@devrouter/cli 0.0.62 → 0.0.64

package/dist/devrouter-lifecycle-worker.js

@@ -240,7 +240,9 @@ function tryReclaimStaleLock(lockPath, staleLinkPath, livenessCache) {
 function acquireFileLock(lockPath, options) {
   const processBirth = processBirthIdentity(process.pid);
   if (!processBirth) {
-    throw new Error(`could not determine process identity for ${options.activity} lock`);
+    throw new Error(
+      `could not determine process identity for ${options.activity} lock: process inspection may be unavailable or sandbox-denied; run the canonical command in a permitted host context`
+    );
   }
   const ownerId = (0, import_node_crypto2.randomUUID)();
   const owner = `${process.pid}:${Buffer.from(processBirth).toString("base64url")}:${ownerId}`;
@@ -978,6 +980,33 @@ function inspectManagedStopWorkspaceIds(endpoint, composeDirectory) {
   assertUniqueContainerIds(ids);
   return ids;
 }
+function hasExactManagedStopMissingObjectError(stderr, id2) {
+  if (typeof stderr !== "string") return false;
+  const line = stderr.endsWith("\r\n") ? stderr.slice(0, -2) : stderr.endsWith("\n") ? stderr.slice(0, -1) : stderr;
+  return line.toLowerCase() === `error: no such object: ${id2}`;
+}
+function assertManagedStopContainersAbsent(endpoint, ids) {
+  assertManagedStopEndpoint(endpoint);
+  if (!Array.isArray(ids) || ids.length === 0 || ids.length > 256) {
+    throw new Error("Managed stop absence proof requires between 1 and 256 container ids.");
+  }
+  ids.forEach(assertFullContainerId);
+  assertUniqueContainerIds(ids);
+  const env = { ...process.env };
+  delete env.DOCKER_CONTEXT;
+  delete env.DOCKER_HOST;
+  for (const id2 of ids) {
+    const result = (0, import_node_child_process3.spawnSync)("docker", ["--host", endpoint, "inspect", "--format", "{{.Id}}", id2], {
+      env,
+      encoding: "utf-8",
+      timeout: MANAGED_STOP_DOCKER_TIMEOUT_MS,
+      maxBuffer: MANAGED_STOP_DOCKER_MAX_BUFFER
+    });
+    if (result.status !== 1 || result.error || result.signal || result.stdout !== "" && result.stdout !== "\n" && result.stdout !== "\r\n" || !hasExactManagedStopMissingObjectError(result.stderr, id2)) {
+      throw new Error("Managed stop Docker inspection did not prove container absence.");
+    }
+  }
+}
 function stopPinnedManagedContainer(endpoint, containerId) {
   assertFullContainerId(containerId);
   runManagedStopDocker(["stop", containerId], endpoint, 3e4);
@@ -988,11 +1017,13 @@ var import_node_child_process8 = require("child_process");
 
 // src/core/devpod-registry.ts
 var import_node_child_process4 = require("child_process");
-function listDevpodWorkspacesRaw() {
+function listDevpodWorkspacesRaw(options = {}) {
   const result = (0, import_node_child_process4.spawnSync)("devpod", ["list", "--output", "json", "--skip-pro"], {
     encoding: "utf-8"
   });
-  if (result.status !== 0) {
+  if (options.allowMissingExecutable && result.error?.code === "ENOENT")
+    return [];
+  if (result.error || result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
   }
@@ -3240,7 +3271,56 @@ function proveRetainedManagedStop(state) {
   }
   return result;
 }
+function absentRegistrationIdentity(state) {
+  resetWorkspaceRuntimeCaches();
+  if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
+    throw new Error("Stop provider changed.");
+  if (!state.workspace || !isLinkedWorktree(state.repoPath))
+    throw new Error("Absent stop requires a linked workspace.");
+  const record4 = readWorkspaceOwnership(state.repoPath, state.workspace);
+  if (!record4 || record4.workspace !== state.workspace || record4.devpodId !== state.devpodId || !sameWorkspacePath(record4.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== state.workspace || inspectWorkspaceOwnership(record4, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
+    throw new Error("Absent stop workspace ownership changed.");
+  for (const entries of [
+    listDevsyWorkspaces(),
+    listDevpodWorkspacesRaw({ allowMissingExecutable: true })
+  ]) {
+    if (entries.some(
+      (entry) => entry.id === state.devpodId || sameWorkspacePath(entry.source.localFolder, state.repoPath)
+    ))
+      throw new Error("Absent stop requires both provider registrations to remain absent.");
+  }
+  return { record: record4, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+}
+function proveManagedStop(state) {
+  const baseline = validateManagedStopBaseline(state.stopBaseline, state);
+  const owner = inspectDevsyWorkspaceOwnership(
+    listDevsyWorkspaces(),
+    state.devpodId,
+    state.repoPath
+  );
+  if (owner.status !== "absent")
+    return { status: "retained", containers: proveRetainedManagedStop(state) };
+  if (baseline.sourceContainer) throw new Error("Absent stop cannot prove a source container.");
+  const before = absentRegistrationIdentity(state);
+  if (!(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Retained stop generation changed.");
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId)
+    throw new Error("Stop daemon changed.");
+  assertManagedStopContainersAbsent(
+    baseline.endpoint,
+    baseline.containers.map((container) => container.id)
+  );
+  const uidBytes = Buffer.byteLength(baseline.uid);
+  const runnerId = uidBytes === 16 || uidBytes === 40 ? baseline.uid : baseline.providerId;
+  if (inspectManagedStopContainers(baseline.project, baseline.endpoint).length !== 0 || inspectManagedStopWorkspaceIds(baseline.endpoint, baseline.composeDirectory).length !== 0 || inspectProviderRunnerContainers(baseline.endpoint, runnerId).length !== 0)
+    throw new Error("Absent stop observed a remaining workspace population.");
+  if (inspectManagedStopDaemon(baseline.endpoint) !== baseline.daemonId || !(0, import_node_util2.isDeepStrictEqual)(absentRegistrationIdentity(state), before) || !(0, import_node_util2.isDeepStrictEqual)(readManagedRuntimeState(state.repoPath, state.workspace), state))
+    throw new Error("Absent stop authority changed during inspection.");
+  return { status: "proven-absent", containers: [] };
+}
 function stopFromManagedBaseline(state) {
+  const proof = proveManagedStop(state);
+  if (proof.status === "proven-absent") return proof.status;
   const baseline = validateManagedStopBaseline(state.stopBaseline, state);
   const stopped = /* @__PURE__ */ new Set();
   for (const initial of proveRetainedManagedStop(state))
@@ -3263,6 +3343,12 @@ function stopFromManagedBaseline(state) {
   }
   if (inspect().some((container) => container.state.Running))
     throw new Error("Retained workloads remain running.");
+  return "retained";
+}
+function managedStopRouteReferences(state) {
+  return state.desired.apps.flatMap(
+    (name) => ["http", "tcp"].map((protocol) => ({ repoPath: state.repoPath, name, protocol }))
+  );
 }
 
 // src/core/repo-config.ts
@@ -4621,7 +4707,7 @@ function loadRepoConfig(repoPath, read = (file) => import_node_fs14.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.62" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.64" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5157,8 +5243,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
     throw new Error("Managed stop requires the exact retained workspace identity.");
   }
   if (state.stopBaseline) {
-    stopFromManagedBaseline(state);
-    return true;
+    return stopFromManagedBaseline(state) === "proven-absent" ? "proven-absent" : true;
   }
   const workspaceEnv = workspace ? { token: workspace, gitCommonDir: resolveGitCommonDir(repoPath) } : void 0;
   function registration2() {
@@ -5386,12 +5471,14 @@ function inspectExactOwnership(devsyId, worktreePath) {
 }
 function mutateOwnedDevsyWorkspace(action, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action}`, worktreePath, () => {
-    if (action === "stop" && stopRetainedManagedDevsyWorkspace({
-      repoPath: worktreePath,
-      devsyId,
-      stopProvider: () => runDevsyAction("stop", devsyId)
-    }))
-      return { status: "changed" };
+    if (action === "stop") {
+      const stopped = stopRetainedManagedDevsyWorkspace({
+        repoPath: worktreePath,
+        devsyId,
+        stopProvider: () => runDevsyAction("stop", devsyId)
+      });
+      if (stopped) return { status: stopped === "proven-absent" ? "proven-absent" : "changed" };
+    }
     const before = inspectExactOwnership(devsyId, worktreePath);
     if (before.status === "absent") return { status: "absent" };
     runDevsyAction(action, devsyId);
@@ -6206,7 +6293,7 @@ function applyReliabilityEvent(state, event, nowMs) {
     case "not-started":
       if (next.executionPolicy !== "manual" || next.operation?.kind !== "exec")
         return unchanged(next, "blocked");
-      if (next.operation.id !== event.operationId || next.operation.status !== "RUNNING")
+      if (next.operation.id !== event.operationId || !["RUNNING", "DISPATCH_RECORDED"].includes(next.operation.status))
         return unchanged(next, "stale");
       next.operation = { ...next.operation, status: "NOT_LAUNCHED", exitCode: null };
       return transition(next, "accepted");
@@ -6427,1361 +6514,1370 @@ function workerGroupAbsent(pid) {
   }
 }
 
-// src/core/workspace-ensure.ts
-var import_node_child_process21 = require("child_process");
-var import_node_fs23 = __toESM(require("fs"));
-var import_node_path27 = __toESM(require("path"));
-
-// src/core/devpod-mutation.ts
+// src/core/traefik-route-health.ts
 var import_node_child_process16 = require("child_process");
 var import_node_fs19 = __toESM(require("fs"));
 var import_node_path24 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path24.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
-var DEVPOD_MUTATION_WAIT_MS = 18e5;
-var DevpodStartPostconditionError = class extends Error {
-};
-function withMutationLock2(activity, target, operation) {
-  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  return withFileLockSync(
-    DEVPOD_MUTATION_LOCK_FILE,
-    {
-      activity,
-      target: `'${target}'`,
-      waitMs: DEVPOD_MUTATION_WAIT_MS,
-      fair: true,
-      onWait: createStderrWaitReporter(activity, `'${target}'`)
-    },
-    operation
-  );
-}
-function commandFailure2(result) {
-  return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
+var ROUTER_RELOAD_LOCK_FILE = import_node_path24.default.join(DEVROUTER_HOME, "router-reload.lock");
+var ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
+var DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
+var DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
+var DEFAULT_POLL_INTERVAL_MS = 250;
+var ROUTER_API_PAGE_SIZE = 1e3;
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function runDevpodAction(action, devpodId, force = false) {
-  const args = action === "delete" ? [action, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action, devpodId];
-  claimLifecycleEffect();
-  const result = (0, import_node_child_process16.spawnSync)("devpod", args, { encoding: "utf-8" });
+function inspectRouterApi(protocol) {
+  const result = (0, import_node_child_process16.spawnSync)(
+    "curl",
+    [
+      "--silent",
+      "--show-error",
+      "--fail",
+      "--max-time",
+      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
+      `${ROUTER_API_BASE}/${protocol}/routers?per_page=${ROUTER_API_PAGE_SIZE}`
+    ],
+    { encoding: "utf-8" }
+  );
   if (result.status !== 0) {
-    throw new Error(
-      `devpod ${action}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
-    );
+    return {
+      ok: false,
+      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
+    };
   }
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
+  }
+  if (!Array.isArray(value)) {
+    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
+  }
+  if (value.some((item) => !isRecord3(item) || typeof item.name !== "string" || !item.name))
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} router API returned malformed entries`
+    };
+  return {
+    ok: true,
+    reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
+    names: new Set(
+      value.flatMap((item) => {
+        if (!item || typeof item !== "object") return [];
+        const name = item.name;
+        return typeof name === "string" ? [name] : [];
+      })
+    )
+  };
 }
-function inspectExactOwnership2(devpodId, worktreePath) {
-  const ownership = inspectDevpodWorkspaceOwnership(
-    listDevpodWorkspaces(worktreePath),
-    devpodId,
-    worktreePath
-  );
-  if (ownership.status === "conflict") throw new Error(ownership.reason);
-  return ownership;
-}
-function mutateOwnedDevpodWorkspace(action, devpodId, worktreePath) {
-  return withMutationLock2(`DevPod ${action}`, worktreePath, () => {
-    const before = inspectExactOwnership2(devpodId, worktreePath);
-    if (before.status === "absent") return { status: "absent" };
-    runDevpodAction(action, devpodId);
-    let after = inspectExactOwnership2(devpodId, worktreePath);
-    if (action === "stop" && after.status !== "owned") {
-      throw new Error(`DevPod '${devpodId}' no longer owns '${worktreePath}' after provider stop.`);
-    }
-    if (action === "delete" && after.status === "owned") {
-      const runtime = inspectDevpodRuntimeStatus(devpodId, worktreePath);
-      if (runtime !== "not-found") {
-        throw new Error(
-          `DevPod '${devpodId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
-        );
-      }
-      after = inspectExactOwnership2(devpodId, worktreePath);
-      if (after.status === "owned") {
-        runDevpodAction("delete", devpodId, true);
-        after = inspectExactOwnership2(devpodId, worktreePath);
-      }
-      if (after.status !== "absent") {
-        throw new Error(
-          `DevPod '${devpodId}' still owns '${worktreePath}' after forced provider delete.`
-        );
-      }
-    }
-    return { status: "changed" };
-  });
+function isRecord3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function stopOwnedDevpodWorkspace(devpodId, worktreePath) {
+function inspectNamedRouterApi(protocol, resource, name) {
+  const result = (0, import_node_child_process16.spawnSync)(
+    "curl",
+    [
+      "--silent",
+      "--show-error",
+      "--fail",
+      "--max-time",
+      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
+      `${ROUTER_API_BASE}/${protocol}/${resource}/${encodeURIComponent(name)}`
+    ],
+    { encoding: "utf-8" }
+  );
+  if (result.status !== 0) {
+    return {
+      ok: false,
+      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
+    };
+  }
+  let value;
   try {
-    resetWorkspaceRuntimeCaches();
-    if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
-      return stopOwnedDevsyWorkspace(devpodId, worktreePath);
-    }
-    return mutateOwnedDevpodWorkspace("stop", devpodId, worktreePath);
-  } finally {
-    resetWorkspaceRuntimeCaches();
+    value = JSON.parse(result.stdout);
+  } catch {
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned invalid JSON`
+    };
   }
-}
-function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
-  if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
-    const result2 = deleteOwnedDevsyWorkspace(devpodId, worktreePath);
-    resetWorkspaceRuntimeCaches();
-    return result2;
+  if (!isRecord3(value)) {
+    return {
+      ok: false,
+      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned a non-object`
+    };
   }
-  const result = mutateOwnedDevpodWorkspace("delete", devpodId, worktreePath);
-  resetWorkspaceRuntimeCaches();
-  return result;
+  return { ok: true, value };
 }
-async function startDevpodWorkspace(options) {
-  if (resolveWorkspaceRuntimeOrDefault(options.repoPath) === "devsy") {
-    try {
-      const result = await startDevsyWorkspace({
-        repoPath: options.repoPath,
-        devsyId: options.devpodId,
-        devcontainerPath: options.devcontainerPath,
-        recreate: options.recreate,
-        quiet: options.quiet,
-        workspace: options.workspace,
-        inactivityTimeout: readWorkspaceRuntimeConfig().devsyInactivityTimeout
-      });
-      resetWorkspaceRuntimeCaches();
-      return result;
-    } catch (error) {
-      if (error instanceof DevsyStartPostconditionError) {
-        resetWorkspaceRuntimeCaches();
-        throw new DevpodStartPostconditionError(error.message);
-      }
-      throw error;
-    }
-  }
-  const activity = options.recreate ? "DevPod recreate" : "DevPod start";
-  return withMutationLock2(activity, options.repoPath, () => {
-    const workspaces = listDevpodWorkspaces(options.repoPath);
-    let devpodId = options.devpodId ?? selectDevpodWorkspace(workspaces, options.repoPath)?.id;
-    if (devpodId) {
-      const before = inspectDevpodWorkspaceOwnership(workspaces, devpodId, options.repoPath);
-      if (before.status === "conflict") throw new Error(before.reason);
-      if (options.recreate && before.status !== "owned") {
-        throw new Error(`Cannot recreate DevPod '${devpodId}' without one exact owner.`);
-      }
-    } else if (options.recreate) {
-      throw new Error("Cannot recreate a DevPod before its exact id is known.");
-    }
-    const args = ["up", options.repoPath];
-    if (devpodId) args.push("--id", devpodId);
-    if (options.devcontainerPath) {
-      args.push("--devcontainer-path", options.devcontainerPath);
-    }
-    args.push("--open-ide=false");
-    if (options.workspace) {
-      args.push(
-        "--workspace-env",
-        `WORKSPACE=${options.workspace.token}`,
-        "--workspace-env",
-        `DEVROUTER_WORKSPACE=${options.workspace.token}`
-      );
-    }
-    if (options.recreate) args.push("--recreate");
-    const env = { ...process.env };
-    if (options.workspace) {
-      env.WORKSPACE = options.workspace.token;
-      env.DEVROUTER_WORKSPACE = options.workspace.token;
-      env.DEVROUTER_GIT_COMMON_DIR = options.workspace.gitCommonDir;
-      env.DEVCONTAINER_COMPOSE_OVERLAY = "docker-compose.devrouter.yml";
-    } else {
-      delete env.WORKSPACE;
-      delete env.DEVROUTER_WORKSPACE;
-      delete env.DEVROUTER_GIT_COMMON_DIR;
-      delete env.DEVCONTAINER_COMPOSE_OVERLAY;
-    }
-    claimLifecycleEffect();
-    const result = (0, import_node_child_process16.spawnSync)("devpod", args, {
-      stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
-      env
-    });
-    if (result.status !== 0) {
-      resetWorkspaceRuntimeCaches();
-      const message = `devpod up failed for '${devpodId ?? options.repoPath}'.`;
-      if (options.devcontainerPath) throw new DevpodStartPostconditionError(message);
-      throw new Error(message);
-    }
-    try {
-      const attached = listDevpodWorkspaces(options.repoPath);
-      devpodId ??= selectDevpodWorkspace(attached, options.repoPath)?.id;
-      if (!devpodId) {
-        throw new Error(`DevPod did not attach '${options.repoPath}' after startup.`);
-      }
-      const ownership = inspectDevpodWorkspaceOwnership(attached, devpodId, options.repoPath);
-      if (ownership.status === "conflict") throw new Error(ownership.reason);
-      if (ownership.status !== "owned") {
-        throw new Error(
-          `DevPod did not attach '${options.repoPath}' as '${devpodId}' after startup.`
-        );
-      }
-      resetWorkspaceRuntimeCaches();
-      return devpodId;
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      throw new DevpodStartPostconditionError(message);
-    }
-  });
-}
-
-// src/core/http-route-probe.ts
-var import_node_child_process17 = require("child_process");
-var DEFAULT_MAX_TIME_SECONDS = 5;
-var PARENT_TIMEOUT_PADDING_MS = 250;
-var CONTRACT_MAX_BUFFER = 1024;
-var MIME_TOKEN_RE2 = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-function httpRouteUrl(host) {
-  return `${isTLSEnabled() ? "https" : "http"}://${host}`;
-}
-function probeHttpRoute(host, options = {}) {
-  const maxTimeSeconds = options.maxTimeSeconds ?? DEFAULT_MAX_TIME_SECONDS;
-  if (!Number.isFinite(maxTimeSeconds) || maxTimeSeconds <= 0) {
-    throw new Error("maxTimeSeconds must be a positive finite number.");
-  }
-  if (options.readiness !== void 0) {
-    return probeHttpReadinessSync(host, options.readiness, maxTimeSeconds, options.repoPath);
-  }
-  const tlsEnabled = isTLSEnabled();
-  const url = `${tlsEnabled ? "https" : "http"}://${host}`;
-  const args = [
-    "--silent",
-    "--show-error",
-    "--output",
-    "/dev/null",
-    "--write-out",
-    "%{http_code}",
-    "--max-time",
-    String(maxTimeSeconds)
-  ];
-  if (tlsEnabled) {
-    getMkcertRootCAPath({ repoPath: options.repoPath });
-    args.push("--cacert", CERT_FILE);
+function renderExpectedRoute(route) {
+  const protocol = route.protocol ?? "http";
+  const routerName = buildHostRouteRouterName(route.repoPath, route.name);
+  const routeState = {
+    id: buildHostRouteId(route.repoPath, route.name),
+    name: route.name,
+    host: route.host,
+    protocol,
+    tcpProtocol: route.tcpProtocol,
+    repoPath: route.repoPath,
+    port: route.port,
+    mode: route.mode,
+    upstreamHost: route.upstreamHost,
+    pid: route.pid,
+    command: route.command,
+    workspace: route.workspace,
+    createdAt: "",
+    updatedAt: ""
+  };
+  const document = buildHostRoutesDocument([routeState], false);
+  const protocolDocument = document[protocol];
+  if (!isRecord3(protocolDocument)) return void 0;
+  const routers = protocolDocument.routers;
+  const services = protocolDocument.services;
+  if (!isRecord3(routers) || !isRecord3(services)) return void 0;
+  const routerKey = routerName.slice(0, routerName.lastIndexOf("@"));
+  const router = routers[routerKey];
+  const service = services[routerKey];
+  if (!isRecord3(router) || !isRecord3(service)) return void 0;
+  const rule = router.rule;
+  const serviceReference = router.service;
+  const loadBalancer = service.loadBalancer;
+  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
+  if (typeof rule !== "string" || serviceReference !== routerKey || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(servers[0])) {
+    return void 0;
   }
-  args.push(url);
-  const result = (0, import_node_child_process17.spawnSync)("curl", args, { encoding: "utf-8" });
-  const stdout = result.stdout?.trim() ?? "";
-  const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
-  const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
-  const details = ok ? `HTTP ${status}` : [status === void 0 ? void 0 : `HTTP ${status}`, result.stderr?.trim()].filter(Boolean).join(": ") || `curl exited with status ${result.status ?? "unknown"}`;
-  return { ok, status, details };
+  const serverField = protocol === "http" ? "url" : "address";
+  const server = servers[0][serverField];
+  if (typeof server !== "string") return void 0;
+  const provider = routerName.slice(routerName.lastIndexOf("@")).trim();
+  if (!provider.startsWith("@")) return void 0;
+  return {
+    protocol,
+    routerName,
+    serviceKey: routerKey,
+    serviceName: `${routerKey}${provider}`,
+    rule,
+    serverField,
+    server
+  };
 }
-function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
-  const parentTimeoutMs = maxTimeSeconds * 1e3 + PARENT_TIMEOUT_PADDING_MS;
-  if (!Number.isFinite(parentTimeoutMs)) {
-    throw new Error("maxTimeSeconds is too large for a bounded probe timeout.");
-  }
-  const tlsEnabled = isTLSEnabled();
-  const args = buildHttpReadinessCurlArgs(host, readiness, maxTimeSeconds, tlsEnabled);
-  if (tlsEnabled) {
-    getMkcertRootCAPath({ repoPath });
-  }
-  let result;
-  try {
-    result = (0, import_node_child_process17.spawnSync)("curl", args, {
-      encoding: "utf-8",
-      maxBuffer: CONTRACT_MAX_BUFFER,
-      timeout: Math.ceil(parentTimeoutMs)
-    });
-  } catch {
-    return transportFailure();
-  }
-  if (result.status !== 0 || result.error) {
-    return transportFailure();
+function inspectExpectedRouteMatch(route) {
+  const expected = renderExpectedRoute(route);
+  const routeName = buildHostRouteRouterName(route.repoPath, route.name);
+  if (!expected) {
+    return {
+      ok: false,
+      routes: [routeName],
+      details: "host-route renderer returned an incomplete route configuration"
+    };
   }
-  const metadata = typeof result.stdout === "string" ? result.stdout : "";
-  return parseHttpReadinessMetadata(metadata, readiness);
-}
-function buildHttpReadinessCurlArgs(host, readiness, maxTimeSeconds, tlsEnabled) {
-  const url = `${tlsEnabled ? "https" : "http"}://${host}${readiness.path}`;
-  const args = [
-    "--disable",
-    "--globoff",
-    "--silent",
-    "--show-error",
-    "--no-location",
-    "--noproxy",
-    "*",
-    "--output",
-    "/dev/null",
-    "--write-out",
-    "%{http_code}	%{content_type}",
-    "--max-time",
-    String(maxTimeSeconds)
-  ];
-  if (tlsEnabled) args.push("--cacert", CERT_FILE);
-  args.push(url);
-  return args;
-}
-function parseHttpReadinessMetadata(metadata, readiness) {
-  if (metadata.length > CONTRACT_MAX_BUFFER) {
-    return transportFailure();
+  const routerResult = inspectNamedRouterApi(expected.protocol, "routers", expected.routerName);
+  if (!routerResult.ok) {
+    return { ok: false, routes: [routeName], details: routerResult.details };
   }
-  const match = /^(\d{3})\t([^\r\n]*)$/.exec(metadata);
-  if (!match) {
-    return transportFailure();
+  if (routerResult.value.status !== "enabled" || routerResult.value.name !== expected.routerName || routerResult.value.rule !== expected.rule || routerResult.value.service !== expected.serviceKey && routerResult.value.service !== expected.serviceName) {
+    return {
+      ok: false,
+      routes: [routeName],
+      details: "active Traefik router does not match the rendered route"
+    };
   }
-  const status = Number(match[1]);
-  if (status < 100 || status > 599) {
-    return transportFailure();
+  const serviceResult = inspectNamedRouterApi(expected.protocol, "services", expected.serviceName);
+  if (!serviceResult.ok) {
+    return { ok: false, routes: [routeName], details: serviceResult.details };
   }
-  const statuses = readiness.statuses ?? [200];
-  const statusAllowed = statuses.includes(status);
-  const mediaFailure = readiness.contentType ? contentTypeFailure(match[2], readiness.contentType) : void 0;
-  if (statusAllowed && mediaFailure === void 0) {
-    return { ok: true, status, details: `HTTP ${status}` };
+  const loadBalancer = serviceResult.value.loadBalancer;
+  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
+  const server = Array.isArray(servers) && servers.length === 1 ? servers[0] : void 0;
+  if (serviceResult.value.status !== "enabled" || serviceResult.value.name !== expected.serviceName || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(server) || server[expected.serverField] !== expected.server) {
+    return {
+      ok: false,
+      routes: [routeName],
+      details: "active Traefik service does not match the rendered route"
+    };
   }
-  const reasons = [
-    ...statusAllowed ? [] : ["status not allowed"],
-    ...mediaFailure ? [mediaFailure] : []
-  ];
-  return {
-    ok: false,
-    status,
-    details: `HTTP ${status}; ${reasons.join("; ")}`,
-    classification: "application-contract"
-  };
+  return { ok: true };
 }
-function contentTypeFailure(responseContentType, expectedContentType) {
-  const normalized = responseContentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
-  if (normalized.length === 0) {
-    return "content type missing";
-  }
-  const separator = normalized.indexOf("/");
-  if (separator <= 0 || separator === normalized.length - 1 || normalized.indexOf("/", separator + 1) !== -1 || !MIME_TOKEN_RE2.test(normalized.slice(0, separator)) || !MIME_TOKEN_RE2.test(normalized.slice(separator + 1))) {
-    return "content type invalid";
+function inspectExpectedRouteMatches(routes) {
+  const mismatched = [];
+  const failures = [];
+  for (const route of routes) {
+    const result = inspectExpectedRouteMatch(route);
+    if (!result.ok) {
+      mismatched.push(...result.routes);
+      failures.push(result.details);
+    }
   }
-  return normalized === expectedContentType.toLowerCase() ? void 0 : "content type mismatch";
-}
-function transportFailure() {
-  return {
+  return mismatched.length === 0 ? { ok: true } : {
     ok: false,
-    details: "HTTP route probe transport failure",
-    classification: "transport"
+    routes: mismatched,
+    details: failures.join("; ")
   };
 }
-
-// src/core/managed-host-preparation.ts
-var import_node_child_process18 = require("child_process");
-var import_node_fs20 = __toESM(require("fs"));
-var PREPARATION_TIMEOUT_MS = 6e4;
-var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
-var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
-var START_ERROR = "Managed host preparation could not start.";
-var FAILURE_ERROR = "Managed host preparation failed.";
-var TIMEOUT_ERROR = "Managed host preparation timed out after 60 seconds.";
-function runPreparationCommand(argv, cwd) {
-  return new Promise((resolve) => {
-    let child;
-    try {
-      child = (0, import_node_child_process18.spawn)(argv[0], argv.slice(1), {
-        cwd,
-        detached: true,
-        shell: false,
-        stdio: "ignore"
-      });
-    } catch {
-      resolve("start-error");
-      return;
+async function waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  let result;
+  do {
+    result = inspectExpectedRouteMatches(routes);
+    if (result.ok) return result;
+    if (Date.now() < deadline) {
+      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
     }
-    let timedOut = false;
-    const deadline = setTimeout(() => {
-      timedOut = true;
-      if (child.pid !== void 0 && child.exitCode === null && child.signalCode === null) {
-        try {
-          process.kill(-child.pid, "SIGKILL");
-        } catch {
-        }
-      }
-    }, PREPARATION_TIMEOUT_MS);
-    child.once("error", () => {
-      clearTimeout(deadline);
-      resolve("start-error");
-    });
-    child.once("close", (code) => {
-      clearTimeout(deadline);
-      resolve(timedOut ? "timeout" : code === 0 ? "success" : "failure");
-    });
-  });
+  } while (Date.now() < deadline);
+  return result;
 }
-function readConfigBytes(configPath) {
-  try {
-    return import_node_fs20.default.readFileSync(configPath);
-  } catch {
-    return void 0;
+function inspectExpectedRoutes(routes, expectation) {
+  const mismatched = [];
+  const failures = [];
+  for (const protocol of ["http", "tcp"]) {
+    const expected = routes.filter((route) => (route.protocol ?? "http") === protocol).map((route) => buildHostRouteRouterName(route.repoPath, route.name));
+    if (expected.length === 0) continue;
+    const result = inspectRouterApi(protocol);
+    if (!result.ok) {
+      failures.push(result.details);
+      mismatched.push(...expected);
+      continue;
+    }
+    const unexpected = expected.filter(
+      (name) => expectation === "loaded" ? !result.names.has(name) : result.names.has(name)
+    );
+    const boundedAbsenceIsUncertain = result.reachedPageLimit && (expectation === "loaded" ? unexpected.length > 0 : unexpected.length === 0);
+    if (boundedAbsenceIsUncertain) {
+      failures.push(
+        `${protocol.toUpperCase()} router API reached the ${ROUTER_API_PAGE_SIZE}-entry safety limit`
+      );
+    }
+    mismatched.push(...unexpected);
+    if (expectation === "removed" && unexpected.length === 0 && result.reachedPageLimit) {
+      mismatched.push(...expected);
+    }
   }
+  return mismatched.length === 0 ? { ok: true } : {
+    ok: false,
+    routes: mismatched,
+    details: failures.length > 0 ? failures.join("; ") : expectation === "loaded" ? "router names are absent" : "router names are still present"
+  };
 }
-async function runManagedHostPreparation(repoPath, config) {
-  const prepareCommand = config.managedRuntime?.devcontainer.prepareCommand;
-  if (!prepareCommand) return;
-  if (process.platform === "win32") {
-    throw new Error("Managed host preparation requires POSIX process-group ownership.");
-  }
-  const resolvedRepoPath = resolveRepoPath(repoPath);
-  const configPath = getRepoConfigPath(resolvedRepoPath);
-  const before = readConfigBytes(configPath);
-  if (!before) {
-    throw new Error(CONFIG_READ_ERROR);
-  }
-  const result = await runPreparationCommand(prepareCommand, resolvedRepoPath);
-  const after = readConfigBytes(configPath);
-  if (!after?.equals(before)) {
-    throw new Error(CONFIG_CHANGED_ERROR);
-  }
-  if (result === "start-error") {
-    throw new Error(START_ERROR);
-  }
-  if (result === "timeout") {
-    throw new Error(TIMEOUT_ERROR);
-  }
-  if (result === "failure") {
-    throw new Error(FAILURE_ERROR);
-  }
+async function waitForExpectedRoutes(routes, expectation, timeoutMs, pollIntervalMs) {
+  const deadline = Date.now() + timeoutMs;
+  let result;
+  do {
+    result = inspectExpectedRoutes(routes, expectation);
+    if (result.ok) return result;
+    if (Date.now() < deadline) {
+      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
+    }
+  } while (Date.now() < deadline);
+  return result;
 }
-
-// src/core/managed-post-start.ts
-var import_node_child_process19 = require("child_process");
-var import_node_crypto10 = require("crypto");
-var import_node_fs21 = __toESM(require("fs"));
-var import_node_path25 = __toESM(require("path"));
-var MANAGED_MARKER = "devrouter:managed devcontainer";
-var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
-var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
-var ADAPTER_WRAPPER = `adapter_snapshot="$1"
-shift
-readonly DEVROUTER_PROCESS_HELPER DEVROUTER_PROCESS_ADAPTER_SHA256
-source "$adapter_snapshot"
-`;
-function renderDeliveryScript(targetPath) {
-  if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
-    throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
-  }
-  const temporaryPrefix = import_node_path25.default.posix.basename(targetPath);
-  return `set -eu
-umask 077
-runtime_root=/tmp/devrouter
-runtime_bin="$runtime_root/bin"
-target="${targetPath}"
-if [ -L "$runtime_root" ] || [ -L "$runtime_bin" ]; then
-  echo "Refusing symlinked devrouter runtime path." >&2
-  exit 1
-fi
-mkdir -p "$runtime_bin"
-chmod 700 "$runtime_root" "$runtime_bin"
-temporary="$(mktemp "$runtime_bin/.${temporaryPrefix}.XXXXXX")"
-trap 'rm -f "$temporary"' EXIT
-cat > "$temporary"
-chmod 700 "$temporary"
-mv -f "$temporary" "$target"
-trap - EXIT
-`;
+async function ensureTraefikRouteExpectation(routes, expectation, options) {
+  if (routes.length === 0) return { restarted: false };
+  const initialTimeoutMs = options.initialTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
+  const recoveryTimeoutMs = options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS;
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const initial = await waitForExpectedRoutes(
+    routes,
+    expectation,
+    initialTimeoutMs,
+    pollIntervalMs
+  );
+  if (initial.ok) return { restarted: false };
+  if (options.allowRestart === false)
+    throw new Error(
+      "Traefik routes did not reload; shared router restart is disabled for this operation."
+    );
+  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLock(
+    ROUTER_RELOAD_LOCK_FILE,
+    {
+      activity: "Traefik route reload recovery",
+      waitMs: initialTimeoutMs + recoveryTimeoutMs + 1e4,
+      fair: true,
+      onWait: createStderrWaitReporter("Traefik route reload recovery", "shared router")
+    },
+    async () => {
+      const recheck = await waitForExpectedRoutes(routes, expectation, 0, pollIntervalMs);
+      if (recheck.ok) return { restarted: false };
+      claimLifecycleEffect();
+      restartRouterStack();
+      const recovered = await waitForExpectedRoutes(
+        routes,
+        expectation,
+        recoveryTimeoutMs,
+        pollIntervalMs
+      );
+      if (recovered.ok) return { restarted: true };
+      const action = expectation === "loaded" ? "load" : "remove";
+      throw new Error(
+        `Traefik did not ${action} file-provider routes after one restart: ${recovered.routes.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
+      );
+    }
+  );
 }
-function commandFailure3(result) {
-  return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
+async function ensureTraefikRoutesLoaded(routes, options = {}) {
+  return ensureTraefikRouteExpectation(routes, "loaded", options);
 }
-function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process19.spawnSync)(
-    "docker",
-    ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
-    { input: contents, encoding: "utf-8" }
-  );
-  if (result.status !== 0) {
-    const details = commandFailure3(result);
-    throw new Error(`Could not deliver ${label}${details ? `: ${details}` : "."}`);
+async function ensureTraefikRoutesMatch(routes, options = {}) {
+  if (routes.length === 0) return;
+  const timeoutMs = options.initialTimeoutMs ?? options.recoveryTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const result = await waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs);
+  if (!result.ok) {
+    throw new Error(
+      `Traefik route configuration did not match rendered routes: ${result.routes.join(", ")} (${result.details})`
+    );
   }
 }
-function readRegularFileBytes(filePath) {
-  if (!import_node_fs21.default.existsSync(filePath) || !import_node_fs21.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs21.default.readFileSync(filePath);
+async function ensureTraefikRoutesRemoved(routes, options = {}) {
+  return ensureTraefikRouteExpectation(routes, "removed", options);
 }
-function readRegularFile(filePath) {
-  return readRegularFileBytes(filePath)?.toString("utf-8");
+function assertTraefikRoutesRemoved(routes) {
+  const result = inspectExpectedRoutes(routes, "removed");
+  if (!result.ok) throw new Error(`Workspace route cessation is not proven: ${result.details}`);
 }
-function adapterFingerprint(adapter) {
-  return (0, import_node_crypto10.createHash)("sha256").update(adapter).digest("hex");
+
+// src/core/workspace-ensure.ts
+var import_node_child_process21 = require("child_process");
+var import_node_fs23 = __toESM(require("fs"));
+var import_node_path27 = __toESM(require("path"));
+
+// src/core/devpod-mutation.ts
+var import_node_child_process17 = require("child_process");
+var import_node_fs20 = __toESM(require("fs"));
+var import_node_path25 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path25.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var DEVPOD_MUTATION_WAIT_MS = 18e5;
+var DevpodStartPostconditionError = class extends Error {
+};
+function withMutationLock2(activity, target, operation) {
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  return withFileLockSync(
+    DEVPOD_MUTATION_LOCK_FILE,
+    {
+      activity,
+      target: `'${target}'`,
+      waitMs: DEVPOD_MUTATION_WAIT_MS,
+      fair: true,
+      onWait: createStderrWaitReporter(activity, `'${target}'`)
+    },
+    operation
+  );
 }
-function resolveProcessHelperPath() {
-  const candidates = [
-    import_node_path25.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path25.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
-  ];
-  const helperPath = candidates.find((candidate) => import_node_fs21.default.existsSync(candidate));
-  if (!helperPath) {
-    throw new Error("Could not locate the packaged devrouter-process helper.");
+function commandFailure2(result) {
+  return [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+}
+function runDevpodAction(action, devpodId, force = false) {
+  const args = action === "delete" ? [action, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action, devpodId];
+  claimLifecycleEffect();
+  const result = (0, import_node_child_process17.spawnSync)("devpod", args, { encoding: "utf-8" });
+  if (result.status !== 0) {
+    throw new Error(
+      `devpod ${action}${force ? " --force" : ""} failed for '${devpodId}': ${commandFailure2(result) || "unknown error"}`
+    );
   }
-  return helperPath;
 }
-function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path25.default.join(repoPath, MANAGED_ADAPTER_PATH);
-  const adapterBytes = readRegularFileBytes(adapterPath);
-  const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path25.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path25.default.join(repoPath, ".devcontainer", "devcontainer.json");
-  const dockerfile = readRegularFile(dockerfilePath) ?? "";
-  const devcontainer = readRegularFile(devcontainerPath) ?? "";
-  const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
-    (value) => value.includes("DEVROUTER_PROCESS_HELPER") || value.includes("devrouter-process")
+function inspectExactOwnership2(devpodId, worktreePath) {
+  const ownership = inspectDevpodWorkspaceOwnership(
+    listDevpodWorkspaces(worktreePath),
+    devpodId,
+    worktreePath
   );
-  if (adapterBytes === void 0) {
-    if (devrouterPattern) {
-      throw new Error(
-        "Devrouter lifecycle wiring is incomplete: add the managed post-start adapter or remove the stale devrouter-process references."
-      );
+  if (ownership.status === "conflict") throw new Error(ownership.reason);
+  return ownership;
+}
+function mutateOwnedDevpodWorkspace(action, devpodId, worktreePath) {
+  return withMutationLock2(`DevPod ${action}`, worktreePath, () => {
+    const before = inspectExactOwnership2(devpodId, worktreePath);
+    if (before.status === "absent") return { status: "absent" };
+    runDevpodAction(action, devpodId);
+    let after = inspectExactOwnership2(devpodId, worktreePath);
+    if (action === "stop" && after.status !== "owned") {
+      throw new Error(`DevPod '${devpodId}' no longer owns '${worktreePath}' after provider stop.`);
     }
-    return { kind: "unmanaged" };
-  }
-  const adapter = adapterBytes.toString("utf-8");
-  if (!adapter.includes(MANAGED_MARKER)) {
-    if (devrouterPattern) {
-      throw new Error(
-        "Devrouter-looking post-start adapter is missing the 'devrouter:managed devcontainer' marker. Regenerate or migrate the devcontainer, then retry devrouter ensure."
-      );
+    if (action === "delete" && after.status === "owned") {
+      const runtime = inspectDevpodRuntimeStatus(devpodId, worktreePath);
+      if (runtime !== "not-found") {
+        throw new Error(
+          `DevPod '${devpodId}' still owns '${worktreePath}' after provider delete (runtime=${runtime}).`
+        );
+      }
+      after = inspectExactOwnership2(devpodId, worktreePath);
+      if (after.status === "owned") {
+        runDevpodAction("delete", devpodId, true);
+        after = inspectExactOwnership2(devpodId, worktreePath);
+      }
+      if (after.status !== "absent") {
+        throw new Error(
+          `DevPod '${devpodId}' still owns '${worktreePath}' after forced provider delete.`
+        );
+      }
     }
-    return { kind: "unmanaged" };
-  }
-  assertManagedDevcontainerLifecycle(repoPath);
-  if (adapter.includes("DEVROUTER_PROCESS_HELPER")) {
-    return {
-      kind: "runtime",
-      adapterPath: MANAGED_ADAPTER_PATH,
-      adapterSha256: adapterFingerprint(adapterBytes),
-      adapterContents: adapterBytes
-    };
-  }
-  if (dockerfile.includes("devrouter-process") && devcontainer.includes("postStartCommand")) {
-    return { kind: "legacy" };
+    return { status: "changed" };
+  });
+}
+function stopOwnedDevpodWorkspace(devpodId, worktreePath) {
+  try {
+    resetWorkspaceRuntimeCaches();
+    if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
+      return stopOwnedDevsyWorkspace(devpodId, worktreePath);
+    }
+    return mutateOwnedDevpodWorkspace("stop", devpodId, worktreePath);
+  } finally {
+    resetWorkspaceRuntimeCaches();
   }
-  throw new Error(
-    "Managed post-start must use DEVROUTER_PROCESS_HELPER before removing the legacy image helper and postStartCommand. Regenerate or migrate the devcontainer, then retry devrouter ensure."
-  );
 }
-function runManagedPostStart(options) {
-  if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs21.default.readFileSync(resolveProcessHelperPath());
-  deliverRuntimeFile(
-    options.container.id,
-    RUNTIME_HELPER_PATH,
-    helper,
-    "the managed process helper"
-  );
-  const runtimeAdapterPath = `/tmp/devrouter/bin/managed-post-start-${options.plan.adapterSha256}`;
-  deliverRuntimeFile(
-    options.container.id,
-    runtimeAdapterPath,
-    options.plan.adapterContents,
-    "the managed post-start adapter"
-  );
-  const started = (0, import_node_child_process19.spawnSync)(
-    "docker",
-    [
-      "exec",
-      "--workdir",
-      options.container.workspacePath,
-      "--env",
-      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
-      "--env",
-      `DEVROUTER_PROCESS_ADAPTER_SHA256=${options.plan.adapterSha256}`,
-      ...options.profile ? ["--env", `DEVROUTER_PROFILE=${options.profile}`] : [],
-      ...options.processes ? [
-        "--env",
-        `DEVROUTER_PROCESS_SET=${options.processes.join(",")}`,
-        "--env",
-        "DEVROUTER_PROCESS_FINGERPRINT_ENV=DEVROUTER_PROFILE,DEVROUTER_PROCESS_SET"
-      ] : [],
-      options.container.id,
-      "bash",
-      "-c",
-      ADAPTER_WRAPPER,
-      options.plan.adapterPath,
-      runtimeAdapterPath
-    ],
-    { stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit" }
-  );
-  if (started.status !== 0) {
-    const details = commandFailure3(started);
-    throw new Error(`Managed post-start failed${details ? `: ${details}.` : "."}`);
+function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
+  if (resolveWorkspaceRuntimeOrDefault(worktreePath) === "devsy") {
+    const result2 = deleteOwnedDevsyWorkspace(devpodId, worktreePath);
+    resetWorkspaceRuntimeCaches();
+    return result2;
   }
+  const result = mutateOwnedDevpodWorkspace("delete", devpodId, worktreePath);
+  resetWorkspaceRuntimeCaches();
+  return result;
 }
-function assertSafeProcessName(name) {
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name)) {
-    throw new Error(`Managed process '${name}' is not a safe exact identifier.`);
+async function startDevpodWorkspace(options) {
+  if (resolveWorkspaceRuntimeOrDefault(options.repoPath) === "devsy") {
+    try {
+      const result = await startDevsyWorkspace({
+        repoPath: options.repoPath,
+        devsyId: options.devpodId,
+        devcontainerPath: options.devcontainerPath,
+        recreate: options.recreate,
+        quiet: options.quiet,
+        workspace: options.workspace,
+        inactivityTimeout: readWorkspaceRuntimeConfig().devsyInactivityTimeout
+      });
+      resetWorkspaceRuntimeCaches();
+      return result;
+    } catch (error) {
+      if (error instanceof DevsyStartPostconditionError) {
+        resetWorkspaceRuntimeCaches();
+        throw new DevpodStartPostconditionError(error.message);
+      }
+      throw error;
+    }
   }
-}
-function runManagedProcessAction(options) {
-  assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process19.spawnSync)(
-    "docker",
-    [
-      "exec",
-      "--workdir",
-      options.container.workspacePath,
-      "--env",
-      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
-      options.container.id,
-      "bash",
-      "-c",
-      'exec "$DEVROUTER_PROCESS_HELPER" "$1" --name "$2"',
-      "devrouter-process",
-      options.action,
-      options.name
-    ],
-    {
-      encoding: "utf-8",
-      stdio: options.action === "status" ? ["ignore", "pipe", "pipe"] : ["ignore", 2, "inherit"]
+  const activity = options.recreate ? "DevPod recreate" : "DevPod start";
+  return withMutationLock2(activity, options.repoPath, () => {
+    const workspaces = listDevpodWorkspaces(options.repoPath);
+    let devpodId = options.devpodId ?? selectDevpodWorkspace(workspaces, options.repoPath)?.id;
+    if (devpodId) {
+      const before = inspectDevpodWorkspaceOwnership(workspaces, devpodId, options.repoPath);
+      if (before.status === "conflict") throw new Error(before.reason);
+      if (options.recreate && before.status !== "owned") {
+        throw new Error(`Cannot recreate DevPod '${devpodId}' without one exact owner.`);
+      }
+    } else if (options.recreate) {
+      throw new Error("Cannot recreate a DevPod before its exact id is known.");
     }
-  );
-  if (options.action === "stop") {
+    const args = ["up", options.repoPath];
+    if (devpodId) args.push("--id", devpodId);
+    if (options.devcontainerPath) {
+      args.push("--devcontainer-path", options.devcontainerPath);
+    }
+    args.push("--open-ide=false");
+    if (options.workspace) {
+      args.push(
+        "--workspace-env",
+        `WORKSPACE=${options.workspace.token}`,
+        "--workspace-env",
+        `DEVROUTER_WORKSPACE=${options.workspace.token}`
+      );
+    }
+    if (options.recreate) args.push("--recreate");
+    const env = { ...process.env };
+    if (options.workspace) {
+      env.WORKSPACE = options.workspace.token;
+      env.DEVROUTER_WORKSPACE = options.workspace.token;
+      env.DEVROUTER_GIT_COMMON_DIR = options.workspace.gitCommonDir;
+      env.DEVCONTAINER_COMPOSE_OVERLAY = "docker-compose.devrouter.yml";
+    } else {
+      delete env.WORKSPACE;
+      delete env.DEVROUTER_WORKSPACE;
+      delete env.DEVROUTER_GIT_COMMON_DIR;
+      delete env.DEVCONTAINER_COMPOSE_OVERLAY;
+    }
+    claimLifecycleEffect();
+    const result = (0, import_node_child_process17.spawnSync)("devpod", args, {
+      stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
+      env
+    });
     if (result.status !== 0) {
-      throw new Error(`Could not stop managed process '${options.name}'.`);
+      resetWorkspaceRuntimeCaches();
+      const message = `devpod up failed for '${devpodId ?? options.repoPath}'.`;
+      if (options.devcontainerPath) throw new DevpodStartPostconditionError(message);
+      throw new Error(message);
     }
-    return "stopped";
-  }
-  try {
-    const parsed = JSON.parse(result.stdout.trim());
-    if (parsed.status === "running" || parsed.status === "stopped" || parsed.status === "foreign" || parsed.status === "drifted") {
-      return parsed.status;
+    try {
+      const attached = listDevpodWorkspaces(options.repoPath);
+      devpodId ??= selectDevpodWorkspace(attached, options.repoPath)?.id;
+      if (!devpodId) {
+        throw new Error(`DevPod did not attach '${options.repoPath}' after startup.`);
+      }
+      const ownership = inspectDevpodWorkspaceOwnership(attached, devpodId, options.repoPath);
+      if (ownership.status === "conflict") throw new Error(ownership.reason);
+      if (ownership.status !== "owned") {
+        throw new Error(
+          `DevPod did not attach '${options.repoPath}' as '${devpodId}' after startup.`
+        );
+      }
+      resetWorkspaceRuntimeCaches();
+      return devpodId;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new DevpodStartPostconditionError(message);
     }
-  } catch {
-  }
-  return "drifted";
+  });
 }
 
-// src/core/managed-runtime-status.ts
-var EMPTY_RESOURCES = {
-  apps: [],
-  services: [],
-  processes: []
-};
-function sortedUnique(values) {
-  return Array.from(new Set(values)).sort((left, right) => left.localeCompare(right));
-}
-function selectedResources(values, allValues, hasResolvedProfile) {
-  if (values === void 0) return hasResolvedProfile ? [] : sortedUnique(allValues);
-  return values.length === 1 && values[0] === "*" ? sortedUnique(allValues) : sortedUnique(values);
-}
-function containerResourceStatus(container) {
-  if (!container) return "missing";
-  if (!container.state.Running) return "stopped";
-  const health = container.state.Health?.Status;
-  if (health === "starting") return "starting";
-  if (health === "unhealthy") return "unhealthy";
-  return "healthy";
-}
-function isActiveResourceStatus(status) {
-  return status === "running" || status === "healthy" || status === "starting" || status === "unhealthy";
-}
-function isReadyResourceStatus(status) {
-  return status === "running" || status === "healthy";
-}
-function isStoppedOrMissingResourceStatus(status) {
-  return status === "stopped" || status === "missing";
-}
-function exactRoutes(repoPath, workspace) {
-  try {
-    const routes = listHostRouteState().filter(
-      (route) => sameWorkspacePath(route.repoPath, repoPath) && route.workspace === workspace
-    );
-    return { apps: sortedUnique(routes.map((route) => route.name)), drift: [] };
-  } catch {
-    return { apps: [], drift: ["managed route state could not be inspected"] };
-  }
+// src/core/http-route-probe.ts
+var import_node_child_process18 = require("child_process");
+var DEFAULT_MAX_TIME_SECONDS = 5;
+var PARENT_TIMEOUT_PADDING_MS = 250;
+var CONTRACT_MAX_BUFFER = 1024;
+var MIME_TOKEN_RE2 = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+function httpRouteUrl(host) {
+  return `${isTLSEnabled() ? "https" : "http"}://${host}`;
 }
-function compareResourceSet(label, expected, actual) {
-  if (expected.length !== actual.length || expected.some((value, index) => value !== actual[index])) {
-    return `active ${label} differ from the selected profile`;
+function probeHttpRoute(host, options = {}) {
+  const maxTimeSeconds = options.maxTimeSeconds ?? DEFAULT_MAX_TIME_SECONDS;
+  if (!Number.isFinite(maxTimeSeconds) || maxTimeSeconds <= 0) {
+    throw new Error("maxTimeSeconds must be a positive finite number.");
   }
-  return void 0;
-}
-function resourceStatusesForMissing(names, status) {
-  return Object.fromEntries(names.map((name) => [name, status]));
-}
-function inspectManagedRuntime(options) {
-  const {
-    repoPath,
-    config,
-    registeredServices,
-    registeredProcesses,
-    desiredServices,
-    desiredProcesses,
-    workspace,
-    state
-  } = options;
-  const drift = [];
-  const baseServices = sortedUnique(config.managedRuntime?.devcontainer.baseServices ?? []);
-  const serviceStatuses = resourceStatusesForMissing(registeredServices, "missing");
-  const baseStatuses = resourceStatusesForMissing(baseServices, "missing");
-  const processStatuses = resourceStatusesForMissing(registeredProcesses, "missing");
-  const activeServices = [];
-  const activeProcesses = [];
-  let plan;
-  try {
-    plan = inspectManagedDevcontainerConfig({
-      repoPath,
-      config,
-      profile: {
-        apps: ["*"],
-        devcontainerServices: desiredServices,
-        processes: ["*"]
-      },
-      linked: workspace !== void 0
-    });
-  } catch {
-    drift.push("managed Dev Container configuration could not be inspected");
-    return {
-      plan,
-      primaryReady: false,
-      primaryActive: false,
-      baseStatuses,
-      serviceStatuses,
-      processStatuses,
-      activeServices,
-      activeProcesses,
-      drift
-    };
+  if (options.readiness !== void 0) {
+    return probeHttpReadinessSync(host, options.readiness, maxTimeSeconds, options.repoPath);
   }
-  let containers;
-  try {
-    containers = inspectWorkspaceContainers();
-  } catch {
-    drift.push("managed workspace containers could not be inspected");
-    return {
-      plan,
-      primaryReady: false,
-      primaryActive: false,
-      baseStatuses,
-      serviceStatuses,
-      processStatuses,
-      activeServices,
-      activeProcesses,
-      drift
-    };
+  const tlsEnabled = isTLSEnabled();
+  const url = `${tlsEnabled ? "https" : "http"}://${host}`;
+  const args = [
+    "--silent",
+    "--show-error",
+    "--output",
+    "/dev/null",
+    "--write-out",
+    "%{http_code}",
+    "--max-time",
+    String(maxTimeSeconds)
+  ];
+  if (tlsEnabled) {
+    getMkcertRootCAPath({ repoPath: options.repoPath });
+    args.push("--cacert", CERT_FILE);
   }
-  if (!plan) {
-    drift.push("managed Dev Container configuration could not be inspected");
-    return {
-      plan,
-      primaryReady: false,
-      primaryActive: false,
-      baseStatuses,
-      serviceStatuses,
-      processStatuses,
-      activeServices,
-      activeProcesses,
-      drift
-    };
+  args.push(url);
+  const result = (0, import_node_child_process18.spawnSync)("curl", args, { encoding: "utf-8" });
+  const stdout = result.stdout?.trim() ?? "";
+  const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
+  const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
+  const details = ok ? `HTTP ${status}` : [status === void 0 ? void 0 : `HTTP ${status}`, result.stderr?.trim()].filter(Boolean).join(": ") || `curl exited with status ${result.status ?? "unknown"}`;
+  return { ok, status, details };
+}
+function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
+  const parentTimeoutMs = maxTimeSeconds * 1e3 + PARENT_TIMEOUT_PADDING_MS;
+  if (!Number.isFinite(parentTimeoutMs)) {
+    throw new Error("maxTimeSeconds is too large for a bounded probe timeout.");
   }
-  const resolvedPlan = plan;
-  let generatedConfigSha256;
-  let generatedConfigMissing = false;
+  const tlsEnabled = isTLSEnabled();
+  const args = buildHttpReadinessCurlArgs(host, readiness, maxTimeSeconds, tlsEnabled);
+  if (tlsEnabled) {
+    getMkcertRootCAPath({ repoPath });
+  }
+  let result;
   try {
-    const generated = inspectManagedDevcontainerGeneratedConfig(resolvedPlan);
-    generatedConfigSha256 = generated.sha256;
-    if (generated.status === "missing") {
-      generatedConfigMissing = true;
-    } else if (generated.status === "foreign") {
-      drift.push("managed generated Dev Container configuration is not devrouter-owned");
-    } else if (generated.status === "drifted") {
-      drift.push("managed generated Dev Container configuration changed");
-    }
+    result = (0, import_node_child_process18.spawnSync)("curl", args, {
+      encoding: "utf-8",
+      maxBuffer: CONTRACT_MAX_BUFFER,
+      timeout: Math.ceil(parentTimeoutMs)
+    });
   } catch {
-    drift.push("managed generated Dev Container configuration could not be inspected");
-  }
-  const appContainers = workspaceAppContainers(containers, repoPath).filter(
-    (container) => hasExactComposeIdentity(container, {
-      repoPath,
-      service: resolvedPlan.primaryService,
-      composeFiles: resolvedPlan.composeFiles
-    })
-  );
-  const projectScopedPrimary = state?.composeProject ? appContainers.filter(
-    (container) => container.labels["com.docker.compose.project"] === state.composeProject
-  ) : appContainers;
-  let primary;
-  let composeProject = state?.composeProject;
-  if (projectScopedPrimary.length === 1) {
-    primary = projectScopedPrimary[0];
-    composeProject = primary.labels["com.docker.compose.project"] ?? composeProject;
-  } else if (projectScopedPrimary.length > 1) {
-    drift.push("managed primary container identity is ambiguous");
-  } else if (appContainers.length > 0) {
-    drift.push(
-      state?.composeProject ? "managed primary container is foreign" : "managed primary container identity is ambiguous"
-    );
+    return transportFailure();
   }
-  if (!composeProject && appContainers.length === 1) {
-    composeProject = appContainers[0].labels["com.docker.compose.project"];
+  if (result.status !== 0 || result.error) {
+    return transportFailure();
   }
-  if (primary && !composeProject) {
-    drift.push("managed primary container has no Compose project identity");
+  const metadata = typeof result.stdout === "string" ? result.stdout : "";
+  return parseHttpReadinessMetadata(metadata, readiness);
+}
+function buildHttpReadinessCurlArgs(host, readiness, maxTimeSeconds, tlsEnabled) {
+  const url = `${tlsEnabled ? "https" : "http"}://${host}${readiness.path}`;
+  const args = [
+    "--disable",
+    "--globoff",
+    "--silent",
+    "--show-error",
+    "--no-location",
+    "--noproxy",
+    "*",
+    "--output",
+    "/dev/null",
+    "--write-out",
+    "%{http_code}	%{content_type}",
+    "--max-time",
+    String(maxTimeSeconds)
+  ];
+  if (tlsEnabled) args.push("--cacert", CERT_FILE);
+  args.push(url);
+  return args;
+}
+function parseHttpReadinessMetadata(metadata, readiness) {
+  if (metadata.length > CONTRACT_MAX_BUFFER) {
+    return transportFailure();
   }
-  const exactService = (service) => containers.filter(
-    (container) => hasExactComposeIdentity(container, {
-      repoPath,
-      service,
-      composeProject,
-      composeFiles: resolvedPlan.composeFiles
-    })
-  );
-  const unscopedService = (service) => containers.filter(
-    (container) => hasExactComposeIdentity(container, {
-      repoPath,
-      service,
-      composeFiles: resolvedPlan.composeFiles
-    })
-  );
-  const inspectService = (service, statuses) => {
-    const exact = exactService(service);
-    if (exact.length > 1) {
-      statuses[service] = "drifted";
-      drift.push(`managed service '${service}' identity is ambiguous`);
-      return;
-    }
-    if (exact.length === 0) {
-      const foreign = unscopedService(service);
-      statuses[service] = foreign.length > 0 ? "foreign" : "missing";
-      if (foreign.length > 0) drift.push(`managed service '${service}' is foreign`);
-      return;
-    }
-    const status = containerResourceStatus(exact[0]);
-    statuses[service] = status;
-    if (isActiveResourceStatus(status)) {
-      if (statuses === serviceStatuses) activeServices.push(service);
-    }
-  };
-  for (const service of registeredServices) inspectService(service, serviceStatuses);
-  for (const service of baseServices) inspectService(service, baseStatuses);
-  const managedServicesActive = activeServices.length > 0 || Object.values(baseStatuses).some(isActiveResourceStatus);
-  const primaryWorkspacePath = primary?.mounts.find(
-    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
-  )?.Destination;
-  const primaryActive = Boolean(primary?.state.Running);
-  if (generatedConfigMissing && (state || primaryActive || managedServicesActive)) {
-    drift.push("managed generated Dev Container configuration is missing");
+  const match = /^(\d{3})\t([^\r\n]*)$/.exec(metadata);
+  if (!match) {
+    return transportFailure();
   }
-  const primaryHealth = primary?.state.Health?.Status;
-  const primaryReady = primaryActive && primaryHealth !== "starting" && primaryHealth !== "unhealthy";
-  if (!primary) {
-    if (managedServicesActive) {
-      drift.push("managed primary container is missing");
-    }
-  } else if (!primaryActive) {
-    if (managedServicesActive) {
-      drift.push("managed primary container is stopped");
-    }
-  } else if (primaryHealth === "unhealthy") {
-    drift.push("managed primary container is unhealthy");
+  const status = Number(match[1]);
+  if (status < 100 || status > 599) {
+    return transportFailure();
   }
-  if (primary && primaryActive && primaryWorkspacePath) {
-    for (const process2 of registeredProcesses) {
-      let status;
-      try {
-        status = runManagedProcessAction({
-          container: { id: primary.id, workspacePath: primaryWorkspacePath },
-          name: process2,
-          action: "status",
-          quiet: true
-        });
-      } catch {
-        status = "drifted";
-      }
-      processStatuses[process2] = status;
-      if (status === "running") activeProcesses.push(process2);
-      if (desiredProcesses.includes(process2) && status !== "running") {
-        drift.push(`managed process '${process2}' is not running`);
-      }
-    }
-  } else {
-    if (primary && !primaryActive) {
-      for (const process2 of registeredProcesses) processStatuses[process2] = "stopped";
-    }
-    if (desiredProcesses.length > 0 && (primaryActive || managedServicesActive)) {
-      drift.push("managed processes cannot be proven without the primary container");
-    }
+  const statuses = readiness.statuses ?? [200];
+  const statusAllowed = statuses.includes(status);
+  const mediaFailure = readiness.contentType ? contentTypeFailure(match[2], readiness.contentType) : void 0;
+  if (statusAllowed && mediaFailure === void 0) {
+    return { ok: true, status, details: `HTTP ${status}` };
   }
-  for (const service of desiredServices) {
-    const status = serviceStatuses[service] ?? "missing";
-    if (!isReadyResourceStatus(status) && status !== "starting" && (primaryActive || managedServicesActive)) {
-      drift.push(`managed service '${service}' is not ready`);
-    }
+  const reasons = [
+    ...statusAllowed ? [] : ["status not allowed"],
+    ...mediaFailure ? [mediaFailure] : []
+  ];
+  return {
+    ok: false,
+    status,
+    details: `HTTP ${status}; ${reasons.join("; ")}`,
+    classification: "application-contract"
+  };
+}
+function contentTypeFailure(responseContentType, expectedContentType) {
+  const normalized = responseContentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+  if (normalized.length === 0) {
+    return "content type missing";
   }
-  for (const service of baseServices) {
-    const status = baseStatuses[service] ?? "missing";
-    if (!isReadyResourceStatus(status) && status !== "starting" && (primaryActive || managedServicesActive)) {
-      drift.push(`managed base service '${service}' is not ready`);
-    }
+  const separator = normalized.indexOf("/");
+  if (separator <= 0 || separator === normalized.length - 1 || normalized.indexOf("/", separator + 1) !== -1 || !MIME_TOKEN_RE2.test(normalized.slice(0, separator)) || !MIME_TOKEN_RE2.test(normalized.slice(separator + 1))) {
+    return "content type invalid";
   }
+  return normalized === expectedContentType.toLowerCase() ? void 0 : "content type mismatch";
+}
+function transportFailure() {
   return {
-    plan,
-    generatedConfigSha256,
-    composeProject,
-    primaryReady,
-    primaryActive,
-    baseStatuses,
-    serviceStatuses,
-    processStatuses,
-    activeServices: sortedUnique(activeServices),
-    activeProcesses: sortedUnique(activeProcesses),
-    drift
+    ok: false,
+    details: "HTTP route probe transport failure",
+    classification: "transport"
   };
 }
-function collectManagedRuntimeStatus(options) {
-  if (!options.config.managedRuntime) {
-    return {
-      mode: "legacy",
-      status: "legacy",
-      profile: options.profile,
-      desired: { ...EMPTY_RESOURCES },
-      active: { ...EMPTY_RESOURCES },
-      serviceStatuses: {},
-      baseServiceStatuses: {},
-      processStatuses: {},
-      drift: []
-    };
-  }
-  const managedRuntime = options.config.managedRuntime;
-  const hasResolvedProfile = options.resolvedProfile !== void 0;
-  const routedApps = options.config.apps.filter((app) => app.kind !== "dependency").map((app) => app.name);
-  const registeredServices = sortedUnique(managedRuntime.devcontainer.profileServices);
-  const registeredProcesses = sortedUnique(managedRuntime.processes);
-  const desiredApps = selectedResources(
-    options.resolvedProfile?.apps,
-    routedApps,
-    hasResolvedProfile
-  );
-  const desiredServices = selectedResources(
-    options.resolvedProfile?.devcontainerServices,
-    registeredServices,
-    hasResolvedProfile
-  );
-  const desiredProcesses = selectedResources(
-    options.resolvedProfile?.processes,
-    registeredProcesses,
-    hasResolvedProfile
-  );
-  let state;
-  let stateReadFailed = false;
+
+// src/core/managed-host-preparation.ts
+var import_node_child_process19 = require("child_process");
+var import_node_fs21 = __toESM(require("fs"));
+var PREPARATION_TIMEOUT_MS = 6e4;
+var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
+var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
+var START_ERROR = "Managed host preparation could not start.";
+var FAILURE_ERROR = "Managed host preparation failed.";
+var TIMEOUT_ERROR = "Managed host preparation timed out after 60 seconds.";
+function runPreparationCommand(argv, cwd) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = (0, import_node_child_process19.spawn)(argv[0], argv.slice(1), {
+        cwd,
+        detached: true,
+        shell: false,
+        stdio: "ignore"
+      });
+    } catch {
+      resolve("start-error");
+      return;
+    }
+    let timedOut = false;
+    const deadline = setTimeout(() => {
+      timedOut = true;
+      if (child.pid !== void 0 && child.exitCode === null && child.signalCode === null) {
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch {
+        }
+      }
+    }, PREPARATION_TIMEOUT_MS);
+    child.once("error", () => {
+      clearTimeout(deadline);
+      resolve("start-error");
+    });
+    child.once("close", (code) => {
+      clearTimeout(deadline);
+      resolve(timedOut ? "timeout" : code === 0 ? "success" : "failure");
+    });
+  });
+}
+function readConfigBytes(configPath) {
   try {
-    state = options.candidateState ?? readManagedRuntimeState(options.repoPath, options.workspace);
+    return import_node_fs21.default.readFileSync(configPath);
   } catch {
-    stateReadFailed = true;
+    return void 0;
   }
-  const drift = [];
-  if (stateReadFailed) drift.push("managed runtime state could not be read");
-  if (state?.status === "degraded") drift.push("the last managed transition is degraded");
-  if (state) {
-    const desiredState = {
-      apps: sortedUnique(state.desired.apps),
-      services: sortedUnique(state.desired.services),
-      processes: sortedUnique(state.desired.processes)
-    };
-    const desired = {
-      apps: desiredApps,
-      services: desiredServices,
-      processes: desiredProcesses
-    };
-    for (const [label, expected, actual] of [
-      ["apps", desired.apps, desiredState.apps],
-      ["services", desired.services, desiredState.services],
-      ["processes", desired.processes, desiredState.processes]
-    ]) {
-      const mismatch = compareResourceSet(label, expected, actual);
-      if (mismatch) drift.push(mismatch);
-    }
-    if (state.profile !== options.profile)
-      drift.push("active profile differs from the selected profile");
+}
+async function runManagedHostPreparation(repoPath, config) {
+  const prepareCommand = config.managedRuntime?.devcontainer.prepareCommand;
+  if (!prepareCommand) return;
+  if (process.platform === "win32") {
+    throw new Error("Managed host preparation requires POSIX process-group ownership.");
   }
-  const inspection = inspectManagedRuntime({
-    repoPath: options.repoPath,
-    config: options.config,
-    registeredServices,
-    registeredProcesses,
-    desiredServices,
-    desiredProcesses,
-    workspace: options.workspace,
-    state
-  });
-  drift.push(...inspection.drift);
-  if (state && inspection.plan && state.sourceConfigSha256 !== inspection.plan.sourceConfigSha256) {
-    drift.push("managed Dev Container source configuration changed");
+  const resolvedRepoPath = resolveRepoPath(repoPath);
+  const configPath = getRepoConfigPath(resolvedRepoPath);
+  const before = readConfigBytes(configPath);
+  if (!before) {
+    throw new Error(CONFIG_READ_ERROR);
   }
-  if (state && inspection.plan && state.effectiveConfigSha256 !== inspection.plan.effectiveConfigSha256) {
-    drift.push("managed Dev Container effective configuration changed");
+  const result = await runPreparationCommand(prepareCommand, resolvedRepoPath);
+  const after = readConfigBytes(configPath);
+  if (!after?.equals(before)) {
+    throw new Error(CONFIG_CHANGED_ERROR);
   }
-  if (state && inspection.generatedConfigSha256 && state.effectiveConfigSha256 !== inspection.generatedConfigSha256) {
-    drift.push("managed generated Dev Container configuration differs from last successful state");
+  if (result === "start-error") {
+    throw new Error(START_ERROR);
   }
-  const routes = exactRoutes(options.repoPath, options.workspace);
-  drift.push(...routes.drift);
-  const activeApps = routes.apps;
-  const anyActive = inspection.primaryActive || inspection.activeServices.length > 0 || Object.values(inspection.baseStatuses).some(isActiveResourceStatus) || inspection.activeProcesses.length > 0 || activeApps.length > 0;
-  if (activeApps.length > 0 && !inspection.primaryActive) {
-    drift.push("active app routes exist without a running primary container");
+  if (result === "timeout") {
+    throw new Error(TIMEOUT_ERROR);
   }
-  if (desiredApps.some((app) => !activeApps.includes(app)) && anyActive) {
-    drift.push("one or more selected app routes are missing");
+  if (result === "failure") {
+    throw new Error(FAILURE_ERROR);
   }
-  if (activeApps.some((app) => !desiredApps.includes(app))) {
-    drift.push("one or more active app routes are outside the selected profile");
+}
+
+// src/core/managed-post-start.ts
+var import_node_child_process20 = require("child_process");
+var import_node_crypto10 = require("crypto");
+var import_node_fs22 = __toESM(require("fs"));
+var import_node_path26 = __toESM(require("path"));
+var MANAGED_MARKER = "devrouter:managed devcontainer";
+var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
+var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
+var ADAPTER_WRAPPER = `adapter_snapshot="$1"
+shift
+readonly DEVROUTER_PROCESS_HELPER DEVROUTER_PROCESS_ADAPTER_SHA256
+source "$adapter_snapshot"
+`;
+function renderDeliveryScript(targetPath) {
+  if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
+    throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  if (inspection.activeServices.some((service) => !desiredServices.includes(service))) {
-    drift.push("one or more active services are outside the selected profile");
+  const temporaryPrefix = import_node_path26.default.posix.basename(targetPath);
+  return `set -eu
+umask 077
+runtime_root=/tmp/devrouter
+runtime_bin="$runtime_root/bin"
+target="${targetPath}"
+if [ -L "$runtime_root" ] || [ -L "$runtime_bin" ]; then
+  echo "Refusing symlinked devrouter runtime path." >&2
+  exit 1
+fi
+mkdir -p "$runtime_bin"
+chmod 700 "$runtime_root" "$runtime_bin"
+temporary="$(mktemp "$runtime_bin/.${temporaryPrefix}.XXXXXX")"
+trap 'rm -f "$temporary"' EXIT
+cat > "$temporary"
+chmod 700 "$temporary"
+mv -f "$temporary" "$target"
+trap - EXIT
+`;
+}
+function commandFailure3(result) {
+  return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
+}
+function deliverRuntimeFile(containerId, targetPath, contents, label) {
+  const result = (0, import_node_child_process20.spawnSync)(
+    "docker",
+    ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
+    { input: contents, encoding: "utf-8" }
+  );
+  if (result.status !== 0) {
+    const details = commandFailure3(result);
+    throw new Error(`Could not deliver ${label}${details ? `: ${details}` : "."}`);
   }
-  if (inspection.activeProcesses.some((process2) => !desiredProcesses.includes(process2))) {
-    drift.push("one or more active processes are outside the selected profile");
+}
+function readRegularFileBytes(filePath) {
+  if (!import_node_fs22.default.existsSync(filePath) || !import_node_fs22.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs22.default.readFileSync(filePath);
+}
+function readRegularFile(filePath) {
+  return readRegularFileBytes(filePath)?.toString("utf-8");
+}
+function adapterFingerprint(adapter) {
+  return (0, import_node_crypto10.createHash)("sha256").update(adapter).digest("hex");
+}
+function resolveProcessHelperPath() {
+  const candidates = [
+    import_node_path26.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path26.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+  ];
+  const helperPath = candidates.find((candidate) => import_node_fs22.default.existsSync(candidate));
+  if (!helperPath) {
+    throw new Error("Could not locate the packaged devrouter-process helper.");
   }
-  const positivelyStopped = !inspection.primaryActive && Object.values(inspection.baseStatuses).every(isStoppedOrMissingResourceStatus) && Object.values(inspection.serviceStatuses).every(isStoppedOrMissingResourceStatus) && activeApps.length === 0;
-  const onlyDegradedIncident = state?.status === "degraded" && drift.length === 1;
-  const requiredServicesReady = desiredServices.every(
-    (service) => isReadyResourceStatus(inspection.serviceStatuses[service] ?? "missing")
+  return helperPath;
+}
+function resolveManagedPostStartPlan(repoPath) {
+  const adapterPath = import_node_path26.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterBytes = readRegularFileBytes(adapterPath);
+  const adapterText = adapterBytes?.toString("utf-8");
+  const dockerfilePath = import_node_path26.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path26.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfile = readRegularFile(dockerfilePath) ?? "";
+  const devcontainer = readRegularFile(devcontainerPath) ?? "";
+  const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
+    (value) => value.includes("DEVROUTER_PROCESS_HELPER") || value.includes("devrouter-process")
   );
-  const baseServicesReady = Object.values(inspection.baseStatuses).every(isReadyResourceStatus);
-  const processesReady = desiredProcesses.every(
-    (process2) => isReadyResourceStatus(inspection.processStatuses[process2] ?? "missing")
+  if (adapterBytes === void 0) {
+    if (devrouterPattern) {
+      throw new Error(
+        "Devrouter lifecycle wiring is incomplete: add the managed post-start adapter or remove the stale devrouter-process references."
+      );
+    }
+    return { kind: "unmanaged" };
+  }
+  const adapter = adapterBytes.toString("utf-8");
+  if (!adapter.includes(MANAGED_MARKER)) {
+    if (devrouterPattern) {
+      throw new Error(
+        "Devrouter-looking post-start adapter is missing the 'devrouter:managed devcontainer' marker. Regenerate or migrate the devcontainer, then retry devrouter ensure."
+      );
+    }
+    return { kind: "unmanaged" };
+  }
+  assertManagedDevcontainerLifecycle(repoPath);
+  if (adapter.includes("DEVROUTER_PROCESS_HELPER")) {
+    return {
+      kind: "runtime",
+      adapterPath: MANAGED_ADAPTER_PATH,
+      adapterSha256: adapterFingerprint(adapterBytes),
+      adapterContents: adapterBytes
+    };
+  }
+  if (dockerfile.includes("devrouter-process") && devcontainer.includes("postStartCommand")) {
+    return { kind: "legacy" };
+  }
+  throw new Error(
+    "Managed post-start must use DEVROUTER_PROCESS_HELPER before removing the legacy image helper and postStartCommand. Regenerate or migrate the devcontainer, then retry devrouter ensure."
+  );
+}
+function runManagedPostStart(options) {
+  if (options.plan.kind !== "runtime") return;
+  const helper = import_node_fs22.default.readFileSync(resolveProcessHelperPath());
+  deliverRuntimeFile(
+    options.container.id,
+    RUNTIME_HELPER_PATH,
+    helper,
+    "the managed process helper"
+  );
+  const runtimeAdapterPath = `/tmp/devrouter/bin/managed-post-start-${options.plan.adapterSha256}`;
+  deliverRuntimeFile(
+    options.container.id,
+    runtimeAdapterPath,
+    options.plan.adapterContents,
+    "the managed post-start adapter"
+  );
+  const started2 = (0, import_node_child_process20.spawnSync)(
+    "docker",
+    [
+      "exec",
+      "--workdir",
+      options.container.workspacePath,
+      "--env",
+      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
+      "--env",
+      `DEVROUTER_PROCESS_ADAPTER_SHA256=${options.plan.adapterSha256}`,
+      ...options.profile ? ["--env", `DEVROUTER_PROFILE=${options.profile}`] : [],
+      ...options.processes ? [
+        "--env",
+        `DEVROUTER_PROCESS_SET=${options.processes.join(",")}`,
+        "--env",
+        "DEVROUTER_PROCESS_FINGERPRINT_ENV=DEVROUTER_PROFILE,DEVROUTER_PROCESS_SET"
+      ] : [],
+      options.container.id,
+      "bash",
+      "-c",
+      ADAPTER_WRAPPER,
+      options.plan.adapterPath,
+      runtimeAdapterPath
+    ],
+    { stdio: options.quiet ? ["ignore", 2, "inherit"] : "inherit" }
   );
-  const routesReady = desiredApps.every((app) => activeApps.includes(app));
-  const ready = inspection.primaryReady && requiredServicesReady && baseServicesReady && processesReady && routesReady && !stateReadFailed && !drift.length;
-  const status = positivelyStopped && onlyDegradedIncident ? "stopped" : state?.status === "degraded" ? "failed-transition" : drift.length > 0 ? "drifted" : ready ? "ready" : anyActive ? "starting" : "stopped";
-  const active = {
-    apps: activeApps,
-    services: inspection.activeServices,
-    processes: inspection.activeProcesses
-  };
-  return {
-    mode: "managed",
-    status,
-    profile: options.profile,
-    ...state?.profile ? { activeProfile: state.profile } : {},
-    ...options.workspace !== void 0 ? { workspace: options.workspace } : {},
-    ...state?.devpodId ? { devpodId: state.devpodId } : {},
-    ...inspection.composeProject ? { composeProject: inspection.composeProject } : {},
-    desired: {
-      apps: desiredApps,
-      services: desiredServices,
-      processes: desiredProcesses
-    },
-    active,
-    serviceStatuses: inspection.serviceStatuses,
-    baseServiceStatuses: inspection.baseStatuses,
-    processStatuses: inspection.processStatuses,
-    drift: sortedUnique(drift),
-    ...inspection.plan?.sourceConfigSha256 || state?.sourceConfigSha256 ? { sourceConfigSha256: inspection.plan?.sourceConfigSha256 ?? state?.sourceConfigSha256 } : {},
-    ...inspection.plan?.effectiveConfigSha256 || state?.effectiveConfigSha256 ? {
-      effectiveConfigSha256: inspection.plan?.effectiveConfigSha256 ?? state?.effectiveConfigSha256
-    } : {},
-    ...state?.transitionPhase ? { transitionPhase: state.transitionPhase } : {}
-  };
+  if (started2.status !== 0) {
+    const details = commandFailure3(started2);
+    throw new Error(`Managed post-start failed${details ? `: ${details}.` : "."}`);
+  }
 }
-
-// src/core/traefik-route-health.ts
-var import_node_child_process20 = require("child_process");
-var import_node_fs22 = __toESM(require("fs"));
-var import_node_path26 = __toESM(require("path"));
-var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-var ROUTER_RELOAD_LOCK_FILE = import_node_path26.default.join(DEVROUTER_HOME, "router-reload.lock");
-var ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
-var DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
-var DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
-var DEFAULT_POLL_INTERVAL_MS = 250;
-var ROUTER_API_PAGE_SIZE = 1e3;
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function assertSafeProcessName(name) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(name)) {
+    throw new Error(`Managed process '${name}' is not a safe exact identifier.`);
+  }
 }
-function inspectRouterApi(protocol) {
+function runManagedProcessAction(options) {
+  assertSafeProcessName(options.name);
   const result = (0, import_node_child_process20.spawnSync)(
-    "curl",
+    "docker",
     [
-      "--silent",
-      "--show-error",
-      "--fail",
-      "--max-time",
-      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
-      `${ROUTER_API_BASE}/${protocol}/routers?per_page=${ROUTER_API_PAGE_SIZE}`
+      "exec",
+      "--workdir",
+      options.container.workspacePath,
+      "--env",
+      `DEVROUTER_PROCESS_HELPER=${RUNTIME_HELPER_PATH}`,
+      options.container.id,
+      "bash",
+      "-c",
+      'exec "$DEVROUTER_PROCESS_HELPER" "$1" --name "$2"',
+      "devrouter-process",
+      options.action,
+      options.name
     ],
-    { encoding: "utf-8" }
+    {
+      encoding: "utf-8",
+      stdio: options.action === "status" ? ["ignore", "pipe", "pipe"] : ["ignore", 2, "inherit"]
+    }
   );
-  if (result.status !== 0) {
-    return {
-      ok: false,
-      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
-    };
+  if (options.action === "stop") {
+    if (result.status !== 0) {
+      throw new Error(`Could not stop managed process '${options.name}'.`);
+    }
+    return "stopped";
   }
-  let value;
   try {
-    value = JSON.parse(result.stdout);
+    const parsed = JSON.parse(result.stdout.trim());
+    if (parsed.status === "running" || parsed.status === "stopped" || parsed.status === "foreign" || parsed.status === "drifted") {
+      return parsed.status;
+    }
   } catch {
-    return { ok: false, details: `${protocol.toUpperCase()} router API returned invalid JSON` };
   }
-  if (!Array.isArray(value)) {
-    return { ok: false, details: `${protocol.toUpperCase()} router API returned a non-array` };
+  return "drifted";
+}
+
+// src/core/managed-runtime-status.ts
+var EMPTY_RESOURCES = {
+  apps: [],
+  services: [],
+  processes: []
+};
+function sortedUnique(values) {
+  return Array.from(new Set(values)).sort((left, right) => left.localeCompare(right));
+}
+function selectedResources(values, allValues, hasResolvedProfile) {
+  if (values === void 0) return hasResolvedProfile ? [] : sortedUnique(allValues);
+  return values.length === 1 && values[0] === "*" ? sortedUnique(allValues) : sortedUnique(values);
+}
+function containerResourceStatus(container) {
+  if (!container) return "missing";
+  if (!container.state.Running) return "stopped";
+  const health = container.state.Health?.Status;
+  if (health === "starting") return "starting";
+  if (health === "unhealthy") return "unhealthy";
+  return "healthy";
+}
+function isActiveResourceStatus(status) {
+  return status === "running" || status === "healthy" || status === "starting" || status === "unhealthy";
+}
+function isReadyResourceStatus(status) {
+  return status === "running" || status === "healthy";
+}
+function isStoppedOrMissingResourceStatus(status) {
+  return status === "stopped" || status === "missing";
+}
+function exactRoutes(repoPath, workspace) {
+  try {
+    const routes = listHostRouteState().filter(
+      (route) => sameWorkspacePath(route.repoPath, repoPath) && route.workspace === workspace
+    );
+    return { apps: sortedUnique(routes.map((route) => route.name)), drift: [] };
+  } catch {
+    return { apps: [], drift: ["managed route state could not be inspected"] };
   }
-  return {
-    ok: true,
-    reachedPageLimit: value.length >= ROUTER_API_PAGE_SIZE,
-    names: new Set(
-      value.flatMap((item) => {
-        if (!item || typeof item !== "object") return [];
-        const name = item.name;
-        return typeof name === "string" ? [name] : [];
-      })
-    )
-  };
 }
-function isRecord3(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+function compareResourceSet(label, expected, actual) {
+  if (expected.length !== actual.length || expected.some((value, index) => value !== actual[index])) {
+    return `active ${label} differ from the selected profile`;
+  }
+  return void 0;
 }
-function inspectNamedRouterApi(protocol, resource, name) {
-  const result = (0, import_node_child_process20.spawnSync)(
-    "curl",
-    [
-      "--silent",
-      "--show-error",
-      "--fail",
-      "--max-time",
-      ROUTER_API_REQUEST_TIMEOUT_SECONDS,
-      `${ROUTER_API_BASE}/${protocol}/${resource}/${encodeURIComponent(name)}`
-    ],
-    { encoding: "utf-8" }
-  );
-  if (result.status !== 0) {
+function resourceStatusesForMissing(names, status) {
+  return Object.fromEntries(names.map((name) => [name, status]));
+}
+function inspectManagedRuntime(options) {
+  const {
+    repoPath,
+    config,
+    registeredServices,
+    registeredProcesses,
+    desiredServices,
+    desiredProcesses,
+    workspace,
+    state
+  } = options;
+  const drift = [];
+  const baseServices = sortedUnique(config.managedRuntime?.devcontainer.baseServices ?? []);
+  const serviceStatuses = resourceStatusesForMissing(registeredServices, "missing");
+  const baseStatuses = resourceStatusesForMissing(baseServices, "missing");
+  const processStatuses = resourceStatusesForMissing(registeredProcesses, "missing");
+  const activeServices = [];
+  const activeProcesses = [];
+  let plan;
+  try {
+    plan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config,
+      profile: {
+        apps: ["*"],
+        devcontainerServices: desiredServices,
+        processes: ["*"]
+      },
+      linked: workspace !== void 0
+    });
+  } catch {
+    drift.push("managed Dev Container configuration could not be inspected");
     return {
-      ok: false,
-      details: result.stderr?.trim() || `curl exited with status ${result.status ?? "unknown"}`
+      plan,
+      primaryReady: false,
+      primaryActive: false,
+      baseStatuses,
+      serviceStatuses,
+      processStatuses,
+      activeServices,
+      activeProcesses,
+      drift
+    };
+  }
+  let containers;
+  try {
+    containers = inspectWorkspaceContainers();
+  } catch {
+    drift.push("managed workspace containers could not be inspected");
+    return {
+      plan,
+      primaryReady: false,
+      primaryActive: false,
+      baseStatuses,
+      serviceStatuses,
+      processStatuses,
+      activeServices,
+      activeProcesses,
+      drift
+    };
+  }
+  if (!plan) {
+    drift.push("managed Dev Container configuration could not be inspected");
+    return {
+      plan,
+      primaryReady: false,
+      primaryActive: false,
+      baseStatuses,
+      serviceStatuses,
+      processStatuses,
+      activeServices,
+      activeProcesses,
+      drift
     };
   }
-  let value;
+  const resolvedPlan = plan;
+  let generatedConfigSha256;
+  let generatedConfigMissing = false;
   try {
-    value = JSON.parse(result.stdout);
+    const generated = inspectManagedDevcontainerGeneratedConfig(resolvedPlan);
+    generatedConfigSha256 = generated.sha256;
+    if (generated.status === "missing") {
+      generatedConfigMissing = true;
+    } else if (generated.status === "foreign") {
+      drift.push("managed generated Dev Container configuration is not devrouter-owned");
+    } else if (generated.status === "drifted") {
+      drift.push("managed generated Dev Container configuration changed");
+    }
   } catch {
-    return {
-      ok: false,
-      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned invalid JSON`
-    };
+    drift.push("managed generated Dev Container configuration could not be inspected");
   }
-  if (!isRecord3(value)) {
-    return {
-      ok: false,
-      details: `${protocol.toUpperCase()} ${resource.slice(0, -1)} API returned a non-object`
-    };
+  const appContainers = workspaceAppContainers(containers, repoPath).filter(
+    (container) => hasExactComposeIdentity(container, {
+      repoPath,
+      service: resolvedPlan.primaryService,
+      composeFiles: resolvedPlan.composeFiles
+    })
+  );
+  const projectScopedPrimary = state?.composeProject ? appContainers.filter(
+    (container) => container.labels["com.docker.compose.project"] === state.composeProject
+  ) : appContainers;
+  let primary;
+  let composeProject = state?.composeProject;
+  if (projectScopedPrimary.length === 1) {
+    primary = projectScopedPrimary[0];
+    composeProject = primary.labels["com.docker.compose.project"] ?? composeProject;
+  } else if (projectScopedPrimary.length > 1) {
+    drift.push("managed primary container identity is ambiguous");
+  } else if (appContainers.length > 0) {
+    drift.push(
+      state?.composeProject ? "managed primary container is foreign" : "managed primary container identity is ambiguous"
+    );
   }
-  return { ok: true, value };
-}
-function renderExpectedRoute(route) {
-  const protocol = route.protocol ?? "http";
-  const routerName = buildHostRouteRouterName(route.repoPath, route.name);
-  const routeState = {
-    id: buildHostRouteId(route.repoPath, route.name),
-    name: route.name,
-    host: route.host,
-    protocol,
-    tcpProtocol: route.tcpProtocol,
-    repoPath: route.repoPath,
-    port: route.port,
-    mode: route.mode,
-    upstreamHost: route.upstreamHost,
-    pid: route.pid,
-    command: route.command,
-    workspace: route.workspace,
-    createdAt: "",
-    updatedAt: ""
+  if (!composeProject && appContainers.length === 1) {
+    composeProject = appContainers[0].labels["com.docker.compose.project"];
+  }
+  if (primary && !composeProject) {
+    drift.push("managed primary container has no Compose project identity");
+  }
+  const exactService = (service) => containers.filter(
+    (container) => hasExactComposeIdentity(container, {
+      repoPath,
+      service,
+      composeProject,
+      composeFiles: resolvedPlan.composeFiles
+    })
+  );
+  const unscopedService = (service) => containers.filter(
+    (container) => hasExactComposeIdentity(container, {
+      repoPath,
+      service,
+      composeFiles: resolvedPlan.composeFiles
+    })
+  );
+  const inspectService = (service, statuses) => {
+    const exact = exactService(service);
+    if (exact.length > 1) {
+      statuses[service] = "drifted";
+      drift.push(`managed service '${service}' identity is ambiguous`);
+      return;
+    }
+    if (exact.length === 0) {
+      const foreign = unscopedService(service);
+      statuses[service] = foreign.length > 0 ? "foreign" : "missing";
+      if (foreign.length > 0) drift.push(`managed service '${service}' is foreign`);
+      return;
+    }
+    const status = containerResourceStatus(exact[0]);
+    statuses[service] = status;
+    if (isActiveResourceStatus(status)) {
+      if (statuses === serviceStatuses) activeServices.push(service);
+    }
   };
-  const document = buildHostRoutesDocument([routeState], false);
-  const protocolDocument = document[protocol];
-  if (!isRecord3(protocolDocument)) return void 0;
-  const routers = protocolDocument.routers;
-  const services = protocolDocument.services;
-  if (!isRecord3(routers) || !isRecord3(services)) return void 0;
-  const routerKey = routerName.slice(0, routerName.lastIndexOf("@"));
-  const router = routers[routerKey];
-  const service = services[routerKey];
-  if (!isRecord3(router) || !isRecord3(service)) return void 0;
-  const rule = router.rule;
-  const serviceReference = router.service;
-  const loadBalancer = service.loadBalancer;
-  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
-  if (typeof rule !== "string" || serviceReference !== routerKey || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(servers[0])) {
-    return void 0;
+  for (const service of registeredServices) inspectService(service, serviceStatuses);
+  for (const service of baseServices) inspectService(service, baseStatuses);
+  const managedServicesActive = activeServices.length > 0 || Object.values(baseStatuses).some(isActiveResourceStatus);
+  const primaryWorkspacePath = primary?.mounts.find(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  )?.Destination;
+  const primaryActive = Boolean(primary?.state.Running);
+  if (generatedConfigMissing && (state || primaryActive || managedServicesActive)) {
+    drift.push("managed generated Dev Container configuration is missing");
+  }
+  const primaryHealth = primary?.state.Health?.Status;
+  const primaryReady = primaryActive && primaryHealth !== "starting" && primaryHealth !== "unhealthy";
+  if (!primary) {
+    if (managedServicesActive) {
+      drift.push("managed primary container is missing");
+    }
+  } else if (!primaryActive) {
+    if (managedServicesActive) {
+      drift.push("managed primary container is stopped");
+    }
+  } else if (primaryHealth === "unhealthy") {
+    drift.push("managed primary container is unhealthy");
+  }
+  if (primary && primaryActive && primaryWorkspacePath) {
+    for (const process2 of registeredProcesses) {
+      let status;
+      try {
+        status = runManagedProcessAction({
+          container: { id: primary.id, workspacePath: primaryWorkspacePath },
+          name: process2,
+          action: "status",
+          quiet: true
+        });
+      } catch {
+        status = "drifted";
+      }
+      processStatuses[process2] = status;
+      if (status === "running") activeProcesses.push(process2);
+      if (desiredProcesses.includes(process2) && status !== "running") {
+        drift.push(`managed process '${process2}' is not running`);
+      }
+    }
+  } else {
+    if (primary && !primaryActive) {
+      for (const process2 of registeredProcesses) processStatuses[process2] = "stopped";
+    }
+    if (desiredProcesses.length > 0 && (primaryActive || managedServicesActive)) {
+      drift.push("managed processes cannot be proven without the primary container");
+    }
+  }
+  for (const service of desiredServices) {
+    const status = serviceStatuses[service] ?? "missing";
+    if (!isReadyResourceStatus(status) && status !== "starting" && (primaryActive || managedServicesActive)) {
+      drift.push(`managed service '${service}' is not ready`);
+    }
+  }
+  for (const service of baseServices) {
+    const status = baseStatuses[service] ?? "missing";
+    if (!isReadyResourceStatus(status) && status !== "starting" && (primaryActive || managedServicesActive)) {
+      drift.push(`managed base service '${service}' is not ready`);
+    }
   }
-  const serverField = protocol === "http" ? "url" : "address";
-  const server = servers[0][serverField];
-  if (typeof server !== "string") return void 0;
-  const provider = routerName.slice(routerName.lastIndexOf("@")).trim();
-  if (!provider.startsWith("@")) return void 0;
   return {
-    protocol,
-    routerName,
-    serviceKey: routerKey,
-    serviceName: `${routerKey}${provider}`,
-    rule,
-    serverField,
-    server
+    plan,
+    generatedConfigSha256,
+    composeProject,
+    primaryReady,
+    primaryActive,
+    baseStatuses,
+    serviceStatuses,
+    processStatuses,
+    activeServices: sortedUnique(activeServices),
+    activeProcesses: sortedUnique(activeProcesses),
+    drift
   };
 }
-function inspectExpectedRouteMatch(route) {
-  const expected = renderExpectedRoute(route);
-  const routeName = buildHostRouteRouterName(route.repoPath, route.name);
-  if (!expected) {
+function collectManagedRuntimeStatus(options) {
+  if (!options.config.managedRuntime) {
     return {
-      ok: false,
-      routes: [routeName],
-      details: "host-route renderer returned an incomplete route configuration"
+      mode: "legacy",
+      status: "legacy",
+      profile: options.profile,
+      desired: { ...EMPTY_RESOURCES },
+      active: { ...EMPTY_RESOURCES },
+      serviceStatuses: {},
+      baseServiceStatuses: {},
+      processStatuses: {},
+      drift: []
+    };
+  }
+  const managedRuntime = options.config.managedRuntime;
+  const hasResolvedProfile = options.resolvedProfile !== void 0;
+  const routedApps = options.config.apps.filter((app) => app.kind !== "dependency").map((app) => app.name);
+  const registeredServices = sortedUnique(managedRuntime.devcontainer.profileServices);
+  const registeredProcesses = sortedUnique(managedRuntime.processes);
+  const desiredApps = selectedResources(
+    options.resolvedProfile?.apps,
+    routedApps,
+    hasResolvedProfile
+  );
+  const desiredServices = selectedResources(
+    options.resolvedProfile?.devcontainerServices,
+    registeredServices,
+    hasResolvedProfile
+  );
+  const desiredProcesses = selectedResources(
+    options.resolvedProfile?.processes,
+    registeredProcesses,
+    hasResolvedProfile
+  );
+  let state;
+  let stateReadFailed = false;
+  try {
+    state = options.candidateState ?? readManagedRuntimeState(options.repoPath, options.workspace);
+  } catch {
+    stateReadFailed = true;
+  }
+  const drift = [];
+  if (stateReadFailed) drift.push("managed runtime state could not be read");
+  if (state?.status === "degraded") drift.push("the last managed transition is degraded");
+  if (state) {
+    const desiredState = {
+      apps: sortedUnique(state.desired.apps),
+      services: sortedUnique(state.desired.services),
+      processes: sortedUnique(state.desired.processes)
+    };
+    const desired = {
+      apps: desiredApps,
+      services: desiredServices,
+      processes: desiredProcesses
     };
+    for (const [label, expected, actual] of [
+      ["apps", desired.apps, desiredState.apps],
+      ["services", desired.services, desiredState.services],
+      ["processes", desired.processes, desiredState.processes]
+    ]) {
+      const mismatch = compareResourceSet(label, expected, actual);
+      if (mismatch) drift.push(mismatch);
+    }
+    if (state.profile !== options.profile)
+      drift.push("active profile differs from the selected profile");
   }
-  const routerResult = inspectNamedRouterApi(expected.protocol, "routers", expected.routerName);
-  if (!routerResult.ok) {
-    return { ok: false, routes: [routeName], details: routerResult.details };
+  const inspection = inspectManagedRuntime({
+    repoPath: options.repoPath,
+    config: options.config,
+    registeredServices,
+    registeredProcesses,
+    desiredServices,
+    desiredProcesses,
+    workspace: options.workspace,
+    state
+  });
+  drift.push(...inspection.drift);
+  if (state && inspection.plan && state.sourceConfigSha256 !== inspection.plan.sourceConfigSha256) {
+    drift.push("managed Dev Container source configuration changed");
   }
-  if (routerResult.value.status !== "enabled" || routerResult.value.name !== expected.routerName || routerResult.value.rule !== expected.rule || routerResult.value.service !== expected.serviceKey && routerResult.value.service !== expected.serviceName) {
-    return {
-      ok: false,
-      routes: [routeName],
-      details: "active Traefik router does not match the rendered route"
-    };
+  if (state && inspection.plan && state.effectiveConfigSha256 !== inspection.plan.effectiveConfigSha256) {
+    drift.push("managed Dev Container effective configuration changed");
   }
-  const serviceResult = inspectNamedRouterApi(expected.protocol, "services", expected.serviceName);
-  if (!serviceResult.ok) {
-    return { ok: false, routes: [routeName], details: serviceResult.details };
+  if (state && inspection.generatedConfigSha256 && state.effectiveConfigSha256 !== inspection.generatedConfigSha256) {
+    drift.push("managed generated Dev Container configuration differs from last successful state");
   }
-  const loadBalancer = serviceResult.value.loadBalancer;
-  const servers = isRecord3(loadBalancer) ? loadBalancer.servers : void 0;
-  const server = Array.isArray(servers) && servers.length === 1 ? servers[0] : void 0;
-  if (serviceResult.value.status !== "enabled" || serviceResult.value.name !== expected.serviceName || !isRecord3(loadBalancer) || !Array.isArray(servers) || servers.length !== 1 || !isRecord3(server) || server[expected.serverField] !== expected.server) {
-    return {
-      ok: false,
-      routes: [routeName],
-      details: "active Traefik service does not match the rendered route"
-    };
+  const routes = exactRoutes(options.repoPath, options.workspace);
+  drift.push(...routes.drift);
+  const activeApps = routes.apps;
+  const anyActive = inspection.primaryActive || inspection.activeServices.length > 0 || Object.values(inspection.baseStatuses).some(isActiveResourceStatus) || inspection.activeProcesses.length > 0 || activeApps.length > 0;
+  if (activeApps.length > 0 && !inspection.primaryActive) {
+    drift.push("active app routes exist without a running primary container");
   }
-  return { ok: true };
-}
-function inspectExpectedRouteMatches(routes) {
-  const mismatched = [];
-  const failures = [];
-  for (const route of routes) {
-    const result = inspectExpectedRouteMatch(route);
-    if (!result.ok) {
-      mismatched.push(...result.routes);
-      failures.push(result.details);
-    }
+  if (desiredApps.some((app) => !activeApps.includes(app)) && anyActive) {
+    drift.push("one or more selected app routes are missing");
   }
-  return mismatched.length === 0 ? { ok: true } : {
-    ok: false,
-    routes: mismatched,
-    details: failures.join("; ")
-  };
-}
-async function waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs) {
-  const deadline = Date.now() + timeoutMs;
-  let result;
-  do {
-    result = inspectExpectedRouteMatches(routes);
-    if (result.ok) return result;
-    if (Date.now() < deadline) {
-      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
-    }
-  } while (Date.now() < deadline);
-  return result;
-}
-function inspectExpectedRoutes(routes, expectation) {
-  const mismatched = [];
-  const failures = [];
-  for (const protocol of ["http", "tcp"]) {
-    const expected = routes.filter((route) => (route.protocol ?? "http") === protocol).map((route) => buildHostRouteRouterName(route.repoPath, route.name));
-    if (expected.length === 0) continue;
-    const result = inspectRouterApi(protocol);
-    if (!result.ok) {
-      failures.push(result.details);
-      mismatched.push(...expected);
-      continue;
-    }
-    const unexpected = expected.filter(
-      (name) => expectation === "loaded" ? !result.names.has(name) : result.names.has(name)
-    );
-    const boundedAbsenceIsUncertain = result.reachedPageLimit && (expectation === "loaded" ? unexpected.length > 0 : unexpected.length === 0);
-    if (boundedAbsenceIsUncertain) {
-      failures.push(
-        `${protocol.toUpperCase()} router API reached the ${ROUTER_API_PAGE_SIZE}-entry safety limit`
-      );
-    }
-    mismatched.push(...unexpected);
-    if (expectation === "removed" && unexpected.length === 0 && result.reachedPageLimit) {
-      mismatched.push(...expected);
-    }
+  if (activeApps.some((app) => !desiredApps.includes(app))) {
+    drift.push("one or more active app routes are outside the selected profile");
   }
-  return mismatched.length === 0 ? { ok: true } : {
-    ok: false,
-    routes: mismatched,
-    details: failures.length > 0 ? failures.join("; ") : expectation === "loaded" ? "router names are absent" : "router names are still present"
-  };
-}
-async function waitForExpectedRoutes(routes, expectation, timeoutMs, pollIntervalMs) {
-  const deadline = Date.now() + timeoutMs;
-  let result;
-  do {
-    result = inspectExpectedRoutes(routes, expectation);
-    if (result.ok) return result;
-    if (Date.now() < deadline) {
-      await sleep(Math.min(pollIntervalMs, Math.max(1, deadline - Date.now())));
-    }
-  } while (Date.now() < deadline);
-  return result;
-}
-async function ensureTraefikRouteExpectation(routes, expectation, options) {
-  if (routes.length === 0) return { restarted: false };
-  const initialTimeoutMs = options.initialTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
-  const recoveryTimeoutMs = options.recoveryTimeoutMs ?? DEFAULT_RECOVERY_TIMEOUT_MS;
-  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const initial = await waitForExpectedRoutes(
-    routes,
-    expectation,
-    initialTimeoutMs,
-    pollIntervalMs
+  if (inspection.activeServices.some((service) => !desiredServices.includes(service))) {
+    drift.push("one or more active services are outside the selected profile");
+  }
+  if (inspection.activeProcesses.some((process2) => !desiredProcesses.includes(process2))) {
+    drift.push("one or more active processes are outside the selected profile");
+  }
+  const positivelyStopped = !inspection.primaryActive && Object.values(inspection.baseStatuses).every(isStoppedOrMissingResourceStatus) && Object.values(inspection.serviceStatuses).every(isStoppedOrMissingResourceStatus) && activeApps.length === 0;
+  const onlyDegradedIncident = state?.status === "degraded" && drift.length === 1;
+  const requiredServicesReady = desiredServices.every(
+    (service) => isReadyResourceStatus(inspection.serviceStatuses[service] ?? "missing")
   );
-  if (initial.ok) return { restarted: false };
-  if (options.allowRestart === false)
-    throw new Error(
-      "Traefik routes did not reload; shared router restart is disabled for this operation."
-    );
-  import_node_fs22.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
-  return withFileLock(
-    ROUTER_RELOAD_LOCK_FILE,
-    {
-      activity: "Traefik route reload recovery",
-      waitMs: initialTimeoutMs + recoveryTimeoutMs + 1e4,
-      fair: true,
-      onWait: createStderrWaitReporter("Traefik route reload recovery", "shared router")
-    },
-    async () => {
-      const recheck = await waitForExpectedRoutes(routes, expectation, 0, pollIntervalMs);
-      if (recheck.ok) return { restarted: false };
-      claimLifecycleEffect();
-      restartRouterStack();
-      const recovered = await waitForExpectedRoutes(
-        routes,
-        expectation,
-        recoveryTimeoutMs,
-        pollIntervalMs
-      );
-      if (recovered.ok) return { restarted: true };
-      const action = expectation === "loaded" ? "load" : "remove";
-      throw new Error(
-        `Traefik did not ${action} file-provider routes after one restart: ${recovered.routes.join(", ")} (${recovered.details}). Inspect: devrouter logs --tail 100`
-      );
-    }
+  const baseServicesReady = Object.values(inspection.baseStatuses).every(isReadyResourceStatus);
+  const processesReady = desiredProcesses.every(
+    (process2) => isReadyResourceStatus(inspection.processStatuses[process2] ?? "missing")
   );
-}
-async function ensureTraefikRoutesLoaded(routes, options = {}) {
-  return ensureTraefikRouteExpectation(routes, "loaded", options);
-}
-async function ensureTraefikRoutesMatch(routes, options = {}) {
-  if (routes.length === 0) return;
-  const timeoutMs = options.initialTimeoutMs ?? options.recoveryTimeoutMs ?? DEFAULT_INITIAL_TIMEOUT_MS;
-  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const result = await waitForExpectedRouteMatches(routes, timeoutMs, pollIntervalMs);
-  if (!result.ok) {
-    throw new Error(
-      `Traefik route configuration did not match rendered routes: ${result.routes.join(", ")} (${result.details})`
-    );
-  }
-}
-async function ensureTraefikRoutesRemoved(routes, options = {}) {
-  return ensureTraefikRouteExpectation(routes, "removed", options);
+  const routesReady = desiredApps.every((app) => activeApps.includes(app));
+  const ready = inspection.primaryReady && requiredServicesReady && baseServicesReady && processesReady && routesReady && !stateReadFailed && !drift.length;
+  const status = positivelyStopped && onlyDegradedIncident ? "stopped" : state?.status === "degraded" ? "failed-transition" : drift.length > 0 ? "drifted" : ready ? "ready" : anyActive ? "starting" : "stopped";
+  const active = {
+    apps: activeApps,
+    services: inspection.activeServices,
+    processes: inspection.activeProcesses
+  };
+  return {
+    mode: "managed",
+    status,
+    profile: options.profile,
+    ...state?.profile ? { activeProfile: state.profile } : {},
+    ...options.workspace !== void 0 ? { workspace: options.workspace } : {},
+    ...state?.devpodId ? { devpodId: state.devpodId } : {},
+    ...inspection.composeProject ? { composeProject: inspection.composeProject } : {},
+    desired: {
+      apps: desiredApps,
+      services: desiredServices,
+      processes: desiredProcesses
+    },
+    active,
+    serviceStatuses: inspection.serviceStatuses,
+    baseServiceStatuses: inspection.baseStatuses,
+    processStatuses: inspection.processStatuses,
+    drift: sortedUnique(drift),
+    ...inspection.plan?.sourceConfigSha256 || state?.sourceConfigSha256 ? { sourceConfigSha256: inspection.plan?.sourceConfigSha256 ?? state?.sourceConfigSha256 } : {},
+    ...inspection.plan?.effectiveConfigSha256 || state?.effectiveConfigSha256 ? {
+      effectiveConfigSha256: inspection.plan?.effectiveConfigSha256 ?? state?.effectiveConfigSha256
+    } : {},
+    ...state?.transitionPhase ? { transitionPhase: state.transitionPhase } : {}
+  };
 }
 
 // src/core/workspace-ensure.ts
@@ -9348,6 +9444,7 @@ var cancelled = false;
 var lockHeld = false;
 var stopProjects = [];
 var stopBaselineState;
+var BUSY_LIFECYCLE_WAIT_MS = 30 * 60 * 1e3;
 function matchesFence(record4, fence) {
   return Object.entries(reliabilityFence(record4.state)).every(
     ([key, value]) => value === fence[key]
@@ -9465,7 +9562,7 @@ async function executeLifecycleWorker(request, operation) {
           withMutationLock(
             "Verify retained stop",
             request.repoPath,
-            () => proveRetainedManagedStop(retained)
+            () => proveManagedStop(retained)
           );
         } else {
           const containers = inspectWorkspaceContainers();
@@ -9546,9 +9643,11 @@ function proveLifecycleStopped() {
   const settle = () => {
     claimLifecycleEffect();
     if (stopBaselineState) {
-      if (proveRetainedManagedStop(stopBaselineState).some((container) => container.state.Running)) {
+      const proof = proveManagedStop(stopBaselineState);
+      if (proof.containers.some((container) => container.state.Running))
         throw new Error("Retained workspace workloads remain running.");
-      }
+      if (proof.status === "proven-absent")
+        assertTraefikRoutesRemoved(managedStopRouteReferences(stopBaselineState));
     } else {
       for (const project of stopProjects) {
         const containers = inspectManagedStopContainers(project);
@@ -9911,6 +10010,9 @@ var import_node_path29 = __toESM(require("path"));
 
 // src/core/route-state.ts
 var import_node_fs24 = __toESM(require("fs"));
+function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
+  return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
+}
 function removeWorkspaceRoutesForWorktree(workspace, worktreePath) {
   return removeHostRoutesWhere(
     (route) => route.workspace === workspace && sameWorkspacePath(route.repoPath, worktreePath)
@@ -9962,8 +10064,24 @@ async function mutateWorkspaceRuntime(action, resolved, worktrees, quiet = false
       "Retained managed runtime has no exact provider registration; routes were preserved."
     );
   }
-  const routes = removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
-  await ensureTraefikRoutesRemoved(routes);
+  const retained = action === "stop" ? readManagedRuntimeState(resolved.worktreePath, resolved.workspace) : void 0;
+  let absent = false;
+  const remove = () => {
+    if (retained?.stopBaseline) {
+      absent = proveManagedStop(retained).status === "proven-absent";
+      if (absent && listRoutesForWorktreePath(resolved.worktreePath).some(
+        (route) => route.workspace !== resolved.workspace || !retained.desired.apps.includes(route.name)
+      ))
+        throw new Error("Absent stop contains routes outside the retained desired set.");
+    }
+    claimLifecycleEffect();
+    return removeWorkspaceRoutesForWorktree(resolved.workspace, resolved.worktreePath);
+  };
+  const routes = retained?.stopBaseline ? withMutationLock("Revalidate stop routes", resolved.worktreePath, remove) : remove();
+  await ensureTraefikRoutesRemoved([
+    ...routes,
+    ...absent && retained ? managedStopRouteReferences(retained) : []
+  ]);
   if (!quiet) {
     process.stdout.write(
       `Freed ${routes.length} route(s) for workspace '${resolved.workspace}'.
@@ -9974,6 +10092,7 @@ async function mutateWorkspaceRuntime(action, resolved, worktrees, quiet = false
     ...mutation.status === "changed" ? { devpodId } : {},
     freedRoutes: routes.length,
     providerChanged: mutation.status === "changed",
+    ...absent ? { runtimeAbsent: true } : {},
     workspace: resolved.workspace
   };
 }
@@ -10037,7 +10156,7 @@ async function environmentStop(repoPath, options = {}) {
         repoPath,
         workspace: result.workspace,
         ...result.devpodId ? { devpodId: result.devpodId } : {},
-        stopped: !options.delete && result.providerChanged,
+        stopped: !options.delete && (result.providerChanged || result.runtimeAbsent === true),
         ...options.delete ? { deleted: result.providerChanged } : {},
         freedRoutes: result.freedRoutes
       };
@@ -10070,10 +10189,16 @@ async function environmentStop(repoPath, options = {}) {
 }
 
 // src/lifecycle-worker.ts
-process.on("SIGTERM", cancelLifecycleWorker);
-process.on("SIGINT", cancelLifecycleWorker);
-process.on("disconnect", cancelLifecycleWorker);
+var started = false;
+function cancel() {
+  cancelLifecycleWorker();
+  if (!started && process.connected) process.disconnect();
+}
+process.on("SIGTERM", cancel);
+process.on("SIGINT", cancel);
+process.on("disconnect", cancel);
 process.once("message", async (message) => {
+  started = true;
   let result;
   try {
     const request = message.request;