@devrouter/cli 0.0.61 → 0.0.62

package/dist/devrouter.js

@@ -2450,7 +2450,7 @@ function loadRepoConfig(repoPath, read = (file) => import_node_fs6.default.readF
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.61" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.62" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -4558,6 +4558,19 @@ function parseManagedStopJson(output2) {
     throw new Error("Managed stop Docker response is malformed.");
   }
 }
+function resolveManagedStopEndpoint() {
+  const endpoint = process.env.DOCKER_HOST && !process.env.DOCKER_CONTEXT ? process.env.DOCKER_HOST : parseManagedStopJson(
+    runManagedStopDocker([
+      "context",
+      "inspect",
+      "--format",
+      "{{json .Endpoints.docker.Host}}"
+    ])
+  );
+  if (typeof endpoint !== "string") throw new Error("Docker endpoint is unavailable.");
+  supportsManagedStopBaseline(endpoint);
+  return endpoint;
+}
 function inspectManagedStopDaemon(endpoint) {
   const value = parseManagedStopJson(
     runManagedStopDocker(["info", "--format", "{{json .ID}}"], endpoint)
@@ -4579,6 +4592,28 @@ function inspectManagedStopRunnerId(endpoint, containerId) {
     throw new Error("Provider container binding is unavailable.");
   return value;
 }
+function inspectProviderRunnerContainers(endpoint, runnerId) {
+  if (!runnerId || runnerId.length > 4096 || /[\r\n\0]/.test(runnerId))
+    throw new Error("Provider runner identity is malformed.");
+  const ids = parseDockerLines(
+    runManagedStopDocker(
+      [
+        "ps",
+        "-a",
+        "--no-trunc",
+        "--filter",
+        `label=dev.containers.id=${runnerId}`,
+        "--format",
+        "{{.ID}}"
+      ],
+      endpoint
+    )
+  );
+  if (ids.length > 256) throw new Error("Provider runner population exceeds its bound.");
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  return ids;
+}
 function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   const ids = parseDockerLines(
     runManagedStopDocker(
@@ -7106,6 +7141,7 @@ function buildOnboardingPrompt(options = {}) {
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- After a drained interrupted ensure, manual exec can use an exactly proven retained Devsy runtime with the plain local Docker command. Revalidate identity for each tooling command until later preparation reconciles startup; preserve configuration, data and interrupted history. This does not repair absent stop baselines or provide OOM protection.",
     "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not prevent OOM or activate capacity-managed recovery.",
     "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once so Devrouter acquires and verifies the pinned agent in its own machine cache. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access, and `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match a pinned official asset.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
@@ -9634,6 +9670,10 @@ function listDevsyWorkspaces() {
       ...typeof candidate.uid === "string" ? { uid: candidate.uid } : {},
       ...typeof candidate.context === "string" ? { context: candidate.context } : {}
     };
+    const provider = candidate.provider;
+    if (provider && typeof provider.name === "string") workspace.providerName = provider.name;
+    if (typeof provider?.options?.DOCKER_PATH?.value === "string")
+      workspace.dockerPathOption = provider.options.DOCKER_PATH.value;
     if ("lastUsed" in candidate) {
       if (typeof candidate.lastUsed === "string") {
         workspace.lastUsed = candidate.lastUsed;
@@ -9691,6 +9731,16 @@ function inspectDevsyWorkspaceOwnership(workspaces, devsyId, worktreePath) {
   }
   return exact[0] ? { status: "owned", workspace: exact[0] } : { status: "absent" };
 }
+function selectDevsyWorkspace(workspaces, repoPath) {
+  const matches = workspaces.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, repoPath)
+  );
+  if (matches.length > 1) {
+    const ids = matches.map((match) => match.id).join(", ");
+    throw new Error(`Multiple Devsy workspaces reference '${repoPath}': ${ids}`);
+  }
+  return matches[0];
+}
 var import_node_child_process13;
 var init_devsy_workspaces = __esm({
   "src/core/devsy-workspaces.ts"() {
@@ -12018,7 +12068,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.61" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.62" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -12651,6 +12701,96 @@ var init_up = __esm({
   }
 });
 
+// src/core/devsy-exec-proof.ts
+function proveLocalDockerSelection(workspace) {
+  const name = workspace.providerName;
+  const context = workspace.context;
+  if (!name || !context || !/^[a-z0-9][a-z0-9-]{0,31}$/.test(name) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(context))
+    throw new Error("Retained exec provider configuration identity is unavailable.");
+  const file = import_node_path37.default.join(
+    process.env.DEVSY_HOME || import_node_path37.default.join(import_node_os4.default.homedir(), ".devsy"),
+    "contexts",
+    context,
+    "providers",
+    name,
+    "provider.json"
+  );
+  try {
+    if (import_node_fs30.default.statSync(file).size > 1024 * 1024) throw new Error();
+    const config = JSON.parse(import_node_fs30.default.readFileSync(file, "utf8"));
+    const driver = config.agent?.driver ?? "docker";
+    const configuredPath = config.agent?.docker?.path ?? "";
+    if (typeof configuredPath !== "string") throw new Error();
+    const command = configuredPath === "${DOCKER_PATH}" || configuredPath === "$DOCKER_PATH" ? workspace.dockerPathOption || process.env.DOCKER_PATH || "docker" : configuredPath || "docker";
+    if (config.name !== name || driver !== "docker" || command !== "docker") throw new Error();
+  } catch {
+    throw new Error("Retained exec requires a provider configured for the local Docker command.");
+  }
+  return name;
+}
+function captureDevsyExecProof(repoPath) {
+  repoPath = comparableWorkspacePath(repoPath);
+  const registry = listDevsyWorkspaces();
+  const workspace = selectDevsyWorkspace(registry, repoPath);
+  if (!workspace?.uid || !workspace.context || workspace.source.container || inspectDevsyWorkspaceOwnership(registry, workspace.id, repoPath).status !== "owned" || inspectDevsyRuntimeStatus(workspace.id) !== "running")
+    throw new Error("Retained exec requires one exact running Devsy registration.");
+  const providerName = proveLocalDockerSelection(workspace);
+  const endpoint = resolveManagedStopEndpoint();
+  if (!supportsManagedStopBaseline(endpoint))
+    throw new Error("Retained exec requires an exact local Docker endpoint.");
+  const daemon = inspectManagedStopDaemon(endpoint);
+  const candidates = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).filter(
+    (container) => container.state.Running
+  );
+  if (candidates.length !== 1)
+    throw new Error("Retained exec requires one exact running primary container.");
+  const candidate = candidates[0];
+  const project = candidate.labels["com.docker.compose.project"];
+  if (!project) throw new Error("Retained exec primary has no Compose identity.");
+  const pinned = workspaceAppContainers(
+    inspectManagedStopContainers(project, endpoint),
+    repoPath
+  ).filter((container) => container.state.Running);
+  if (pinned.length !== 1 || pinned[0].id !== candidate.id)
+    throw new Error("Retained exec primary changed during inspection.");
+  const mounts = pinned[0].mounts.filter(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  );
+  if (mounts.length !== 1 || !mounts[0].Destination.startsWith("/"))
+    throw new Error("Retained exec requires one exact source mount.");
+  const uidBytes = Buffer.byteLength(workspace.uid);
+  const runner = uidBytes === 16 || uidBytes === 40 ? workspace.uid : workspace.id;
+  const runnerContainers = inspectProviderRunnerContainers(endpoint, runner);
+  if (runnerContainers.length !== 1 || runnerContainers[0] !== candidate.id)
+    throw new Error("Retained exec runner does not select the exact primary container.");
+  if (inspectManagedStopRunnerId(endpoint, candidate.id) !== runner || inspectManagedStopDaemon(endpoint) !== daemon)
+    throw new Error("Retained exec provider or Docker identity changed.");
+  return {
+    repoPath,
+    id: workspace.id,
+    uid: workspace.uid,
+    context: workspace.context,
+    providerName,
+    endpoint,
+    daemon,
+    containerId: candidate.id,
+    workspacePath: mounts[0].Destination
+  };
+}
+var import_node_fs30, import_node_os4, import_node_path37, import_node_util3;
+var init_devsy_exec_proof = __esm({
+  "src/core/devsy-exec-proof.ts"() {
+    "use strict";
+    import_node_fs30 = __toESM(require("fs"));
+    import_node_os4 = __toESM(require("os"));
+    import_node_path37 = __toESM(require("path"));
+    import_node_util3 = require("util");
+    init_devpod_environment();
+    init_devsy_workspaces();
+    init_workspace();
+  }
+});
+
 // src/core/reliability-model.ts
 function record3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -12680,7 +12820,7 @@ function assertReliabilityEvent(value) {
       valid = oneOf2(value.mode, ["start", "attach"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer);
       break;
     case "operation-request":
-      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean";
+      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean" && (value.recoverInterruptedEnsure === void 0 || typeof value.recoverInterruptedEnsure === "boolean");
       break;
     case "drained":
       valid = isReliabilityId(value.operationId);
@@ -12863,6 +13003,10 @@ function handleRequest(state, event) {
   });
   return transition(state, "accepted");
 }
+function canExecAfterInterruptedEnsure(state) {
+  const latestEnsure = [...state.operationHistory].reverse().find((operation) => operation.kind === "ensure");
+  return state.executionPolicy === "manual" && state.desired === "running" && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && state.phase === "recovering" || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
+}
 function handleOperationRequest(state, event) {
   if (state.executionPolicy !== "manual") return unchanged(state, "blocked");
   const previous = state.operationHistory.find((entry) => entry.key === event.key);
@@ -12873,9 +13017,11 @@ function handleOperationRequest(state, event) {
     );
   if (state.operationHistory.some((entry) => entry.id === event.operationId))
     return unchanged(state, "conflict");
+  if (event.kind === "exec" && canExecAfterInterruptedEnsure(state) && event.recoverInterruptedEnsure !== true)
+    return unchanged(state, "blocked");
   const fullyStopped = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
   const reconcileEnsure = event.kind === "ensure" && state.operation?.kind === "ensure" && ["NOT_STARTED", "INTERRUPTED"].includes(state.operation.status);
-  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure))
+  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure && !(event.kind === "exec" && event.recoverInterruptedEnsure === true && canExecAfterInterruptedEnsure(state))))
     return unchanged(state, "blocked");
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
     return unchanged(state, "blocked");
@@ -12886,8 +13032,9 @@ function handleOperationRequest(state, event) {
   if (rollover) {
     if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED"].includes(state.operation.status)))
       return unchanged(state, "blocked");
+    const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
     retired = state.operationHistory.findIndex(
-      (entry) => entry.id !== state.operation?.id && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
+      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
     );
     if (retired === -1) return unchanged(state, "blocked");
   }
@@ -13289,8 +13436,8 @@ function signalOwnedGroup(child, signal) {
 async function runLifecycleWorker(request) {
   if (process.platform === "win32")
     throw new Error("Lifecycle workers require POSIX process-group ownership.");
-  const workerPath = import_node_path37.default.join(__dirname, "devrouter-lifecycle-worker.js");
-  if (!import_node_fs30.default.existsSync(workerPath))
+  const workerPath = import_node_path38.default.join(__dirname, "devrouter-lifecycle-worker.js");
+  if (!import_node_fs31.default.existsSync(workerPath))
     throw new Error("The packaged lifecycle worker is missing; rebuild the CLI.");
   const child = (0, import_node_child_process21.fork)(workerPath, [], {
     detached: true,
@@ -13448,14 +13595,14 @@ async function runLifecycleWorker(request) {
 function newLifecycleIds() {
   return { requestId: (0, import_node_crypto16.randomUUID)(), operationId: (0, import_node_crypto16.randomUUID)(), workerId: (0, import_node_crypto16.randomUUID)() };
 }
-var import_node_child_process21, import_node_crypto16, import_node_fs30, import_node_path37;
+var import_node_child_process21, import_node_crypto16, import_node_fs31, import_node_path38;
 var init_reliability_worker = __esm({
   "src/core/reliability-worker.ts"() {
     "use strict";
     import_node_child_process21 = require("child_process");
     import_node_crypto16 = require("crypto");
-    import_node_fs30 = __toESM(require("fs"));
-    import_node_path37 = __toESM(require("path"));
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_path38 = __toESM(require("path"));
     init_file_lock();
     init_reliability_contract();
     init_reliability_model();
@@ -13464,12 +13611,12 @@ var init_reliability_worker = __esm({
 });
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process22, import_node_fs31;
+var import_node_child_process22, import_node_fs32;
 var init_managed_host_preparation = __esm({
   "src/core/managed-host-preparation.ts"() {
     "use strict";
     import_node_child_process22 = require("child_process");
-    import_node_fs31 = __toESM(require("fs"));
+    import_node_fs32 = __toESM(require("fs"));
     init_repo_config();
   }
 });
@@ -13578,7 +13725,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs33.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -13609,19 +13756,19 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
 async function ensureTraefikRoutesRemoved(routes, options = {}) {
   return ensureTraefikRouteExpectation(routes, "removed", options);
 }
-var import_node_child_process23, import_node_fs32, import_node_path38, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
+var import_node_child_process23, import_node_fs33, import_node_path39, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
 var init_traefik_route_health = __esm({
   "src/core/traefik-route-health.ts"() {
     "use strict";
     import_node_child_process23 = require("child_process");
-    import_node_fs32 = __toESM(require("fs"));
-    import_node_path38 = __toESM(require("path"));
+    import_node_fs33 = __toESM(require("fs"));
+    import_node_path39 = __toESM(require("path"));
     init_file_lock();
     init_host_routes();
     init_reliability_context();
     init_router();
     ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-    ROUTER_RELOAD_LOCK_FILE = import_node_path38.default.join(DEVROUTER_HOME, "router-reload.lock");
+    ROUTER_RELOAD_LOCK_FILE = import_node_path39.default.join(DEVROUTER_HOME, "router-reload.lock");
     ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
     DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
     DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
@@ -13660,13 +13807,13 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
-var import_node_child_process24, import_node_fs33, import_node_path39;
+var import_node_child_process24, import_node_fs34, import_node_path40;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
     import_node_child_process24 = require("child_process");
-    import_node_fs33 = __toESM(require("fs"));
-    import_node_path39 = __toESM(require("path"));
+    import_node_fs34 = __toESM(require("fs"));
+    import_node_path40 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
@@ -13753,8 +13900,22 @@ async function superviseLifecycle(kind, repoPath, options = {}, command) {
   const ids = newLifecycleIds();
   let fence;
   const runtimeRunning = kind === "exec" ? Boolean(resolveRunningWorkspaceContainer(repoPath)) : false;
+  const previous = kind === "exec" && identity2.provider === "devsy" ? updateReliabilityOperation(identity2, (record4) => {
+    reconcileDrained(record4);
+    return record4;
+  }) : void 0;
+  let retainedExecProof;
+  if (previous && !previous.worker && canExecAfterInterruptedEnsure(previous.state)) {
+    retainedExecProof = withMutationLock(
+      "Prove retained exec",
+      repoPath,
+      () => captureDevsyExecProof(repoPath)
+    );
+  }
   updateReliabilityOperation(identity2, (record4) => {
     reconcileDrained(record4);
+    if (retainedExecProof && record4.state.operation?.id !== previous?.state.operation?.id)
+      throw new Error("Lifecycle operation changed during retained exec proof.");
     if (kind === "stop") {
       stepRecord(record4, { ...reliabilityFence(record4.state), type: "stop" });
     } else {
@@ -13771,7 +13932,8 @@ async function superviseLifecycle(kind, repoPath, options = {}, command) {
         operationId: ids.operationId,
         profile: options.profile ?? record4.state.profile ?? "full",
         consumer: { id: "manual-cli", requiredCapabilities: [], pinned: false },
-        runtimeRunning
+        runtimeRunning,
+        ...retainedExecProof ? { recoverInterruptedEnsure: true } : {}
       });
     }
     fence = reliabilityFence(record4.state);
@@ -13783,15 +13945,17 @@ async function superviseLifecycle(kind, repoPath, options = {}, command) {
     ...ids,
     fence,
     options,
-    ...command ? { command } : {}
+    ...command ? { command } : {},
+    ...retainedExecProof ? { retainedExecProof } : {}
   });
 }
-var import_node_path40, activeWorker, lockHeld;
+var import_node_path41, activeWorker, lockHeld;
 var init_reliability_lifecycle = __esm({
   "src/core/reliability-lifecycle.ts"() {
     "use strict";
-    import_node_path40 = __toESM(require("path"));
+    import_node_path41 = __toESM(require("path"));
     init_devpod_environment();
+    init_devsy_exec_proof();
     init_devsy_mutation();
     init_file_lock();
     init_host_routes();
@@ -14200,17 +14364,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs34.default.existsSync(filePath)) {
+  if (!import_node_fs35.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs34.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs35.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path41.default.relative(repoPath, filePath) || ".";
+  return import_node_path42.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -14251,7 +14415,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs34.default.existsSync(import_node_path41.default.join(repoPath, fileName))) {
+    if (import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -14266,9 +14430,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path41.default.join(repoPath, ".nvmrc");
-  if (import_node_fs34.default.existsSync(nvmrc)) {
-    const version = import_node_fs34.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path42.default.join(repoPath, ".nvmrc");
+  if (import_node_fs35.default.existsSync(nvmrc)) {
+    const version = import_node_fs35.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -14329,7 +14493,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path41.default.isAbsolute(fileName) && !import_node_path41.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path42.default.isAbsolute(fileName) && !import_node_path42.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -14347,7 +14511,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs34.default.existsSync(import_node_path41.default.join(repoPath, fileName))
+    (fileName) => import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -14385,7 +14549,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs34.default.readFileSync(import_node_path41.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs35.default.readFileSync(import_node_path42.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -14420,8 +14584,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs34.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs34.default.readFileSync(import_node_path41.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs35.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs35.default.readFileSync(import_node_path42.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -14435,18 +14599,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path41.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs34.default.existsSync(dir)) {
+  const dir = import_node_path42.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs35.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs34.default.readdirSync(dir).filter((fileName) => import_node_fs34.default.statSync(import_node_path41.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs35.default.readdirSync(dir).filter((fileName) => import_node_fs35.default.statSync(import_node_path42.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs34.default.existsSync(configPath)) {
+  if (!import_node_fs35.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -14490,15 +14654,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs34.default.existsSync(import_node_path41.default.join(repoPath, fileName))) {
+    if (import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path41.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs34.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs34.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path41.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs34.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path42.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs35.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs35.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path42.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs35.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -14541,7 +14705,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path41.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path42.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -14560,12 +14724,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs34, import_node_path41, import_yaml6;
+var import_node_fs35, import_node_path42, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs34 = __toESM(require("fs"));
-    import_node_path41 = __toESM(require("path"));
+    import_node_fs35 = __toESM(require("fs"));
+    import_node_path42 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -14670,7 +14834,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs36.default.existsSync(import_node_path43.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -14895,12 +15059,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs35, import_node_path42;
+var import_node_fs36, import_node_path43;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs35 = __toESM(require("fs"));
-    import_node_path42 = __toESM(require("path"));
+    import_node_fs36 = __toESM(require("fs"));
+    import_node_path43 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -15197,7 +15361,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path43.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path44.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -15242,8 +15406,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path43.default.join(repoPath, file.relativePath);
-  if (!import_node_fs36.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path44.default.join(repoPath, file.relativePath);
+  if (!import_node_fs37.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -15251,7 +15415,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs36.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs37.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -15308,11 +15472,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path43.default.join(repoPath, file.relativePath);
-  import_node_fs36.default.mkdirSync(import_node_path43.default.dirname(absolutePath), { recursive: true });
-  import_node_fs36.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path44.default.join(repoPath, file.relativePath);
+  import_node_fs37.default.mkdirSync(import_node_path44.default.dirname(absolutePath), { recursive: true });
+  import_node_fs37.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs36.default.chmodSync(absolutePath, 493);
+    import_node_fs37.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -15350,12 +15514,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs36, import_node_path43, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs37, import_node_path44, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs36 = __toESM(require("fs"));
-    import_node_path43 = __toESM(require("path"));
+    import_node_fs37 = __toESM(require("fs"));
+    import_node_path44 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -15689,13 +15853,13 @@ function buildProfilePlanReport(options) {
   return { ...report, contractPath, bindings };
 }
 function loadContract(repoPath, contractPath) {
-  if (import_node_path44.default.isAbsolute(contractPath)) {
+  if (import_node_path45.default.isAbsolute(contractPath)) {
     fail3("profile plan contract path must be relative to the repository.");
   }
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs37.default.lstatSync(absolutePath);
+    metadata = import_node_fs38.default.lstatSync(absolutePath);
   } catch (error) {
     fail3(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -15705,16 +15869,16 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs37.default.realpathSync(repoPath);
-  const realContract = import_node_fs37.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs38.default.realpathSync(repoPath);
+  const realContract = import_node_fs38.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs37.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs38.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
   return {
     contract: parseProfilePlanContract(source),
-    contractPath: import_node_path44.default.relative(repoPath, absolutePath).split(import_node_path44.default.sep).join("/")
+    contractPath: import_node_path45.default.relative(repoPath, absolutePath).split(import_node_path45.default.sep).join("/")
   };
 }
 function resolveProfilePlan(options) {
@@ -15728,12 +15892,12 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs37, import_node_path44, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs38, import_node_path45, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs37 = __toESM(require("fs"));
-    import_node_path44 = __toESM(require("path"));
+    import_node_fs38 = __toESM(require("fs"));
+    import_node_path45 = __toESM(require("path"));
     import_yaml7 = require("yaml");
     init_paths();
     init_profile_resolution();
@@ -15765,7 +15929,7 @@ async function runProfileResolveCommand(options) {
 async function runProfilePlanCommand(options) {
   const report = resolveProfilePlan(options);
   if (options.output) {
-    writeFileAtomically(import_node_path45.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
+    writeFileAtomically(import_node_path46.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
 `);
   }
   if (options.json) {
@@ -15801,14 +15965,14 @@ function printProfilePlanSummary(report, output2) {
     process.stdout.write(`Binding ${key}: ${renderValues(report.bindings[key] ?? [])}
 `);
   }
-  if (output2) process.stdout.write(`Output: ${import_node_path45.default.resolve(output2)}
+  if (output2) process.stdout.write(`Output: ${import_node_path46.default.resolve(output2)}
 `);
 }
-var import_node_path45;
+var import_node_path46;
 var init_profile = __esm({
   "src/commands/profile.ts"() {
     "use strict";
-    import_node_path45 = __toESM(require("path"));
+    import_node_path46 = __toESM(require("path"));
     init_atomic_file();
     init_output();
     init_profile_plan();
@@ -16098,7 +16262,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto17.createHash)("sha1").update(import_node_path46.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto17.createHash)("sha1").update(import_node_path47.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -16177,11 +16341,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path46.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs38.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path46.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path47.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs39.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path47.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs38.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs39.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -16301,14 +16465,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process27, import_node_crypto17, import_node_fs38, import_node_path46, import_yaml8;
+var import_node_child_process27, import_node_crypto17, import_node_fs39, import_node_path47, import_yaml8;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process27 = require("child_process");
     import_node_crypto17 = require("crypto");
-    import_node_fs38 = __toESM(require("fs"));
-    import_node_path46 = __toESM(require("path"));
+    import_node_fs39 = __toESM(require("fs"));
+    import_node_path47 = __toESM(require("path"));
     import_yaml8 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -17130,13 +17294,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs39.default.lstatSync(worktreePath);
+    rootStat = import_node_fs40.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs39.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs40.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -17162,10 +17326,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path47.default.join(dirPath, entry.name);
+      const entryPath = import_node_path48.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs39.default.lstatSync(entryPath);
+        entryStat = import_node_fs40.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -17175,7 +17339,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs39.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs40.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -17239,12 +17403,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs39, import_node_path47, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs40, import_node_path48, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs39 = __toESM(require("fs"));
-    import_node_path47 = __toESM(require("path"));
+    import_node_fs40 = __toESM(require("fs"));
+    import_node_path48 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -17345,7 +17509,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs40.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs41.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -17870,7 +18034,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers2 = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers2 = new Map(worktreePaths.map((path48) => [path48, unknownContainers(reason)]));
+      containers2 = new Map(worktreePaths.map((path49) => [path49, unknownContainers(reason)]));
     }
   }
   const rows = records.map((record4) => {
@@ -17919,12 +18083,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process29, import_node_fs40, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process29, import_node_fs41, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
     import_node_child_process29 = require("child_process");
-    import_node_fs40 = __toESM(require("fs"));
+    import_node_fs41 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -17971,7 +18135,7 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path48.default.join(mainRepo, "trees", ws);
+  return import_node_path49.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
   const ignored = (0, import_node_child_process30.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
@@ -17979,12 +18143,12 @@ function assertDefaultWorktreeRootIgnored(mainRepo) {
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path48.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path48.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path49.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path49.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path48.default.join(import_node_path48.default.dirname(mainRepo), `${import_node_path48.default.basename(mainRepo)}-${ws}`);
+  return import_node_path49.default.join(import_node_path49.default.dirname(mainRepo), `${import_node_path49.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -18096,7 +18260,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs41.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs42.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -18136,9 +18300,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs41.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs42.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path48.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path49.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -18147,7 +18311,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs41.default.existsSync(selectedPath)) {
+    if (import_node_fs42.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -18287,7 +18451,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     const result = await mutateWorkspaceRuntime("delete", resolved, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs41.default.existsSync(resolved.worktreePath)) {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs42.default.existsSync(resolved.worktreePath)) {
         const rm = (0, import_node_child_process30.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
@@ -18306,7 +18470,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs41.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs42.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
 }
 async function workspaceStop(target, opts = {}) {
   return runWorkspaceLifecycle("stop", target, opts);
@@ -18314,13 +18478,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process30, import_node_fs41, import_node_path48, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process30, import_node_fs42, import_node_path49, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
     import_node_child_process30 = require("child_process");
-    import_node_fs41 = __toESM(require("fs"));
-    import_node_path48 = __toESM(require("path"));
+    import_node_fs42 = __toESM(require("fs"));
+    import_node_path49 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_managed_runtime_state();
@@ -18479,7 +18643,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.61" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.62" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {