@devrouter/cli 0.0.68 → 0.0.69

package/dist/devrouter.js

@@ -4133,7 +4133,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs7.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.68" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.69" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5386,7 +5386,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.68" : "0.0.0-dev";
+  return true ? "0.0.69" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -10047,12 +10047,108 @@ function containerIdentity(container) {
     mounts: container.mounts.map((mount) => JSON.stringify(mount)).sort()
   });
 }
+function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
+  if (!import_node_fs23.default.existsSync(import_node_path31.default.join(repoPath, ".devrouter.yml"))) return false;
+  const linked = isLinkedWorktree(repoPath);
+  const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+  const registration2 = () => {
+    resetWorkspaceRuntimeCaches();
+    if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy")
+      throw new Error("Initial managed stop provider selection changed.");
+    const owner2 = inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, repoPath);
+    if (owner2.status !== "owned")
+      throw new Error("Initial managed stop requires one exact Devsy registration.");
+    if (linked) {
+      const record5 = workspace ? readWorkspaceOwnership(repoPath, workspace) : void 0;
+      if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace)
+        throw new Error("Initial managed stop workspace ownership changed.");
+    }
+    return owner2.workspace;
+  };
+  const runtime = loadRuntimeConfig(repoPath, workspace ?? "");
+  if (!runtime.config.managedRuntime) return false;
+  const owner = registration2();
+  if (!owner.context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(owner.context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId))
+    throw new Error("Initial managed stop requires exact provider context.");
+  const plan = inspectManagedDevcontainerConfig({
+    repoPath,
+    config: runtime.config,
+    profile: runtime.resolvedProfile,
+    linked
+  });
+  const providerRoot = import_node_path31.default.resolve(process.env.DEVSY_HOME || import_node_path31.default.join(import_node_os4.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path31.default.join(
+    providerRoot,
+    "contexts",
+    owner.context,
+    "workspaces",
+    devsyId,
+    "agent",
+    ".docker-compose"
+  );
+  const observe = () => {
+    if (!(0, import_node_util9.isDeepStrictEqual)(registration2(), owner) || readManagedRuntimeState(repoPath, workspace))
+      throw new Error("Initial managed stop ownership or runtime state changed.");
+    const matches = inspectWorkspaceContainers().filter(
+      (c) => sameWorkspacePath(
+        c.labels["com.docker.compose.project.working_dir"] ?? "",
+        plan.composeDirectory
+      )
+    );
+    if (!matches.length) return [];
+    const projects = new Set(matches.map((c) => c.labels["com.docker.compose.project"]));
+    if (projects.size !== 1 || !matches[0]?.labels["com.docker.compose.project"])
+      throw new Error("Initial managed stop requires one exact Compose project.");
+    const population = inspectManagedStopContainers(
+      matches[0].labels["com.docker.compose.project"]
+    );
+    if (!sameSet(
+      matches.map((c) => c.id),
+      population.map((c) => c.id)
+    ))
+      throw new Error("Initial managed stop population changed.");
+    proveManagedComposePopulation({
+      plan,
+      repoPath,
+      composeProject: matches[0].labels["com.docker.compose.project"],
+      providerRoot,
+      featureDirectory,
+      containers: population
+    });
+    return population;
+  };
+  const initial = observe();
+  const stable = () => {
+    const current = observe();
+    if (!sameSet(
+      initial.map((c) => c.id),
+      current.map((c) => c.id)
+    ) || current.some((c) => {
+      const prior = initial.find((p) => p.id === c.id);
+      return !prior || containerIdentity(prior) !== containerIdentity(c) || !prior.state.Running && c.state.Running;
+    }))
+      throw new Error("Initial managed stop population or identity changed.");
+    return current;
+  };
+  stable();
+  if (!initial.length) return false;
+  for (const container of initial) {
+    const current = stable().find((c) => c.id === container.id);
+    if (current?.state.Running)
+      stopExactManagedService(current.id, current.labels["com.docker.compose.service"] ?? "", {
+        timeoutMs: 3e4
+      });
+  }
+  if (stable().some((c) => c.state.Running))
+    throw new Error("Initial managed stop left a workload running.");
+  return true;
+}
 function stopRetainedManagedDevsyWorkspace(options) {
   const { repoPath, devsyId } = options;
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
   const retainedState = readManagedRuntimeState(repoPath, workspace);
-  if (!retainedState) return false;
+  if (!retainedState) return stopInitialManagedDevsyWorkspace(repoPath, devsyId);
   const state = retainedState;
   if (state.devpodId !== devsyId || linked && !workspace) {
     throw new Error("Managed stop requires the exact retained workspace identity.");
@@ -10247,10 +10343,11 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (providerFailed) throw providerError;
   return true;
 }
-var import_node_os4, import_node_path31, import_node_util9;
+var import_node_fs23, import_node_os4, import_node_path31, import_node_util9;
 var init_managed_devsy_stop = __esm({
   "src/core/managed-devsy-stop.ts"() {
     "use strict";
+    import_node_fs23 = __toESM(require("fs"));
     import_node_os4 = __toESM(require("os"));
     import_node_path31 = __toESM(require("path"));
     import_node_util9 = require("util");
@@ -10808,7 +10905,7 @@ function hasControlCharacter2(value) {
 function readPolicyFile(filePath) {
   let initialStats;
   try {
-    initialStats = import_node_fs23.default.lstatSync(filePath);
+    initialStats = import_node_fs24.default.lstatSync(filePath);
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
@@ -10821,16 +10918,16 @@ function readPolicyFile(filePath) {
   }
   let fileDescriptor;
   try {
-    fileDescriptor = import_node_fs23.default.openSync(
+    fileDescriptor = import_node_fs24.default.openSync(
       filePath,
-      import_node_fs23.default.constants.O_RDONLY | import_node_fs23.default.constants.O_NONBLOCK | (import_node_fs23.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NONBLOCK | (import_node_fs24.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
   }
   try {
-    const openedStats = import_node_fs23.default.fstatSync(fileDescriptor);
+    const openedStats = import_node_fs24.default.fstatSync(fileDescriptor);
     if (!openedStats.isFile()) {
       return { status: "invalid", error: "network policy must be a regular file" };
     }
@@ -10843,12 +10940,12 @@ function readPolicyFile(filePath) {
     const buffer = Buffer.alloc(openedStats.size);
     let offset = 0;
     while (offset < buffer.length) {
-      const bytesRead = import_node_fs23.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
+      const bytesRead = import_node_fs24.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
       if (bytesRead === 0)
         return { status: "invalid", error: "network policy changed during read" };
       offset += bytesRead;
     }
-    const finalStats = import_node_fs23.default.fstatSync(fileDescriptor);
+    const finalStats = import_node_fs24.default.fstatSync(fileDescriptor);
     if (!finalStats.isFile() || finalStats.size !== openedStats.size) {
       return { status: "invalid", error: "network policy changed during read" };
     }
@@ -10857,7 +10954,7 @@ function readPolicyFile(filePath) {
     return { status: "invalid", error: "network policy could not be read" };
   } finally {
     try {
-      import_node_fs23.default.closeSync(fileDescriptor);
+      import_node_fs24.default.closeSync(fileDescriptor);
     } catch {
     }
   }
@@ -10874,11 +10971,11 @@ function assertDisjoint(cidrs, message) {
 function isErrno(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }
-var import_node_fs23, import_node_path32, NETWORK_POLICY_VERSION, NETWORK_POLICY_FILE, DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE, NETWORK_POLICY_PREFIX_LENGTHS, MAX_NETWORK_POLICY_FILE_BYTES, MAX_NETWORK_POLICY_ARRAY_ENTRIES, MAX_NETWORK_POLICY_DAEMON_ID_LENGTH, NetworkPolicyValidationError, NETWORK_POLICY_KEYS, PRIVATE_IPV4_RANGES;
+var import_node_fs24, import_node_path32, NETWORK_POLICY_VERSION, NETWORK_POLICY_FILE, DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE, NETWORK_POLICY_PREFIX_LENGTHS, MAX_NETWORK_POLICY_FILE_BYTES, MAX_NETWORK_POLICY_ARRAY_ENTRIES, MAX_NETWORK_POLICY_DAEMON_ID_LENGTH, NetworkPolicyValidationError, NETWORK_POLICY_KEYS, PRIVATE_IPV4_RANGES;
 var init_network_policy = __esm({
   "src/core/network-policy.ts"() {
     "use strict";
-    import_node_fs23 = __toESM(require("fs"));
+    import_node_fs24 = __toESM(require("fs"));
     import_node_path32 = __toESM(require("path"));
     init_network_capacity();
     init_router();
@@ -10984,27 +11081,27 @@ function assertExactKeys(value, keys2) {
 function readDocument(store) {
   let descriptor;
   try {
-    descriptor = import_node_fs24.default.openSync(
+    descriptor = import_node_fs25.default.openSync(
       store.filePath,
-      import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NONBLOCK | (import_node_fs24.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs25.default.constants.O_RDONLY | import_node_fs25.default.constants.O_NONBLOCK | (import_node_fs25.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno2(error, "ENOENT")) return void 0;
     throw claimError("invalid-state", "network claim state could not be read");
   }
   try {
-    const stat = import_node_fs24.default.fstatSync(descriptor);
+    const stat = import_node_fs25.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES || (stat.mode & 63) !== 0) {
       throw claimError("invalid-state", "network claim state is not a bounded private file");
     }
     const buffer = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
     let count = 0;
     while (count < buffer.length) {
-      const bytesRead = import_node_fs24.default.readSync(descriptor, buffer, count, buffer.length - count, null);
+      const bytesRead = import_node_fs25.default.readSync(descriptor, buffer, count, buffer.length - count, null);
       if (bytesRead === 0) break;
       count += bytesRead;
     }
-    const finalStat = import_node_fs24.default.fstatSync(descriptor);
+    const finalStat = import_node_fs25.default.fstatSync(descriptor);
     if (count > NETWORK_CLAIMS_MAX_FILE_BYTES || finalStat.size !== stat.size) {
       throw claimError("invalid-state", "network claim state changed during read");
     }
@@ -11016,7 +11113,7 @@ function readDocument(store) {
     }
     return validateDocument(parsed, store.daemonId);
   } finally {
-    import_node_fs24.default.closeSync(descriptor);
+    import_node_fs25.default.closeSync(descriptor);
   }
 }
 function validateDocument(value, daemonId) {
@@ -11120,12 +11217,12 @@ function isErrno2(error, code) {
 function claimError(code, message) {
   return new NetworkClaimError(code, message);
 }
-var import_node_crypto13, import_node_fs24, import_node_path33, NETWORK_CLAIMS_VERSION, NETWORK_CLAIMS_ROOT, NETWORK_CLAIMS_MAX_RECORDS, NETWORK_CLAIMS_MAX_FILE_BYTES, NetworkClaimError, CLAIM_CORE_KEYS, CLAIM_KEYS, FENCE_KEYS, DOCUMENT_KEYS, MAX_CLAIM_TEXT, MAX_ENDPOINT_TEXT;
+var import_node_crypto13, import_node_fs25, import_node_path33, NETWORK_CLAIMS_VERSION, NETWORK_CLAIMS_ROOT, NETWORK_CLAIMS_MAX_RECORDS, NETWORK_CLAIMS_MAX_FILE_BYTES, NetworkClaimError, CLAIM_CORE_KEYS, CLAIM_KEYS, FENCE_KEYS, DOCUMENT_KEYS, MAX_CLAIM_TEXT, MAX_ENDPOINT_TEXT;
 var init_network_claims = __esm({
   "src/core/network-claims.ts"() {
     "use strict";
     import_node_crypto13 = require("crypto");
-    import_node_fs24 = __toESM(require("fs"));
+    import_node_fs25 = __toESM(require("fs"));
     import_node_path33 = __toESM(require("path"));
     init_atomic_file();
     init_file_lock();
@@ -11182,7 +11279,7 @@ function networkOwnerKey(repoPath) {
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
   try {
-    names = import_node_fs25.default.readdirSync(root);
+    names = import_node_fs26.default.readdirSync(root);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw new Error("Network claims cannot be inspected; repair is required.");
@@ -11192,20 +11289,20 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let found;
   for (const file of files) {
     const full = import_node_path34.default.join(root, file);
-    const stat = import_node_fs25.default.lstatSync(full);
+    const stat = import_node_fs26.default.lstatSync(full);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES)
       throw new Error("Invalid retained network claim file.");
     let value;
-    const descriptor = import_node_fs25.default.openSync(
+    const descriptor = import_node_fs26.default.openSync(
       full,
-      import_node_fs25.default.constants.O_RDONLY | import_node_fs25.default.constants.O_NONBLOCK | import_node_fs25.default.constants.O_NOFOLLOW
+      import_node_fs26.default.constants.O_RDONLY | import_node_fs26.default.constants.O_NONBLOCK | import_node_fs26.default.constants.O_NOFOLLOW
     );
     try {
-      if (!import_node_fs25.default.fstatSync(descriptor).isFile()) throw new Error();
+      if (!import_node_fs26.default.fstatSync(descriptor).isFile()) throw new Error();
       const bytes2 = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
       let size = 0;
       while (size < bytes2.length) {
-        const count = import_node_fs25.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
+        const count = import_node_fs26.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
         if (!count) break;
         size += count;
       }
@@ -11215,7 +11312,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     } catch {
       throw new Error("Retained network claim could not be read safely.");
     } finally {
-      import_node_fs25.default.closeSync(descriptor);
+      import_node_fs26.default.closeSync(descriptor);
     }
     if (typeof value.daemonId !== "string" || `${(0, import_node_crypto14.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
@@ -11231,12 +11328,12 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   }
   return found;
 }
-var import_node_crypto14, import_node_fs25, import_node_path34;
+var import_node_crypto14, import_node_fs26, import_node_path34;
 var init_network_claim_lookup = __esm({
   "src/core/network-claim-lookup.ts"() {
     "use strict";
     import_node_crypto14 = require("crypto");
-    import_node_fs25 = __toESM(require("fs"));
+    import_node_fs26 = __toESM(require("fs"));
     import_node_path34 = __toESM(require("path"));
     init_network_claims();
   }
@@ -11396,7 +11493,7 @@ var init_network_provider_effect = __esm({
 
 // src/core/devsy-mutation.ts
 function withMutationLock(activity, target, operation) {
-  import_node_fs26.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs27.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -11477,12 +11574,12 @@ function stopOwnedDevsyWorkspace(devsyId, worktreePath) {
 function deleteOwnedDevsyWorkspace(devsyId, worktreePath) {
   return mutateOwnedDevsyWorkspace("delete", devsyId, worktreePath);
 }
-var import_node_child_process16, import_node_fs26, import_node_path35, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
+var import_node_child_process16, import_node_fs27, import_node_path35, DEVSY_MUTATION_LOCK_FILE, DEVSY_MUTATION_WAIT_MS;
 var init_devsy_mutation = __esm({
   "src/core/devsy-mutation.ts"() {
     "use strict";
     import_node_child_process16 = require("child_process");
-    import_node_fs26 = __toESM(require("fs"));
+    import_node_fs27 = __toESM(require("fs"));
     import_node_path35 = __toESM(require("path"));
     init_devsy_agent();
     init_devsy_workspaces();
@@ -12213,7 +12310,7 @@ async function runLifecycleWorker(request2, supervision, beforeAdmission) {
   if (process.platform === "win32")
     throw new Error("Lifecycle workers require POSIX process-group ownership.");
   const workerPath = import_node_path36.default.join(__dirname, "devrouter-lifecycle-worker.js");
-  if (!import_node_fs27.default.existsSync(workerPath))
+  if (!import_node_fs28.default.existsSync(workerPath))
     throw new Error("The packaged lifecycle worker is missing; rebuild the CLI.");
   const child = (0, import_node_child_process17.fork)(workerPath, [], {
     detached: true,
@@ -12442,13 +12539,13 @@ async function runLifecycleWorker(request2, supervision, beforeAdmission) {
 function newLifecycleIds() {
   return { requestId: (0, import_node_crypto16.randomUUID)(), operationId: (0, import_node_crypto16.randomUUID)(), workerId: (0, import_node_crypto16.randomUUID)() };
 }
-var import_node_child_process17, import_node_crypto16, import_node_fs27, import_node_path36, OUTPUT_BUFFER_LIMIT, DEFAULT_OUTPUT_PAGE_BYTES, LifecycleOutput, LifecycleWorkerAdmissionBusyError;
+var import_node_child_process17, import_node_crypto16, import_node_fs28, import_node_path36, OUTPUT_BUFFER_LIMIT, DEFAULT_OUTPUT_PAGE_BYTES, LifecycleOutput, LifecycleWorkerAdmissionBusyError;
 var init_reliability_worker = __esm({
   "src/core/reliability-worker.ts"() {
     "use strict";
     import_node_child_process17 = require("child_process");
     import_node_crypto16 = require("crypto");
-    import_node_fs27 = __toESM(require("fs"));
+    import_node_fs28 = __toESM(require("fs"));
     import_node_path36 = __toESM(require("path"));
     init_file_lock();
     init_reliability_contract();
@@ -12676,7 +12773,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs28.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs29.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -12707,12 +12804,12 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
 async function ensureTraefikRoutesRemoved(routes, options = {}) {
   return ensureTraefikRouteExpectation(routes, "removed", options);
 }
-var import_node_child_process18, import_node_fs28, import_node_path37, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
+var import_node_child_process18, import_node_fs29, import_node_path37, ROUTER_API_BASE, ROUTER_RELOAD_LOCK_FILE, ROUTER_API_REQUEST_TIMEOUT_SECONDS, DEFAULT_INITIAL_TIMEOUT_MS, DEFAULT_RECOVERY_TIMEOUT_MS, DEFAULT_POLL_INTERVAL_MS, ROUTER_API_PAGE_SIZE;
 var init_traefik_route_health = __esm({
   "src/core/traefik-route-health.ts"() {
     "use strict";
     import_node_child_process18 = require("child_process");
-    import_node_fs28 = __toESM(require("fs"));
+    import_node_fs29 = __toESM(require("fs"));
     import_node_path37 = __toESM(require("path"));
     init_file_lock();
     init_host_routes();
@@ -12730,7 +12827,7 @@ var init_traefik_route_health = __esm({
 
 // src/core/devpod-mutation.ts
 function withMutationLock2(activity, target, operation) {
-  import_node_fs29.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs30.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -12820,12 +12917,12 @@ function deleteOwnedDevpodWorkspace(devpodId, worktreePath) {
   resetWorkspaceRuntimeCaches();
   return result;
 }
-var import_node_child_process19, import_node_fs29, import_node_path38, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
+var import_node_child_process19, import_node_fs30, import_node_path38, DEVPOD_MUTATION_LOCK_FILE, DEVPOD_MUTATION_WAIT_MS;
 var init_devpod_mutation = __esm({
   "src/core/devpod-mutation.ts"() {
     "use strict";
     import_node_child_process19 = require("child_process");
-    import_node_fs29 = __toESM(require("fs"));
+    import_node_fs30 = __toESM(require("fs"));
     import_node_path38 = __toESM(require("path"));
     init_devpod_workspaces();
     init_devsy_mutation();
@@ -12840,6 +12937,278 @@ var init_devpod_mutation = __esm({
   }
 });
 
+// src/core/host-port-claims.ts
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function optionalLabel(labels, key) {
+  const value = isRecord6(labels) ? labels[key] : void 0;
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function normalizeHostIp(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || trimmed === "0.0.0.0" || trimmed === "::") return null;
+  return trimmed;
+}
+function parseSinglePortValue(value, service, label2) {
+  if (typeof value === "number") {
+    if (!Number.isInteger(value) || value <= 0 || value > 65535) {
+      throw new Error(`Service '${service}' has an out-of-range ${label2} port.`);
+    }
+    return value;
+  }
+  if (typeof value === "string") {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+      throw new Error(`Service '${service}' has an out-of-range ${label2} port '${value}'.`);
+    }
+    return parsed;
+  }
+  throw new Error(`Service '${service}' has an unsupported ${label2} port value.`);
+}
+function parseFixedPublishedPort(value, service) {
+  if (value === void 0 || value === null || value === "" || value === 0 || value === "0") {
+    return null;
+  }
+  if (typeof value === "string" && value.includes("-")) {
+    return null;
+  }
+  return parseSinglePortValue(value, service, "published host");
+}
+function parsePublishedRange(value, service) {
+  const match = /^(\d+)-(\d+)$/.exec(value.trim());
+  if (!match) return void 0;
+  const lower = Number(match[1]);
+  const upper = Number(match[2]);
+  if (!Number.isInteger(lower) || !Number.isInteger(upper) || lower <= 0 || upper < lower || upper > 65535) {
+    throw new Error(`Service '${service}' publishes an invalid host port range '${value}'.`);
+  }
+  return [lower, upper];
+}
+function resolveFixedPublishedHostPorts(renderedConfig) {
+  const services = isRecord6(renderedConfig) ? renderedConfig.services : void 0;
+  const bindings = [];
+  const pushBinding = (binding) => {
+    bindings.push(binding);
+    if (bindings.length > MAX_DESIRED_HOST_PORTS) {
+      throw new Error(
+        `The managed Compose model declares more than ${MAX_DESIRED_HOST_PORTS} fixed host ports.`
+      );
+    }
+  };
+  for (const [service, serviceValue] of Object.entries(isRecord6(services) ? services : {})) {
+    const serviceRecord = isRecord6(serviceValue) ? serviceValue : {};
+    if (!Array.isArray(serviceRecord.ports)) continue;
+    for (const port of serviceRecord.ports) {
+      if (!isRecord6(port)) {
+        throw new Error(`Service '${service}' declares an unsupported port entry.`);
+      }
+      parseSinglePortValue(port.target, service, "container target");
+      const hostIp = normalizeHostIp(port.host_ip);
+      const protocol = typeof port.protocol === "string" && port.protocol ? port.protocol : "tcp";
+      if (typeof port.published !== "string" || !port.published.includes("-")) {
+        const hostPort = parseFixedPublishedPort(port.published, service);
+        if (hostPort === null) continue;
+        pushBinding({ service, hostIp, hostPort, protocol });
+        continue;
+      }
+      const range = parsePublishedRange(port.published, service);
+      if (!range) {
+        throw new Error(
+          `Service '${service}' publishes an unsupported host port value '${String(port.published)}'.`
+        );
+      }
+      for (let hostPort = range[0]; hostPort <= range[1]; hostPort += 1) {
+        pushBinding({ service, hostIp, hostPort, protocol });
+      }
+    }
+  }
+  return bindings;
+}
+function hostPortBindingsConflict(desired, holder) {
+  return desired.hostPort === holder.hostPort && desired.protocol === holder.protocol && // Wildcards collide with everything in their protocol family; specific
+  // addresses only collide with themselves. IPv6 nuance intentionally
+  // over-approximates: a loud refusal beats a missed kernel collision.
+  (desired.hostIp === null || holder.hostIp === null || desired.hostIp === holder.hostIp);
+}
+function runDocker(args) {
+  const result = (0, import_node_child_process20.spawnSync)("docker", args, {
+    ...networkDockerOptions(),
+    encoding: "utf-8",
+    timeout: DOCKER_TIMEOUT_MS,
+    maxBuffer: DOCKER_MAX_BUFFER
+  });
+  if (result.error || result.status !== 0) {
+    const reason = (result.stderr || result.stdout || result.error?.message || "unknown error").toString().trim();
+    throw new Error(`docker ${String(args[0])} failed: ${reason}`);
+  }
+  if (typeof result.stdout !== "string") {
+    throw new Error(`docker ${String(args[0])} returned invalid output.`);
+  }
+  return result.stdout;
+}
+function parseHolderPortMap(value) {
+  const ports = [];
+  for (const [key, entries] of Object.entries(isRecord6(value) ? value : {})) {
+    const separator = key.lastIndexOf("/");
+    if (separator <= 0) continue;
+    const protocol = key.slice(separator + 1);
+    if (!Array.isArray(entries)) continue;
+    for (const entry of entries) {
+      if (!isRecord6(entry) || entry.HostPort === void 0 || entry.HostPort === null) continue;
+      const bound = Number(entry.HostPort);
+      if (!Number.isInteger(bound) || bound <= 0) continue;
+      ports.push({ hostIp: normalizeHostIp(entry.HostIp), hostPort: bound, protocol });
+    }
+  }
+  return ports;
+}
+function parseHolderSnapshots(stdout) {
+  return stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      throw new Error("Host-port holder inspection returned malformed JSON.");
+    }
+    if (!isRecord6(parsed) || typeof parsed.id !== "string" || parsed.id.length === 0) {
+      throw new Error("Host-port holder inspection returned an invalid container record.");
+    }
+    const name = typeof parsed.name === "string" ? parsed.name.replace(/^\//, "") : parsed.id;
+    return {
+      id: parsed.id,
+      name,
+      composeProject: optionalLabel(parsed.labels, "com.docker.compose.project"),
+      workingDir: optionalLabel(parsed.labels, "com.docker.compose.project.working_dir"),
+      ports: parseHolderPortMap(parsed.ports)
+    };
+  });
+}
+function listHolderSnapshots() {
+  const listed = runDocker(["ps", "--filter", "status=running", "--format", "{{.ID}}"]);
+  const ids2 = listed.split(/\r?\n/).map((id5) => id5.trim()).filter(Boolean);
+  if (ids2.length === 0) return [];
+  if (ids2.length > MAX_RUNNING_HOLDERS) {
+    throw new Error(
+      `Host-port holder inspection found ${ids2.length} running containers, above its bound.`
+    );
+  }
+  const inspected = runDocker(["inspect", "--format", HOST_PORT_INSPECT_TEMPLATE, ...ids2]);
+  return parseHolderSnapshots(inspected);
+}
+function renderManagedComposeModel(plan, workspace) {
+  const fileArgs = plan.composeFiles.flatMap((file) => ["-f", file]);
+  const result = (0, import_node_child_process20.spawnSync)(
+    "docker",
+    [
+      "compose",
+      "--profile",
+      "*",
+      "--project-directory",
+      plan.composeDirectory,
+      ...fileArgs,
+      "config",
+      "--format",
+      "json"
+    ],
+    {
+      cwd: plan.composeDirectory,
+      encoding: "utf-8",
+      env: managedComposeEnvironment(workspace),
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: COMPOSE_RENDER_TIMEOUT_MS,
+      maxBuffer: COMPOSE_RENDER_MAX_BUFFER
+    }
+  );
+  if (result.status !== 0 || result.error || !result.stdout?.trim()) {
+    const reason = (result.stderr || result.error?.message || "unknown error").toString().trim().split(/\r?\n/).slice(-3).join("; ");
+    throw new Error(
+      `Host-port claims could not render the managed Compose model that the start would bind: ${reason}`
+    );
+  }
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    throw new Error("Host-port claims received a malformed rendered Compose model.");
+  }
+}
+function attributeHolderWorktree(workingDir) {
+  if (import_node_path39.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path39.default.dirname(workingDir));
+}
+function holderAttribution(holder, repoPath) {
+  const attribution = {};
+  if (holder.composeProject) attribution.holderComposeProject = holder.composeProject;
+  const worktree = holder.workingDir ? attributeHolderWorktree(holder.workingDir) : void 0;
+  if (!worktree) return attribution;
+  attribution.holderWorktreePath = worktree;
+  try {
+    const owner = listWorkspaceOwnership(repoPath).find(
+      (record5) => comparableWorkspacePath(record5.worktreePath) === worktree
+    );
+    if (owner) {
+      attribution.holderWorkspace = owner.workspace;
+      if (owner.branch) attribution.holderBranch = owner.branch;
+    }
+  } catch {
+  }
+  return attribution;
+}
+function remediationFor(holder, attribution) {
+  if (attribution.holderWorktreePath) {
+    return `Stop the holding workspace with 'devrouter stop ${attribution.holderWorktreePath}', or override the consumer's published host binding through its own configuration, then run ensure again.`;
+  }
+  return `Stop or reconfigure the holding container '${holder.name}' and run ensure again; devrouter never rewrites consumer-declared host bindings.`;
+}
+function detectHostPortClaimConflicts(options) {
+  const desired = resolveFixedPublishedHostPorts(
+    renderManagedComposeModel(options.plan, options.workspace)
+  );
+  if (desired.length === 0) return [];
+  const holders = listHolderSnapshots();
+  const devcontainerDir = import_node_path39.default.join(options.repoPath, ".devcontainer");
+  const conflicts = [];
+  for (const binding of desired) {
+    for (const holder of holders) {
+      for (const holderPort of holder.ports) {
+        if (!hostPortBindingsConflict(binding, holderPort)) continue;
+        if (holder.workingDir && sameWorkspacePath(holder.workingDir, devcontainerDir)) continue;
+        const attribution = holderAttribution(holder, options.repoPath);
+        conflicts.push({
+          service: binding.service,
+          hostIp: binding.hostIp,
+          hostPort: binding.hostPort,
+          protocol: binding.protocol,
+          holderContainer: holder.name,
+          ...attribution,
+          remediation: remediationFor(holder, attribution)
+        });
+      }
+    }
+  }
+  return conflicts;
+}
+var import_node_child_process20, import_node_path39, COMPOSE_RENDER_TIMEOUT_MS, COMPOSE_RENDER_MAX_BUFFER, DOCKER_TIMEOUT_MS, DOCKER_MAX_BUFFER, MAX_DESIRED_HOST_PORTS, MAX_RUNNING_HOLDERS, HOST_PORT_INSPECT_TEMPLATE;
+var init_host_port_claims = __esm({
+  "src/core/host-port-claims.ts"() {
+    "use strict";
+    import_node_child_process20 = require("child_process");
+    import_node_path39 = __toESM(require("path"));
+    init_devcontainer_profile();
+    init_network_effect_scope();
+    init_workspace();
+    init_workspace_ownership();
+    COMPOSE_RENDER_TIMEOUT_MS = 3e4;
+    COMPOSE_RENDER_MAX_BUFFER = 8 * 1024 * 1024;
+    DOCKER_TIMEOUT_MS = 1e4;
+    DOCKER_MAX_BUFFER = 1024 * 1024;
+    MAX_DESIRED_HOST_PORTS = 1024;
+    MAX_RUNNING_HOLDERS = 512;
+    HOST_PORT_INSPECT_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}}},"ports":{{json .NetworkSettings.Ports}}}';
+  }
+});
+
 // src/core/http-route-probe.ts
 function probeHttpRoute(host, options = {}) {
   const maxTimeSeconds = options.maxTimeSeconds ?? DEFAULT_MAX_TIME_SECONDS;
@@ -12866,7 +13235,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process20.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process21.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -12901,7 +13270,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process20.spawnSync)("curl", args, {
+    result = (0, import_node_child_process21.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -12983,11 +13352,11 @@ function transportFailure() {
     classification: "transport"
   };
 }
-var import_node_child_process20, DEFAULT_MAX_TIME_SECONDS, CONTROLLER_CURL_MAX_TIME_SECONDS, PARENT_TIMEOUT_PADDING_MS, CONTRACT_MAX_BUFFER, MIME_TOKEN_RE2;
+var import_node_child_process21, DEFAULT_MAX_TIME_SECONDS, CONTROLLER_CURL_MAX_TIME_SECONDS, PARENT_TIMEOUT_PADDING_MS, CONTRACT_MAX_BUFFER, MIME_TOKEN_RE2;
 var init_http_route_probe = __esm({
   "src/core/http-route-probe.ts"() {
     "use strict";
-    import_node_child_process20 = require("child_process");
+    import_node_child_process21 = require("child_process");
     init_router();
     init_tls();
     DEFAULT_MAX_TIME_SECONDS = 5;
@@ -12999,20 +13368,20 @@ var init_http_route_probe = __esm({
 });
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process21, import_node_fs30;
+var import_node_child_process22, import_node_fs31;
 var init_managed_host_preparation = __esm({
   "src/core/managed-host-preparation.ts"() {
     "use strict";
-    import_node_child_process21 = require("child_process");
-    import_node_fs30 = __toESM(require("fs"));
+    import_node_child_process22 = require("child_process");
+    import_node_fs31 = __toESM(require("fs"));
     init_repo_config();
   }
 });
 
 // src/core/managed-post-start.ts
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs31.default.existsSync(filePath) || !import_node_fs31.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs31.default.readFileSync(filePath);
+  if (!import_node_fs32.default.existsSync(filePath) || !import_node_fs32.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs32.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
@@ -13021,11 +13390,11 @@ function adapterFingerprint(adapter) {
   return (0, import_node_crypto17.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path39.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path40.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path39.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path39.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path40.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path40.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -13071,7 +13440,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process22.spawnSync)(
+  const result = (0, import_node_child_process23.spawnSync)(
     "docker",
     [
       "exec",
@@ -13108,14 +13477,14 @@ function runManagedProcessAction(options) {
   }
   return "drifted";
 }
-var import_node_child_process22, import_node_crypto17, import_node_fs31, import_node_path39, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
+var import_node_child_process23, import_node_crypto17, import_node_fs32, import_node_path40, MANAGED_MARKER, MANAGED_ADAPTER_PATH, RUNTIME_HELPER_PATH;
 var init_managed_post_start = __esm({
   "src/core/managed-post-start.ts"() {
     "use strict";
-    import_node_child_process22 = require("child_process");
+    import_node_child_process23 = require("child_process");
     import_node_crypto17 = require("crypto");
-    import_node_fs31 = __toESM(require("fs"));
-    import_node_path39 = __toESM(require("path"));
+    import_node_fs32 = __toESM(require("fs"));
+    import_node_path40 = __toESM(require("path"));
     init_devcontainer_config();
     init_network_effect_scope();
     MANAGED_MARKER = "devrouter:managed devcontainer";
@@ -13567,7 +13936,7 @@ function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process23.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process24.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -13722,11 +14091,11 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
   }
   return result;
 }
-var import_node_child_process23, NetworkInventoryError, MAX_IDS, MAX_OUTPUT_BYTES, FULL_ID, NETWORK_TEMPLATE, CONTAINER_TEMPLATE;
+var import_node_child_process24, NetworkInventoryError, MAX_IDS, MAX_OUTPUT_BYTES, FULL_ID, NETWORK_TEMPLATE, CONTAINER_TEMPLATE;
 var init_network_inventory = __esm({
   "src/core/network-inventory.ts"() {
     "use strict";
-    import_node_child_process23 = require("child_process");
+    import_node_child_process24 = require("child_process");
     init_devpod_environment();
     NetworkInventoryError = class extends Error {
     };
@@ -14054,26 +14423,26 @@ function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs32.default.readFileSync(import_node_path40.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs33.default.readFileSync(import_node_path41.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs32.default.readlinkSync(import_node_path40.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs32.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs33.default.readlinkSync(import_node_path41.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs33.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path40.default.join(procRoot, pid);
-        if (import_node_path40.default.basename(import_node_fs32.default.readlinkSync(import_node_path40.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs32.default.readlinkSync(import_node_path40.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs32.default.readdirSync(import_node_path40.default.join(root, "fd"));
+        const root = import_node_path41.default.join(procRoot, pid);
+        if (import_node_path41.default.basename(import_node_fs33.default.readlinkSync(import_node_path41.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs33.default.readlinkSync(import_node_path41.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs33.default.readdirSync(import_node_path41.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs32.default.readlinkSync(import_node_path40.default.join(root, "fd", fd)) === inode;
+            return import_node_fs33.default.readlinkSync(import_node_path41.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -14087,12 +14456,12 @@ function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   }
   return false;
 }
-var import_node_fs32, import_node_path40;
+var import_node_fs33, import_node_path41;
 var init_network_local_daemon = __esm({
   "src/core/network-local-daemon.ts"() {
     "use strict";
-    import_node_fs32 = __toESM(require("fs"));
-    import_node_path40 = __toESM(require("path"));
+    import_node_fs33 = __toESM(require("fs"));
+    import_node_path41 = __toESM(require("path"));
   }
 });
 
@@ -14120,7 +14489,7 @@ function parseLinuxNetworkRoutes(output2) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process24.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process25.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -14128,11 +14497,11 @@ function collectNetworkRoutes(options) {
   if (result.error || result.status !== 0) return { status: "unknown", routes: [] };
   return parseLinuxNetworkRoutes(result.stdout);
 }
-var import_node_child_process24, import_node_net3;
+var import_node_child_process25, import_node_net3;
 var init_network_routes = __esm({
   "src/core/network-routes.ts"() {
     "use strict";
-    import_node_child_process24 = require("child_process");
+    import_node_child_process25 = require("child_process");
     import_node_net3 = require("net");
     init_network_capacity();
     init_network_local_daemon();
@@ -14208,14 +14577,14 @@ var init_network_compose = __esm({
 });
 
 // src/core/network-compose-files.ts
-var import_node_child_process25, import_node_crypto19, import_node_fs33, import_node_path41, import_yaml4, MAX_BYTES3;
+var import_node_child_process26, import_node_crypto19, import_node_fs34, import_node_path42, import_yaml4, MAX_BYTES3;
 var init_network_compose_files = __esm({
   "src/core/network-compose-files.ts"() {
     "use strict";
-    import_node_child_process25 = require("child_process");
+    import_node_child_process26 = require("child_process");
     import_node_crypto19 = require("crypto");
-    import_node_fs33 = __toESM(require("fs"));
-    import_node_path41 = __toESM(require("path"));
+    import_node_fs34 = __toESM(require("fs"));
+    import_node_path42 = __toESM(require("path"));
     import_yaml4 = __toESM(require("yaml"));
     init_atomic_file();
     init_devcontainer_profile();
@@ -14225,11 +14594,11 @@ var init_network_compose_files = __esm({
 });
 
 // src/core/network-connected-route.ts
-var import_node_child_process26;
+var import_node_child_process27;
 var init_network_connected_route = __esm({
   "src/core/network-connected-route.ts"() {
     "use strict";
-    import_node_child_process26 = require("child_process");
+    import_node_child_process27 = require("child_process");
     init_network_capacity();
   }
 });
@@ -14319,19 +14688,20 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
-var import_node_child_process27, import_node_fs34, import_node_path42;
+var import_node_child_process28, import_node_fs35, import_node_path43;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process27 = require("child_process");
-    import_node_fs34 = __toESM(require("fs"));
-    import_node_path42 = __toESM(require("path"));
+    import_node_child_process28 = require("child_process");
+    import_node_fs35 = __toESM(require("fs"));
+    import_node_path43 = __toESM(require("path"));
     init_devcontainer_profile();
     init_devpod_environment();
     init_devpod_mutation();
     init_devpod_workspaces();
     init_devsy_mutation();
     init_file_lock();
+    init_host_port_claims();
     init_host_routes();
     init_http_route_probe();
     init_managed_host_preparation();
@@ -14460,13 +14830,13 @@ function prepareManagedLifecycleOperation(input2) {
     };
   });
 }
-function assertCurrentCapacityController(expected, directory = import_node_path43.default.join(DEVROUTER_HOME, "controller")) {
+function assertCurrentCapacityController(expected, directory = import_node_path44.default.join(DEVROUTER_HOME, "controller")) {
   const current = new ControllerStore(directory).read();
   if (!expected || current?.store !== expected.store || current.epoch !== expected.epoch)
     throw new Error("Capacity controller incarnation changed.");
 }
 function settlePreparedLifecycleCapacity(input2) {
-  const directory = input2.directory ?? import_node_path43.default.join(DEVROUTER_HOME, "controller");
+  const directory = input2.directory ?? import_node_path44.default.join(DEVROUTER_HOME, "controller");
   const store = new CapacityStore(directory);
   for (let attempt = 0; attempt < 3; attempt++) {
     const snapshot = store.read();
@@ -14680,7 +15050,7 @@ async function superviseLifecycle(kind, repoPath, options = {}, command) {
     removeSignals();
   }
 }
-function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs, maxSampleAgeMs, directory = import_node_path43.default.join(DEVROUTER_HOME, "controller"), controller, admission) {
+function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs, maxSampleAgeMs, directory = import_node_path44.default.join(DEVROUTER_HOME, "controller"), controller, admission) {
   if (request2.kind === "stop") throw new Error("Stop never requires capacity admission.");
   const capacity = new CapacityStore(directory);
   const snapshot = capacity.read();
@@ -14780,7 +15150,7 @@ function admitLifecycleCapacity(request2, reservation, budgets, samples, nowMs,
   return decision;
 }
 function capacityPolicyTargets(repoPath) {
-  const policy = readCapacityPolicy(import_node_path43.default.join(DEVROUTER_HOME, "controller"));
+  const policy = readCapacityPolicy(import_node_path44.default.join(DEVROUTER_HOME, "controller"));
   return policy?.admissions === "enabled" && policy.enrollments.some((entry) => entry.repoPath === repoPath);
 }
 function controllerWaitSeconds(deadline) {
@@ -14789,7 +15159,7 @@ function controllerWaitSeconds(deadline) {
 async function superviseThroughController(input2) {
   if (input2.kind === "exec" && !input2.command)
     throw new Error("Exec requires a command for controller admission.");
-  const directory = import_node_path43.default.join(DEVROUTER_HOME, "controller");
+  const directory = import_node_path44.default.join(DEVROUTER_HOME, "controller");
   const cancellation = { requested: false };
   const removeSignals = installLifecycleWaitSignals(cancellation);
   const cancelled = () => {
@@ -14846,7 +15216,7 @@ async function superviseThroughController(input2) {
     removeSignals();
   }
 }
-function renewLifecycleCapacity(request2, policy, samples, controller, directory = import_node_path43.default.join(DEVROUTER_HOME, "controller"), nowMs = Date.now()) {
+function renewLifecycleCapacity(request2, policy, samples, controller, directory = import_node_path44.default.join(DEVROUTER_HOME, "controller"), nowMs = Date.now()) {
   return updateReliabilityOperation(request2.identity, (record5) => {
     const binding = record5.capacity;
     if (!matchesFence(record5, request2.fence) || !binding || binding.operationId !== request2.operationId || binding.workerId !== request2.workerId || binding.controller?.store !== controller.store || binding.controller?.epoch !== controller.epoch)
@@ -14924,7 +15294,7 @@ function retireQueuedLifecycle(request2, supersededOnly = false) {
     return true;
   });
 }
-function bindLifecycleCapacity(request2, binding, directory = import_node_path43.default.join(DEVROUTER_HOME, "controller")) {
+function bindLifecycleCapacity(request2, binding, directory = import_node_path44.default.join(DEVROUTER_HOME, "controller")) {
   if (request2.kind === "stop") throw new Error("Stop never requires capacity admission.");
   updateReliabilityOperation(request2.identity, (record5) => {
     if (!matchesFence(record5, request2.fence) || record5.worker || record5.state.operation?.id !== request2.operationId || record5.state.operation.status !== "NOT_STARTED" || record5.state.operation.drained)
@@ -14939,12 +15309,12 @@ function bindLifecycleCapacity(request2, binding, directory = import_node_path43
       stepRecord(record5, { ...request2.fence, type: "admission", result: "admitted" });
   });
 }
-var import_node_crypto21, import_node_path43, import_node_util10, activeWorker, lockHeld, BUSY_LIFECYCLE_WAIT_MS, BUSY_LIFECYCLE_POLL_MS, CAPACITY_CLIENT_WAIT_MS, BUSY_LIFECYCLE_PROGRESS_MS;
+var import_node_crypto21, import_node_path44, import_node_util10, activeWorker, lockHeld, BUSY_LIFECYCLE_WAIT_MS, BUSY_LIFECYCLE_POLL_MS, CAPACITY_CLIENT_WAIT_MS, BUSY_LIFECYCLE_PROGRESS_MS;
 var init_reliability_lifecycle = __esm({
   "src/core/reliability-lifecycle.ts"() {
     "use strict";
     import_node_crypto21 = require("crypto");
-    import_node_path43 = __toESM(require("path"));
+    import_node_path44 = __toESM(require("path"));
     import_node_util10 = require("util");
     init_capacity_accounting();
     init_capacity_policy();
@@ -15431,7 +15801,7 @@ function createCapacityController(options) {
         const record5 = readReliabilityOperation(identity2);
         if (!record5?.capacity || !record5.preparation && !record5.capacity.execSteady || record5.worker || !record5.state.operation?.drained || !["ensure", "exec"].includes(record5.state.operation.kind))
           continue;
-        const bytes2 = readControllerEvidence(import_node_path44.default.join(enrollment.repoPath, ".devrouter.yml"));
+        const bytes2 = readControllerEvidence(import_node_path45.default.join(enrollment.repoPath, ".devrouter.yml"));
         const estimates = loadRepoConfig(enrollment.repoPath, () => bytes2).capacity;
         if (!estimates) continue;
         settlePreparedLifecycleCapacity({
@@ -15591,12 +15961,12 @@ function createCapacityController(options) {
     }
   };
 }
-var import_node_crypto22, import_node_path44, import_node_util12;
+var import_node_crypto22, import_node_path45, import_node_util12;
 var init_capacity_controller = __esm({
   "src/core/capacity-controller.ts"() {
     "use strict";
     import_node_crypto22 = require("crypto");
-    import_node_path44 = __toESM(require("path"));
+    import_node_path45 = __toESM(require("path"));
     import_node_util12 = require("util");
     init_capacity_docker_probe();
     init_capacity_enrollment();
@@ -15937,12 +16307,12 @@ async function containers(project, signal) {
   }
   return values.sort((a, b) => a.id.localeCompare(b.id));
 }
-var import_node_crypto24, import_node_path45, OBSERVATION_INSPECT_TEMPLATE, collectControllerObservation;
+var import_node_crypto24, import_node_path46, OBSERVATION_INSPECT_TEMPLATE, collectControllerObservation;
 var init_controller_observation = __esm({
   "src/core/controller-observation.ts"() {
     "use strict";
     import_node_crypto24 = require("crypto");
-    import_node_path45 = __toESM(require("path"));
+    import_node_path46 = __toESM(require("path"));
     init_controller_binding();
     init_controller_monitor();
     init_controller_probe();
@@ -15985,14 +16355,14 @@ var init_controller_observation = __esm({
       )).trim().split("\n");
       if (metadata.length !== 2) throw new Error("Observation ownership paths unavailable.");
       const [gitDir, commonDir] = metadata;
-      const sourcePath = import_node_path45.default.join(environment.repoPath, ".devcontainer/devcontainer.json");
+      const sourcePath = import_node_path46.default.join(environment.repoPath, ".devcontainer/devcontainer.json");
       const files = [
-        import_node_path45.default.join(commonDir, "devrouter/workspaces", `${environment.workspace}.json`),
-        import_node_path45.default.join(environment.repoPath, ".devrouter.yml"),
-        import_node_path45.default.join(gitDir, "devrouter-workspace"),
+        import_node_path46.default.join(commonDir, "devrouter/workspaces", `${environment.workspace}.json`),
+        import_node_path46.default.join(environment.repoPath, ".devrouter.yml"),
+        import_node_path46.default.join(gitDir, "devrouter-workspace"),
         managedRuntimeStatePath(environment.repoPath, environment.workspace),
         sourcePath,
-        import_node_path45.default.join(environment.repoPath, MANAGED_DEVCONTAINER_PATH)
+        import_node_path46.default.join(environment.repoPath, MANAGED_DEVCONTAINER_PATH)
       ];
       const persisted = captureControllerEvidence(files);
       if (controllerBindingFingerprint(persisted.contents[0], persisted.contents[1]) !== environment.fingerprint)
@@ -16017,7 +16387,7 @@ var init_controller_observation = __esm({
       if (!journal) throw new Error("Observation journal is unavailable.");
       const routes = readRoutes().filter((route) => route.repoPath === environment.repoPath);
       const before = await containers(state.composeProject, signal);
-      const composeDirectory = import_node_path45.default.join(environment.repoPath, ".devcontainer");
+      const composeDirectory = import_node_path46.default.join(environment.repoPath, ".devcontainer");
       const references = typeof source.dockerComposeFile === "string" ? [source.dockerComposeFile] : source.dockerComposeFile;
       if (!Array.isArray(references) || !references.length || references.some((value) => typeof value !== "string"))
         throw new Error("Observation Compose source is unavailable.");
@@ -16034,7 +16404,7 @@ var init_controller_observation = __esm({
         if (!recorded || container.labels["com.docker.compose.project.working_dir"] !== composeDirectory)
           throw new Error("Observation Compose ownership is unavailable.");
         const files2 = recorded.split(",").map((file) => file.trim());
-        if (files2.some((file) => !import_node_path45.default.isAbsolute(file)) || !hasExactComposeIdentity(container, {
+        if (files2.some((file) => !import_node_path46.default.isAbsolute(file)) || !hasExactComposeIdentity(container, {
           repoPath: environment.repoPath,
           service: container.labels["com.docker.compose.service"] ?? "",
           composeProject: state.composeProject,
@@ -16393,26 +16763,26 @@ var init_controller_sessions = __esm({
 
 // src/core/controller-server.ts
 function privateDirectory(directory) {
-  const absolute2 = import_node_path46.default.resolve(directory);
-  let current = import_node_path46.default.parse(absolute2).root;
-  for (const part of absolute2.slice(current.length).split(import_node_path46.default.sep)) {
-    current = import_node_path46.default.join(current, part);
+  const absolute2 = import_node_path47.default.resolve(directory);
+  let current = import_node_path47.default.parse(absolute2).root;
+  for (const part of absolute2.slice(current.length).split(import_node_path47.default.sep)) {
+    current = import_node_path47.default.join(current, part);
     try {
-      const stat2 = import_node_fs35.default.lstatSync(current);
+      const stat2 = import_node_fs36.default.lstatSync(current);
       if (!stat2.isDirectory() || stat2.isSymbolicLink())
         throw new Error("Unsafe controller directory.");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
-      import_node_fs35.default.mkdirSync(current, { mode: 448 });
+      import_node_fs36.default.mkdirSync(current, { mode: 448 });
     }
   }
-  const stat = import_node_fs35.default.lstatSync(absolute2);
+  const stat = import_node_fs36.default.lstatSync(absolute2);
   if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
     throw new Error("Controller directory is not private.");
 }
 function validateOwnedFile(file, socket) {
   try {
-    const stat = import_node_fs35.default.lstatSync(file);
+    const stat = import_node_fs36.default.lstatSync(file);
     if (stat.uid !== process.getuid?.() || (socket ? !stat.isSocket() : !stat.isFile()) || (stat.mode & 63) !== 0)
       throw new Error("Unsafe controller artifact.");
     return true;
@@ -16424,19 +16794,19 @@ function validateOwnedFile(file, socket) {
 async function runController(options) {
   if (options.operations && options.createOperations)
     throw new Error("Controller operations have multiple owners.");
-  const socketPath = import_node_path46.default.join(options.directory, "control.sock");
+  const socketPath = import_node_path47.default.join(options.directory, "control.sock");
   if (Buffer.byteLength(socketPath) > 103) throw new Error("Controller socket path is too long.");
   privateDirectory(options.directory);
-  const lockPath = import_node_path46.default.join(options.directory, "owner.lock");
+  const lockPath = import_node_path47.default.join(options.directory, "owner.lock");
   try {
-    const stat = import_node_fs35.default.lstatSync(lockPath);
+    const stat = import_node_fs36.default.lstatSync(lockPath);
     if (!stat.isFile() || stat.uid !== process.getuid?.())
       throw new Error("Unsafe controller owner lock.");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
   await withFileLock(lockPath, { activity: "controller ownership", waitMs: 0 }, async () => {
-    if (validateOwnedFile(socketPath, true)) import_node_fs35.default.unlinkSync(socketPath);
+    if (validateOwnedFile(socketPath, true)) import_node_fs36.default.unlinkSync(socketPath);
     const sessions = new ControllerSessions(new ControllerStore(options.directory));
     const incarnation = sessions.read();
     let startupAvailable = true;
@@ -16815,7 +17185,7 @@ async function runController(options) {
           resolve();
         });
       });
-      import_node_fs35.default.chmodSync(socketPath, 384);
+      import_node_fs36.default.chmodSync(socketPath, 384);
       await new Promise((resolve) => {
         finish = resolve;
         options.signal.addEventListener("abort", shutdown, { once: true });
@@ -16834,13 +17204,13 @@ async function runController(options) {
     }
   });
 }
-var import_node_fs35, import_node_net4, import_node_path46, FRAME_BYTES;
+var import_node_fs36, import_node_net4, import_node_path47, FRAME_BYTES;
 var init_controller_server = __esm({
   "src/core/controller-server.ts"() {
     "use strict";
-    import_node_fs35 = __toESM(require("fs"));
+    import_node_fs36 = __toESM(require("fs"));
     import_node_net4 = __toESM(require("net"));
-    import_node_path46 = __toESM(require("path"));
+    import_node_path47 = __toESM(require("path"));
     init_controller_monitor();
     init_controller_protocol();
     init_controller_sessions();
@@ -16857,7 +17227,7 @@ __export(controller_exports, {
   runControllerCommand: () => runControllerCommand
 });
 async function runControllerCommand(method, options, repo, dependencies = {}) {
-  const directory = import_node_path47.default.join(DEVROUTER_HOME, "controller");
+  const directory = import_node_path48.default.join(DEVROUTER_HOME, "controller");
   try {
     if (method === "run") {
       const controller = new AbortController();
@@ -16892,7 +17262,7 @@ async function runControllerCommand(method, options, repo, dependencies = {}) {
     if (fields2.timeout !== void 0) fields2.timeout = Number(fields2.timeout);
     await controllerRequest(
       directory,
-      { method, ...fields2, ...repo ? { path: import_node_path47.default.resolve(repo) } : {} },
+      { method, ...fields2, ...repo ? { path: import_node_path48.default.resolve(repo) } : {} },
       (value) => process.stdout.write(`${JSON.stringify(value)}
 `)
     );
@@ -16907,11 +17277,11 @@ async function runControllerCommand(method, options, repo, dependencies = {}) {
     process.exitCode = 1;
   }
 }
-var import_node_path47;
+var import_node_path48;
 var init_controller = __esm({
   "src/commands/controller.ts"() {
     "use strict";
-    import_node_path47 = __toESM(require("path"));
+    import_node_path48 = __toESM(require("path"));
     init_capacity_collector();
     init_capacity_controller();
     init_capacity_policy();
@@ -16962,28 +17332,28 @@ function replaceDevrouterSection(content) {
   return `${content.slice(0, start)}${buildDevrouterSection()}${content.slice(end)}`;
 }
 function writeRepoFile(repoPath, relPath, content) {
-  const absolutePath = (0, import_node_path48.join)(repoPath, relPath);
-  (0, import_node_fs36.mkdirSync)((0, import_node_path48.dirname)(absolutePath), { recursive: true });
-  (0, import_node_fs36.writeFileSync)(absolutePath, content, "utf-8");
+  const absolutePath = (0, import_node_path49.join)(repoPath, relPath);
+  (0, import_node_fs37.mkdirSync)((0, import_node_path49.dirname)(absolutePath), { recursive: true });
+  (0, import_node_fs37.writeFileSync)(absolutePath, content, "utf-8");
   return absolutePath;
 }
 function ensureAgentsMdSection(repoPath) {
-  const filePath = (0, import_node_path48.join)(repoPath, AGENTS_MD);
-  if ((0, import_node_fs36.existsSync)(filePath)) {
-    const content = (0, import_node_fs36.readFileSync)(filePath, "utf-8");
+  const filePath = (0, import_node_path49.join)(repoPath, AGENTS_MD);
+  if ((0, import_node_fs37.existsSync)(filePath)) {
+    const content = (0, import_node_fs37.readFileSync)(filePath, "utf-8");
     if (content.includes(DEVROUTER_SENTINEL)) {
       const updated = replaceDevrouterSection(content);
       if (updated === void 0 || updated === content) return { path: filePath, written: false };
-      (0, import_node_fs36.writeFileSync)(filePath, updated, "utf-8");
+      (0, import_node_fs37.writeFileSync)(filePath, updated, "utf-8");
       return { path: filePath, written: true };
     }
-    (0, import_node_fs36.writeFileSync)(filePath, `${content.trimEnd()}
+    (0, import_node_fs37.writeFileSync)(filePath, `${content.trimEnd()}
 
 ${buildDevrouterSection()}
 `, "utf-8");
     return { path: filePath, written: true };
   }
-  (0, import_node_fs36.writeFileSync)(filePath, `# AGENTS.md
+  (0, import_node_fs37.writeFileSync)(filePath, `# AGENTS.md
 
 ${buildDevrouterSection()}
 `, "utf-8");
@@ -16993,12 +17363,12 @@ function ensureSkillFile(repoPath) {
   const filePath = writeRepoFile(repoPath, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT);
   return { path: filePath, written: true };
 }
-var import_node_fs36, import_node_path48, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
+var import_node_fs37, import_node_path49, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
 var init_agents_md = __esm({
   "src/core/agents-md.ts"() {
     "use strict";
-    import_node_fs36 = require("fs");
-    import_node_path48 = require("path");
+    import_node_fs37 = require("fs");
+    import_node_path49 = require("path");
     DEVROUTER_SENTINEL = "<!-- devrouter -->";
     DEVROUTER_END_SENTINEL = "<!-- /devrouter -->";
     LEGACY_DEVROUTER_SECTION_END = "- `devrouter ls`";
@@ -17459,6 +17829,7 @@ function buildOnboardingPrompt(options = {}) {
     "- if kind=app and runtime=proxy:",
     "  - HTTP-only optional readiness: { path: /api/health, statuses: [200], contentType: application/json }; statuses default to [200], explicit lists allow unique 2xx/4xx codes, never redirects. Paths stay on the configured host with no query, fragment, percent escapes, backslash or dot segments. Media types match their case-insensitive base type.",
     "  - Declared application readiness failures return applicationReadiness.status=application-error and a nonzero ensure exit, while retaining tooling and routes for application fixes; do not reset caches or recreate the provider. Absent readiness means legacy route liveness, not full application readiness.",
+    "  - A configured FIXED published host binding already held by a running container refuses managed ensure before any provider start (hostPortConflicts in --json, nonzero exit) naming the port, holder container, compose project, and owning workspace when attributable. Ephemeral host::container bindings are exempt. Never rewrite consumer ports to resolve a conflict: stop the holding workspace or use the consumer's own override, then ensure again. Unverifiable evidence also refuses.",
     '  - upstream: "host:port" (an already-running port, e.g. a devcontainer published on 127.0.0.1:3000, or a container reachable by name on a shared Docker network such as `derivatives-db:5432`)',
     `  - upstream may use the \`${WORKSPACE_PLACEHOLDER}\` placeholder (e.g. \`${WORKSPACE_PLACEHOLDER}-app:3000\`) to target a per-workspace devcontainer alias; it is substituted with the resolved workspace token at runtime and re-validated. Do NOT put \`${WORKSPACE_PLACEHOLDER}\` in \`host\` (rejected) \u2014 the host is auto-namespaced.`,
     "  - managed `devrouter ensure` requires every HTTP/TCP proxy upstream to begin with the exact resolved workspace/project alias prefix before it mutates DevPod or routes",
@@ -17565,6 +17936,7 @@ function buildOnboardingPrompt(options = {}) {
     "- Avoid pre-wrapper DB assignments such as `DATABASE_URI=... <wrapper> run -- ...`; wrapper-managed env may override those values.",
     "- `devrouter doctor --repo <REPO_PATH>` warns on risky pre-wrapper DB assignments before `run --` for host apps that depend on postgres.",
     "- With TLS enabled, `devrouter doctor --repo <REPO_PATH>` also warns on cert SAN mismatches for configured hosts (`repo.tls-host-coverage`).",
+    "- `devrouter doctor --repo <REPO_PATH>` errors on configured fixed host-port bindings already held by running containers (`repo.host-port-claims`) and warns when that comparison is unavailable.",
     "- Robust one-shot migrate example (argv-safe, no nested shell quoting): `devrouter app exec <name> --repo <REPO_PATH> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload migrate`.",
     "- Robust one-shot seed example: `devrouter app exec <name> --repo <REPO_PATH> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload seed`.",
     "- Environment probe/debug example (run before migrations): `devrouter app exec <name> --repo <REPO_PATH> --yes -- printenv DB_URL DB_HOST DB_PORT DB_SHADOW_URL`.",
@@ -18275,11 +18647,11 @@ function extractCurrentVersionFromRepoConfig(repoPath) {
   };
 }
 function readPromptDirectory(promptDirPath) {
-  if (!import_node_fs37.default.existsSync(promptDirPath)) {
+  if (!import_node_fs38.default.existsSync(promptDirPath)) {
     throw new Error(`Missing ${UPGRADE_PROMPTS_DIR} directory at ${promptDirPath}.`);
   }
   const releases = [];
-  const files = import_node_fs37.default.readdirSync(promptDirPath, { withFileTypes: true });
+  const files = import_node_fs38.default.readdirSync(promptDirPath, { withFileTypes: true });
   for (const file of files) {
     if (!file.isFile() || !file.name.endsWith(".md")) {
       continue;
@@ -18289,8 +18661,8 @@ function readPromptDirectory(promptDirPath) {
       continue;
     }
     const version = normalizeVersion(basename);
-    const promptPath = import_node_path49.default.join(promptDirPath, file.name);
-    const prompt = import_node_fs37.default.readFileSync(promptPath, "utf-8").trim();
+    const promptPath = import_node_path50.default.join(promptDirPath, file.name);
+    const prompt = import_node_fs38.default.readFileSync(promptPath, "utf-8").trim();
     releases.push({ version, prompt, promptPath });
   }
   const deduped = /* @__PURE__ */ new Map();
@@ -18311,19 +18683,19 @@ function listAvailableUpgradeTargets(currentVersion, releases) {
 }
 function resolvePromptDirectory(explicitPath) {
   if (explicitPath) {
-    return import_node_path49.default.resolve(explicitPath);
+    return import_node_path50.default.resolve(explicitPath);
   }
-  const entryFile = process.argv[1] ? import_node_path49.default.resolve(process.argv[1]) : __filename;
-  const entryDir = import_node_path49.default.dirname(entryFile);
-  const resolvedEntryDir = import_node_fs37.default.existsSync(entryFile) ? import_node_path49.default.dirname(import_node_fs37.default.realpathSync(entryFile)) : entryDir;
+  const entryFile = process.argv[1] ? import_node_path50.default.resolve(process.argv[1]) : __filename;
+  const entryDir = import_node_path50.default.dirname(entryFile);
+  const resolvedEntryDir = import_node_fs38.default.existsSync(entryFile) ? import_node_path50.default.dirname(import_node_fs38.default.realpathSync(entryFile)) : entryDir;
   const candidates = [
-    import_node_path49.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path49.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path49.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path49.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
-    import_node_path49.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
+    import_node_path50.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path50.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path50.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path50.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
+    import_node_path50.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
   ];
-  const existing = candidates.find((candidate) => import_node_fs37.default.existsSync(candidate));
+  const existing = candidates.find((candidate) => import_node_fs38.default.existsSync(candidate));
   return existing ?? candidates[0];
 }
 function loadUpgradeCatalog(options = {}) {
@@ -18339,12 +18711,12 @@ function loadUpgradeCatalog(options = {}) {
     releases
   };
 }
-var import_node_fs37, import_node_path49, SEMVER_RE, UPGRADE_PROMPTS_DIR;
+var import_node_fs38, import_node_path50, SEMVER_RE, UPGRADE_PROMPTS_DIR;
 var init_upgrade = __esm({
   "src/core/upgrade.ts"() {
     "use strict";
-    import_node_fs37 = __toESM(require("fs"));
-    import_node_path49 = __toESM(require("path"));
+    import_node_fs38 = __toESM(require("fs"));
+    import_node_path50 = __toESM(require("path"));
     init_repo_config();
     SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
     UPGRADE_PROMPTS_DIR = "upgrade-prompts";
@@ -18487,7 +18859,7 @@ function isLoopbackHost(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "host.docker.internal";
 }
 function inspectCompose(composeFile, _workspace) {
-  if (!import_node_fs38.default.existsSync(composeFile)) {
+  if (!import_node_fs39.default.existsSync(composeFile)) {
     return {
       aliases: [],
       publishedPorts: [],
@@ -18496,7 +18868,7 @@ function inspectCompose(composeFile, _workspace) {
     };
   }
   try {
-    const raw = import_node_fs38.default.readFileSync(composeFile, "utf-8");
+    const raw = import_node_fs39.default.readFileSync(composeFile, "utf-8");
     const parsed = import_yaml5.default.parse(raw);
     const root = asRecord(parsed);
     const services = asRecord(root?.services);
@@ -18552,12 +18924,51 @@ function routedProxyApps(config) {
     (app) => app.kind !== "dependency" && app.runtime === "proxy"
   );
 }
+function buildHostPortClaimsCheck(repoPath, workspace) {
+  try {
+    const linked = isLinkedWorktree(repoPath);
+    const runtime = loadRuntimeConfig(repoPath);
+    const plan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config: runtime.config,
+      profile: runtime.resolvedProfile,
+      linked
+    });
+    const gitCommonDir = linked ? resolveGitCommonDir(repoPath) : void 0;
+    const workspaceEnv = linked && workspace && gitCommonDir ? { token: workspace, gitCommonDir } : void 0;
+    const conflicts = detectHostPortClaimConflicts({ repoPath, plan, workspace: workspaceEnv });
+    if (conflicts.length === 0) {
+      return {
+        id: "repo.host-port-claims",
+        level: "ok",
+        summary: "No configured fixed host-port binding conflicts with a running container."
+      };
+    }
+    return {
+      id: "repo.host-port-claims",
+      level: "error",
+      summary: `${conflicts.length} configured fixed host-port binding${conflicts.length === 1 ? "" : "s"} conflict${conflicts.length === 1 ? "s" : ""} with running containers.`,
+      details: conflicts.map(
+        (conflict) => `${conflict.service}: ${conflict.hostIp ?? "*"}:${conflict.hostPort}/${conflict.protocol} held by '${conflict.holderContainer}'` + (conflict.holderWorkspace ? ` (workspace '${conflict.holderWorkspace}')` : "")
+      ).join("; "),
+      suggestion: "Stop the holding workspace or change the consumer's own published binding, then run ensure again. Devrouter never rewrites consumer-declared host bindings."
+    };
+  } catch (error) {
+    return {
+      id: "repo.host-port-claims",
+      level: "warn",
+      summary: "Could not compare configured fixed host-port bindings against live holders.",
+      details: error instanceof Error ? error.message : String(error),
+      suggestion: "Check Docker availability; a managed ensure refuses on this evidence before starting."
+    };
+  }
+}
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path50.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs38.default.existsSync(devcontainerDir)) {
+  const devcontainerDir = import_node_path51.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs39.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path50.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path51.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -18584,9 +18995,9 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path50.default.join(devcontainerDir, "Dockerfile");
-  const dockerfileExists = import_node_fs38.default.existsSync(dockerfilePath);
-  const dockerfile = dockerfileExists ? import_node_fs38.default.readFileSync(dockerfilePath, "utf-8") : "";
+  const dockerfilePath = import_node_path51.default.join(devcontainerDir, "Dockerfile");
+  const dockerfileExists = import_node_fs39.default.existsSync(dockerfilePath);
+  const dockerfile = dockerfileExists ? import_node_fs39.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
     (artifact) => dockerfile.includes(artifact)
   );
@@ -18623,6 +19034,9 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     });
     return checks;
   }
+  if (config.managedRuntime) {
+    checks.push(buildHostPortClaimsCheck(repoPath, workspace));
+  }
   const aliasSet = new Set(
     compose.aliases.flatMap((alias) => expandAliasCandidates(alias, workspace)).map(normalizeWorkspaceToken)
   );
@@ -18641,14 +19055,19 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs38, import_node_path50, import_yaml5;
+var import_node_fs39, import_node_path51, import_yaml5;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
-    import_node_fs38 = __toESM(require("fs"));
-    import_node_path50 = __toESM(require("path"));
+    import_node_fs39 = __toESM(require("fs"));
+    import_node_path51 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
+    init_devcontainer_profile();
+    init_host_port_claims();
     init_managed_post_start();
+    init_repo_config();
+    init_workspace();
+    init_workspace_ownership();
   }
 });
 
@@ -18736,11 +19155,11 @@ function reconcileRouteRunConflict(repoPath, app) {
     }
   }
 }
-var import_node_fs39;
+var import_node_fs40;
 var init_route_state = __esm({
   "src/core/route-state.ts"() {
     "use strict";
-    import_node_fs39 = __toESM(require("fs"));
+    import_node_fs40 = __toESM(require("fs"));
     init_host_routes();
     init_workspace();
   }
@@ -18915,7 +19334,7 @@ function toRepoStatus(repoPath) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
   const explicitRepo = typeof repoPath === "string" && repoPath.trim().length > 0;
-  const configExists = import_node_fs40.default.existsSync(configPath);
+  const configExists = import_node_fs41.default.existsSync(configPath);
   if (!explicitRepo && !configExists) {
     return void 0;
   }
@@ -19063,11 +19482,11 @@ async function collectRouterStatus(repoPath) {
     }
   };
 }
-var import_node_fs40;
+var import_node_fs41;
 var init_status = __esm({
   "src/core/status.ts"() {
     "use strict";
-    import_node_fs40 = __toESM(require("fs"));
+    import_node_fs41 = __toESM(require("fs"));
     init_docker();
     init_managed_runtime_state();
     init_managed_runtime_status();
@@ -19084,7 +19503,7 @@ function outputFromResult(result) {
   return output2.length > 0 ? output2 : void 0;
 }
 function runTool(command, args = []) {
-  const result = (0, import_node_child_process28.spawnSync)(command, args, {
+  const result = (0, import_node_child_process29.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.error) {
@@ -19141,12 +19560,12 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path51.default.join(repoPath, "package.json");
-  if (!import_node_fs41.default.existsSync(packagePath)) {
+  const packagePath = import_node_path52.default.join(repoPath, "package.json");
+  if (!import_node_fs42.default.existsSync(packagePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs41.default.readFileSync(packagePath, "utf-8"));
+    return JSON.parse(import_node_fs42.default.readFileSync(packagePath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -19330,13 +19749,13 @@ function buildGlobalToolChecksWithoutTelemetry(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process28, import_node_fs41, import_node_path51, DEVSY_DISABLE_TELEMETRY;
+var import_node_child_process29, import_node_fs42, import_node_path52, DEVSY_DISABLE_TELEMETRY;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
-    import_node_child_process28 = require("child_process");
-    import_node_fs41 = __toESM(require("fs"));
-    import_node_path51 = __toESM(require("path"));
+    import_node_child_process29 = require("child_process");
+    import_node_fs42 = __toESM(require("fs"));
+    import_node_path52 = __toESM(require("path"));
     init_devsy_agent();
     init_workspace_runtime();
     DEVSY_DISABLE_TELEMETRY = "DEVSY_DISABLE_TELEMETRY";
@@ -19353,10 +19772,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path52.default.join(comparableRepo, "trees") + import_node_path52.default.sep;
+  const localRoot = import_node_path53.default.join(comparableRepo, "trees") + import_node_path53.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path52.default.basename(comparableRepo)}-`;
-  return import_node_path52.default.dirname(comparableWorktree) === import_node_path52.default.dirname(comparableRepo) && import_node_path52.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path53.default.basename(comparableRepo)}-`;
+  return import_node_path53.default.dirname(comparableWorktree) === import_node_path53.default.dirname(comparableRepo) && import_node_path53.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -19608,11 +20027,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path52;
+var import_node_path53;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path52 = __toESM(require("path"));
+    import_node_path53 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -19682,11 +20101,11 @@ function inspectPostgresCredentials(repoPath, config) {
         parseErrors.push(`${app.name}: ${composeFile} (${message})`);
         continue;
       }
-      if (!import_node_fs42.default.existsSync(absolutePath)) {
+      if (!import_node_fs43.default.existsSync(absolutePath)) {
         continue;
       }
       try {
-        const raw = import_node_fs42.default.readFileSync(absolutePath, "utf-8");
+        const raw = import_node_fs43.default.readFileSync(absolutePath, "utf-8");
         const parsed = import_yaml6.default.parse(raw);
         const root = asRecord2(parsed);
         const services = asRecord2(root?.services);
@@ -19966,7 +20385,7 @@ async function buildDoctorReport(options = {}) {
       const config = runtimeConfig.config;
       loadedConfig = config;
       loadedWorkspace = runtimeConfig.workspace;
-      const cliVersion = true ? "0.0.68" : "0.0.0-dev";
+      const cliVersion = true ? "0.0.69" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       if (configVersion && cliVersion !== "0.0.0-dev" && compareSemver(configVersion, cliVersion) > 0) {
         addCheck(checks, {
@@ -19996,9 +20415,9 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path53.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path54.default.resolve(repo.path, filePath)
         }))
-      ).filter((entry) => !import_node_fs42.default.existsSync(entry.absolutePath));
+      ).filter((entry) => !import_node_fs43.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.compose-files",
         level: missingComposeFiles.length === 0 ? "ok" : "error",
@@ -20041,8 +20460,8 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path53.default.resolve(repo.path, app.hostRun.cwd)
-      })).filter((entry) => !import_node_fs42.default.existsSync(entry.absolutePath));
+        absolutePath: import_node_path54.default.resolve(repo.path, app.hostRun.cwd)
+      })).filter((entry) => !import_node_fs43.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
         level: missingHostCwds.length === 0 ? "ok" : "error",
@@ -20186,12 +20605,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs42, import_node_path53, import_yaml6, POSTGRES_DEFAULTS;
+var import_node_fs43, import_node_path54, import_yaml6, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
-    import_node_fs42 = __toESM(require("fs"));
-    import_node_path53 = __toESM(require("path"));
+    import_node_fs43 = __toESM(require("fs"));
+    import_node_path54 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_docker();
     init_host_routes();
@@ -20507,12 +20926,12 @@ function parseSsPortListeners(stdout, port) {
   return listeners;
 }
 function findPortListeners(port) {
-  const result = (0, import_node_child_process29.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+  const result = (0, import_node_child_process30.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process29.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process30.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsPortListeners(ssResult.stdout, port);
       }
@@ -20541,11 +20960,11 @@ function findPortListeners(port) {
     };
   });
 }
-var import_node_child_process29;
+var import_node_child_process30;
 var init_ports = __esm({
   "src/util/ports.ts"() {
     "use strict";
-    import_node_child_process29 = require("child_process");
+    import_node_child_process30 = require("child_process");
   }
 });
 
@@ -20632,14 +21051,33 @@ async function runEnsureCommand(options) {
     profile: options.profile,
     ...options.repair ? { repair: true } : {}
   });
+  const conflicts = result.hostPortConflicts ?? [];
   const applicationFailed = result.applicationReadiness?.status === "application-error";
-  if (applicationFailed) process.exitCode = 1;
+  if (applicationFailed || conflicts.length > 0) process.exitCode = 1;
   if (options.json) {
     process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
     return;
   }
   const label2 = result.kind === "primary" ? `Primary checkout [profile: ${result.profile}]` : `Workspace '${result.workspace}' [profile: ${result.profile}]`;
+  if (conflicts.length > 0) {
+    const lines = conflicts.map((conflict) => {
+      const desired = `${conflict.hostIp ?? "*"}:${conflict.hostPort}/${conflict.protocol}`;
+      const holder = [
+        `'${conflict.holderContainer}'`,
+        conflict.holderComposeProject ? `compose project '${conflict.holderComposeProject}'` : void 0,
+        conflict.holderWorkspace ? `workspace '${conflict.holderWorkspace}'` : void 0
+      ].filter(Boolean).join(", ");
+      return `  - service '${conflict.service}' needs ${desired}, held by ${holder}
+    ${conflict.remediation}`;
+    });
+    process.stdout.write(
+      `${label2} was not started: ${conflicts.length} fixed host-port claim${conflicts.length === 1 ? "" : "s"} conflict${conflicts.length === 1 ? "s" : ""} with running containers.
+${lines.join("\n")}
+`
+    );
+    return;
+  }
   const routes = result.urls.map((url) => `  ${url}`).join("\n");
   process.stdout.write(
     `${label2} ${applicationFailed ? "has available infrastructure but failed its application readiness contract" : "is ready"} (${result.devpodId}).
@@ -20891,7 +21329,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process30.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process31.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -20899,11 +21337,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process30;
+var import_node_child_process31;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process30 = require("child_process");
+    import_node_child_process31 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -20926,7 +21364,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process31.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process32.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -20940,17 +21378,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process31.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process32.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process31;
+var import_node_child_process32;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process31 = require("child_process");
+    import_node_child_process32 = require("child_process");
     init_docker();
     init_router();
   }
@@ -20990,17 +21428,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs43.default.existsSync(filePath)) {
+  if (!import_node_fs44.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs43.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs44.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path54.default.relative(repoPath, filePath) || ".";
+  return import_node_path55.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -21041,7 +21479,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs43.default.existsSync(import_node_path54.default.join(repoPath, fileName))) {
+    if (import_node_fs44.default.existsSync(import_node_path55.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -21056,9 +21494,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path54.default.join(repoPath, ".nvmrc");
-  if (import_node_fs43.default.existsSync(nvmrc)) {
-    const version = import_node_fs43.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path55.default.join(repoPath, ".nvmrc");
+  if (import_node_fs44.default.existsSync(nvmrc)) {
+    const version = import_node_fs44.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -21119,7 +21557,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path54.default.isAbsolute(fileName) && !import_node_path54.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path55.default.isAbsolute(fileName) && !import_node_path55.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -21137,7 +21575,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs43.default.existsSync(import_node_path54.default.join(repoPath, fileName))
+    (fileName) => import_node_fs44.default.existsSync(import_node_path55.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -21175,7 +21613,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml7.default.parse(import_node_fs43.default.readFileSync(import_node_path54.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml7.default.parse(import_node_fs44.default.readFileSync(import_node_path55.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -21210,8 +21648,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs43.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs43.default.readFileSync(import_node_path54.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs44.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs44.default.readFileSync(import_node_path55.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -21225,18 +21663,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path54.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs43.default.existsSync(dir)) {
+  const dir = import_node_path55.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs44.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs43.default.readdirSync(dir).filter((fileName) => import_node_fs43.default.statSync(import_node_path54.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs44.default.readdirSync(dir).filter((fileName) => import_node_fs44.default.statSync(import_node_path55.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs43.default.existsSync(configPath)) {
+  if (!import_node_fs44.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -21280,15 +21718,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs43.default.existsSync(import_node_path54.default.join(repoPath, fileName))) {
+    if (import_node_fs44.default.existsSync(import_node_path55.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path54.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs43.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs43.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path54.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs43.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path55.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs44.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs44.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path55.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs44.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -21331,7 +21769,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path54.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path55.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -21350,12 +21788,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs43, import_node_path54, import_yaml7;
+var import_node_fs44, import_node_path55, import_yaml7;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs43 = __toESM(require("fs"));
-    import_node_path54 = __toESM(require("path"));
+    import_node_fs44 = __toESM(require("fs"));
+    import_node_path55 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -21460,7 +21898,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs44.default.existsSync(import_node_path55.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs45.default.existsSync(import_node_path56.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -21685,12 +22123,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs44, import_node_path55;
+var import_node_fs45, import_node_path56;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs44 = __toESM(require("fs"));
-    import_node_path55 = __toESM(require("path"));
+    import_node_fs45 = __toESM(require("fs"));
+    import_node_path56 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -21987,7 +22425,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path56.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path57.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -22032,8 +22470,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path56.default.join(repoPath, file.relativePath);
-  if (!import_node_fs45.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path57.default.join(repoPath, file.relativePath);
+  if (!import_node_fs46.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -22041,7 +22479,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs45.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs46.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -22098,11 +22536,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path56.default.join(repoPath, file.relativePath);
-  import_node_fs45.default.mkdirSync(import_node_path56.default.dirname(absolutePath), { recursive: true });
-  import_node_fs45.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path57.default.join(repoPath, file.relativePath);
+  import_node_fs46.default.mkdirSync(import_node_path57.default.dirname(absolutePath), { recursive: true });
+  import_node_fs46.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs45.default.chmodSync(absolutePath, 493);
+    import_node_fs46.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -22140,12 +22578,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs45, import_node_path56, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs46, import_node_path57, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs45 = __toESM(require("fs"));
-    import_node_path56 = __toESM(require("path"));
+    import_node_fs46 = __toESM(require("fs"));
+    import_node_path57 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -22258,11 +22696,11 @@ var init_repo_devcontainer = __esm({
 function fail3(message) {
   throw new Error(message);
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requireRecord(value, label2) {
-  if (!isRecord6(value)) fail3(`${label2} must be a mapping.`);
+  if (!isRecord7(value)) fail3(`${label2} must be a mapping.`);
   return value;
 }
 function requireExactKeys(value, allowed, label2) {
@@ -22479,13 +22917,13 @@ function buildProfilePlanReport(options) {
   return { ...report, contractPath, bindings };
 }
 function loadContract(repoPath, contractPath) {
-  if (import_node_path57.default.isAbsolute(contractPath)) {
+  if (import_node_path58.default.isAbsolute(contractPath)) {
     fail3("profile plan contract path must be relative to the repository.");
   }
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs46.default.lstatSync(absolutePath);
+    metadata = import_node_fs47.default.lstatSync(absolutePath);
   } catch (error) {
     fail3(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -22495,16 +22933,16 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs46.default.realpathSync(repoPath);
-  const realContract = import_node_fs46.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs47.default.realpathSync(repoPath);
+  const realContract = import_node_fs47.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs46.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs47.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
   return {
     contract: parseProfilePlanContract(source),
-    contractPath: import_node_path57.default.relative(repoPath, absolutePath).split(import_node_path57.default.sep).join("/")
+    contractPath: import_node_path58.default.relative(repoPath, absolutePath).split(import_node_path58.default.sep).join("/")
   };
 }
 function resolveProfilePlan(options) {
@@ -22518,12 +22956,12 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs46, import_node_path57, import_yaml8, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs47, import_node_path58, import_yaml8, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs46 = __toESM(require("fs"));
-    import_node_path57 = __toESM(require("path"));
+    import_node_fs47 = __toESM(require("fs"));
+    import_node_path58 = __toESM(require("path"));
     import_yaml8 = require("yaml");
     init_paths();
     init_profile_resolution();
@@ -22555,7 +22993,7 @@ async function runProfileResolveCommand(options) {
 async function runProfilePlanCommand(options) {
   const report = resolveProfilePlan(options);
   if (options.output) {
-    writeFileAtomically(import_node_path58.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
+    writeFileAtomically(import_node_path59.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
 `);
   }
   if (options.json) {
@@ -22591,14 +23029,14 @@ function printProfilePlanSummary(report, output2) {
     process.stdout.write(`Binding ${key}: ${renderValues(report.bindings[key] ?? [])}
 `);
   }
-  if (output2) process.stdout.write(`Output: ${import_node_path58.default.resolve(output2)}
+  if (output2) process.stdout.write(`Output: ${import_node_path59.default.resolve(output2)}
 `);
 }
-var import_node_path58;
+var import_node_path59;
 var init_profile = __esm({
   "src/commands/profile.ts"() {
     "use strict";
-    import_node_path58 = __toESM(require("path"));
+    import_node_path59 = __toESM(require("path"));
     init_atomic_file();
     init_output();
     init_profile_plan();
@@ -22888,7 +23326,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto26.createHash)("sha1").update(import_node_path59.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto26.createHash)("sha1").update(import_node_path60.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -22967,11 +23405,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path59.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs47.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path59.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path60.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs48.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path60.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs47.default.writeFileSync(overlayPath, import_yaml9.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs48.default.writeFileSync(overlayPath, import_yaml9.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -22985,7 +23423,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process32.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process33.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -23013,7 +23451,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process32.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process33.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -23039,7 +23477,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process32.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process33.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -23065,7 +23503,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process32.spawnSync)("docker", args, {
+  (0, import_node_child_process33.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -23077,7 +23515,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process32.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process33.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -23091,14 +23529,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process32, import_node_crypto26, import_node_fs47, import_node_path59, import_yaml9;
+var import_node_child_process33, import_node_crypto26, import_node_fs48, import_node_path60, import_yaml9;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process32 = require("child_process");
+    import_node_child_process33 = require("child_process");
     import_node_crypto26 = require("crypto");
-    import_node_fs47 = __toESM(require("fs"));
-    import_node_path59 = __toESM(require("path"));
+    import_node_fs48 = __toESM(require("fs"));
+    import_node_path60 = __toESM(require("path"));
     import_yaml9 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -23188,7 +23626,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process33.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process34.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -23299,12 +23737,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process33.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process34.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process33.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process34.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -23363,7 +23801,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process33.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process34.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -23731,7 +24169,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process33.spawn)(wrapped, {
+        child = (0, import_node_child_process34.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -23745,7 +24183,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process33.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process34.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -23753,7 +24191,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process33.spawn)(options.command[0], {
+      child = (0, import_node_child_process34.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -23761,7 +24199,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process33.spawn)(command, args, {
+      child = (0, import_node_child_process34.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -23782,11 +24220,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process33, import_node_net5, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process34, import_node_net5, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process33 = require("child_process");
+    import_node_child_process34 = require("child_process");
     import_node_net5 = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -23920,13 +24358,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs48.default.lstatSync(worktreePath);
+    rootStat = import_node_fs49.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs48.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs49.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -23952,10 +24390,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path60.default.join(dirPath, entry.name);
+      const entryPath = import_node_path61.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs48.default.lstatSync(entryPath);
+        entryStat = import_node_fs49.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -23965,7 +24403,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs48.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs49.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -24029,12 +24467,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs48, import_node_path60, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs49, import_node_path61, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs48 = __toESM(require("fs"));
-    import_node_path60 = __toESM(require("path"));
+    import_node_fs49 = __toESM(require("fs"));
+    import_node_path61 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -24042,7 +24480,7 @@ var init_workspace_consumption = __esm({
 });
 
 // src/core/workspace-cleanup.ts
-function isRecord7(value) {
+function isRecord8(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isSha(value) {
@@ -24135,7 +24573,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs49.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs50.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -24186,14 +24624,14 @@ function parseGitHubChanges(value, project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord7(item)) return void 0;
-    const repository = isRecord7(item.repository) ? item.repository.nameWithOwner : void 0;
-    const headRepository = isRecord7(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
+    if (!isRecord8(item)) return void 0;
+    const repository = isRecord8(item.repository) ? item.repository.nameWithOwner : void 0;
+    const headRepository = isRecord8(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
     if (repository !== project || headRepository !== project || item.headRefName !== branch || !isSha(item.headRefOid) || typeof item.baseRefName !== "string") {
       continue;
     }
     const merged = item.state === "MERGED" && validTimestamp(item.mergedAt);
-    const mergeCommit = isRecord7(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
+    const mergeCommit = isRecord8(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
     const baseSha = isSha(item.baseRefOid) ? item.baseRefOid : void 0;
     changes.push({
       sourceBranch: branch,
@@ -24210,14 +24648,14 @@ function parseGitLabChanges(value, _project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord7(item)) return void 0;
+    if (!isRecord8(item)) return void 0;
     const sourceProjectId = item.source_project_id;
     const targetProjectId = item.target_project_id;
     const sameProject = typeof sourceProjectId === "number" && typeof targetProjectId === "number" && sourceProjectId === targetProjectId;
     if (!sameProject || item.source_branch !== branch || !isSha(item.sha) || typeof item.target_branch !== "string") {
       continue;
     }
-    const diffRefs = isRecord7(item.diff_refs) ? item.diff_refs : void 0;
+    const diffRefs = isRecord8(item.diff_refs) ? item.diff_refs : void 0;
     const mergeCommitSha = isSha(item.merge_commit_sha) ? item.merge_commit_sha : void 0;
     const baseSha = diffRefs && isSha(diffRefs.base_sha) ? diffRefs.base_sha : void 0;
     changes.push({
@@ -24660,7 +25098,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers2 = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers2 = new Map(worktreePaths.map((path61) => [path61, unknownContainers(reason)]));
+      containers2 = new Map(worktreePaths.map((path62) => [path62, unknownContainers(reason)]));
     }
   }
   const rows2 = records.map((record5) => {
@@ -24710,12 +25148,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     networkCapacity: (dependencies.inspectNetworkCapacity ?? inspectNetworkCapacity)()
   };
 }
-var import_node_child_process34, import_node_fs49, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process35, import_node_fs50, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process34 = require("child_process");
-    import_node_fs49 = __toESM(require("fs"));
+    import_node_child_process35 = require("child_process");
+    import_node_fs50 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_network_diagnostics();
@@ -24733,7 +25171,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process34.spawnSync)(command, args, {
+      const result = (0, import_node_child_process35.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -24827,20 +25265,20 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path61.default.join(mainRepo, "trees", ws);
+  return import_node_path62.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process35.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path61.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path61.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path62.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path62.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path61.default.join(import_node_path61.default.dirname(mainRepo), `${import_node_path61.default.basename(mainRepo)}-${ws}`);
+  return import_node_path62.default.join(import_node_path62.default.dirname(mainRepo), `${import_node_path62.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -24952,13 +25390,13 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs50.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs51.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
     );
   }
-  const status = (0, import_node_child_process35.spawnSync)(
+  const status = (0, import_node_child_process36.spawnSync)(
     "git",
     ["-C", target.worktreePath, "status", "--porcelain", "--untracked-files=normal"],
     { encoding: "utf-8" }
@@ -24992,9 +25430,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs50.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs51.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path61.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path62.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -25003,7 +25441,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs50.default.existsSync(selectedPath)) {
+    if (import_node_fs51.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -25022,11 +25460,11 @@ async function workspaceUp(branch, opts = {}) {
       return selectedPath;
     }
     if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
-    const add = (0, import_node_child_process35.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
+    const add = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process35.spawnSync)(
+      const addNew = (0, import_node_child_process36.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
         { encoding: "utf-8" }
@@ -25160,8 +25598,8 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     const result = await mutateWorkspaceRuntime("delete", resolved, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs50.default.existsSync(resolved.worktreePath)) {
-        const rm = (0, import_node_child_process35.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs51.default.existsSync(resolved.worktreePath)) {
+        const rm = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -25179,7 +25617,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs50.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs51.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
 }
 async function workspaceStop(target, opts = {}) {
   return runWorkspaceLifecycle("stop", target, opts);
@@ -25187,13 +25625,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process35, import_node_fs50, import_node_path61, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process36, import_node_fs51, import_node_path62, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process35 = require("child_process");
-    import_node_fs50 = __toESM(require("fs"));
-    import_node_path61 = __toESM(require("path"));
+    import_node_child_process36 = require("child_process");
+    import_node_fs51 = __toESM(require("fs"));
+    import_node_path62 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_devsy_mutation();
@@ -25377,7 +25815,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.68" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.0.69" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -25747,13 +26185,13 @@ workspaceCommand2.command("down").description("Delete a workspace's runtime and
     await runWorkspaceDownCommand2(target, options);
   })
 );
-workspaceCommand2.command("journal settle").description(
+workspaceCommand2.command("journal").description("Inspect and recover workspace lifecycle journals").command("settle").description(
   "Settle an interrupted lifecycle operation as unobservable so ensure and stop can proceed"
 ).argument("[path]", "Checkout path (defaults to current directory)").option("--json", "Output JSON").action(
-  withErrorHandling(async (path61, _options, command) => {
+  withErrorHandling(async (path62, _options, command) => {
     const options = command.opts();
     const { runWorkspaceJournalSettleCommand: runWorkspaceJournalSettleCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
-    await runWorkspaceJournalSettleCommand2({ ...path61 ? { path: path61 } : {}, ...options });
+    await runWorkspaceJournalSettleCommand2({ ...path62 ? { path: path62 } : {}, ...options });
   })
 );
 function parseVersionRequest(argv) {