
+  }
+  if (value.length === 0) {
+    throw new Error(`${pathLabel} must be a non-empty array of strings.`);
+  }
+  if (value.length > MAX_PREPARE_ARGS) {
+    throw new Error(`${pathLabel} exceeds the maximum of ${MAX_PREPARE_ARGS} arguments.`);
+  }
+  return value.map((item, index) => {
+    if (typeof item !== "string") {
+      throw new Error(`${pathLabel}[${index}] must be a string.`);
+    }
+    if (index === 0 && item.length === 0) {
+      throw new Error(`${pathLabel}[0] must be a non-empty executable.`);
+    }
+    if (item.includes("\0")) {
+      throw new Error(`${pathLabel}[${index}] must not contain null bytes.`);
+    }
+    const byteLength = Buffer.byteLength(item, "utf8");
+    if (byteLength > MAX_PREPARE_ARG_BYTES) {
+      throw new Error(
+        `${pathLabel}[${index}] exceeds the maximum of ${MAX_PREPARE_ARG_BYTES} UTF-8 bytes.`
+      );
+    }
+    return item;
+  });
+}
 function parseManagedRuntime(value, configPath) {
   if (value === void 0) {
     return void 0;
@@ -2303,7 +2335,7 @@ function parseManagedRuntime(value, configPath) {
   );
   ensureAllowedKeys(
     devcontainer,
-    ["baseServices", "profileServices"],
+    ["baseServices", "profileServices", "prepareCommand"],
     `${configPath}.managedRuntime.devcontainer`
   );
   const baseServices = parseRequiredUniqueStringArray(
@@ -2314,6 +2346,10 @@ function parseManagedRuntime(value, configPath) {
     devcontainer.profileServices,
     `${configPath}.managedRuntime.devcontainer.profileServices`
   );
+  const prepareCommand = parsePrepareCommand(
+    devcontainer.prepareCommand,
+    `${configPath}.managedRuntime.devcontainer.prepareCommand`
+  );
   const baseSet = new Set(baseServices);
   const overlappingServices = profileServices.filter((service) => baseSet.has(service));
   if (overlappingServices.length > 0) {
@@ -2334,7 +2370,11 @@ function parseManagedRuntime(value, configPath) {
     );
   }
   return {
-    devcontainer: { baseServices, profileServices },
+    devcontainer: {
+      baseServices,
+      profileServices,
+      ...prepareCommand ? { prepareCommand } : {}
+    },
     processes
   };
 }
@@ -2781,7 +2821,7 @@ function loadRepoConfig(repoPath) {
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.57" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.59" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -3125,7 +3165,7 @@ function resolveAppDependencies(config, app) {
   }
   return results;
 }
-var import_node_fs7, import_node_path7, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, DEFAULT_HOST_STRATEGY, MAX_READINESS_PATH_LENGTH, MIME_TOKEN_RE, PROFILE_NAME_RE, MAX_PROFILES;
+var import_node_fs7, import_node_path7, import_yaml2, hasWarnedVersionMismatch, CONFIG_FILE_NAME, DEFAULT_TCP_PROTOCOL, VALID_HOSTNAME_RE, DEVROUTER_VERSION_RE, VALID_ENV_NAME_RE, VALID_ENV_VAR_RE, UPSTREAM_TEMPLATE_RE, MAX_COMMAND_LENGTH, MAX_PREPARE_ARGS, MAX_PREPARE_ARG_BYTES, DEFAULT_HOST_STRATEGY, MAX_READINESS_PATH_LENGTH, MIME_TOKEN_RE, PROFILE_NAME_RE, MAX_PROFILES;
 var init_repo_config = __esm({
   "src/core/repo-config.ts"() {
     "use strict";
@@ -3144,6 +3184,8 @@ var init_repo_config = __esm({
     VALID_ENV_VAR_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
     UPSTREAM_TEMPLATE_RE = /^(?:\$\{WORKSPACE\}|[a-zA-Z0-9._-])+:\d{1,5}$/;
     MAX_COMMAND_LENGTH = 4096;
+    MAX_PREPARE_ARGS = 64;
+    MAX_PREPARE_ARG_BYTES = 4096;
     DEFAULT_HOST_STRATEGY = {
       type: "auto",
       denyPorts: [80, 443, 5432],
@@ -3323,6 +3365,7 @@ function buildOnboardingPrompt(options = {}) {
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Managed adapters may use devrouter-process ensure --prepare-command <command> for synchronous dependency preparation under the process lock before app launch. Unchanged owned processes skip preparation; it participates in default fingerprints and must not daemonize or detach.",
+    "- Host-generated Compose inputs may use managedRuntime.devcontainer.prepareCommand as literal argv. Ensure runs it once from the checkout root before Compose inspection, with a 60-second bound and no implicit shell. Keep .devrouter.yml unchanged. Diagnostics never run it; changed warm mounts require separate verification.",
     "- Exact managed Devsy stop validates complete retained container membership, ownership and configuration before stopping residual services after a stopped primary. Unknown evidence blocks cleanup; original provider failures remain errors even after successful residual cleanup.",
     "- Owner status is `present`, `missing`, `locked`, or `conflict`. Dirty or locked full down fails before side effects. `workspace gc` is a dry run; only `--yes` deletes exact eligible missing resources and records, never Git worktrees, branches, or prune state.",
     "- `devrouter workspace cleanup --repo . --inactive-for 30d --check-merged --json` is report-only and never mutates the workspace runtime, routes, ownership, Git, Docker, applications, worktrees, or branches. It reports ownership, workspace runtime registration, runtime state (`running|stopped|busy|not-found|absent|unknown`), checkout, advisory activity, route, and integration evidence. Local DevPod/Devsy list/status checks always run; `--check-merged` alone enables read-only origin and matching GitHub/GitLab checks. Treat `not-found` as stale runtime after Docker pruning; busy, unavailable, or conflicting evidence suppresses destructive suggestions. Explicit `gc`/`down` can remove exact stale registration only after expected-ID `NotFound` proof and ownership revalidation. Runtime `lastUsed` remains advisory.",
@@ -3370,7 +3413,7 @@ function buildOnboardingPrompt(options = {}) {
     "- devrouter repo devcontainer write --repo <REPO_PATH> --yes",
     "- devrouter repo devcontainer verify --repo <REPO_PATH> --json",
     "- Normal primary or linked startup: devrouter ensure <REPO_PATH> --json",
-    "- Degraded recovery: ordinary ensure automatically repairs the recorded profile before the desired transition; --repair limits the invocation to recorded-profile repair. Both validate unchanged retained configuration; stopped primary requires all project containers stopped and zero checkout routes. It starts only retained IDs, never provider bootstrap/recreation. Inspect failures before retrying.",
+    "- Degraded recovery: ordinary ensure validates retained ownership, then reconciles the requested profile without starting dropped processes first. Same-profile repair and --repair retain the recorded-profile path and start only retained IDs without provider bootstrap/recreation. Stopped primary requires all project containers stopped and zero checkout routes. Failed transitions preserve degraded state without replaying its broken adapter.",
     "- Managed selective startup: devrouter ensure <REPO_PATH> --profile <name> --json",
     "- Container seed/migration: devrouter exec <REPO_PATH> -- <command...>",
     "- Compatibility verification only after ensure: devrouter repo devcontainer verify --repo <REPO_PATH> --live --yes --json",
@@ -9166,7 +9209,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.57" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.59" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -11008,12 +11051,23 @@ var init_http_route_probe = __esm({
   }
 });
 
+// src/core/managed-host-preparation.ts
+var import_node_child_process21, import_node_fs27;
+var init_managed_host_preparation = __esm({
+  "src/core/managed-host-preparation.ts"() {
+    "use strict";
+    import_node_child_process21 = require("child_process");
+    import_node_fs27 = __toESM(require("fs"));
+    init_repo_config();
+  }
+});
+
 // src/core/traefik-route-health.ts
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function inspectRouterApi(protocol) {
-  const result = (0, import_node_child_process21.spawnSync)(
+  const result = (0, import_node_child_process22.spawnSync)(
     "curl",
     [
       "--silent",
@@ -11112,7 +11166,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs27.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs28.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -11143,12 +11197,12 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
 async function ensureTraefikRoutesRemoved(routes, options = {}) {
   return ensureTraefikRouteExpectation(routes, "removed", options);
 }
-var import_node_child_process21, import_node_fs27, import_node_path28, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
+var import_node_child_process22, import_node_fs28, import_node_path28, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
 var init_traefik_route_health = __esm({
   "src/core/traefik-route-health.ts"() {
     "use strict";
-    import_node_child_process21 = require("child_process");
-    import_node_fs27 = __toESM(require("fs"));
+    import_node_child_process22 = require("child_process");
+    import_node_fs28 = __toESM(require("fs"));
     import_node_path28 = __toESM(require("path"));
     init_file_lock();
     init_host_routes();
@@ -11194,12 +11248,12 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
-var import_node_child_process22, import_node_fs28, import_node_path29;
+var import_node_child_process23, import_node_fs29, import_node_path29;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process22 = require("child_process");
-    import_node_fs28 = __toESM(require("fs"));
+    import_node_child_process23 = require("child_process");
+    import_node_fs29 = __toESM(require("fs"));
     import_node_path29 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
@@ -11208,6 +11262,7 @@ var init_workspace_ensure = __esm({
     init_file_lock();
     init_host_routes();
     init_http_route_probe();
+    init_managed_host_preparation();
     init_managed_post_start();
     init_managed_runtime_state();
     init_managed_runtime_status();
@@ -11629,7 +11684,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process23.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process24.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -11637,11 +11692,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process23;
+var import_node_child_process24;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process23 = require("child_process");
+    import_node_child_process24 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -11664,7 +11719,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process24.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process25.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -11678,17 +11733,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process24.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process25.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process24;
+var import_node_child_process25;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process24 = require("child_process");
+    import_node_child_process25 = require("child_process");
     init_docker();
     init_router();
   }
@@ -11728,11 +11783,11 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs29.default.existsSync(filePath)) {
+  if (!import_node_fs30.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs29.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs30.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -11779,7 +11834,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs29.default.existsSync(import_node_path31.default.join(repoPath, fileName))) {
+    if (import_node_fs30.default.existsSync(import_node_path31.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -11795,8 +11850,8 @@ function inspectNode(repoPath, pkg) {
     return { version: engines.node, source: "package.json:engines.node" };
   }
   const nvmrc = import_node_path31.default.join(repoPath, ".nvmrc");
-  if (import_node_fs29.default.existsSync(nvmrc)) {
-    const version = import_node_fs29.default.readFileSync(nvmrc, "utf-8").trim();
+  if (import_node_fs30.default.existsSync(nvmrc)) {
+    const version = import_node_fs30.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -11875,7 +11930,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs29.default.existsSync(import_node_path31.default.join(repoPath, fileName))
+    (fileName) => import_node_fs30.default.existsSync(import_node_path31.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -11913,7 +11968,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs29.default.readFileSync(import_node_path31.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs30.default.readFileSync(import_node_path31.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -11948,8 +12003,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs29.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs29.default.readFileSync(import_node_path31.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs30.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs30.default.readFileSync(import_node_path31.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -11964,17 +12019,17 @@ function inspectEnvFiles(repoPath) {
 }
 function inspectDevcontainer(repoPath) {
   const dir = import_node_path31.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs29.default.existsSync(dir)) {
+  if (!import_node_fs30.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs29.default.readdirSync(dir).filter((fileName) => import_node_fs29.default.statSync(import_node_path31.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs30.default.readdirSync(dir).filter((fileName) => import_node_fs30.default.statSync(import_node_path31.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs29.default.existsSync(configPath)) {
+  if (!import_node_fs30.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -12018,15 +12073,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs29.default.existsSync(import_node_path31.default.join(repoPath, fileName))) {
+    if (import_node_fs30.default.existsSync(import_node_path31.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
   const skillsDir = import_node_path31.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs29.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs29.default.readdirSync(skillsDir).sort()) {
+  if (import_node_fs30.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs30.default.readdirSync(skillsDir).sort()) {
       const skillPath = import_node_path31.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs29.default.existsSync(skillPath)) {
+      if (import_node_fs30.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -12088,11 +12143,11 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs29, import_node_path31, import_yaml6;
+var import_node_fs30, import_node_path31, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs29 = __toESM(require("fs"));
+    import_node_fs30 = __toESM(require("fs"));
     import_node_path31 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
@@ -12198,7 +12253,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs30.default.existsSync(import_node_path32.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs31.default.existsSync(import_node_path32.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -12423,11 +12478,11 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs30, import_node_path32;
+var import_node_fs31, import_node_path32;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs30 = __toESM(require("fs"));
+    import_node_fs31 = __toESM(require("fs"));
     import_node_path32 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
@@ -12771,7 +12826,7 @@ function plannedFiles(repoPath, version) {
 }
 function classifyFile(repoPath, file) {
   const absolutePath = import_node_path33.default.join(repoPath, file.relativePath);
-  if (!import_node_fs31.default.existsSync(absolutePath)) {
+  if (!import_node_fs32.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -12779,7 +12834,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs31.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs32.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -12837,10 +12892,10 @@ function buildPlan(repoPath, dryRun, version) {
 }
 function writeFile(repoPath, file) {
   const absolutePath = import_node_path33.default.join(repoPath, file.relativePath);
-  import_node_fs31.default.mkdirSync(import_node_path33.default.dirname(absolutePath), { recursive: true });
-  import_node_fs31.default.writeFileSync(absolutePath, file.content, "utf-8");
+  import_node_fs32.default.mkdirSync(import_node_path33.default.dirname(absolutePath), { recursive: true });
+  import_node_fs32.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs31.default.chmodSync(absolutePath, 493);
+    import_node_fs32.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -12878,11 +12933,11 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs31, import_node_path33, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs32, import_node_path33, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs31 = __toESM(require("fs"));
+    import_node_fs32 = __toESM(require("fs"));
     import_node_path33 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
@@ -13296,7 +13351,7 @@ function loadContract(repoPath, contractPath) {
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs32.default.lstatSync(absolutePath);
+    metadata = import_node_fs33.default.lstatSync(absolutePath);
   } catch (error) {
     fail(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -13306,10 +13361,10 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs32.default.realpathSync(repoPath);
-  const realContract = import_node_fs32.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs33.default.realpathSync(repoPath);
+  const realContract = import_node_fs33.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs32.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs33.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
@@ -13329,11 +13384,11 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs32, import_node_path34, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs33, import_node_path34, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs32 = __toESM(require("fs"));
+    import_node_fs33 = __toESM(require("fs"));
     import_node_path34 = __toESM(require("path"));
     import_yaml7 = require("yaml");
     init_paths();
@@ -13779,10 +13834,10 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
   const cachePath = import_node_path36.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs33.default.mkdirSync(cachePath, { recursive: true });
+  import_node_fs34.default.mkdirSync(cachePath, { recursive: true });
   const overlayPath = import_node_path36.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs33.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs34.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -13796,7 +13851,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process26.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -13824,7 +13879,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process26.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -13850,7 +13905,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process26.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -13876,7 +13931,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process25.spawnSync)("docker", args, {
+  (0, import_node_child_process26.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -13888,7 +13943,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process25.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process26.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -13902,13 +13957,13 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process25, import_node_crypto11, import_node_fs33, import_node_path36, import_yaml8;
+var import_node_child_process26, import_node_crypto11, import_node_fs34, import_node_path36, import_yaml8;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process25 = require("child_process");
+    import_node_child_process26 = require("child_process");
     import_node_crypto11 = require("crypto");
-    import_node_fs33 = __toESM(require("fs"));
+    import_node_fs34 = __toESM(require("fs"));
     import_node_path36 = __toESM(require("path"));
     import_yaml8 = __toESM(require("yaml"));
     init_docker_error_guidance();
@@ -13999,7 +14054,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process26.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process27.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -14110,12 +14165,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process26.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process27.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process26.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process27.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -14174,7 +14229,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process26.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process27.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -14542,7 +14597,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process26.spawn)(wrapped, {
+        child = (0, import_node_child_process27.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -14556,7 +14611,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process26.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process27.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -14564,7 +14619,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process26.spawn)(options.command[0], {
+      child = (0, import_node_child_process27.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -14572,7 +14627,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process26.spawn)(command, args, {
+      child = (0, import_node_child_process27.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -14593,11 +14648,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process26, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process27, import_node_net, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process26 = require("child_process");
+    import_node_child_process27 = require("child_process");
     import_node_net = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -14731,13 +14786,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs34.default.lstatSync(worktreePath);
+    rootStat = import_node_fs35.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs34.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs35.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -14766,7 +14821,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       const entryPath = import_node_path37.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs34.default.lstatSync(entryPath);
+        entryStat = import_node_fs35.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -14776,7 +14831,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs34.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs35.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -14840,11 +14895,11 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs34, import_node_path37, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs35, import_node_path37, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs34 = __toESM(require("fs"));
+    import_node_fs35 = __toESM(require("fs"));
     import_node_path37 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
@@ -14946,7 +15001,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs35.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs36.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -15520,12 +15575,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process27, import_node_fs35, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process28, import_node_fs36, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process27 = require("child_process");
-    import_node_fs35 = __toESM(require("fs"));
+    import_node_child_process28 = require("child_process");
+    import_node_fs36 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -15542,7 +15597,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process27.spawnSync)(command, args, {
+      const result = (0, import_node_child_process28.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -15575,7 +15630,7 @@ function defaultWorktreePath(mainRepo, ws) {
   return import_node_path38.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process28.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process29.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
@@ -15697,13 +15752,13 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs36.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs37.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
     );
   }
-  const status = (0, import_node_child_process28.spawnSync)(
+  const status = (0, import_node_child_process29.spawnSync)(
     "git",
     ["-C", target.worktreePath, "status", "--porcelain", "--untracked-files=normal"],
     { encoding: "utf-8" }
@@ -15737,7 +15792,7 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs36.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs37.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
     const selectedPath = opts.path ? import_node_path38.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
@@ -15748,7 +15803,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs36.default.existsSync(selectedPath)) {
+    if (import_node_fs37.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -15767,11 +15822,11 @@ async function workspaceUp(branch, opts = {}) {
       return selectedPath;
     }
     if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
-    const add = (0, import_node_child_process28.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
+    const add = (0, import_node_child_process29.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process28.spawnSync)(
+      const addNew = (0, import_node_child_process29.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
         { encoding: "utf-8" }
@@ -15888,8 +15943,8 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     const result = await mutateWorkspaceRuntime("delete", resolved, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs36.default.existsSync(resolved.worktreePath)) {
-        const rm = (0, import_node_child_process28.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs37.default.existsSync(resolved.worktreePath)) {
+        const rm = (0, import_node_child_process29.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -15907,7 +15962,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs36.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs37.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
 }
 async function workspaceStop(target, opts = {}) {
   return runWorkspaceLifecycle("stop", target, opts);
@@ -15915,12 +15970,12 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process28, import_node_fs36, import_node_path38, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process29, import_node_fs37, import_node_path38, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process28 = require("child_process");
-    import_node_fs36 = __toESM(require("fs"));
+    import_node_child_process29 = require("child_process");
+    import_node_fs37 = __toESM(require("fs"));
     import_node_path38 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
@@ -16080,7 +16135,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.57" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.59" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {