@devrouter/cli 0.0.61 → 0.0.62

package/dist/devrouter-lifecycle-worker.js

@@ -936,6 +936,28 @@ function inspectManagedStopRunnerId(endpoint, containerId) {
     throw new Error("Provider container binding is unavailable.");
   return value;
 }
+function inspectProviderRunnerContainers(endpoint, runnerId) {
+  if (!runnerId || runnerId.length > 4096 || /[\r\n\0]/.test(runnerId))
+    throw new Error("Provider runner identity is malformed.");
+  const ids = parseDockerLines(
+    runManagedStopDocker(
+      [
+        "ps",
+        "-a",
+        "--no-trunc",
+        "--filter",
+        `label=dev.containers.id=${runnerId}`,
+        "--format",
+        "{{.ID}}"
+      ],
+      endpoint
+    )
+  );
+  if (ids.length > 256) throw new Error("Provider runner population exceeds its bound.");
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  return ids;
+}
 function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   const ids = parseDockerLines(
     runManagedStopDocker(
@@ -1046,6 +1068,10 @@ function listDevsyWorkspaces() {
       ...typeof candidate.uid === "string" ? { uid: candidate.uid } : {},
       ...typeof candidate.context === "string" ? { context: candidate.context } : {}
     };
+    const provider = candidate.provider;
+    if (provider && typeof provider.name === "string") workspace.providerName = provider.name;
+    if (typeof provider?.options?.DOCKER_PATH?.value === "string")
+      workspace.dockerPathOption = provider.options.DOCKER_PATH.value;
     if ("lastUsed" in candidate) {
       if (typeof candidate.lastUsed === "string") {
         workspace.lastUsed = candidate.lastUsed;
@@ -1627,29 +1653,101 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 // src/core/devsy-exec.ts
 var import_node_child_process22 = require("child_process");
 
-// src/core/execution-outcome.ts
-var ExecutionOutcomeError = class extends Error {
-  outcome;
-  constructor(message, outcome) {
-    super(message);
-    this.name = "ExecutionOutcomeError";
-    this.outcome = outcome;
+// src/core/devsy-exec-proof.ts
+var import_node_fs6 = __toESM(require("fs"));
+var import_node_os2 = __toESM(require("os"));
+var import_node_path7 = __toESM(require("path"));
+var import_node_util = require("util");
+function proveLocalDockerSelection(workspace) {
+  const name = workspace.providerName;
+  const context = workspace.context;
+  if (!name || !context || !/^[a-z0-9][a-z0-9-]{0,31}$/.test(name) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(context))
+    throw new Error("Retained exec provider configuration identity is unavailable.");
+  const file = import_node_path7.default.join(
+    process.env.DEVSY_HOME || import_node_path7.default.join(import_node_os2.default.homedir(), ".devsy"),
+    "contexts",
+    context,
+    "providers",
+    name,
+    "provider.json"
+  );
+  try {
+    if (import_node_fs6.default.statSync(file).size > 1024 * 1024) throw new Error();
+    const config = JSON.parse(import_node_fs6.default.readFileSync(file, "utf8"));
+    const driver = config.agent?.driver ?? "docker";
+    const configuredPath = config.agent?.docker?.path ?? "";
+    if (typeof configuredPath !== "string") throw new Error();
+    const command = configuredPath === "${DOCKER_PATH}" || configuredPath === "$DOCKER_PATH" ? workspace.dockerPathOption || process.env.DOCKER_PATH || "docker" : configuredPath || "docker";
+    if (config.name !== name || driver !== "docker" || command !== "docker") throw new Error();
+  } catch {
+    throw new Error("Retained exec requires a provider configured for the local Docker command.");
   }
-};
-
-// src/core/reliability-lifecycle.ts
-var import_node_path27 = __toESM(require("path"));
+  return name;
+}
+function captureDevsyExecProof(repoPath) {
+  repoPath = comparableWorkspacePath(repoPath);
+  const registry = listDevsyWorkspaces();
+  const workspace = selectDevsyWorkspace(registry, repoPath);
+  if (!workspace?.uid || !workspace.context || workspace.source.container || inspectDevsyWorkspaceOwnership(registry, workspace.id, repoPath).status !== "owned" || inspectDevsyRuntimeStatus(workspace.id) !== "running")
+    throw new Error("Retained exec requires one exact running Devsy registration.");
+  const providerName = proveLocalDockerSelection(workspace);
+  const endpoint = resolveManagedStopEndpoint();
+  if (!supportsManagedStopBaseline(endpoint))
+    throw new Error("Retained exec requires an exact local Docker endpoint.");
+  const daemon = inspectManagedStopDaemon(endpoint);
+  const candidates = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).filter(
+    (container) => container.state.Running
+  );
+  if (candidates.length !== 1)
+    throw new Error("Retained exec requires one exact running primary container.");
+  const candidate = candidates[0];
+  const project = candidate.labels["com.docker.compose.project"];
+  if (!project) throw new Error("Retained exec primary has no Compose identity.");
+  const pinned = workspaceAppContainers(
+    inspectManagedStopContainers(project, endpoint),
+    repoPath
+  ).filter((container) => container.state.Running);
+  if (pinned.length !== 1 || pinned[0].id !== candidate.id)
+    throw new Error("Retained exec primary changed during inspection.");
+  const mounts = pinned[0].mounts.filter(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  );
+  if (mounts.length !== 1 || !mounts[0].Destination.startsWith("/"))
+    throw new Error("Retained exec requires one exact source mount.");
+  const uidBytes = Buffer.byteLength(workspace.uid);
+  const runner = uidBytes === 16 || uidBytes === 40 ? workspace.uid : workspace.id;
+  const runnerContainers = inspectProviderRunnerContainers(endpoint, runner);
+  if (runnerContainers.length !== 1 || runnerContainers[0] !== candidate.id)
+    throw new Error("Retained exec runner does not select the exact primary container.");
+  if (inspectManagedStopRunnerId(endpoint, candidate.id) !== runner || inspectManagedStopDaemon(endpoint) !== daemon)
+    throw new Error("Retained exec provider or Docker identity changed.");
+  return {
+    repoPath,
+    id: workspace.id,
+    uid: workspace.uid,
+    context: workspace.context,
+    providerName,
+    endpoint,
+    daemon,
+    containerId: candidate.id,
+    workspacePath: mounts[0].Destination
+  };
+}
+function revalidateDevsyExecProof(repoPath, proof) {
+  if (!(0, import_node_util.isDeepStrictEqual)(captureDevsyExecProof(repoPath), proof))
+    throw new Error("Retained exec identity changed before command launch.");
+}
 
 // src/core/devsy-mutation.ts
 var import_node_child_process14 = require("child_process");
-var import_node_fs15 = __toESM(require("fs"));
-var import_node_path20 = __toESM(require("path"));
+var import_node_fs16 = __toESM(require("fs"));
+var import_node_path21 = __toESM(require("path"));
 
 // src/core/devsy-agent.ts
 var import_node_child_process9 = require("child_process");
 var import_node_crypto4 = require("crypto");
-var import_node_fs6 = __toESM(require("fs"));
-var import_node_path7 = __toESM(require("path"));
+var import_node_fs7 = __toESM(require("fs"));
+var import_node_path8 = __toESM(require("path"));
 var SUPPORTED_DEVSY_VERSION = "1.16.2";
 var DEVSY_AGENT_SETUP_COMMAND = "devrouter setup --yes --workspace-runtime devsy";
 var DEVSY_AGENT_ASSETS = [
@@ -1675,7 +1773,7 @@ var DevsyAgentReadinessError = class extends Error {
     this.name = "DevsyAgentReadinessError";
   }
 };
-var DEVSY_AGENT_CACHE_LOCK = import_node_path7.default.join(DEVROUTER_HOME, "devsy-agent-cache.lock");
+var DEVSY_AGENT_CACHE_LOCK = import_node_path8.default.join(DEVROUTER_HOME, "devsy-agent-cache.lock");
 function parseVersion(output) {
   return output?.match(
     /\bv?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\b/
@@ -1699,14 +1797,14 @@ function nativeAssetName(platform, arch) {
   return void 0;
 }
 function managedBinaryPath(cacheRoot, asset) {
-  return import_node_path7.default.join(cacheRoot, `v${SUPPORTED_DEVSY_VERSION}`, asset.name);
+  return import_node_path8.default.join(cacheRoot, `v${SUPPORTED_DEVSY_VERSION}`, asset.name);
 }
 function hashOpenFile(file) {
   const digest = (0, import_node_crypto4.createHash)("sha256");
   const buffer = Buffer.allocUnsafe(1024 * 1024);
   let position = 0;
   for (; ; ) {
-    const bytesRead = import_node_fs6.default.readSync(file, buffer, 0, buffer.length, position);
+    const bytesRead = import_node_fs7.default.readSync(file, buffer, 0, buffer.length, position);
     if (bytesRead === 0) break;
     digest.update(buffer.subarray(0, bytesRead));
     position += bytesRead;
@@ -1716,8 +1814,8 @@ function hashOpenFile(file) {
 function inspectBinary(binaryPath, assets, missingState) {
   let file;
   try {
-    file = import_node_fs6.default.openSync(binaryPath, import_node_fs6.default.constants.O_RDONLY | import_node_fs6.default.constants.O_NOFOLLOW);
-    const stat = import_node_fs6.default.fstatSync(file);
+    file = import_node_fs7.default.openSync(binaryPath, import_node_fs7.default.constants.O_RDONLY | import_node_fs7.default.constants.O_NOFOLLOW);
+    const stat = import_node_fs7.default.fstatSync(file);
     if (!stat.isFile()) {
       return { state: "invalid", reason: "the selected source is not a regular file" };
     }
@@ -1732,7 +1830,7 @@ function inspectBinary(binaryPath, assets, missingState) {
     const code = error.code;
     return code === "ENOENT" ? { state: missingState, reason: "the selected source is missing" } : { state: "invalid", reason: "the selected source is not a readable regular file" };
   } finally {
-    if (file !== void 0) import_node_fs6.default.closeSync(file);
+    if (file !== void 0) import_node_fs7.default.closeSync(file);
   }
 }
 function resolvedOptions(options) {
@@ -1741,7 +1839,7 @@ function resolvedOptions(options) {
     platform: options.platform ?? process.platform,
     arch: options.arch ?? process.arch,
     versionOutput: options.versionOutput ?? installedVersionOutput(),
-    cacheRoot: options.cacheRoot ?? import_node_path7.default.join(CACHE_DIR, "devsy", "agents"),
+    cacheRoot: options.cacheRoot ?? import_node_path8.default.join(CACHE_DIR, "devsy", "agents"),
     lockPath: options.lockPath ?? DEVSY_AGENT_CACHE_LOCK,
     assets: options.assets ?? DEVSY_AGENT_ASSETS,
     nativeAssetName: options.nativeAssetName
@@ -1802,19 +1900,19 @@ function requireReadyDevsyAgent(options = {}) {
 }
 
 // src/core/managed-devsy-stop.ts
-var import_node_os3 = __toESM(require("os"));
-var import_node_path19 = __toESM(require("path"));
+var import_node_os4 = __toESM(require("os"));
+var import_node_path20 = __toESM(require("path"));
 
 // src/core/devcontainer-profile.ts
 var import_node_child_process10 = require("child_process");
 var import_node_crypto5 = require("crypto");
-var import_node_fs8 = __toESM(require("fs"));
-var import_node_path10 = __toESM(require("path"));
+var import_node_fs9 = __toESM(require("fs"));
+var import_node_path11 = __toESM(require("path"));
 var import_yaml = __toESM(require("yaml"));
 
 // src/core/devcontainer-config.ts
-var import_node_fs7 = __toESM(require("fs"));
-var import_node_path8 = __toESM(require("path"));
+var import_node_fs8 = __toESM(require("fs"));
+var import_node_path9 = __toESM(require("path"));
 var import_jsonc_parser = require("jsonc-parser");
 function isObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -1837,11 +1935,11 @@ function parseDevcontainerConfig(contents, sourcePath) {
   return parsed;
 }
 function readDevcontainerConfig(repoPath) {
-  const sourcePath = import_node_path8.default.join(repoPath, ".devcontainer", "devcontainer.json");
-  if (!import_node_fs7.default.existsSync(sourcePath) || !import_node_fs7.default.lstatSync(sourcePath).isFile()) {
+  const sourcePath = import_node_path9.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  if (!import_node_fs8.default.existsSync(sourcePath) || !import_node_fs8.default.lstatSync(sourcePath).isFile()) {
     throw new Error(`Managed Dev Container source config does not exist: ${sourcePath}`);
   }
-  const sourceContents = import_node_fs7.default.readFileSync(sourcePath, "utf-8");
+  const sourceContents = import_node_fs8.default.readFileSync(sourcePath, "utf-8");
   return {
     sourcePath,
     sourceContents,
@@ -1859,11 +1957,11 @@ function assertManagedDevcontainerLifecycle(repoPath) {
 }
 
 // src/core/paths.ts
-var import_node_path9 = __toESM(require("path"));
+var import_node_path10 = __toESM(require("path"));
 function assertPathWithinRepo(filePath, repoRoot, label) {
-  const resolvedRoot = import_node_path9.default.resolve(repoRoot);
-  const resolved = import_node_path9.default.resolve(repoRoot, filePath);
-  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path9.default.sep)) {
+  const resolvedRoot = import_node_path10.default.resolve(repoRoot);
+  const resolved = import_node_path10.default.resolve(repoRoot, filePath);
+  if (resolved !== resolvedRoot && !resolved.startsWith(resolvedRoot + import_node_path10.default.sep)) {
     throw new Error(`${label} path '${filePath}' escapes the repository root.`);
   }
   return resolved;
@@ -1917,14 +2015,14 @@ function resolveComposeFiles(source, repoPath, linked) {
       "managedRuntime requires .devcontainer/devcontainer.json to define dockerComposeFile."
     );
   }
-  const directory = import_node_path10.default.join(repoPath, ".devcontainer");
+  const directory = import_node_path11.default.join(repoPath, ".devcontainer");
   const files = references.map((reference) => {
     const resolved2 = assertPathWithinRepo(
       resolveComposeReference(reference, linked),
       directory,
       "dockerComposeFile"
     );
-    if (!import_node_fs8.default.existsSync(resolved2) || !import_node_fs8.default.lstatSync(resolved2).isFile()) {
+    if (!import_node_fs9.default.existsSync(resolved2) || !import_node_fs9.default.lstatSync(resolved2).isFile()) {
       throw new Error(`Managed Dev Container compose file does not exist: ${resolved2}`);
     }
     return resolved2;
@@ -1932,7 +2030,7 @@ function resolveComposeFiles(source, repoPath, linked) {
   for (const file of files) {
     let parsed;
     try {
-      parsed = import_yaml.default.parse(import_node_fs8.default.readFileSync(file, "utf-8"));
+      parsed = import_yaml.default.parse(import_node_fs9.default.readFileSync(file, "utf-8"));
     } catch (error) {
       throw new Error(
         `Could not parse managed Dev Container compose file '${file}': ${String(error)}`
@@ -1981,12 +2079,12 @@ function assertIgnoredGeneratedPath(repoPath, generatedPath) {
   }
 }
 function assertGeneratedPathOwnership(generatedPath) {
-  if (!import_node_fs8.default.existsSync(generatedPath)) return;
-  const stat = import_node_fs8.default.lstatSync(generatedPath);
+  if (!import_node_fs9.default.existsSync(generatedPath)) return;
+  const stat = import_node_fs9.default.lstatSync(generatedPath);
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`Managed Dev Container path '${generatedPath}' is not a regular file.`);
   }
-  const firstLine = import_node_fs8.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
+  const firstLine = import_node_fs9.default.readFileSync(generatedPath, "utf-8").split(/\r?\n/, 1)[0];
   if (firstLine !== MANAGED_DEVCONTAINER_MARKER) {
     throw new Error(
       `Managed Dev Container path '${generatedPath}' exists without the devrouter ownership marker.`
@@ -2062,7 +2160,7 @@ function inspectManagedDevcontainerConfig(options) {
   const contents = `${MANAGED_DEVCONTAINER_MARKER}
 ${JSON.stringify(effective, null, 2)}
 `;
-  const generatedPath = import_node_path10.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
+  const generatedPath = import_node_path11.default.join(options.repoPath, MANAGED_DEVCONTAINER_PATH);
   assertIgnoredGeneratedPath(options.repoPath, generatedPath);
   assertGeneratedPathOwnership(generatedPath);
   return {
@@ -2089,13 +2187,13 @@ function writeManagedDevcontainerConfig(plan) {
 function inspectManagedDevcontainerGeneratedConfig(plan) {
   let stat;
   try {
-    stat = import_node_fs8.default.lstatSync(plan.generatedPath);
+    stat = import_node_fs9.default.lstatSync(plan.generatedPath);
   } catch (error) {
     if (error.code === "ENOENT") return { status: "missing" };
     throw error;
   }
   if (!stat.isFile() || stat.isSymbolicLink()) return { status: "foreign" };
-  const contents = import_node_fs8.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs9.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     return { status: "foreign" };
@@ -2107,17 +2205,17 @@ function inspectManagedDevcontainerGeneratedConfig(plan) {
   };
 }
 function removeManagedDevcontainerConfig(plan) {
-  if (!import_node_fs8.default.existsSync(plan.generatedPath)) return;
-  const stat = import_node_fs8.default.lstatSync(plan.generatedPath);
+  if (!import_node_fs9.default.existsSync(plan.generatedPath)) return;
+  const stat = import_node_fs9.default.lstatSync(plan.generatedPath);
   if (!stat.isFile()) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not a regular file.`);
   }
-  const contents = import_node_fs8.default.readFileSync(plan.generatedPath, "utf-8");
+  const contents = import_node_fs9.default.readFileSync(plan.generatedPath, "utf-8");
   if (!contents.startsWith(`${MANAGED_DEVCONTAINER_MARKER}
 `)) {
     throw new Error(`Managed Dev Container path '${plan.generatedPath}' is not devrouter-owned.`);
   }
-  import_node_fs8.default.unlinkSync(plan.generatedPath);
+  import_node_fs9.default.unlinkSync(plan.generatedPath);
 }
 function assertSafeContainerId(containerId) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(containerId)) {
@@ -2141,8 +2239,8 @@ function managedComposeEnvironment(workspace) {
 }
 function assertReadableComposeFile(file) {
   try {
-    if (!import_node_fs8.default.statSync(file).isFile()) throw new Error("not a regular file");
-    import_node_fs8.default.accessSync(file, import_node_fs8.default.constants.R_OK);
+    if (!import_node_fs9.default.statSync(file).isFile()) throw new Error("not a regular file");
+    import_node_fs9.default.accessSync(file, import_node_fs9.default.constants.R_OK);
   } catch {
     throw new Error("Managed container Compose configuration contains an unreadable file.");
   }
@@ -2274,8 +2372,8 @@ function stopExactManagedService(containerId, service, options) {
 }
 
 // src/core/managed-compose-population.ts
-var import_node_fs9 = __toESM(require("fs"));
-var import_node_path11 = __toESM(require("path"));
+var import_node_fs10 = __toESM(require("fs"));
+var import_node_path12 = __toESM(require("path"));
 function proveManagedComposePopulation(options) {
   const { plan, repoPath, composeProject, featureDirectory, devsyRoot, containers } = options;
   const services = /* @__PURE__ */ new Set();
@@ -2289,13 +2387,13 @@ function proveManagedComposePopulation(options) {
     }
     services.add(service);
     const files = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim());
-    if (files.some((file) => !file || !import_node_path11.default.isAbsolute(file)) || new Set(files.map((file) => import_node_path11.default.resolve(file))).size !== files.length || files.length < plan.composeFiles.length || plan.composeFiles.some((file, index) => !sameWorkspacePath(file, files[index]))) {
+    if (files.some((file) => !file || !import_node_path12.default.isAbsolute(file)) || new Set(files.map((file) => import_node_path12.default.resolve(file))).size !== files.length || files.length < plan.composeFiles.length || plan.composeFiles.some((file, index) => !sameWorkspacePath(file, files[index]))) {
       throw new Error("Managed stop Compose file identity changed.");
     }
     for (const file of files.slice(plan.composeFiles.length)) {
-      if (import_node_path11.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
-        import_node_path11.default.basename(file)
-      ) || import_node_fs9.default.realpathSync(file) !== import_node_path11.default.join(import_node_fs9.default.realpathSync(devsyRoot), import_node_path11.default.relative(devsyRoot, file))) {
+      if (import_node_path12.default.dirname(file) !== featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
+        import_node_path12.default.basename(file)
+      ) || import_node_fs10.default.realpathSync(file) !== import_node_path12.default.join(import_node_fs10.default.realpathSync(devsyRoot), import_node_path12.default.relative(devsyRoot, file))) {
         throw new Error("Managed stop refuses a foreign or escaped provider Compose file.");
       }
     }
@@ -2316,11 +2414,11 @@ function proveManagedComposePopulation(options) {
 
 // src/core/managed-runtime-state.ts
 var import_node_crypto6 = require("crypto");
-var import_node_fs10 = __toESM(require("fs"));
-var import_node_path13 = __toESM(require("path"));
+var import_node_fs11 = __toESM(require("fs"));
+var import_node_path14 = __toESM(require("path"));
 
 // src/core/managed-stop-baseline.ts
-var import_node_path12 = __toESM(require("path"));
+var import_node_path13 = __toESM(require("path"));
 function record(value, keys2) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== keys2.length || Object.keys(value).some((key) => !keys2.includes(key))) {
     throw new Error("Invalid managed stop baseline fields.");
@@ -2335,7 +2433,7 @@ function text(value, empty = false) {
 }
 function absolute(value) {
   const result = text(value);
-  if (!import_node_path12.default.isAbsolute(result) || import_node_path12.default.normalize(result) !== result) {
+  if (!import_node_path13.default.isAbsolute(result) || import_node_path13.default.normalize(result) !== result) {
     throw new Error("Invalid managed stop baseline path.");
   }
   return result;
@@ -2413,8 +2511,8 @@ function validateManagedStopBaseline(value, state) {
     const c = record(entry, ["id", "service", "configFiles", "mounts"]);
     const configFiles = list(c.configFiles, absolute);
     if (configFiles.length < result.composeFiles.length || result.composeFiles.some((file, index) => configFiles[index] !== file) || configFiles.slice(result.composeFiles.length).some(
-      (file) => import_node_path12.default.dirname(file) !== result.featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
-        import_node_path12.default.basename(file)
+      (file) => import_node_path13.default.dirname(file) !== result.featureDirectory || !/^docker-compose\.devcontainer\.containerFeatures-[a-zA-Z0-9_-]+\.yml$/.test(
+        import_node_path13.default.basename(file)
       )
     )) {
       throw new Error("Invalid stop baseline Compose provenance.");
@@ -2453,7 +2551,7 @@ function stateKey(repoPath, workspace) {
   return (0, import_node_crypto6.createHash)("sha256").update(`${repoPath}\0${workspace ?? ""}`, "utf-8").digest("hex");
 }
 function managedRuntimeStatePath(repoPath, workspace) {
-  return import_node_path13.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
+  return import_node_path14.default.join(DEVROUTER_HOME, "managed-runtime", `${stateKey(repoPath, workspace)}.json`);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string") && new Set(value).size === value.length;
@@ -2518,9 +2616,9 @@ function validateState(value, repoPath, workspace) {
   }
   return result;
 }
-function readManagedRuntimeState(repoPath, workspace, read = (file) => import_node_fs10.default.readFileSync(file, "utf-8")) {
+function readManagedRuntimeState(repoPath, workspace, read = (file) => import_node_fs11.default.readFileSync(file, "utf-8")) {
   const statePath = managedRuntimeStatePath(repoPath, workspace);
-  if (!import_node_fs10.default.existsSync(statePath)) return void 0;
+  if (!import_node_fs11.default.existsSync(statePath)) return void 0;
   let parsed;
   try {
     parsed = JSON.parse(read(statePath));
@@ -2547,9 +2645,9 @@ function markManagedRuntimeDegraded(state, transitionPhase) {
 }
 
 // src/core/managed-stop-recovery.ts
-var import_node_os2 = __toESM(require("os"));
-var import_node_path15 = __toESM(require("path"));
-var import_node_util = require("util");
+var import_node_os3 = __toESM(require("os"));
+var import_node_path16 = __toESM(require("path"));
+var import_node_util2 = require("util");
 
 // src/core/reliability-context.ts
 var claim;
@@ -2563,11 +2661,11 @@ function claimLifecycleEffect() {
 
 // src/core/workspace-ownership.ts
 var import_node_child_process11 = require("child_process");
-var import_node_fs11 = __toESM(require("fs"));
-var import_node_path14 = __toESM(require("path"));
+var import_node_fs12 = __toESM(require("fs"));
+var import_node_path15 = __toESM(require("path"));
 var READ_ONLY_GIT_ENV = { ...process.env, GIT_OPTIONAL_LOCKS: "0" };
 var OWNERSHIP_VERSION = 1;
-var OWNERSHIP_DIR = import_node_path14.default.join("devrouter", "workspaces");
+var OWNERSHIP_DIR = import_node_path15.default.join("devrouter", "workspaces");
 function commandError(command, repoPath, stderr) {
   return new Error(
     `${command} failed for '${repoPath}': ${stderr?.trim() || "not a Git repository"}`
@@ -2582,7 +2680,7 @@ function resolveGitCommonDir(repoPath) {
   if (result.status !== 0 || !output) {
     throw commandError("Could not resolve the Git common directory", repoPath, result.stderr);
   }
-  return comparableWorkspacePath(import_node_path14.default.isAbsolute(output) ? output : import_node_path14.default.resolve(repoPath, output));
+  return comparableWorkspacePath(import_node_path15.default.isAbsolute(output) ? output : import_node_path15.default.resolve(repoPath, output));
 }
 function listGitWorktrees(repoPath) {
   const result = (0, import_node_child_process11.spawnSync)("git", ["-C", repoPath, "worktree", "list", "--porcelain"], {
@@ -2622,7 +2720,7 @@ function listGitWorktrees(repoPath) {
   return worktrees;
 }
 function ownershipDirectory(repoPath) {
-  return import_node_path14.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
+  return import_node_path15.default.join(resolveGitCommonDir(repoPath), OWNERSHIP_DIR);
 }
 function validateWorkspace(value, label) {
   if (typeof value !== "string" || wsFromBranch(value) !== value) {
@@ -2650,7 +2748,7 @@ function validateRecord(value, expectedWorkspace) {
       `workspace ownership file '${expectedWorkspace}' contains identity '${workspace}'`
     );
   }
-  if (typeof candidate.worktreePath !== "string" || !import_node_path14.default.isAbsolute(candidate.worktreePath)) {
+  if (typeof candidate.worktreePath !== "string" || !import_node_path15.default.isAbsolute(candidate.worktreePath)) {
     throw new Error("invalid workspace ownership worktreePath");
   }
   if (candidate.branch !== null && typeof candidate.branch !== "string") {
@@ -2668,7 +2766,7 @@ function validateRecord(value, expectedWorkspace) {
   };
 }
 function recordPath(repoPath, workspace) {
-  return import_node_path14.default.join(
+  return import_node_path15.default.join(
     ownershipDirectory(repoPath),
     `${validateWorkspace(workspace, "workspace")}.json`
   );
@@ -2676,7 +2774,7 @@ function recordPath(repoPath, workspace) {
 function readRecordFile(filePath, expectedWorkspace) {
   let parsed;
   try {
-    parsed = JSON.parse(import_node_fs11.default.readFileSync(filePath, "utf-8"));
+    parsed = JSON.parse(import_node_fs12.default.readFileSync(filePath, "utf-8"));
   } catch (error) {
     if (error instanceof SyntaxError) {
       throw new Error(`invalid workspace ownership JSON at '${filePath}'`);
@@ -2701,7 +2799,7 @@ function listWorkspaceOwnership(repoPath) {
 function listWorkspaceOwnershipInDirectory(directory) {
   let entries;
   try {
-    entries = import_node_fs11.default.readdirSync(directory, { withFileTypes: true });
+    entries = import_node_fs12.default.readdirSync(directory, { withFileTypes: true });
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
@@ -2709,14 +2807,14 @@ function listWorkspaceOwnershipInDirectory(directory) {
   return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const workspace = entry.name.slice(0, -".json".length);
     validateWorkspace(workspace, "filename");
-    return readRecordFile(import_node_path14.default.join(directory, entry.name), workspace);
+    return readRecordFile(import_node_path15.default.join(directory, entry.name), workspace);
   });
 }
 function writeWorkspaceOwnershipInDirectory(directory, input) {
   const workspace = validateWorkspace(input.workspace, "workspace");
   const devpodId = validateWorkspace(input.devpodId, "devpodId");
   const worktreePath = comparableWorkspacePath(input.worktreePath);
-  const filePath = import_node_path14.default.join(directory, `${workspace}.json`);
+  const filePath = import_node_path15.default.join(directory, `${workspace}.json`);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const records = listWorkspaceOwnershipInDirectory(directory);
   const existing = records.find((record5) => record5.workspace === workspace);
@@ -2752,9 +2850,9 @@ function writeWorkspaceOwnershipInDirectory(directory, input) {
   return record4;
 }
 function removeWorkspaceOwnershipInDirectory(directory, workspace) {
-  const filePath = import_node_path14.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
+  const filePath = import_node_path15.default.join(directory, `${validateWorkspace(workspace, "workspace")}.json`);
   try {
-    import_node_fs11.default.rmSync(filePath);
+    import_node_fs12.default.rmSync(filePath);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -2765,7 +2863,7 @@ function sameOwnershipRecord(left, right) {
   return left.version === right.version && left.workspace === right.workspace && sameWorkspacePath(left.worktreePath, right.worktreePath) && left.branch === right.branch && left.devpodId === right.devpodId && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
 }
 function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
-  const filePath = import_node_path14.default.join(
+  const filePath = import_node_path15.default.join(
     directory,
     `${validateWorkspace(expected.workspace, "workspace")}.json`
   );
@@ -2777,14 +2875,14 @@ function removeWorkspaceOwnershipIfMatchesInDirectory(directory, expected) {
     throw error;
   }
   if (!sameOwnershipRecord(current, expected)) return "changed";
-  import_node_fs11.default.rmSync(filePath);
+  import_node_fs12.default.rmSync(filePath);
   return "removed";
 }
 function withWorkspaceOwnershipTransaction(repoPath, operation, options = {}) {
   const directory = ownershipDirectory(repoPath);
-  import_node_fs11.default.mkdirSync(directory, { recursive: true });
+  import_node_fs12.default.mkdirSync(directory, { recursive: true });
   return withFileLockSync(
-    import_node_path14.default.join(directory, ".lock"),
+    import_node_path15.default.join(directory, ".lock"),
     {
       activity: "workspace ownership transaction",
       target: `'${repoPath}'`,
@@ -2817,7 +2915,7 @@ function persistedWorkspaceOwners(repoPath, worktreePath) {
     try {
       workspace = readPersistedWorkspace(worktree.path);
     } catch (error) {
-      if (!import_node_fs11.default.existsSync(worktree.path)) continue;
+      if (!import_node_fs12.default.existsSync(worktree.path)) continue;
       throw error;
     }
     if (!workspace) continue;
@@ -2974,7 +3072,7 @@ function inspectWorkspaceOwnership(record4, worktrees, devpods) {
   if (worktree?.locked) {
     return { ownerStatus: "locked", devpodStatus, worktree };
   }
-  if ((!worktree || worktree.prunable) && import_node_fs11.default.existsSync(record4.worktreePath)) {
+  if ((!worktree || worktree.prunable) && import_node_fs12.default.existsSync(record4.worktreePath)) {
     return { ownerStatus: "conflict", devpodStatus, worktree };
   }
   if (!worktree || worktree.prunable) {
@@ -3052,7 +3150,7 @@ function prove(state, baseline) {
   const containers = inspectManagedStopContainers(baseline.project, baseline.endpoint);
   const expected = baseline.containers.map((container) => ({ ...container, mounts: orderedMounts(container.mounts) })).sort((a, b) => compareText(a.id, b.id));
   const observed = containers.map(identity).sort((a, b) => compareText(a.id, b.id));
-  if (!(0, import_node_util.isDeepStrictEqual)(expected, observed) || containers.some(
+  if (!(0, import_node_util2.isDeepStrictEqual)(expected, observed) || containers.some(
     (container) => container.labels["com.docker.compose.project.working_dir"] !== baseline.composeDirectory
   )) {
     throw new Error("Retained container population or immutable identity changed.");
@@ -3061,7 +3159,7 @@ function prove(state, baseline) {
     baseline.endpoint,
     baseline.composeDirectory
   ).sort();
-  if (!(0, import_node_util.isDeepStrictEqual)(workspaceIds, expected.map((container) => container.id).sort())) {
+  if (!(0, import_node_util2.isDeepStrictEqual)(workspaceIds, expected.map((container) => container.id).sort())) {
     throw new Error("Workspace contains an unrecorded container population.");
   }
   const primary = baseline.containers.find(
@@ -3073,7 +3171,7 @@ function prove(state, baseline) {
   if (!baseline.sourceContainer && inspectManagedStopRunnerId(baseline.endpoint, primary.id) !== runnerId) {
     throw new Error("Provider-to-container binding changed.");
   }
-  if (!(0, import_node_util.isDeepStrictEqual)(registration(state), owner) || inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId) {
+  if (!(0, import_node_util2.isDeepStrictEqual)(registration(state), owner) || inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId) {
     throw new Error("Stop authority changed during inspection.");
   }
   return containers;
@@ -3082,8 +3180,8 @@ function captureManagedStopBaseline(state, plan, primaryId, expectedEndpoint) {
   const owner = registration(state);
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(owner.context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(owner.providerId))
     throw new Error("Invalid capture provider identity.");
-  const devsyRoot = import_node_path15.default.resolve(process.env.DEVSY_HOME || import_node_path15.default.join(import_node_os2.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path15.default.join(
+  const devsyRoot = import_node_path16.default.resolve(process.env.DEVSY_HOME || import_node_path16.default.join(import_node_os3.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path16.default.join(
     devsyRoot,
     "contexts",
     owner.context,
@@ -3133,11 +3231,11 @@ function captureManagedStopBaseline(state, plan, primaryId, expectedEndpoint) {
 }
 function proveRetainedManagedStop(state) {
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
-  if (!(0, import_node_util.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
     throw new Error("Retained stop generation changed.");
   }
   const result = prove(state, baseline);
-  if (!(0, import_node_util.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state)) {
     throw new Error("Retained stop generation changed during inspection.");
   }
   return result;
@@ -3168,8 +3266,8 @@ function stopFromManagedBaseline(state) {
 }
 
 // src/core/repo-config.ts
-var import_node_fs13 = __toESM(require("fs"));
-var import_node_path17 = __toESM(require("path"));
+var import_node_fs14 = __toESM(require("fs"));
+var import_node_path18 = __toESM(require("path"));
 var import_yaml3 = __toESM(require("yaml"));
 
 // src/core/capabilities.ts
@@ -3195,9 +3293,9 @@ function formatSupportedTcpProtocols() {
 }
 
 // src/core/host-routes.ts
-var import_node_fs12 = __toESM(require("fs"));
-var import_node_path16 = __toESM(require("path"));
-var import_node_util2 = require("util");
+var import_node_fs13 = __toESM(require("fs"));
+var import_node_path17 = __toESM(require("path"));
+var import_node_util3 = require("util");
 var import_yaml2 = __toESM(require("yaml"));
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0"]);
 var UPSTREAM_RE = /^([a-zA-Z0-9._-]+):(\d{1,5})$/;
@@ -3380,7 +3478,7 @@ function writeRouteGeneration(routes, tlsEnabled) {
   writeFileAtomically(HOST_ROUTES_STATE_FILE, renderCompatibilityState(routes));
   writeFileAtomically(TRAEFIK_HOST_ROUTES_FILE, renderCanonicalState(routes, tlsEnabled));
 }
-function readCompatibilityState(read = (file) => import_node_fs12.default.readFileSync(file, "utf-8")) {
+function readCompatibilityState(read = (file) => import_node_fs13.default.readFileSync(file, "utf-8")) {
   let raw;
   try {
     raw = read(HOST_ROUTES_STATE_FILE);
@@ -3437,14 +3535,14 @@ function parseCanonicalState(raw) {
     throw new Error(`Canonical host-route document is invalid: ${error.message}`);
   }
   const expectedDocument = buildHostRoutesDocument(routes, metadata.tlsEnabled);
-  if (!(0, import_node_util2.isDeepStrictEqual)(document, expectedDocument)) {
+  if (!(0, import_node_util3.isDeepStrictEqual)(document, expectedDocument)) {
     throw new Error("Canonical host-route document does not match its metadata.");
   }
   return { kind: "canonical", metadata };
 }
 function ensureHostRouteStorage() {
-  import_node_fs12.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  import_node_fs12.default.mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });
+  import_node_fs13.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs13.default.mkdirSync(TRAEFIK_DYNAMIC_DIR, { recursive: true });
 }
 function writeState(routes) {
   ensureHostRouteStorage();
@@ -3463,8 +3561,8 @@ function refreshHostRoutesDynamicFile() {
 }
 function readHostRouteStateLocked() {
   ensureHostRouteStorage();
-  if (!import_node_fs12.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
-    if (import_node_fs12.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+  if (!import_node_fs13.default.existsSync(TRAEFIK_HOST_ROUTES_FILE)) {
+    if (import_node_fs13.default.existsSync(HOST_ROUTES_STATE_FILE)) {
       const routes = readCompatibilityState();
       writeRouteGeneration(routes, isTLSEnabled());
       return routes;
@@ -3472,10 +3570,10 @@ function readHostRouteStateLocked() {
     writeRouteGeneration([], isTLSEnabled());
     return [];
   }
-  const raw = import_node_fs12.default.readFileSync(TRAEFIK_HOST_ROUTES_FILE, "utf-8");
+  const raw = import_node_fs13.default.readFileSync(TRAEFIK_HOST_ROUTES_FILE, "utf-8");
   const canonical = parseCanonicalState(raw);
   if (canonical.kind === "legacy") {
-    if (!import_node_fs12.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+    if (!import_node_fs13.default.existsSync(HOST_ROUTES_STATE_FILE)) {
       throw new Error(
         "Headerless host-route document requires a valid compatibility state file for migration."
       );
@@ -3485,9 +3583,9 @@ function readHostRouteStateLocked() {
     return routes;
   }
   let mirrorMatches = false;
-  if (import_node_fs12.default.existsSync(HOST_ROUTES_STATE_FILE)) {
+  if (import_node_fs13.default.existsSync(HOST_ROUTES_STATE_FILE)) {
     try {
-      mirrorMatches = (0, import_node_util2.isDeepStrictEqual)(readCompatibilityState(), canonical.metadata.routes);
+      mirrorMatches = (0, import_node_util3.isDeepStrictEqual)(readCompatibilityState(), canonical.metadata.routes);
     } catch {
       mirrorMatches = false;
     }
@@ -4505,15 +4603,15 @@ function applyProfile(config, profile) {
   return next;
 }
 function resolveRepoPath(repoPath) {
-  return import_node_path17.default.resolve(repoPath ?? process.cwd());
+  return import_node_path18.default.resolve(repoPath ?? process.cwd());
 }
 function getRepoConfigPath(repoPath) {
-  return import_node_path17.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
+  return import_node_path18.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
 }
-function loadRepoConfig(repoPath, read = (file) => import_node_fs13.default.readFileSync(file, "utf-8")) {
+function loadRepoConfig(repoPath, read = (file) => import_node_fs14.default.readFileSync(file, "utf-8")) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
-  if (!import_node_fs13.default.existsSync(configPath)) {
+  if (!import_node_fs14.default.existsSync(configPath)) {
     throw new Error(
       `Missing ${CONFIG_FILE_NAME} in ${resolvedRepoPath}. Run 'dev repo init --repo ${resolvedRepoPath}' first.`
     );
@@ -4523,7 +4621,7 @@ function loadRepoConfig(repoPath, read = (file) => import_node_fs13.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.61" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.62" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -4543,7 +4641,7 @@ function namespaceHost(host, workspace) {
   return `${base}.${workspace}${suffix}`;
 }
 function applyWorkspace(config, workspace, repoPath) {
-  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path17.default.basename(import_node_path17.default.resolve(repoPath))) ?? "app";
+  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path18.default.basename(import_node_path18.default.resolve(repoPath))) ?? "app";
   const substitutionToken = workspace ?? defaultToken;
   const next = structuredClone(config);
   for (const app of next.apps) {
@@ -4704,10 +4802,10 @@ async function ensureNetwork(name) {
 // src/core/tls.ts
 var import_node_child_process13 = require("child_process");
 var import_node_crypto7 = require("crypto");
-var import_node_fs14 = __toESM(require("fs"));
-var import_node_path18 = __toESM(require("path"));
+var import_node_fs15 = __toESM(require("fs"));
+var import_node_path19 = __toESM(require("path"));
 var DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
-var TLS_CERTIFICATE_LOCK_FILE = import_node_path18.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+var TLS_CERTIFICATE_LOCK_FILE = import_node_path19.default.join(DEVROUTER_HOME, "tls-certificate.lock");
 var TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
 var TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
 function runOrThrow(command, args) {
@@ -4739,8 +4837,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path18.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs14.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path19.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs15.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -4841,11 +4939,11 @@ function compactTLSCertificateHosts(hosts) {
   );
 }
 function readCurrentCertificateHosts(options = {}) {
-  if (!import_node_fs14.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs15.default.existsSync(CERT_FILE)) {
     return [];
   }
   try {
-    const pem = import_node_fs14.default.readFileSync(CERT_FILE, "utf-8");
+    const pem = import_node_fs15.default.readFileSync(CERT_FILE, "utf-8");
     return parseCertificateDnsHosts(pem);
   } catch (error) {
     if (options.replaceMalformed) {
@@ -5084,8 +5182,8 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
     throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
   }
-  const devsyRoot = import_node_path19.default.resolve(process.env.DEVSY_HOME || import_node_path19.default.join(import_node_os3.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path19.default.join(
+  const devsyRoot = import_node_path20.default.resolve(process.env.DEVSY_HOME || import_node_path20.default.join(import_node_os4.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path20.default.join(
     devsyRoot,
     "contexts",
     context,
@@ -5191,7 +5289,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
 }
 
 // src/core/devsy-mutation.ts
-var DEVSY_MUTATION_LOCK_FILE = import_node_path20.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+var DEVSY_MUTATION_LOCK_FILE = import_node_path21.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
 var DEVSY_MUTATION_WAIT_MS = 18e5;
 var DevsyStartPostconditionError = class extends Error {
 };
@@ -5206,7 +5304,7 @@ function failedStartMayHaveAttached(devsyId, repoPath) {
   }
 }
 function withMutationLock(activity, target, operation) {
-  import_node_fs15.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs16.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -5220,7 +5318,7 @@ function withMutationLock(activity, target, operation) {
   );
 }
 function withMutationLockAsync(activity, target, operation) {
-  import_node_fs15.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs16.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -5424,6 +5522,19 @@ async function startDevsyWorkspace(options) {
   });
 }
 
+// src/core/execution-outcome.ts
+var ExecutionOutcomeError = class extends Error {
+  outcome;
+  constructor(message, outcome) {
+    super(message);
+    this.name = "ExecutionOutcomeError";
+    this.outcome = outcome;
+  }
+};
+
+// src/core/reliability-lifecycle.ts
+var import_node_path28 = __toESM(require("path"));
+
 // src/core/reliability-contract.ts
 var RELIABILITY_CONTRACT_VERSION = 2;
 var RELIABILITY_MAX_ITEMS = 128;
@@ -5553,7 +5664,7 @@ function assertReliabilityEvent(value) {
       valid = oneOf2(value.mode, ["start", "attach"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer);
       break;
     case "operation-request":
-      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean";
+      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean" && (value.recoverInterruptedEnsure === void 0 || typeof value.recoverInterruptedEnsure === "boolean");
       break;
     case "drained":
       valid = isReliabilityId(value.operationId);
@@ -5736,6 +5847,10 @@ function handleRequest(state, event) {
   });
   return transition(state, "accepted");
 }
+function canExecAfterInterruptedEnsure(state) {
+  const latestEnsure = [...state.operationHistory].reverse().find((operation) => operation.kind === "ensure");
+  return state.executionPolicy === "manual" && state.desired === "running" && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && state.phase === "recovering" || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
+}
 function handleOperationRequest(state, event) {
   if (state.executionPolicy !== "manual") return unchanged(state, "blocked");
   const previous = state.operationHistory.find((entry) => entry.key === event.key);
@@ -5746,9 +5861,11 @@ function handleOperationRequest(state, event) {
     );
   if (state.operationHistory.some((entry) => entry.id === event.operationId))
     return unchanged(state, "conflict");
+  if (event.kind === "exec" && canExecAfterInterruptedEnsure(state) && event.recoverInterruptedEnsure !== true)
+    return unchanged(state, "blocked");
   const fullyStopped = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
   const reconcileEnsure = event.kind === "ensure" && state.operation?.kind === "ensure" && ["NOT_STARTED", "INTERRUPTED"].includes(state.operation.status);
-  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure))
+  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure && !(event.kind === "exec" && event.recoverInterruptedEnsure === true && canExecAfterInterruptedEnsure(state))))
     return unchanged(state, "blocked");
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
     return unchanged(state, "blocked");
@@ -5759,8 +5876,9 @@ function handleOperationRequest(state, event) {
   if (rollover) {
     if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED"].includes(state.operation.status)))
       return unchanged(state, "blocked");
+    const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
     retired = state.operationHistory.findIndex(
-      (entry) => entry.id !== state.operation?.id && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
+      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
     );
     if (retired === -1) return unchanged(state, "blocked");
   }
@@ -6129,17 +6247,17 @@ function stepReliability(state, event, nowMs) {
 
 // src/core/reliability-operation-store.ts
 var import_node_crypto8 = require("crypto");
-var import_node_fs16 = __toESM(require("fs"));
-var import_node_path21 = __toESM(require("path"));
+var import_node_fs17 = __toESM(require("fs"));
+var import_node_path22 = __toESM(require("path"));
 var MAX_RECORD_BYTES = 1048576;
 function identityKey(identity2) {
-  if (!import_node_path21.default.isAbsolute(identity2.repoPath) || import_node_path21.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
+  if (!import_node_path22.default.isAbsolute(identity2.repoPath) || import_node_path22.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
     throw new Error("Invalid reliability workspace identity.");
   }
   return (0, import_node_crypto8.createHash)("sha256").update(identity2.repoPath).digest("hex");
 }
 function reliabilityOperationPath(identity2) {
-  return import_node_path21.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
+  return import_node_path22.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
 }
 function keys(value, expected) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !expected.includes(key))) {
@@ -6218,21 +6336,21 @@ function readReliabilityOperation(identity2) {
   const file = reliabilityOperationPath(identity2);
   let descriptor;
   try {
-    descriptor = import_node_fs16.default.openSync(
+    descriptor = import_node_fs17.default.openSync(
       file,
-      import_node_fs16.default.constants.O_RDONLY | import_node_fs16.default.constants.O_NOFOLLOW | import_node_fs16.default.constants.O_NONBLOCK
+      import_node_fs17.default.constants.O_RDONLY | import_node_fs17.default.constants.O_NOFOLLOW | import_node_fs17.default.constants.O_NONBLOCK
     );
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
   }
   try {
-    const stat = import_node_fs16.default.fstatSync(descriptor);
+    const stat = import_node_fs17.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
       throw new Error("Reliability record is not a bounded private file.");
     }
     const bytes = Buffer.alloc(MAX_RECORD_BYTES + 1);
-    const count = import_node_fs16.default.readSync(descriptor, bytes, 0, bytes.length, 0);
+    const count = import_node_fs17.default.readSync(descriptor, bytes, 0, bytes.length, 0);
     if (count > MAX_RECORD_BYTES) throw new Error("Reliability record exceeds its byte limit.");
     const record4 = JSON.parse(
       bytes.subarray(0, count).toString("utf8")
@@ -6240,7 +6358,7 @@ function readReliabilityOperation(identity2) {
     validate(record4, identity2);
     return record4;
   } finally {
-    import_node_fs16.default.closeSync(descriptor);
+    import_node_fs17.default.closeSync(descriptor);
   }
 }
 function persist(record4) {
@@ -6255,23 +6373,23 @@ function persist(record4) {
   } catch (error) {
     const reread = readReliabilityOperation(record4.identity);
     if (!reread || JSON.stringify(reread) !== JSON.stringify(record4)) throw error;
-    const descriptor = import_node_fs16.default.openSync(file, import_node_fs16.default.constants.O_RDONLY | import_node_fs16.default.constants.O_NOFOLLOW);
+    const descriptor = import_node_fs17.default.openSync(file, import_node_fs17.default.constants.O_RDONLY | import_node_fs17.default.constants.O_NOFOLLOW);
     try {
-      import_node_fs16.default.fsyncSync(descriptor);
+      import_node_fs17.default.fsyncSync(descriptor);
     } finally {
-      import_node_fs16.default.closeSync(descriptor);
+      import_node_fs17.default.closeSync(descriptor);
     }
-    const directory = import_node_fs16.default.openSync(import_node_path21.default.dirname(file), "r");
+    const directory = import_node_fs17.default.openSync(import_node_path22.default.dirname(file), "r");
     try {
-      import_node_fs16.default.fsyncSync(directory);
+      import_node_fs17.default.fsyncSync(directory);
     } finally {
-      import_node_fs16.default.closeSync(directory);
+      import_node_fs17.default.closeSync(directory);
     }
   }
 }
 function updateReliabilityOperation(identity2, operation) {
   const file = reliabilityOperationPath(identity2);
-  import_node_fs16.default.mkdirSync(import_node_path21.default.dirname(file), { recursive: true, mode: 448 });
+  import_node_fs17.default.mkdirSync(import_node_path22.default.dirname(file), { recursive: true, mode: 448 });
   return withFileLockSync(`${file}.lock`, { activity: "reliability intent", waitMs: 2e3 }, () => {
     const record4 = readReliabilityOperation(identity2) ?? {
       version: 1,
@@ -6298,8 +6416,8 @@ function updateReliabilityOperation(identity2, operation) {
 // src/core/reliability-worker.ts
 var import_node_child_process15 = require("child_process");
 var import_node_crypto9 = require("crypto");
-var import_node_fs17 = __toESM(require("fs"));
-var import_node_path22 = __toESM(require("path"));
+var import_node_fs18 = __toESM(require("fs"));
+var import_node_path23 = __toESM(require("path"));
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
@@ -6311,19 +6429,19 @@ function workerGroupAbsent(pid) {
 
 // src/core/workspace-ensure.ts
 var import_node_child_process21 = require("child_process");
-var import_node_fs22 = __toESM(require("fs"));
-var import_node_path26 = __toESM(require("path"));
+var import_node_fs23 = __toESM(require("fs"));
+var import_node_path27 = __toESM(require("path"));
 
 // src/core/devpod-mutation.ts
 var import_node_child_process16 = require("child_process");
-var import_node_fs18 = __toESM(require("fs"));
-var import_node_path23 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path23.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var import_node_fs19 = __toESM(require("fs"));
+var import_node_path24 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path24.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
 var DEVPOD_MUTATION_WAIT_MS = 18e5;
 var DevpodStartPostconditionError = class extends Error {
 };
 function withMutationLock2(activity, target, operation) {
-  import_node_fs18.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -6642,7 +6760,7 @@ function transportFailure() {
 
 // src/core/managed-host-preparation.ts
 var import_node_child_process18 = require("child_process");
-var import_node_fs19 = __toESM(require("fs"));
+var import_node_fs20 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -6685,7 +6803,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs19.default.readFileSync(configPath);
+    return import_node_fs20.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -6721,8 +6839,8 @@ async function runManagedHostPreparation(repoPath, config) {
 // src/core/managed-post-start.ts
 var import_node_child_process19 = require("child_process");
 var import_node_crypto10 = require("crypto");
-var import_node_fs20 = __toESM(require("fs"));
-var import_node_path24 = __toESM(require("path"));
+var import_node_fs21 = __toESM(require("fs"));
+var import_node_path25 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
 var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
 var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
@@ -6735,7 +6853,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path24.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path25.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -6770,8 +6888,8 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs20.default.existsSync(filePath) || !import_node_fs20.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs20.default.readFileSync(filePath);
+  if (!import_node_fs21.default.existsSync(filePath) || !import_node_fs21.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs21.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
@@ -6781,21 +6899,21 @@ function adapterFingerprint(adapter) {
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path24.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path24.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path25.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path25.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs20.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs21.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path24.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path25.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path24.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path24.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path25.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path25.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -6836,7 +6954,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs20.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs21.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -7353,10 +7471,10 @@ function collectManagedRuntimeStatus(options) {
 
 // src/core/traefik-route-health.ts
 var import_node_child_process20 = require("child_process");
-var import_node_fs21 = __toESM(require("fs"));
-var import_node_path25 = __toESM(require("path"));
+var import_node_fs22 = __toESM(require("fs"));
+var import_node_path26 = __toESM(require("path"));
 var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-var ROUTER_RELOAD_LOCK_FILE = import_node_path25.default.join(DEVROUTER_HOME, "router-reload.lock");
+var ROUTER_RELOAD_LOCK_FILE = import_node_path26.default.join(DEVROUTER_HOME, "router-reload.lock");
 var ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
 var DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
 var DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
@@ -7620,7 +7738,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs22.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -7672,11 +7790,11 @@ var DEFAULT_READINESS_TIMEOUT_MS = 12e4;
 var POLL_INTERVAL_MS = 1e3;
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path27.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path27.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -7871,7 +7989,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path26.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path27.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -8255,7 +8373,7 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs22.default.statSync(import_node_path26.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs23.default.statSync(import_node_path27.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
@@ -8316,8 +8434,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path26.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs22.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path27.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs23.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -8387,7 +8505,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path26.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path27.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -9157,9 +9275,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs22.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs23.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
-        import_node_path26.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+        import_node_path27.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
           activity: "Managed runtime repair",
           target: repoPath,
@@ -9354,7 +9472,7 @@ async function executeLifecycleWorker(request, operation) {
           const owned = containers.filter(
             (container) => sameWorkspacePath(
               container.labels["com.docker.compose.project.working_dir"] ?? "",
-              import_node_path27.default.join(request.repoPath, ".devcontainer")
+              import_node_path28.default.join(request.repoPath, ".devcontainer")
             )
           );
           const projects = owned.map((container) => container.labels["com.docker.compose.project"]);
@@ -9440,7 +9558,7 @@ function proveLifecycleStopped() {
       const remaining = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path27.default.join(request.repoPath, ".devcontainer")
+          import_node_path28.default.join(request.repoPath, ".devcontainer")
         )
       );
       if (remaining.some(
@@ -9476,7 +9594,7 @@ function ensureGuidance(repoPath) {
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-async function devsyExecOutcome(repoPath, command) {
+async function devsyExecOutcome(repoPath, command, retainedProof) {
   if (command.length === 0) {
     throw new Error("No command provided. Use `devrouter exec [path] -- <command...>`.");
   }
@@ -9487,12 +9605,25 @@ async function devsyExecOutcome(repoPath, command) {
         `No exact Devsy workspace exists for '${repoPath}'. ${ensureGuidance(repoPath)}`
       );
     }
-    const args = ["workspace", "exec", "--result-format", "plain", workspace.id, "--", ...command];
+    const args = [
+      "workspace",
+      "exec",
+      "--result-format",
+      "plain",
+      ...retainedProof ? ["--context", retainedProof.context] : [],
+      retainedProof?.id ?? workspace.id,
+      "--",
+      ...command
+    ];
     return new Promise((resolve, reject) => {
       let child;
       try {
-        claimLifecycleEffect();
-        child = (0, import_node_child_process22.spawn)("devsy", args, { stdio: "inherit" });
+        const launch = () => {
+          if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
+          claimLifecycleEffect();
+          return (0, import_node_child_process22.spawn)("devsy", args, { stdio: "inherit" });
+        };
+        child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
         reject(
           new ExecutionOutcomeError(`devsy exec failed: ${errorMessage(error)}`, {
@@ -9775,11 +9906,11 @@ async function devpodExecOutcome(repoPath, command) {
 
 // src/core/workspace-lifecycle.ts
 var import_node_child_process24 = require("child_process");
-var import_node_fs24 = __toESM(require("fs"));
-var import_node_path28 = __toESM(require("path"));
+var import_node_fs25 = __toESM(require("fs"));
+var import_node_path29 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs23 = __toESM(require("fs"));
+var import_node_fs24 = __toESM(require("fs"));
 function removeWorkspaceRoutesForWorktree(workspace, worktreePath) {
   return removeHostRoutesWhere(
     (route) => route.workspace === workspace && sameWorkspacePath(route.repoPath, worktreePath)
@@ -9953,7 +10084,11 @@ process.once("message", async (message) => {
         return stopped;
       }
       if (request.kind === "exec") {
-        const outcome = await devpodExecOutcome(request.repoPath, request.command ?? []);
+        const outcome = request.retainedExecProof ? await devsyExecOutcome(
+          request.repoPath,
+          request.command ?? [],
+          request.retainedExecProof
+        ) : await devpodExecOutcome(request.repoPath, request.command ?? []);
         recordLifecycleOutcome(outcome);
         return outcome;
       }