@devrouter/cli 0.0.61 → 0.0.63

package/dist/devrouter.js

@@ -2450,7 +2450,7 @@ function loadRepoConfig(repoPath, read = (file) => import_node_fs6.default.readF
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.61" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.63" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -4558,6 +4558,19 @@ function parseManagedStopJson(output2) {
     throw new Error("Managed stop Docker response is malformed.");
   }
 }
+function resolveManagedStopEndpoint() {
+  const endpoint = process.env.DOCKER_HOST && !process.env.DOCKER_CONTEXT ? process.env.DOCKER_HOST : parseManagedStopJson(
+    runManagedStopDocker([
+      "context",
+      "inspect",
+      "--format",
+      "{{json .Endpoints.docker.Host}}"
+    ])
+  );
+  if (typeof endpoint !== "string") throw new Error("Docker endpoint is unavailable.");
+  supportsManagedStopBaseline(endpoint);
+  return endpoint;
+}
 function inspectManagedStopDaemon(endpoint) {
   const value = parseManagedStopJson(
     runManagedStopDocker(["info", "--format", "{{json .ID}}"], endpoint)
@@ -4579,6 +4592,28 @@ function inspectManagedStopRunnerId(endpoint, containerId) {
     throw new Error("Provider container binding is unavailable.");
   return value;
 }
+function inspectProviderRunnerContainers(endpoint, runnerId) {
+  if (!runnerId || runnerId.length > 4096 || /[\r\n\0]/.test(runnerId))
+    throw new Error("Provider runner identity is malformed.");
+  const ids = parseDockerLines(
+    runManagedStopDocker(
+      [
+        "ps",
+        "-a",
+        "--no-trunc",
+        "--filter",
+        `label=dev.containers.id=${runnerId}`,
+        "--format",
+        "{{.ID}}"
+      ],
+      endpoint
+    )
+  );
+  if (ids.length > 256) throw new Error("Provider runner population exceeds its bound.");
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  return ids;
+}
 function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   const ids = parseDockerLines(
     runManagedStopDocker(
@@ -4599,6 +4634,33 @@ function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   assertUniqueContainerIds(ids);
   return ids;
 }
+function hasExactManagedStopMissingObjectError(stderr, id3) {
+  if (typeof stderr !== "string") return false;
+  const line = stderr.endsWith("\r\n") ? stderr.slice(0, -2) : stderr.endsWith("\n") ? stderr.slice(0, -1) : stderr;
+  return line.toLowerCase() === `error: no such object: ${id3}`;
+}
+function assertManagedStopContainersAbsent(endpoint, ids) {
+  assertManagedStopEndpoint(endpoint);
+  if (!Array.isArray(ids) || ids.length === 0 || ids.length > 256) {
+    throw new Error("Managed stop absence proof requires between 1 and 256 container ids.");
+  }
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  const env = { ...process.env };
+  delete env.DOCKER_CONTEXT;
+  delete env.DOCKER_HOST;
+  for (const id3 of ids) {
+    const result = (0, import_node_child_process6.spawnSync)("docker", ["--host", endpoint, "inspect", "--format", "{{.Id}}", id3], {
+      env,
+      encoding: "utf-8",
+      timeout: MANAGED_STOP_DOCKER_TIMEOUT_MS,
+      maxBuffer: MANAGED_STOP_DOCKER_MAX_BUFFER
+    });
+    if (result.status !== 1 || result.error || result.signal || result.stdout !== "" && result.stdout !== "\n" && result.stdout !== "\r\n" || !hasExactManagedStopMissingObjectError(result.stderr, id3)) {
+      throw new Error("Managed stop Docker inspection did not prove container absence.");
+    }
+  }
+}
 function stopPinnedManagedContainer(endpoint, containerId) {
   assertFullContainerId(containerId);
   runManagedStopDocker(["stop", containerId], endpoint, 3e4);
@@ -7106,6 +7168,8 @@ function buildOnboardingPrompt(options = {}) {
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- After a drained interrupted ensure, manual exec can use an exactly proven retained Devsy runtime with the plain local Docker command. Revalidate identity for each tooling command until later preparation reconciles startup; preserve configuration, data and interrupted history. This does not repair absent stop baselines or provide OOM protection.",
+    "- Busy exec waits up to thirty minutes for a positively identified active lifecycle worker on the same checkout, with stderr progress. Do not stop healthy work to make room. Commands stay serial; timeout or cancellation before admission leaves prior work untouched. A lifecycle fence change cancels admission, and uncertain execution is never replayed.",
     "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not prevent OOM or activate capacity-managed recovery.",
     "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once so Devrouter acquires and verifies the pinned agent in its own machine cache. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access, and `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match a pinned official asset.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
@@ -8689,6 +8753,9 @@ var init_devcontainer_diagnostics = __esm({
 });
 
 // src/core/route-state.ts
+function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
+  return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
+}
 function listRoutesForWorktreePaths(worktreePaths) {
   const routes = listHostRouteState();
   const byWorktreePath = /* @__PURE__ */ new Map();
@@ -9548,11 +9615,13 @@ var init_status = __esm({
 });
 
 // src/core/devpod-registry.ts
-function listDevpodWorkspacesRaw() {
+function listDevpodWorkspacesRaw(options = {}) {
   const result = (0, import_node_child_process12.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
     encoding: "utf-8"
   });
-  if (result.status !== 0) {
+  if (options.allowMissingExecutable && result.error?.code === "ENOENT")
+    return [];
+  if (result.error || result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
   }
@@ -9634,6 +9703,10 @@ function listDevsyWorkspaces() {
       ...typeof candidate.uid === "string" ? { uid: candidate.uid } : {},
       ...typeof candidate.context === "string" ? { context: candidate.context } : {}
     };
+    const provider = candidate.provider;
+    if (provider && typeof provider.name === "string") workspace.providerName = provider.name;
+    if (typeof provider?.options?.DOCKER_PATH?.value === "string")
+      workspace.dockerPathOption = provider.options.DOCKER_PATH.value;
     if ("lastUsed" in candidate) {
       if (typeof candidate.lastUsed === "string") {
         workspace.lastUsed = candidate.lastUsed;
@@ -9691,6 +9764,16 @@ function inspectDevsyWorkspaceOwnership(workspaces, devsyId, worktreePath) {
   }
   return exact[0] ? { status: "owned", workspace: exact[0] } : { status: "absent" };
 }
+function selectDevsyWorkspace(workspaces, repoPath) {
+  const matches = workspaces.filter(
+    (workspace) => sameWorkspacePath(workspace.source.localFolder, repoPath)
+  );
+  if (matches.length > 1) {
+    const ids = matches.map((match) => match.id).join(", ");
+    throw new Error(`Multiple Devsy workspaces reference '${repoPath}': ${ids}`);
+  }
+  return matches[0];
+}
 var import_node_child_process13;
 var init_devsy_workspaces = __esm({
   "src/core/devsy-workspaces.ts"() {
@@ -10904,7 +10987,56 @@ function proveRetainedManagedStop(state) {
   }
   return result;
 }
+function absentRegistrationIdentity(state) {
+  resetWorkspaceRuntimeCaches();
+  if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
+    throw new Error("Stop provider changed.");
+  if (!state.workspace || !isLinkedWorktree(state.repoPath))
+    throw new Error("Absent stop requires a linked workspace.");
+  const record4 = readWorkspaceOwnership(state.repoPath, state.workspace);
+  if (!record4 || record4.workspace !== state.workspace || record4.devpodId !== state.devpodId || !sameWorkspacePath(record4.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== state.workspace || inspectWorkspaceOwnership(record4, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
+    throw new Error("Absent stop workspace ownership changed.");
+  for (const entries of [
+    listDevsyWorkspaces(),
+    listDevpodWorkspacesRaw({ allowMissingExecutable: true })
+  ]) {
+    if (entries.some(
+      (entry) => entry.id === state.devpodId || sameWorkspacePath(entry.source.localFolder, state.repoPath)
+    ))
+      throw new Error("Absent stop requires both provider registrations to remain absent.");
+  }
+  return { record: record4, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+}
+function proveManagedStop(state) {
+  const baseline = validateManagedStopBaseline(state.stopBaseline, state);
+  const owner = inspectDevsyWorkspaceOwnership(
+    listDevsyWorkspaces(),
+    state.devpodId,
+    state.repoPath
+  );
+  if (owner.status !== "absent")
+    return { status: "retained", containers: proveRetainedManagedStop(state) };
+  if (baseline.sourceContainer) throw new Error("Absent stop cannot prove a source container.");
+  const before = absentRegistrationIdentity(state);
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Retained stop generation changed.");
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId)
+    throw new Error("Stop daemon changed.");
+  assertManagedStopContainersAbsent(
+    baseline.endpoint,
+    baseline.containers.map((container) => container.id)
+  );
+  const uidBytes = Buffer.byteLength(baseline.uid);
+  const runnerId = uidBytes === 16 || uidBytes === 40 ? baseline.uid : baseline.providerId;
+  if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || inspectProviderRunnerContainers(baseline.endpoint, runnerId).length !== 0)
+    throw new Error("Absent stop observed a remaining workspace population.");
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId || !(0, import_node_util2.isDeepStrictEqual)(absentRegistrationIdentity(state), before) || !(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Absent stop authority changed during inspection.");
+  return { status: "proven-absent", containers: [] };
+}
 function stopFromManagedBaseline(state) {
+  const proof = proveManagedStop(state);
+  if (proof.status === "proven-absent") return proof.status;
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
   const stopped = /* @__PURE__ */ new Set();
   for (const initial of proveRetainedManagedStop(state))
@@ -10927,6 +11059,12 @@ function stopFromManagedBaseline(state) {
   }
   if (inspect().some((container) => container.state.Running))
     throw new Error("Retained workloads remain running.");
+  return "retained";
+}
+function managedStopRouteReferences(state) {
+  return state.desired.apps.flatMap(
+    (name) => ["http", "tcp"].map((protocol) => ({ repoPath: state.repoPath, name, protocol }))
+  );
 }
 var import_node_os2, import_node_path31, import_node_util2;
 var init_managed_stop_recovery = __esm({
@@ -10936,6 +11074,7 @@ var init_managed_stop_recovery = __esm({
     import_node_path31 = __toESM(require("path"));
     import_node_util2 = require("util");
     init_devpod_environment();
+    init_devpod_registry();
     init_devsy_workspaces();
     init_managed_compose_population();
     init_managed_runtime_state();
@@ -11045,8 +11184,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
     throw new Error("Managed stop requires the exact retained workspace identity.");
   }
   if (state.stopBaseline) {
-    stopFromManagedBaseline(state);
-    return true;
+    return stopFromManagedBaseline(state) === "proven-absent" ? "proven-absent" : true;
   }
   const workspaceEnv = workspace ? { token: workspace, gitCommonDir: resolveGitCommonDir(repoPath) } : void 0;
   function registration2() {
@@ -11230,12 +11368,14 @@ function inspectExactOwnership(devsyId, worktreePath) {
 }
 function mutateOwnedDevsyWorkspace(action2, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action2}`, worktreePath, () => {
-    if (action2 === "stop" && stopRetainedManagedDevsyWorkspace({
-      repoPath: worktreePath,
-      devsyId,
-      stopProvider: () => runDevsyAction("stop", devsyId)
-    }))
-      return { status: "changed" };
+    if (action2 === "stop") {
+      const stopped = stopRetainedManagedDevsyWorkspace({
+        repoPath: worktreePath,
+        devsyId,
+        stopProvider: () => runDevsyAction("stop", devsyId)
+      });
+      if (stopped) return { status: stopped === "proven-absent" ? "proven-absent" : "changed" };
+    }
     const before = inspectExactOwnership(devsyId, worktreePath);
     if (before.status === "absent") return { status: "absent" };
     runDevsyAction(action2, devsyId);
@@ -12018,7 +12158,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.61" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.63" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -12651,6 +12791,96 @@ var init_up = __esm({
   }
 });
 
+// src/core/devsy-exec-proof.ts
+function proveLocalDockerSelection(workspace) {
+  const name = workspace.providerName;
+  const context = workspace.context;
+  if (!name || !context || !/^[a-z0-9][a-z0-9-]{0,31}$/.test(name) || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(context))
+    throw new Error("Retained exec provider configuration identity is unavailable.");
+  const file = import_node_path37.default.join(
+    process.env.DEVSY_HOME || import_node_path37.default.join(import_node_os4.default.homedir(), ".devsy"),
+    "contexts",
+    context,
+    "providers",
+    name,
+    "provider.json"
+  );
+  try {
+    if (import_node_fs30.default.statSync(file).size > 1024 * 1024) throw new Error();
+    const config = JSON.parse(import_node_fs30.default.readFileSync(file, "utf8"));
+    const driver = config.agent?.driver ?? "docker";
+    const configuredPath = config.agent?.docker?.path ?? "";
+    if (typeof configuredPath !== "string") throw new Error();
+    const command = configuredPath === "${DOCKER_PATH}" || configuredPath === "$DOCKER_PATH" ? workspace.dockerPathOption || process.env.DOCKER_PATH || "docker" : configuredPath || "docker";
+    if (config.name !== name || driver !== "docker" || command !== "docker") throw new Error();
+  } catch {
+    throw new Error("Retained exec requires a provider configured for the local Docker command.");
+  }
+  return name;
+}
+function captureDevsyExecProof(repoPath) {
+  repoPath = comparableWorkspacePath(repoPath);
+  const registry = listDevsyWorkspaces();
+  const workspace = selectDevsyWorkspace(registry, repoPath);
+  if (!workspace?.uid || !workspace.context || workspace.source.container || inspectDevsyWorkspaceOwnership(registry, workspace.id, repoPath).status !== "owned" || inspectDevsyRuntimeStatus(workspace.id) !== "running")
+    throw new Error("Retained exec requires one exact running Devsy registration.");
+  const providerName = proveLocalDockerSelection(workspace);
+  const endpoint = resolveManagedStopEndpoint();
+  if (!supportsManagedStopBaseline(endpoint))
+    throw new Error("Retained exec requires an exact local Docker endpoint.");
+  const daemon = inspectManagedStopDaemon(endpoint);
+  const candidates = workspaceAppContainers(inspectWorkspaceContainers(), repoPath).filter(
+    (container) => container.state.Running
+  );
+  if (candidates.length !== 1)
+    throw new Error("Retained exec requires one exact running primary container.");
+  const candidate = candidates[0];
+  const project = candidate.labels["com.docker.compose.project"];
+  if (!project) throw new Error("Retained exec primary has no Compose identity.");
+  const pinned = workspaceAppContainers(
+    inspectManagedStopContainers(project, endpoint),
+    repoPath
+  ).filter((container) => container.state.Running);
+  if (pinned.length !== 1 || pinned[0].id !== candidate.id)
+    throw new Error("Retained exec primary changed during inspection.");
+  const mounts = pinned[0].mounts.filter(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  );
+  if (mounts.length !== 1 || !mounts[0].Destination.startsWith("/"))
+    throw new Error("Retained exec requires one exact source mount.");
+  const uidBytes = Buffer.byteLength(workspace.uid);
+  const runner = uidBytes === 16 || uidBytes === 40 ? workspace.uid : workspace.id;
+  const runnerContainers = inspectProviderRunnerContainers(endpoint, runner);
+  if (runnerContainers.length !== 1 || runnerContainers[0] !== candidate.id)
+    throw new Error("Retained exec runner does not select the exact primary container.");
+  if (inspectManagedStopRunnerId(endpoint, candidate.id) !== runner || inspectManagedStopDaemon(endpoint) !== daemon)
+    throw new Error("Retained exec provider or Docker identity changed.");
+  return {
+    repoPath,
+    id: workspace.id,
+    uid: workspace.uid,
+    context: workspace.context,
+    providerName,
+    endpoint,
+    daemon,
+    containerId: candidate.id,
+    workspacePath: mounts[0].Destination
+  };
+}
+var import_node_fs30, import_node_os4, import_node_path37, import_node_util3;
+var init_devsy_exec_proof = __esm({
+  "src/core/devsy-exec-proof.ts"() {
+    "use strict";
+    import_node_fs30 = __toESM(require("fs"));
+    import_node_os4 = __toESM(require("os"));
+    import_node_path37 = __toESM(require("path"));
+    import_node_util3 = require("util");
+    init_devpod_environment();
+    init_devsy_workspaces();
+    init_workspace();
+  }
+});
+
 // src/core/reliability-model.ts
 function record3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -12680,7 +12910,7 @@ function assertReliabilityEvent(value) {
       valid = oneOf2(value.mode, ["start", "attach"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer);
       break;
     case "operation-request":
-      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean";
+      valid = oneOf2(value.kind, ["ensure", "exec"]) && isReliabilityId(value.key) && isReliabilityId(value.operationId) && isReliabilityProfile(value.profile) && isConsumer(value.consumer) && typeof value.runtimeRunning === "boolean" && (value.recoverInterruptedEnsure === void 0 || typeof value.recoverInterruptedEnsure === "boolean");
       break;
     case "drained":
       valid = isReliabilityId(value.operationId);
@@ -12863,6 +13093,10 @@ function handleRequest(state, event) {
   });
   return transition(state, "accepted");
 }
+function canExecAfterInterruptedEnsure(state) {
+  const latestEnsure = [...state.operationHistory].reverse().find((operation) => operation.kind === "ensure");
+  return state.executionPolicy === "manual" && state.desired === "running" && latestEnsure?.status === "INTERRUPTED" && latestEnsure.drained && state.operation?.drained === true && (state.operation.kind === "ensure" && state.phase === "recovering" || state.operation.kind === "exec" && ["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status));
+}
 function handleOperationRequest(state, event) {
   if (state.executionPolicy !== "manual") return unchanged(state, "blocked");
   const previous = state.operationHistory.find((entry) => entry.key === event.key);
@@ -12873,9 +13107,11 @@ function handleOperationRequest(state, event) {
     );
   if (state.operationHistory.some((entry) => entry.id === event.operationId))
     return unchanged(state, "conflict");
+  if (event.kind === "exec" && canExecAfterInterruptedEnsure(state) && event.recoverInterruptedEnsure !== true)
+    return unchanged(state, "blocked");
   const fullyStopped = state.stopProof.workloadsStopped && state.stopProof.routesRemoved;
   const reconcileEnsure = event.kind === "ensure" && state.operation?.kind === "ensure" && ["NOT_STARTED", "INTERRUPTED"].includes(state.operation.status);
-  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure))
+  if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED", "NOT_STARTED"].includes(state.operation.status) && !fullyStopped && !reconcileEnsure && !(event.kind === "exec" && event.recoverInterruptedEnsure === true && canExecAfterInterruptedEnsure(state))))
     return unchanged(state, "blocked");
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
     return unchanged(state, "blocked");
@@ -12886,8 +13122,9 @@ function handleOperationRequest(state, event) {
   if (rollover) {
     if (state.operation && (!state.operation.drained || !["COMPLETED", "NOT_LAUNCHED"].includes(state.operation.status)))
       return unchanged(state, "blocked");
+    const latestEnsureId = [...state.operationHistory].reverse().find((entry) => entry.kind === "ensure")?.id;
     retired = state.operationHistory.findIndex(
-      (entry) => entry.id !== state.operation?.id && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
+      (entry) => entry.id !== state.operation?.id && entry.id !== latestEnsureId && entry.drained && ["COMPLETED", "NOT_LAUNCHED"].includes(entry.status)
     );
     if (retired === -1) return unchanged(state, "blocked");
   }
@@ -13215,7 +13452,7 @@ function applyReliabilityEvent(state, event, nowMs) {
     case "not-started":
       if (next.executionPolicy !== "manual" || next.operation?.kind !== "exec")
         return unchanged(next, "blocked");
-      if (next.operation.id !== event.operationId || next.operation.status !== "RUNNING")
+      if (next.operation.id !== event.operationId || !["RUNNING", "DISPATCH_RECORDED"].includes(next.operation.status))
         return unchanged(next, "stale");
       next.operation = { ...next.operation, status: "NOT_LAUNCHED", exitCode: null };
       return transition(next, "accepted");
@@ -13270,6 +13507,11 @@ function sameFence2(record4, fence) {
     ([key, value]) => value === fence[key]
   );
 }
+function hasDuplicateOperation(record4, requestId, operationId) {
+  return record4.state.operationHistory.some(
+    (operation) => operation.key === requestId || operation.id === operationId
+  );
+}
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
@@ -13286,11 +13528,11 @@ function signalOwnedGroup(child, signal) {
     if (error.code !== "ESRCH") throw error;
   }
 }
-async function runLifecycleWorker(request) {
+async function runLifecycleWorker(request, beforeAdmission) {
   if (process.platform === "win32")
     throw new Error("Lifecycle workers require POSIX process-group ownership.");
-  const workerPath = import_node_path37.default.join(__dirname, "devrouter-lifecycle-worker.js");
-  if (!import_node_fs30.default.existsSync(workerPath))
+  const workerPath = import_node_path38.default.join(__dirname, "devrouter-lifecycle-worker.js");
+  if (!import_node_fs31.default.existsSync(workerPath))
     throw new Error("The packaged lifecycle worker is missing; rebuild the CLI.");
   const child = (0, import_node_child_process21.fork)(workerPath, [], {
     detached: true,
@@ -13298,13 +13540,18 @@ async function runLifecycleWorker(request) {
     execArgv: []
   });
   let ready = false;
+  let closed = false;
+  let registered = false;
+  let dispatchAcknowledged = false;
+  let sendAttempted = false;
+  let readinessTimer;
   let result;
   let cancelled = false;
   let forceTimer;
   let monitor;
   let failure;
   const cancel = () => {
-    if (cancelled) return;
+    if (cancelled || closed) return;
     cancelled = true;
     try {
       signalOwnedGroup(child, "SIGTERM");
@@ -13327,20 +13574,56 @@ async function runLifecycleWorker(request) {
       child.once("error", (error) => {
         failure = error;
       });
-      child.on("message", (message) => {
+      readinessTimer = setTimeout(() => {
+        failure = new Error("Lifecycle worker readiness timed out before dispatch.");
+        cancel();
+      }, 3e4);
+      child.on("message", async (message) => {
         if (!message || typeof message !== "object") return;
         if ("ready" in message && message.ready === true && !ready) {
           ready = true;
+          if (readinessTimer) clearTimeout(readinessTimer);
           try {
+            await new Promise((resolve2) => setImmediate(resolve2));
+            if (closed) return;
             if (cancelled || !child.pid)
               throw new Error("Lifecycle invocation was cancelled before dispatch.");
             if (request.kind !== "stop") {
               const birth = processBirthIdentity(child.pid);
               if (!birth) throw new Error("Could not prove lifecycle worker incarnation.");
               updateReliabilityOperation(request.identity, (record4) => {
-                if (!sameFence2(record4, request.fence) || record4.worker || record4.state.operation?.id !== request.operationId) {
+                beforeAdmission?.();
+                if (!request.admission)
+                  throw new Error("Lifecycle operation admission is required.");
+                if (hasDuplicateOperation(record4, request.requestId, request.operationId))
+                  throw new Error(
+                    "Lifecycle operation request conflicts with an existing operation."
+                  );
+                if (!sameFence2(record4, request.fence))
                   throw new Error("Lifecycle intent changed before dispatch.");
+                if (record4.worker || record4.revision !== request.admission.expectedRevision) {
+                  throw new LifecycleWorkerAdmissionBusyError();
                 }
+                const admitted = stepReliability(
+                  record4.state,
+                  {
+                    ...request.fence,
+                    type: "operation-request",
+                    kind: request.kind === "exec" ? "exec" : "ensure",
+                    key: request.requestId,
+                    operationId: request.operationId,
+                    profile: request.admission.profile,
+                    consumer: request.admission.consumer,
+                    runtimeRunning: request.admission.runtimeRunning,
+                    ...request.admission.recoverInterruptedEnsure ? { recoverInterruptedEnsure: true } : {}
+                  },
+                  Date.now()
+                );
+                if (admitted.outcome !== "accepted")
+                  throw new Error(`Lifecycle admission is ${admitted.outcome}.`);
+                record4.state = admitted.state;
+                record4.outcome = null;
+                request.fence = reliabilityFence(record4.state);
                 record4.worker = {
                   id: request.workerId,
                   operationId: request.operationId,
@@ -13356,6 +13639,7 @@ async function runLifecycleWorker(request) {
                   throw new Error("Lifecycle dispatch is blocked.");
                 record4.state = transition2.state;
               });
+              registered = true;
               updateReliabilityOperation(request.identity, (record4) => {
                 const transition2 = stepReliability(
                   record4.state,
@@ -13366,12 +13650,18 @@ async function runLifecycleWorker(request) {
                   },
                   Date.now()
                 );
-                record4.state = transition2.state;
                 if (!transition2.effects.some((effect2) => effect2.kind === "launch")) {
                   throw new Error("Lifecycle dispatch persistence was not acknowledged.");
                 }
+                record4.state = transition2.state;
               });
+              dispatchAcknowledged = true;
             }
+            await new Promise((resolve2) => setImmediate(resolve2));
+            if (closed) return;
+            beforeAdmission?.();
+            if (cancelled) throw new Error("Lifecycle invocation was cancelled before dispatch.");
+            sendAttempted = true;
             child.send({ request }, (error) => {
               if (error) {
                 failure = error;
@@ -13396,8 +13686,9 @@ async function runLifecycleWorker(request) {
         }
       });
       child.once("close", () => {
+        closed = true;
         try {
-          if (request.kind !== "stop") {
+          if (request.kind !== "stop" && registered) {
             updateReliabilityOperation(request.identity, (record4) => {
               if (record4.worker?.id !== request.workerId || record4.worker.pid !== child.pid) return;
               if (!result) {
@@ -13405,7 +13696,7 @@ async function runLifecycleWorker(request) {
                   record4.state,
                   {
                     ...reliabilityFence(record4.state),
-                    type: "interrupted",
+                    type: request.kind === "exec" && dispatchAcknowledged && !sendAttempted ? "not-started" : "interrupted",
                     operationId: request.operationId
                   },
                   Date.now()
@@ -13439,6 +13730,7 @@ async function runLifecycleWorker(request) {
       });
     });
   } finally {
+    if (readinessTimer) clearTimeout(readinessTimer);
     if (monitor) clearInterval(monitor);
     if (forceTimer) clearTimeout(forceTimer);
     process.removeListener("SIGINT", onSignal);
@@ -13448,29 +13740,24 @@ async function runLifecycleWorker(request) {
 function newLifecycleIds() {
   return { requestId: (0, import_node_crypto16.randomUUID)(), operationId: (0, import_node_crypto16.randomUUID)(), workerId: (0, import_node_crypto16.randomUUID)() };
 }
-var import_node_child_process21, import_node_crypto16, import_node_fs30, import_node_path37;
+var import_node_child_process21, import_node_crypto16, import_node_fs31, import_node_path38, LifecycleWorkerAdmissionBusyError;
 var init_reliability_worker = __esm({
   "src/core/reliability-worker.ts"() {
     "use strict";
     import_node_child_process21 = require("child_process");
     import_node_crypto16 = require("crypto");
-    import_node_fs30 = __toESM(require("fs"));
-    import_node_path37 = __toESM(require("path"));
+    import_node_fs31 = __toESM(require("fs"));
+    import_node_path38 = __toESM(require("path"));
     init_file_lock();
     init_reliability_contract();
     init_reliability_model();
     init_reliability_operation_store();
-  }
-});
-
-// src/core/managed-host-preparation.ts
-var import_node_child_process22, import_node_fs31;
-var init_managed_host_preparation = __esm({
-  "src/core/managed-host-preparation.ts"() {
-    "use strict";
-    import_node_child_process22 = require("child_process");
-    import_node_fs31 = __toESM(require("fs"));
-    init_repo_config();
+    LifecycleWorkerAdmissionBusyError = class extends Error {
+      constructor() {
+        super("Lifecycle admission lost to another operation.");
+        this.name = "LifecycleWorkerAdmissionBusyError";
+      }
+    };
   }
 });
 
@@ -13479,7 +13766,7 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function inspectRouterApi(protocol) {
-  const result = (0, import_node_child_process23.spawnSync)(
+  const result = (0, import_node_child_process22.spawnSync)(
     "curl",
     [
       "--silent",
@@ -13506,6 +13793,11 @@ function inspectRouterApi(protocol) {
   if (!Array.isArray(value)) {
     return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
   }
+  if (value.some((item) => !isRecord4(item) || typeof item.name !== "string" || !item.name))
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} router API returned malformed entries`
+    };
   return {
     ok: true,
     reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
@@ -13518,6 +13810,9 @@ function inspectRouterApi(protocol) {
     )
   };
 }
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function inspectExpectedRoutes(routes, expectation) {
   const mismatched = [];
   const failures = [];
@@ -13609,19 +13904,19 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
 async function ensureTraefikRoutesRemoved(routes, options = {}) {
   return ensureTraefikRouteExpectation(routes, "removed", options);
 }
-var import_node_child_process23, import_node_fs32, import_node_path38, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
+var import_node_child_process22, import_node_fs32, import_node_path39, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
 var init_traefik_route_health = __esm({
   "src/core/traefik-route-health.ts"() {
     "use strict";
-    import_node_child_process23 = require("child_process");
+    import_node_child_process22 = require("child_process");
     import_node_fs32 = __toESM(require("fs"));
-    import_node_path38 = __toESM(require("path"));
+    import_node_path39 = __toESM(require("path"));
     init_file_lock();
     init_host_routes();
     init_reliability_context();
     init_router();
     ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-    ROUTER_RELOAD_LOCK_FILE = import_node_path38.default.join(DEVROUTER_HOME, "router-reload.lock");
+    ROUTER_RELOAD_LOCK_FILE = import_node_path39.default.join(DEVROUTER_HOME, "router-reload.lock");
     ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
     DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
     DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
@@ -13630,6 +13925,17 @@ var init_traefik_route_health = __esm({
   }
 });
 
+// src/core/managed-host-preparation.ts
+var import_node_child_process23, import_node_fs33;
+var init_managed_host_preparation = __esm({
+  "src/core/managed-host-preparation.ts"() {
+    "use strict";
+    import_node_child_process23 = require("child_process");
+    import_node_fs33 = __toESM(require("fs"));
+    init_repo_config();
+  }
+});
+
 // src/core/workspace-ensure.ts
 function resolveLinkedTarget(repoPath) {
   const snapshots = getWorkspaceRegistrySnapshots();
@@ -13660,13 +13966,13 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
-var import_node_child_process24, import_node_fs33, import_node_path39;
+var import_node_child_process24, import_node_fs34, import_node_path40;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
     import_node_child_process24 = require("child_process");
-    import_node_fs33 = __toESM(require("fs"));
-    import_node_path39 = __toESM(require("path"));
+    import_node_fs34 = __toESM(require("fs"));
+    import_node_path40 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
@@ -13692,6 +13998,11 @@ var init_workspace_ensure = __esm({
 });
 
 // src/core/reliability-lifecycle.ts
+function matchesFence(record4, fence) {
+  return Object.entries(reliabilityFence(record4.state)).every(
+    ([key, value]) => value === fence[key]
+  );
+}
 async function withLifecycleOperationLock(repoPath, operation) {
   if (activeWorker && lockHeld) {
     if (!sameWorkspacePath(repoPath, activeWorker.repoPath))
@@ -13739,6 +14050,23 @@ function reconcileDrained(record4) {
     record4.worker = null;
   }
 }
+function reportBusyExecWait(operationId, waitedMs) {
+  process.stderr.write(
+    `Lifecycle exec ${operationId} is waiting for the existing worker (${Math.ceil(waitedMs / 1e3)}s).
+`
+  );
+}
+function installLifecycleWaitSignals(cancellation) {
+  const onSignal = () => {
+    cancellation.requested = true;
+  };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  return () => {
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+  };
+}
 async function superviseLifecycle(kind, repoPath, options = {}, command) {
   repoPath = comparableWorkspacePath(repoPath);
   if (isLinkedWorktree(repoPath) && !readPersistedWorkspace(repoPath)) {
@@ -13751,47 +14079,119 @@ async function superviseLifecycle(kind, repoPath, options = {}, command) {
     provider: resolveWorkspaceRuntimeOrDefault(repoPath)
   };
   const ids = newLifecycleIds();
-  let fence;
-  const runtimeRunning = kind === "exec" ? Boolean(resolveRunningWorkspaceContainer(repoPath)) : false;
-  updateReliabilityOperation(identity2, (record4) => {
-    reconcileDrained(record4);
-    if (kind === "stop") {
+  const copiedOptions = { ...options };
+  const copiedCommand = command ? [...command] : void 0;
+  if (kind === "stop") {
+    const fence = updateReliabilityOperation(identity2, (record4) => {
+      reconcileDrained(record4);
       stepRecord(record4, { ...reliabilityFence(record4.state), type: "stop" });
-    } else {
-      if (record4.worker)
+      return reliabilityFence(record4.state);
+    });
+    return runLifecycleWorker({ kind, repoPath, identity: identity2, ...ids, fence, options: copiedOptions });
+  }
+  const initial = readReliabilityOperation(identity2) ?? updateReliabilityOperation(identity2, (record4) => record4);
+  const expectedFence = reliabilityFence(initial.state);
+  const deadline = Date.now() + BUSY_EXEC_WAIT_MS;
+  const cancellation = { requested: false };
+  const removeSignals = installLifecycleWaitSignals(cancellation);
+  let lastProgress = -Infinity;
+  const assertWaiting = () => {
+    if (cancellation.requested)
+      throw new Error(`Lifecycle exec ${ids.operationId} cancelled before dispatch.`);
+    if (Date.now() >= deadline)
+      throw new Error(
+        `Lifecycle exec ${ids.operationId} admission timed out; command was not launched.`
+      );
+  };
+  try {
+    for (; ; ) {
+      assertWaiting();
+      let previous = readReliabilityOperation(identity2);
+      if (!previous || !matchesFence(previous, expectedFence))
         throw new Error(
-          "An earlier lifecycle worker may still be active; use explicit stop to reconcile it."
+          "Lifecycle intent changed while awaiting admission; command was not launched."
         );
-      record4.outcome = null;
-      stepRecord(record4, {
-        ...reliabilityFence(record4.state),
-        type: "operation-request",
-        kind,
-        key: ids.requestId,
-        operationId: ids.operationId,
-        profile: options.profile ?? record4.state.profile ?? "full",
-        consumer: { id: "manual-cli", requiredCapabilities: [], pinned: false },
-        runtimeRunning
-      });
+      if (hasDuplicateOperation(previous, ids.requestId, ids.operationId))
+        throw new Error("Lifecycle request identity already exists; command was not replayed.");
+      if (previous.worker) {
+        const worker = previous.worker;
+        const birth = processBirthIdentity(worker.pid);
+        if (birth !== worker.birth && workerGroupAbsent(worker.pid)) {
+          previous = updateReliabilityOperation(identity2, (record4) => {
+            reconcileDrained(record4);
+            return record4;
+          });
+        } else {
+          if (!birth || birth !== worker.birth || previous.state.operation?.status === "COMPLETION_UNKNOWN")
+            throw new Error(
+              "Existing lifecycle worker identity or completion is uncertain; preserve its evidence."
+            );
+          if (kind !== "exec")
+            throw new Error("A lifecycle worker is active; wait for its completion before ensure.");
+          const now = Date.now();
+          if (now - lastProgress >= BUSY_EXEC_PROGRESS_MS) {
+            reportBusyExecWait(ids.operationId, now - (deadline - BUSY_EXEC_WAIT_MS));
+            lastProgress = now;
+          }
+          await new Promise(
+            (resolve) => setTimeout(resolve, Math.min(BUSY_EXEC_POLL_MS, deadline - now))
+          );
+          continue;
+        }
+      }
+      if (!previous.worker && previous.state.operation?.status === "NOT_STARTED" && !previous.state.operation.drained)
+        previous = updateReliabilityOperation(identity2, (record4) => {
+          reconcileDrained(record4);
+          return record4;
+        });
+      assertWaiting();
+      const runtimeRunning = kind === "exec" && Boolean(resolveRunningWorkspaceContainer(repoPath));
+      let retainedExecProof;
+      if (kind === "exec" && identity2.provider === "devsy" && canExecAfterInterruptedEnsure(previous.state))
+        retainedExecProof = withMutationLock(
+          "Prove retained exec",
+          repoPath,
+          () => captureDevsyExecProof(repoPath)
+        );
+      assertWaiting();
+      try {
+        return await runLifecycleWorker(
+          {
+            kind,
+            repoPath,
+            identity: identity2,
+            ...ids,
+            fence: { ...expectedFence },
+            options: copiedOptions,
+            ...copiedCommand ? { command: copiedCommand } : {},
+            ...retainedExecProof ? { retainedExecProof } : {},
+            admission: {
+              expectedRevision: previous.revision,
+              profile: copiedOptions.profile ?? previous.state.profile ?? "full",
+              consumer: { id: "manual-cli", requiredCapabilities: [], pinned: false },
+              runtimeRunning,
+              ...retainedExecProof ? { recoverInterruptedEnsure: true } : {}
+            }
+          },
+          assertWaiting
+        );
+      } catch (error) {
+        if (!(error instanceof LifecycleWorkerAdmissionBusyError) || kind !== "exec") throw error;
+        assertWaiting();
+        await new Promise((resolve) => setTimeout(resolve, BUSY_EXEC_POLL_MS));
+      }
     }
-    fence = reliabilityFence(record4.state);
-  });
-  return runLifecycleWorker({
-    kind,
-    repoPath,
-    identity: identity2,
-    ...ids,
-    fence,
-    options,
-    ...command ? { command } : {}
-  });
+  } finally {
+    removeSignals();
+  }
 }
-var import_node_path40, activeWorker, lockHeld;
+var import_node_path41, activeWorker, lockHeld, BUSY_EXEC_WAIT_MS, BUSY_EXEC_POLL_MS, BUSY_EXEC_PROGRESS_MS;
 var init_reliability_lifecycle = __esm({
   "src/core/reliability-lifecycle.ts"() {
     "use strict";
-    import_node_path40 = __toESM(require("path"));
+    import_node_path41 = __toESM(require("path"));
     init_devpod_environment();
+    init_devsy_exec_proof();
     init_devsy_mutation();
     init_file_lock();
     init_host_routes();
@@ -13802,11 +14202,15 @@ var init_reliability_lifecycle = __esm({
     init_reliability_model();
     init_reliability_operation_store();
     init_reliability_worker();
+    init_traefik_route_health();
     init_workspace();
     init_workspace_ensure();
     init_workspace_runtime();
     init_reliability_context();
     lockHeld = false;
+    BUSY_EXEC_WAIT_MS = 30 * 60 * 1e3;
+    BUSY_EXEC_POLL_MS = 250;
+    BUSY_EXEC_PROGRESS_MS = 1e4;
   }
 });
 
@@ -14200,17 +14604,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs34.default.existsSync(filePath)) {
+  if (!import_node_fs35.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs34.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs35.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path41.default.relative(repoPath, filePath) || ".";
+  return import_node_path42.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -14251,7 +14655,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs34.default.existsSync(import_node_path41.default.join(repoPath, fileName))) {
+    if (import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -14266,9 +14670,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path41.default.join(repoPath, ".nvmrc");
-  if (import_node_fs34.default.existsSync(nvmrc)) {
-    const version = import_node_fs34.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path42.default.join(repoPath, ".nvmrc");
+  if (import_node_fs35.default.existsSync(nvmrc)) {
+    const version = import_node_fs35.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -14329,7 +14733,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path41.default.isAbsolute(fileName) && !import_node_path41.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path42.default.isAbsolute(fileName) && !import_node_path42.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -14347,7 +14751,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs34.default.existsSync(import_node_path41.default.join(repoPath, fileName))
+    (fileName) => import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -14385,7 +14789,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml6.default.parse(import_node_fs34.default.readFileSync(import_node_path41.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml6.default.parse(import_node_fs35.default.readFileSync(import_node_path42.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -14420,8 +14824,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs34.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs34.default.readFileSync(import_node_path41.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs35.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs35.default.readFileSync(import_node_path42.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -14435,18 +14839,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path41.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs34.default.existsSync(dir)) {
+  const dir = import_node_path42.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs35.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs34.default.readdirSync(dir).filter((fileName) => import_node_fs34.default.statSync(import_node_path41.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs35.default.readdirSync(dir).filter((fileName) => import_node_fs35.default.statSync(import_node_path42.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs34.default.existsSync(configPath)) {
+  if (!import_node_fs35.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -14490,15 +14894,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs34.default.existsSync(import_node_path41.default.join(repoPath, fileName))) {
+    if (import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path41.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs34.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs34.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path41.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs34.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path42.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs35.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs35.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path42.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs35.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -14541,7 +14945,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path41.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path42.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -14560,12 +14964,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs34, import_node_path41, import_yaml6;
+var import_node_fs35, import_node_path42, import_yaml6;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs34 = __toESM(require("fs"));
-    import_node_path41 = __toESM(require("path"));
+    import_node_fs35 = __toESM(require("fs"));
+    import_node_path42 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -14670,7 +15074,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs35.default.existsSync(import_node_path42.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs36.default.existsSync(import_node_path43.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -14895,12 +15299,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs35, import_node_path42;
+var import_node_fs36, import_node_path43;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs35 = __toESM(require("fs"));
-    import_node_path42 = __toESM(require("path"));
+    import_node_fs36 = __toESM(require("fs"));
+    import_node_path43 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -15197,7 +15601,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path43.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path44.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -15242,8 +15646,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path43.default.join(repoPath, file.relativePath);
-  if (!import_node_fs36.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path44.default.join(repoPath, file.relativePath);
+  if (!import_node_fs37.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -15251,7 +15655,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs36.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs37.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -15308,11 +15712,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path43.default.join(repoPath, file.relativePath);
-  import_node_fs36.default.mkdirSync(import_node_path43.default.dirname(absolutePath), { recursive: true });
-  import_node_fs36.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path44.default.join(repoPath, file.relativePath);
+  import_node_fs37.default.mkdirSync(import_node_path44.default.dirname(absolutePath), { recursive: true });
+  import_node_fs37.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs36.default.chmodSync(absolutePath, 493);
+    import_node_fs37.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -15350,12 +15754,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs36, import_node_path43, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs37, import_node_path44, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs36 = __toESM(require("fs"));
-    import_node_path43 = __toESM(require("path"));
+    import_node_fs37 = __toESM(require("fs"));
+    import_node_path44 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -15468,11 +15872,11 @@ var init_repo_devcontainer = __esm({
 function fail3(message) {
   throw new Error(message);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requireRecord(value, label) {
-  if (!isRecord4(value)) fail3(`${label} must be a mapping.`);
+  if (!isRecord5(value)) fail3(`${label} must be a mapping.`);
   return value;
 }
 function requireExactKeys(value, allowed, label) {
@@ -15689,13 +16093,13 @@ function buildProfilePlanReport(options) {
   return { ...report, contractPath, bindings };
 }
 function loadContract(repoPath, contractPath) {
-  if (import_node_path44.default.isAbsolute(contractPath)) {
+  if (import_node_path45.default.isAbsolute(contractPath)) {
     fail3("profile plan contract path must be relative to the repository.");
   }
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs37.default.lstatSync(absolutePath);
+    metadata = import_node_fs38.default.lstatSync(absolutePath);
   } catch (error) {
     fail3(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -15705,16 +16109,16 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs37.default.realpathSync(repoPath);
-  const realContract = import_node_fs37.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs38.default.realpathSync(repoPath);
+  const realContract = import_node_fs38.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs37.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs38.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
   return {
     contract: parseProfilePlanContract(source),
-    contractPath: import_node_path44.default.relative(repoPath, absolutePath).split(import_node_path44.default.sep).join("/")
+    contractPath: import_node_path45.default.relative(repoPath, absolutePath).split(import_node_path45.default.sep).join("/")
   };
 }
 function resolveProfilePlan(options) {
@@ -15728,12 +16132,12 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs37, import_node_path44, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs38, import_node_path45, import_yaml7, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs37 = __toESM(require("fs"));
-    import_node_path44 = __toESM(require("path"));
+    import_node_fs38 = __toESM(require("fs"));
+    import_node_path45 = __toESM(require("path"));
     import_yaml7 = require("yaml");
     init_paths();
     init_profile_resolution();
@@ -15765,7 +16169,7 @@ async function runProfileResolveCommand(options) {
 async function runProfilePlanCommand(options) {
   const report = resolveProfilePlan(options);
   if (options.output) {
-    writeFileAtomically(import_node_path45.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
+    writeFileAtomically(import_node_path46.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
 `);
   }
   if (options.json) {
@@ -15801,14 +16205,14 @@ function printProfilePlanSummary(report, output2) {
     process.stdout.write(`Binding ${key}: ${renderValues(report.bindings[key] ?? [])}
 `);
   }
-  if (output2) process.stdout.write(`Output: ${import_node_path45.default.resolve(output2)}
+  if (output2) process.stdout.write(`Output: ${import_node_path46.default.resolve(output2)}
 `);
 }
-var import_node_path45;
+var import_node_path46;
 var init_profile = __esm({
   "src/commands/profile.ts"() {
     "use strict";
-    import_node_path45 = __toESM(require("path"));
+    import_node_path46 = __toESM(require("path"));
     init_atomic_file();
     init_output();
     init_profile_plan();
@@ -16098,7 +16502,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto17.createHash)("sha1").update(import_node_path46.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto17.createHash)("sha1").update(import_node_path47.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -16177,11 +16581,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path46.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs38.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path46.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path47.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs39.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path47.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs38.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs39.default.writeFileSync(overlayPath, import_yaml8.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -16301,14 +16705,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process27, import_node_crypto17, import_node_fs38, import_node_path46, import_yaml8;
+var import_node_child_process27, import_node_crypto17, import_node_fs39, import_node_path47, import_yaml8;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process27 = require("child_process");
     import_node_crypto17 = require("crypto");
-    import_node_fs38 = __toESM(require("fs"));
-    import_node_path46 = __toESM(require("path"));
+    import_node_fs39 = __toESM(require("fs"));
+    import_node_path47 = __toESM(require("path"));
     import_yaml8 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -17130,13 +17534,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs39.default.lstatSync(worktreePath);
+    rootStat = import_node_fs40.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs39.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs40.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -17162,10 +17566,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path47.default.join(dirPath, entry.name);
+      const entryPath = import_node_path48.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs39.default.lstatSync(entryPath);
+        entryStat = import_node_fs40.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -17175,7 +17579,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs39.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs40.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -17239,12 +17643,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs39, import_node_path47, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs40, import_node_path48, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs39 = __toESM(require("fs"));
-    import_node_path47 = __toESM(require("path"));
+    import_node_fs40 = __toESM(require("fs"));
+    import_node_path48 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -17252,7 +17656,7 @@ var init_workspace_consumption = __esm({
 });
 
 // src/core/workspace-cleanup.ts
-function isRecord5(value) {
+function isRecord6(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isSha(value) {
@@ -17345,7 +17749,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs40.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs41.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -17396,14 +17800,14 @@ function parseGitHubChanges(value, project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord5(item)) return void 0;
-    const repository = isRecord5(item.repository) ? item.repository.nameWithOwner : void 0;
-    const headRepository = isRecord5(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
+    if (!isRecord6(item)) return void 0;
+    const repository = isRecord6(item.repository) ? item.repository.nameWithOwner : void 0;
+    const headRepository = isRecord6(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
     if (repository !== project || headRepository !== project || item.headRefName !== branch || !isSha(item.headRefOid) || typeof item.baseRefName !== "string") {
       continue;
     }
     const merged = item.state === "MERGED" && validTimestamp(item.mergedAt);
-    const mergeCommit = isRecord5(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
+    const mergeCommit = isRecord6(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
     const baseSha = isSha(item.baseRefOid) ? item.baseRefOid : void 0;
     changes.push({
       sourceBranch: branch,
@@ -17420,14 +17824,14 @@ function parseGitLabChanges(value, _project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord5(item)) return void 0;
+    if (!isRecord6(item)) return void 0;
     const sourceProjectId = item.source_project_id;
     const targetProjectId = item.target_project_id;
     const sameProject = typeof sourceProjectId === "number" && typeof targetProjectId === "number" && sourceProjectId === targetProjectId;
     if (!sameProject || item.source_branch !== branch || !isSha(item.sha) || typeof item.target_branch !== "string") {
       continue;
     }
-    const diffRefs = isRecord5(item.diff_refs) ? item.diff_refs : void 0;
+    const diffRefs = isRecord6(item.diff_refs) ? item.diff_refs : void 0;
     const mergeCommitSha = isSha(item.merge_commit_sha) ? item.merge_commit_sha : void 0;
     const baseSha = diffRefs && isSha(diffRefs.base_sha) ? diffRefs.base_sha : void 0;
     changes.push({
@@ -17870,7 +18274,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers2 = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers2 = new Map(worktreePaths.map((path48) => [path48, unknownContainers(reason)]));
+      containers2 = new Map(worktreePaths.map((path49) => [path49, unknownContainers(reason)]));
     }
   }
   const rows = records.map((record4) => {
@@ -17919,12 +18323,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     workspaces: rows
   };
 }
-var import_node_child_process29, import_node_fs40, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process29, import_node_fs41, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
     import_node_child_process29 = require("child_process");
-    import_node_fs40 = __toESM(require("fs"));
+    import_node_fs41 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_repo_config();
@@ -17971,7 +18375,7 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path48.default.join(mainRepo, "trees", ws);
+  return import_node_path49.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
   const ignored = (0, import_node_child_process30.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
@@ -17979,12 +18383,12 @@ function assertDefaultWorktreeRootIgnored(mainRepo) {
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path48.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path48.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path49.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path49.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path48.default.join(import_node_path48.default.dirname(mainRepo), `${import_node_path48.default.basename(mainRepo)}-${ws}`);
+  return import_node_path49.default.join(import_node_path49.default.dirname(mainRepo), `${import_node_path49.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -18096,7 +18500,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs41.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs42.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -18136,9 +18540,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs41.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs42.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path48.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path49.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -18147,7 +18551,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs41.default.existsSync(selectedPath)) {
+    if (import_node_fs42.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -18249,8 +18653,24 @@ async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = fals
       "Retained managed runtime has no exact provider registration; routes were preserved."
     );
   }
-  const routes = removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
-  await ensureTraefikRoutesRemoved(routes);
+  const retained = action2 === "stop" ? readManagedRuntimeState(resolved.worktreePath, resolved.workspace) : void 0;
+  let absent = false;
+  const remove = () => {
+    if (retained?.stopBaseline) {
+      absent = proveManagedStop(retained).status === "proven-absent";
+      if (absent && listRoutesForWorktreePath(resolved.worktreePath).some(
+        (route) => route.workspace !== resolved.workspace || !retained.desired.apps.includes(route.name)
+      ))
+        throw new Error("Absent stop contains routes outside the retained desired set.");
+    }
+    claimLifecycleEffect();
+    return removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
+  };
+  const routes = retained?.stopBaseline ? withMutationLock("Revalidate stop routes", resolved.worktreePath, remove) : remove();
+  await ensureTraefikRoutesRemoved([
+    ...routes,
+    ...absent && retained ? managedStopRouteReferences(retained) : []
+  ]);
   if (!quiet) {
     process.stdout.write(
       `Freed ${routes.length} route(s) for workspace '${resolved.workspace}'.
@@ -18261,6 +18681,7 @@ async function mutateWorkspaceRuntime(action2, resolved, worktrees, quiet = fals
     ...mutation.status === "changed" ? { devpodId } : {},
     freedRoutes: routes.length,
     providerChanged: mutation.status === "changed",
+    ...absent ? { runtimeAbsent: true } : {},
     workspace: resolved.workspace
   };
 }
@@ -18287,7 +18708,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     const result = await mutateWorkspaceRuntime("delete", resolved, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs41.default.existsSync(resolved.worktreePath)) {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs42.default.existsSync(resolved.worktreePath)) {
         const rm = (0, import_node_child_process30.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
@@ -18306,7 +18727,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs41.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs42.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
 }
 async function workspaceStop(target, opts = {}) {
   return runWorkspaceLifecycle("stop", target, opts);
@@ -18314,16 +18735,18 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process30, import_node_fs41, import_node_path48, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process30, import_node_fs42, import_node_path49, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
     import_node_child_process30 = require("child_process");
-    import_node_fs41 = __toESM(require("fs"));
-    import_node_path48 = __toESM(require("path"));
+    import_node_fs42 = __toESM(require("fs"));
+    import_node_path49 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
+    init_devsy_mutation();
     init_managed_runtime_state();
+    init_managed_stop_recovery();
     init_reliability_lifecycle();
     init_repo_config();
     init_route_state();
@@ -18479,7 +18902,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.61" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.63" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {