@devrouter/cli 0.0.68 → 0.0.70

package/dist/devrouter-lifecycle-worker.js

@@ -23,7 +23,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/devpod-exec.ts
-var import_node_child_process28 = require("child_process");
+var import_node_child_process29 = require("child_process");
 var import_node_crypto21 = require("crypto");
 
 // src/core/devpod-environment.ts
@@ -1769,7 +1769,7 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 }
 
 // src/core/devsy-exec.ts
-var import_node_child_process27 = require("child_process");
+var import_node_child_process28 = require("child_process");
 
 // src/core/devsy-exec-proof.ts
 var import_node_fs6 = __toESM(require("fs"));
@@ -1858,7 +1858,7 @@ function revalidateDevsyExecProof(repoPath, proof) {
 
 // src/core/devsy-mutation.ts
 var import_node_child_process15 = require("child_process");
-var import_node_fs19 = __toESM(require("fs"));
+var import_node_fs20 = __toESM(require("fs"));
 var import_node_path24 = __toESM(require("path"));
 
 // src/core/devsy-agent.ts
@@ -2018,6 +2018,7 @@ function requireReadyDevsyAgent(options = {}) {
 }
 
 // src/core/managed-devsy-stop.ts
+var import_node_fs16 = __toESM(require("fs"));
 var import_node_os4 = __toESM(require("os"));
 var import_node_path20 = __toESM(require("path"));
 var import_node_util4 = require("util");
@@ -5158,7 +5159,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs14.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.68" : "0.0.0-dev";
+    const cliVersion = true ? "0.0.70" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5682,12 +5683,108 @@ function containerIdentity(container) {
     mounts: container.mounts.map((mount) => JSON.stringify(mount)).sort()
   });
 }
+function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
+  if (!import_node_fs16.default.existsSync(import_node_path20.default.join(repoPath, ".devrouter.yml"))) return false;
+  const linked = isLinkedWorktree(repoPath);
+  const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+  const registration2 = () => {
+    resetWorkspaceRuntimeCaches();
+    if (resolveWorkspaceRuntimeOrDefault(repoPath) !== "devsy")
+      throw new Error("Initial managed stop provider selection changed.");
+    const owner2 = inspectDevsyWorkspaceOwnership(listDevsyWorkspaces(), devsyId, repoPath);
+    if (owner2.status !== "owned")
+      throw new Error("Initial managed stop requires one exact Devsy registration.");
+    if (linked) {
+      const record5 = workspace ? readWorkspaceOwnership(repoPath, workspace) : void 0;
+      if (!record5 || record5.devpodId !== devsyId || !sameWorkspacePath(record5.worktreePath, repoPath) || resolveWorktreeWorkspace(repoPath) !== workspace)
+        throw new Error("Initial managed stop workspace ownership changed.");
+    }
+    return owner2.workspace;
+  };
+  const runtime = loadRuntimeConfig(repoPath, workspace ?? "");
+  if (!runtime.config.managedRuntime) return false;
+  const owner = registration2();
+  if (!owner.context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(owner.context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId))
+    throw new Error("Initial managed stop requires exact provider context.");
+  const plan = inspectManagedDevcontainerConfig({
+    repoPath,
+    config: runtime.config,
+    profile: runtime.resolvedProfile,
+    linked
+  });
+  const providerRoot = import_node_path20.default.resolve(process.env.DEVSY_HOME || import_node_path20.default.join(import_node_os4.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path20.default.join(
+    providerRoot,
+    "contexts",
+    owner.context,
+    "workspaces",
+    devsyId,
+    "agent",
+    ".docker-compose"
+  );
+  const observe = () => {
+    if (!(0, import_node_util4.isDeepStrictEqual)(registration2(), owner) || readManagedRuntimeState(repoPath, workspace))
+      throw new Error("Initial managed stop ownership or runtime state changed.");
+    const matches = inspectWorkspaceContainers().filter(
+      (c) => sameWorkspacePath(
+        c.labels["com.docker.compose.project.working_dir"] ?? "",
+        plan.composeDirectory
+      )
+    );
+    if (!matches.length) return [];
+    const projects = new Set(matches.map((c) => c.labels["com.docker.compose.project"]));
+    if (projects.size !== 1 || !matches[0]?.labels["com.docker.compose.project"])
+      throw new Error("Initial managed stop requires one exact Compose project.");
+    const population = inspectManagedStopContainers(
+      matches[0].labels["com.docker.compose.project"]
+    );
+    if (!sameSet(
+      matches.map((c) => c.id),
+      population.map((c) => c.id)
+    ))
+      throw new Error("Initial managed stop population changed.");
+    proveManagedComposePopulation({
+      plan,
+      repoPath,
+      composeProject: matches[0].labels["com.docker.compose.project"],
+      providerRoot,
+      featureDirectory,
+      containers: population
+    });
+    return population;
+  };
+  const initial = observe();
+  const stable = () => {
+    const current = observe();
+    if (!sameSet(
+      initial.map((c) => c.id),
+      current.map((c) => c.id)
+    ) || current.some((c) => {
+      const prior = initial.find((p) => p.id === c.id);
+      return !prior || containerIdentity(prior) !== containerIdentity(c) || !prior.state.Running && c.state.Running;
+    }))
+      throw new Error("Initial managed stop population or identity changed.");
+    return current;
+  };
+  stable();
+  if (!initial.length) return false;
+  for (const container of initial) {
+    const current = stable().find((c) => c.id === container.id);
+    if (current?.state.Running)
+      stopExactManagedService(current.id, current.labels["com.docker.compose.service"] ?? "", {
+        timeoutMs: 3e4
+      });
+  }
+  if (stable().some((c) => c.state.Running))
+    throw new Error("Initial managed stop left a workload running.");
+  return true;
+}
 function stopRetainedManagedDevsyWorkspace(options) {
   const { repoPath, devsyId } = options;
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
   const retainedState = readManagedRuntimeState(repoPath, workspace);
-  if (!retainedState) return false;
+  if (!retainedState) return stopInitialManagedDevsyWorkspace(repoPath, devsyId);
   const state = retainedState;
   if (state.devpodId !== devsyId || linked && !workspace) {
     throw new Error("Managed stop requires the exact retained workspace identity.");
@@ -5917,12 +6014,12 @@ function networkProviderEnvironment(binding, source) {
 
 // src/core/network-claim-lookup.ts
 var import_node_crypto10 = require("crypto");
-var import_node_fs18 = __toESM(require("fs"));
+var import_node_fs19 = __toESM(require("fs"));
 var import_node_path23 = __toESM(require("path"));
 
 // src/core/network-claims.ts
 var import_node_crypto9 = require("crypto");
-var import_node_fs17 = __toESM(require("fs"));
+var import_node_fs18 = __toESM(require("fs"));
 var import_node_path22 = __toESM(require("path"));
 
 // src/core/network-capacity.ts
@@ -6264,7 +6361,7 @@ function overlaps(left, right) {
 }
 
 // src/core/network-policy.ts
-var import_node_fs16 = __toESM(require("fs"));
+var import_node_fs17 = __toESM(require("fs"));
 var import_node_path21 = __toESM(require("path"));
 var NETWORK_POLICY_VERSION = 1;
 var NETWORK_POLICY_FILE = import_node_path21.default.join(DEVROUTER_HOME, "network-policy.json");
@@ -6460,7 +6557,7 @@ function hasControlCharacter(value) {
 function readPolicyFile(filePath) {
   let initialStats;
   try {
-    initialStats = import_node_fs16.default.lstatSync(filePath);
+    initialStats = import_node_fs17.default.lstatSync(filePath);
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
@@ -6473,16 +6570,16 @@ function readPolicyFile(filePath) {
   }
   let fileDescriptor;
   try {
-    fileDescriptor = import_node_fs16.default.openSync(
+    fileDescriptor = import_node_fs17.default.openSync(
       filePath,
-      import_node_fs16.default.constants.O_RDONLY | import_node_fs16.default.constants.O_NONBLOCK | (import_node_fs16.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs17.default.constants.O_RDONLY | import_node_fs17.default.constants.O_NONBLOCK | (import_node_fs17.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
   }
   try {
-    const openedStats = import_node_fs16.default.fstatSync(fileDescriptor);
+    const openedStats = import_node_fs17.default.fstatSync(fileDescriptor);
     if (!openedStats.isFile()) {
       return { status: "invalid", error: "network policy must be a regular file" };
     }
@@ -6495,12 +6592,12 @@ function readPolicyFile(filePath) {
     const buffer = Buffer.alloc(openedStats.size);
     let offset = 0;
     while (offset < buffer.length) {
-      const bytesRead = import_node_fs16.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
+      const bytesRead = import_node_fs17.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
       if (bytesRead === 0)
         return { status: "invalid", error: "network policy changed during read" };
       offset += bytesRead;
     }
-    const finalStats = import_node_fs16.default.fstatSync(fileDescriptor);
+    const finalStats = import_node_fs17.default.fstatSync(fileDescriptor);
     if (!finalStats.isFile() || finalStats.size !== openedStats.size) {
       return { status: "invalid", error: "network policy changed during read" };
     }
@@ -6509,7 +6606,7 @@ function readPolicyFile(filePath) {
     return { status: "invalid", error: "network policy could not be read" };
   } finally {
     try {
-      import_node_fs16.default.closeSync(fileDescriptor);
+      import_node_fs17.default.closeSync(fileDescriptor);
     } catch {
     }
   }
@@ -6935,27 +7032,27 @@ function assertExactKeys(value, keys2) {
 function readDocument(store) {
   let descriptor;
   try {
-    descriptor = import_node_fs17.default.openSync(
+    descriptor = import_node_fs18.default.openSync(
       store.filePath,
-      import_node_fs17.default.constants.O_RDONLY | import_node_fs17.default.constants.O_NONBLOCK | (import_node_fs17.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs18.default.constants.O_RDONLY | import_node_fs18.default.constants.O_NONBLOCK | (import_node_fs18.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno2(error, "ENOENT")) return void 0;
     throw claimError("invalid-state", "network claim state could not be read");
   }
   try {
-    const stat = import_node_fs17.default.fstatSync(descriptor);
+    const stat = import_node_fs18.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES || (stat.mode & 63) !== 0) {
       throw claimError("invalid-state", "network claim state is not a bounded private file");
     }
     const buffer = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
     let count = 0;
     while (count < buffer.length) {
-      const bytesRead = import_node_fs17.default.readSync(descriptor, buffer, count, buffer.length - count, null);
+      const bytesRead = import_node_fs18.default.readSync(descriptor, buffer, count, buffer.length - count, null);
       if (bytesRead === 0) break;
       count += bytesRead;
     }
-    const finalStat = import_node_fs17.default.fstatSync(descriptor);
+    const finalStat = import_node_fs18.default.fstatSync(descriptor);
     if (count > NETWORK_CLAIMS_MAX_FILE_BYTES || finalStat.size !== stat.size) {
       throw claimError("invalid-state", "network claim state changed during read");
     }
@@ -6967,7 +7064,7 @@ function readDocument(store) {
     }
     return validateDocument(parsed, store.daemonId);
   } finally {
-    import_node_fs17.default.closeSync(descriptor);
+    import_node_fs18.default.closeSync(descriptor);
   }
 }
 function validateDocument(value, daemonId) {
@@ -7071,7 +7168,7 @@ function withStoreLock(daemonId, options, operation) {
   if (!Number.isSafeInteger(waitMs) || waitMs < 0 || waitMs > MAX_LOCK_WAIT_MS) {
     throw claimError("invalid-input", "network claim lock wait is invalid");
   }
-  import_node_fs17.default.mkdirSync(store.root, { recursive: true, mode: 448 });
+  import_node_fs18.default.mkdirSync(store.root, { recursive: true, mode: 448 });
   assertDirectory(store.root);
   return withFileLockSync(
     store.lockPath,
@@ -7102,7 +7199,7 @@ function validateRoot(root) {
 function assertDirectory(directory) {
   let stat;
   try {
-    stat = import_node_fs17.default.lstatSync(directory);
+    stat = import_node_fs18.default.lstatSync(directory);
   } catch {
     throw claimError("invalid-state", "network claim root could not be read");
   }
@@ -7144,7 +7241,7 @@ function networkOwnerKey(repoPath) {
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
   try {
-    names = import_node_fs18.default.readdirSync(root);
+    names = import_node_fs19.default.readdirSync(root);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw new Error("Network claims cannot be inspected; repair is required.");
@@ -7154,20 +7251,20 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let found;
   for (const file of files) {
     const full = import_node_path23.default.join(root, file);
-    const stat = import_node_fs18.default.lstatSync(full);
+    const stat = import_node_fs19.default.lstatSync(full);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES)
       throw new Error("Invalid retained network claim file.");
     let value;
-    const descriptor = import_node_fs18.default.openSync(
+    const descriptor = import_node_fs19.default.openSync(
       full,
-      import_node_fs18.default.constants.O_RDONLY | import_node_fs18.default.constants.O_NONBLOCK | import_node_fs18.default.constants.O_NOFOLLOW
+      import_node_fs19.default.constants.O_RDONLY | import_node_fs19.default.constants.O_NONBLOCK | import_node_fs19.default.constants.O_NOFOLLOW
     );
     try {
-      if (!import_node_fs18.default.fstatSync(descriptor).isFile()) throw new Error();
+      if (!import_node_fs19.default.fstatSync(descriptor).isFile()) throw new Error();
       const bytes2 = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
       let size = 0;
       while (size < bytes2.length) {
-        const count = import_node_fs18.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
+        const count = import_node_fs19.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
         if (!count) break;
         size += count;
       }
@@ -7177,7 +7274,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     } catch {
       throw new Error("Retained network claim could not be read safely.");
     } finally {
-      import_node_fs18.default.closeSync(descriptor);
+      import_node_fs19.default.closeSync(descriptor);
     }
     if (typeof value.daemonId !== "string" || `${(0, import_node_crypto10.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
@@ -7347,7 +7444,7 @@ function failedStartMayHaveAttached(devsyId, repoPath) {
   }
 }
 function withMutationLock(activity, target, operation) {
-  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -7361,7 +7458,7 @@ function withMutationLock(activity, target, operation) {
   );
 }
 function withMutationLockAsync(activity, target, operation) {
-  import_node_fs19.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -7598,7 +7695,7 @@ var ExecutionOutcomeError = class extends Error {
 
 // src/core/reliability-lifecycle.ts
 var import_node_crypto20 = require("crypto");
-var import_node_path38 = __toESM(require("path"));
+var import_node_path39 = __toESM(require("path"));
 var import_node_util6 = require("util");
 
 // src/core/capacity-accounting.ts
@@ -7656,11 +7753,11 @@ function evaluateCapacity(budgets, samples, charges, requested, nowMs, maxSample
 }
 
 // src/core/capacity-policy.ts
-var import_node_fs20 = __toESM(require("fs"));
+var import_node_fs21 = __toESM(require("fs"));
 var import_node_path25 = __toESM(require("path"));
 
 // src/core/capacity-store.ts
-var import_node_fs21 = __toESM(require("fs"));
+var import_node_fs22 = __toESM(require("fs"));
 var import_node_path26 = __toESM(require("path"));
 var MAX_BYTES = 1048576;
 var CapacitySnapshotChangedError = class extends Error {
@@ -7670,8 +7767,8 @@ var CapacitySnapshotChangedError = class extends Error {
   }
 };
 function assertPrivateDirectory(directoryPath) {
-  import_node_fs21.default.mkdirSync(directoryPath, { recursive: true, mode: 448 });
-  const directory = import_node_fs21.default.lstatSync(directoryPath);
+  import_node_fs22.default.mkdirSync(directoryPath, { recursive: true, mode: 448 });
+  const directory = import_node_fs22.default.lstatSync(directoryPath);
   if (!directory.isDirectory() || directory.isSymbolicLink() || directory.uid !== process.getuid?.() || (directory.mode & 63) !== 0)
     throw new Error("Capacity reservation directory is not private.");
 }
@@ -7762,24 +7859,24 @@ var CapacityStore = class {
   read() {
     let descriptor;
     try {
-      descriptor = import_node_fs21.default.openSync(this.file, import_node_fs21.default.constants.O_RDONLY | import_node_fs21.default.constants.O_NOFOLLOW);
+      descriptor = import_node_fs22.default.openSync(this.file, import_node_fs22.default.constants.O_RDONLY | import_node_fs22.default.constants.O_NOFOLLOW);
     } catch (error) {
       if (error.code === "ENOENT")
         return { version: 1, revision: 0, reservations: [] };
       throw error;
     }
     try {
-      const stat = import_node_fs21.default.fstatSync(descriptor);
+      const stat = import_node_fs22.default.fstatSync(descriptor);
       if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > MAX_BYTES)
         throw new Error("Unsafe capacity reservation snapshot.");
       const buffer = Buffer.alloc(MAX_BYTES + 1);
-      const count = import_node_fs21.default.readSync(descriptor, buffer, 0, buffer.length, 0);
+      const count = import_node_fs22.default.readSync(descriptor, buffer, 0, buffer.length, 0);
       if (count > MAX_BYTES) throw new Error("Capacity reservation snapshot exceeds byte limit.");
       const value = JSON.parse(buffer.subarray(0, count).toString("utf8"));
       validate(value);
       return value;
     } finally {
-      import_node_fs21.default.closeSync(descriptor);
+      import_node_fs22.default.closeSync(descriptor);
     }
   }
   /**
@@ -7966,7 +8063,7 @@ var CapacityStore = class {
 
 // src/core/controller-client.ts
 var import_node_crypto12 = require("crypto");
-var import_node_fs22 = __toESM(require("fs"));
+var import_node_fs23 = __toESM(require("fs"));
 var import_node_net2 = __toESM(require("net"));
 var import_node_path28 = __toESM(require("path"));
 
@@ -7981,7 +8078,7 @@ var CONTROLLER_PROFILE_RE = new RegExp(
 
 // src/core/controller-store.ts
 var import_node_crypto13 = require("crypto");
-var import_node_fs23 = __toESM(require("fs"));
+var import_node_fs24 = __toESM(require("fs"));
 var import_node_path29 = __toESM(require("path"));
 var CONTROLLER_SNAPSHOT_BYTES = 1048576;
 function fail() {
@@ -8094,22 +8191,22 @@ var ControllerStore = class {
   read() {
     let fd;
     try {
-      fd = import_node_fs23.default.openSync(
+      fd = import_node_fs24.default.openSync(
         this.file,
-        import_node_fs23.default.constants.O_RDONLY | import_node_fs23.default.constants.O_NOFOLLOW | import_node_fs23.default.constants.O_NONBLOCK
+        import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NOFOLLOW | import_node_fs24.default.constants.O_NONBLOCK
       );
     } catch (error) {
       if (error.code === "ENOENT") return void 0;
       throw new Error("Controller snapshot cannot be opened.");
     }
     try {
-      const stat = import_node_fs23.default.fstatSync(fd);
+      const stat = import_node_fs24.default.fstatSync(fd);
       if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > CONTROLLER_SNAPSHOT_BYTES)
         fail();
       const bytes2 = Buffer.alloc(CONTROLLER_SNAPSHOT_BYTES + 1);
       let length = 0;
       while (length < bytes2.length) {
-        const count = import_node_fs23.default.readSync(fd, bytes2, length, bytes2.length - length, null);
+        const count = import_node_fs24.default.readSync(fd, bytes2, length, bytes2.length - length, null);
         if (!count) break;
         length += count;
       }
@@ -8120,7 +8217,7 @@ var ControllerStore = class {
     } catch {
       throw new Error("Controller snapshot is unreadable or invalid.");
     } finally {
-      import_node_fs23.default.closeSync(fd);
+      import_node_fs24.default.closeSync(fd);
     }
   }
   persist(snapshot) {
@@ -8136,11 +8233,11 @@ var ControllerStore = class {
 ` !== contents)
         throw new Error("Controller snapshot commit failed.");
       for (const file of [this.file, this.directory]) {
-        const fd = import_node_fs23.default.openSync(file, import_node_fs23.default.constants.O_RDONLY | import_node_fs23.default.constants.O_NOFOLLOW);
+        const fd = import_node_fs24.default.openSync(file, import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NOFOLLOW);
         try {
-          import_node_fs23.default.fsyncSync(fd);
+          import_node_fs24.default.fsyncSync(fd);
         } finally {
-          import_node_fs23.default.closeSync(fd);
+          import_node_fs24.default.closeSync(fd);
         }
       }
     }
@@ -8936,11 +9033,11 @@ function stepReliability(state, event, nowMs) {
 
 // src/core/reliability-operation-store.ts
 var import_node_crypto14 = require("crypto");
-var import_node_fs24 = __toESM(require("fs"));
+var import_node_fs25 = __toESM(require("fs"));
 var import_node_path30 = __toESM(require("path"));
 var import_node_util5 = require("util");
 function installedCliVersion() {
-  return true ? "0.0.68" : "0.0.0-dev";
+  return true ? "0.0.70" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -9275,25 +9372,25 @@ function readReliabilityOperation(identity2) {
 function readBoundedPrivateJson(file, label) {
   let descriptor;
   try {
-    descriptor = import_node_fs24.default.openSync(
+    descriptor = import_node_fs25.default.openSync(
       file,
-      import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NOFOLLOW | import_node_fs24.default.constants.O_NONBLOCK
+      import_node_fs25.default.constants.O_RDONLY | import_node_fs25.default.constants.O_NOFOLLOW | import_node_fs25.default.constants.O_NONBLOCK
     );
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
   }
   try {
-    const stat = import_node_fs24.default.fstatSync(descriptor);
+    const stat = import_node_fs25.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
       throw new Error(`${label} is not a bounded private file.`);
     }
     const bytes2 = Buffer.alloc(MAX_RECORD_BYTES + 1);
-    const count = import_node_fs24.default.readSync(descriptor, bytes2, 0, bytes2.length, 0);
+    const count = import_node_fs25.default.readSync(descriptor, bytes2, 0, bytes2.length, 0);
     if (count > MAX_RECORD_BYTES) throw new Error(`${label} exceeds its byte limit.`);
     return JSON.parse(bytes2.subarray(0, count).toString("utf8"));
   } finally {
-    import_node_fs24.default.closeSync(descriptor);
+    import_node_fs25.default.closeSync(descriptor);
   }
 }
 function persist(record5) {
@@ -9308,23 +9405,23 @@ function persist(record5) {
   } catch (error) {
     const reread = readReliabilityOperation(record5.identity);
     if (!reread || JSON.stringify(reread) !== JSON.stringify(record5)) throw error;
-    const descriptor = import_node_fs24.default.openSync(file, import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NOFOLLOW);
+    const descriptor = import_node_fs25.default.openSync(file, import_node_fs25.default.constants.O_RDONLY | import_node_fs25.default.constants.O_NOFOLLOW);
     try {
-      import_node_fs24.default.fsyncSync(descriptor);
+      import_node_fs25.default.fsyncSync(descriptor);
     } finally {
-      import_node_fs24.default.closeSync(descriptor);
+      import_node_fs25.default.closeSync(descriptor);
     }
-    const directory = import_node_fs24.default.openSync(import_node_path30.default.dirname(file), "r");
+    const directory = import_node_fs25.default.openSync(import_node_path30.default.dirname(file), "r");
     try {
-      import_node_fs24.default.fsyncSync(directory);
+      import_node_fs25.default.fsyncSync(directory);
     } finally {
-      import_node_fs24.default.closeSync(directory);
+      import_node_fs25.default.closeSync(directory);
     }
   }
 }
 function updateReliabilityOperation(identity2, operation) {
   const file = reliabilityOperationPath(identity2);
-  import_node_fs24.default.mkdirSync(import_node_path30.default.dirname(file), { recursive: true, mode: 448 });
+  import_node_fs25.default.mkdirSync(import_node_path30.default.dirname(file), { recursive: true, mode: 448 });
   return withFileLockSync(`${file}.lock`, { activity: "reliability intent", waitMs: 2e3 }, () => {
     const record5 = readReliabilityOperation(identity2) ?? {
       version: 1,
@@ -9365,7 +9462,7 @@ function clearStartupWitness(identity2, fence) {
 // src/core/reliability-worker.ts
 var import_node_child_process16 = require("child_process");
 var import_node_crypto15 = require("crypto");
-var import_node_fs25 = __toESM(require("fs"));
+var import_node_fs26 = __toESM(require("fs"));
 var import_node_path31 = __toESM(require("path"));
 var DEFAULT_OUTPUT_PAGE_BYTES = 48 * 1024;
 function workerGroupAbsent(pid) {
@@ -9379,7 +9476,7 @@ function workerGroupAbsent(pid) {
 
 // src/core/traefik-route-health.ts
 var import_node_child_process17 = require("child_process");
-var import_node_fs26 = __toESM(require("fs"));
+var import_node_fs27 = __toESM(require("fs"));
 var import_node_path32 = __toESM(require("path"));
 var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
 var ROUTER_RELOAD_LOCK_FILE = import_node_path32.default.join(DEVROUTER_HOME, "router-reload.lock");
@@ -9651,7 +9748,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs26.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs27.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -9702,20 +9799,20 @@ function assertTraefikRoutesRemoved(routes) {
 }
 
 // src/core/workspace-ensure.ts
-var import_node_child_process26 = require("child_process");
-var import_node_fs32 = __toESM(require("fs"));
-var import_node_path37 = __toESM(require("path"));
+var import_node_child_process27 = require("child_process");
+var import_node_fs33 = __toESM(require("fs"));
+var import_node_path38 = __toESM(require("path"));
 
 // src/core/devpod-mutation.ts
 var import_node_child_process18 = require("child_process");
-var import_node_fs27 = __toESM(require("fs"));
+var import_node_fs28 = __toESM(require("fs"));
 var import_node_path33 = __toESM(require("path"));
 var DEVPOD_MUTATION_LOCK_FILE = import_node_path33.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
 var DEVPOD_MUTATION_WAIT_MS = 18e5;
 var DevpodStartPostconditionError = class extends Error {
 };
 function withMutationLock2(activity, target, operation) {
-  import_node_fs27.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs28.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -9916,8 +10013,274 @@ async function startDevpodWorkspace(options) {
   });
 }
 
-// src/core/http-route-probe.ts
+// src/core/host-port-claims.ts
 var import_node_child_process19 = require("child_process");
+var import_node_path34 = __toESM(require("path"));
+var COMPOSE_RENDER_TIMEOUT_MS = 3e4;
+var COMPOSE_RENDER_MAX_BUFFER = 8 * 1024 * 1024;
+var DOCKER_TIMEOUT_MS = 1e4;
+var DOCKER_MAX_BUFFER = 1024 * 1024;
+var MAX_DESIRED_HOST_PORTS = 1024;
+var MAX_RUNNING_HOLDERS = 512;
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function optionalLabel(labels, key) {
+  const value = isRecord4(labels) ? labels[key] : void 0;
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function normalizeHostIp(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (trimmed.length === 0 || trimmed === "0.0.0.0" || trimmed === "::") return null;
+  return trimmed;
+}
+function parseSinglePortValue(value, service, label) {
+  if (typeof value === "number") {
+    if (!Number.isInteger(value) || value <= 0 || value > 65535) {
+      throw new Error(`Service '${service}' has an out-of-range ${label} port.`);
+    }
+    return value;
+  }
+  if (typeof value === "string") {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+      throw new Error(`Service '${service}' has an out-of-range ${label} port '${value}'.`);
+    }
+    return parsed;
+  }
+  throw new Error(`Service '${service}' has an unsupported ${label} port value.`);
+}
+function parseFixedPublishedPort(value, service) {
+  if (value === void 0 || value === null || value === "" || value === 0 || value === "0") {
+    return null;
+  }
+  if (typeof value === "string" && value.includes("-")) {
+    return null;
+  }
+  return parseSinglePortValue(value, service, "published host");
+}
+function parsePublishedRange(value, service) {
+  const match = /^(\d+)-(\d+)$/.exec(value.trim());
+  if (!match) return void 0;
+  const lower = Number(match[1]);
+  const upper = Number(match[2]);
+  if (!Number.isInteger(lower) || !Number.isInteger(upper) || lower <= 0 || upper < lower || upper > 65535) {
+    throw new Error(`Service '${service}' publishes an invalid host port range '${value}'.`);
+  }
+  return [lower, upper];
+}
+function resolveFixedPublishedHostPorts(renderedConfig) {
+  const services = isRecord4(renderedConfig) ? renderedConfig.services : void 0;
+  const bindings = [];
+  const pushBinding = (binding) => {
+    bindings.push(binding);
+    if (bindings.length > MAX_DESIRED_HOST_PORTS) {
+      throw new Error(
+        `The managed Compose model declares more than ${MAX_DESIRED_HOST_PORTS} fixed host ports.`
+      );
+    }
+  };
+  for (const [service, serviceValue] of Object.entries(isRecord4(services) ? services : {})) {
+    const serviceRecord = isRecord4(serviceValue) ? serviceValue : {};
+    if (!Array.isArray(serviceRecord.ports)) continue;
+    for (const port of serviceRecord.ports) {
+      if (!isRecord4(port)) {
+        throw new Error(`Service '${service}' declares an unsupported port entry.`);
+      }
+      parseSinglePortValue(port.target, service, "container target");
+      const hostIp = normalizeHostIp(port.host_ip);
+      const protocol = typeof port.protocol === "string" && port.protocol ? port.protocol : "tcp";
+      if (typeof port.published !== "string" || !port.published.includes("-")) {
+        const hostPort = parseFixedPublishedPort(port.published, service);
+        if (hostPort === null) continue;
+        pushBinding({ service, hostIp, hostPort, protocol });
+        continue;
+      }
+      const range = parsePublishedRange(port.published, service);
+      if (!range) {
+        throw new Error(
+          `Service '${service}' publishes an unsupported host port value '${String(port.published)}'.`
+        );
+      }
+      for (let hostPort = range[0]; hostPort <= range[1]; hostPort += 1) {
+        pushBinding({ service, hostIp, hostPort, protocol });
+      }
+    }
+  }
+  return bindings;
+}
+function hostPortBindingsConflict(desired, holder) {
+  return desired.hostPort === holder.hostPort && desired.protocol === holder.protocol && // Wildcards collide with everything in their protocol family; specific
+  // addresses only collide with themselves. IPv6 nuance intentionally
+  // over-approximates: a loud refusal beats a missed kernel collision.
+  (desired.hostIp === null || holder.hostIp === null || desired.hostIp === holder.hostIp);
+}
+var HOST_PORT_INSPECT_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}}},"ports":{{json .NetworkSettings.Ports}}}';
+function runDocker(args) {
+  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
+    ...networkDockerOptions(),
+    encoding: "utf-8",
+    timeout: DOCKER_TIMEOUT_MS,
+    maxBuffer: DOCKER_MAX_BUFFER
+  });
+  if (result.error || result.status !== 0) {
+    const reason2 = (result.stderr || result.stdout || result.error?.message || "unknown error").toString().trim();
+    throw new Error(`docker ${String(args[0])} failed: ${reason2}`);
+  }
+  if (typeof result.stdout !== "string") {
+    throw new Error(`docker ${String(args[0])} returned invalid output.`);
+  }
+  return result.stdout;
+}
+function parseHolderPortMap(value) {
+  const ports = [];
+  for (const [key, entries] of Object.entries(isRecord4(value) ? value : {})) {
+    const separator = key.lastIndexOf("/");
+    if (separator <= 0) continue;
+    const protocol = key.slice(separator + 1);
+    if (!Array.isArray(entries)) continue;
+    for (const entry of entries) {
+      if (!isRecord4(entry) || entry.HostPort === void 0 || entry.HostPort === null) continue;
+      const bound = Number(entry.HostPort);
+      if (!Number.isInteger(bound) || bound <= 0) continue;
+      ports.push({ hostIp: normalizeHostIp(entry.HostIp), hostPort: bound, protocol });
+    }
+  }
+  const unique = /* @__PURE__ */ new Map();
+  for (const port of ports) {
+    unique.set(`${port.hostIp ?? ""}|${port.hostPort}|${port.protocol}`, port);
+  }
+  return [...unique.values()];
+}
+function parseHolderSnapshots(stdout) {
+  return stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      throw new Error("Host-port holder inspection returned malformed JSON.");
+    }
+    if (!isRecord4(parsed) || typeof parsed.id !== "string" || parsed.id.length === 0) {
+      throw new Error("Host-port holder inspection returned an invalid container record.");
+    }
+    const name = typeof parsed.name === "string" ? parsed.name.replace(/^\//, "") : parsed.id;
+    return {
+      id: parsed.id,
+      name,
+      composeProject: optionalLabel(parsed.labels, "com.docker.compose.project"),
+      workingDir: optionalLabel(parsed.labels, "com.docker.compose.project.working_dir"),
+      ports: parseHolderPortMap(parsed.ports)
+    };
+  });
+}
+function listHolderSnapshots() {
+  const listed = runDocker(["ps", "--filter", "status=running", "--format", "{{.ID}}"]);
+  const ids2 = listed.split(/\r?\n/).map((id5) => id5.trim()).filter(Boolean);
+  if (ids2.length === 0) return [];
+  if (ids2.length > MAX_RUNNING_HOLDERS) {
+    throw new Error(
+      `Host-port holder inspection found ${ids2.length} running containers, above its bound.`
+    );
+  }
+  const inspected = runDocker(["inspect", "--format", HOST_PORT_INSPECT_TEMPLATE, ...ids2]);
+  return parseHolderSnapshots(inspected);
+}
+function renderManagedComposeModel(plan, workspace) {
+  const fileArgs = plan.composeFiles.flatMap((file) => ["-f", file]);
+  const result = (0, import_node_child_process19.spawnSync)(
+    "docker",
+    [
+      "compose",
+      "--profile",
+      "*",
+      "--project-directory",
+      plan.composeDirectory,
+      ...fileArgs,
+      "config",
+      "--format",
+      "json"
+    ],
+    {
+      cwd: plan.composeDirectory,
+      encoding: "utf-8",
+      env: managedComposeEnvironment(workspace),
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: COMPOSE_RENDER_TIMEOUT_MS,
+      maxBuffer: COMPOSE_RENDER_MAX_BUFFER
+    }
+  );
+  if (result.status !== 0 || result.error || !result.stdout?.trim()) {
+    const reason2 = (result.stderr || result.error?.message || "unknown error").toString().trim().split(/\r?\n/).slice(-3).join("; ");
+    throw new Error(
+      `Host-port claims could not render the managed Compose model that the start would bind: ${reason2}`
+    );
+  }
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    throw new Error("Host-port claims received a malformed rendered Compose model.");
+  }
+}
+function attributeHolderWorktree(workingDir) {
+  if (import_node_path34.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path34.default.dirname(workingDir));
+}
+function holderAttribution(holder, repoPath) {
+  const attribution = {};
+  if (holder.composeProject) attribution.holderComposeProject = holder.composeProject;
+  const worktree = holder.workingDir ? attributeHolderWorktree(holder.workingDir) : void 0;
+  if (!worktree) return attribution;
+  attribution.holderWorktreePath = worktree;
+  try {
+    const owner = listWorkspaceOwnership(repoPath).find(
+      (record5) => comparableWorkspacePath(record5.worktreePath) === worktree
+    );
+    if (owner) {
+      attribution.holderWorkspace = owner.workspace;
+      if (owner.branch) attribution.holderBranch = owner.branch;
+    }
+  } catch {
+  }
+  return attribution;
+}
+function remediationFor(holder, attribution) {
+  if (attribution.holderWorktreePath) {
+    return `Stop the holding workspace with 'devrouter stop ${attribution.holderWorktreePath}', or override the consumer's published host binding through its own configuration, then run ensure again.`;
+  }
+  return `Stop or reconfigure the holding container '${holder.name}' and run ensure again; devrouter never rewrites consumer-declared host bindings.`;
+}
+function detectHostPortClaimConflicts(options) {
+  const desired = resolveFixedPublishedHostPorts(
+    renderManagedComposeModel(options.plan, options.workspace)
+  );
+  if (desired.length === 0) return [];
+  const holders = listHolderSnapshots();
+  const devcontainerDir = import_node_path34.default.join(options.repoPath, ".devcontainer");
+  const conflicts = [];
+  for (const binding of desired) {
+    for (const holder of holders) {
+      for (const holderPort of holder.ports) {
+        if (!hostPortBindingsConflict(binding, holderPort)) continue;
+        if (holder.workingDir && sameWorkspacePath(holder.workingDir, devcontainerDir)) continue;
+        const attribution = holderAttribution(holder, options.repoPath);
+        conflicts.push({
+          service: binding.service,
+          hostIp: binding.hostIp,
+          hostPort: binding.hostPort,
+          protocol: binding.protocol,
+          holderContainer: holder.name,
+          ...attribution,
+          remediation: remediationFor(holder, attribution)
+        });
+      }
+    }
+  }
+  return conflicts;
+}
+
+// src/core/http-route-probe.ts
+var import_node_child_process20 = require("child_process");
 var DEFAULT_MAX_TIME_SECONDS = 5;
 var PARENT_TIMEOUT_PADDING_MS = 250;
 var CONTRACT_MAX_BUFFER = 1024;
@@ -9950,7 +10313,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process19.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process20.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -9969,7 +10332,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process19.spawnSync)("curl", args, {
+    result = (0, import_node_child_process20.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -10053,8 +10416,8 @@ function transportFailure() {
 }
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process20 = require("child_process");
-var import_node_fs28 = __toESM(require("fs"));
+var import_node_child_process21 = require("child_process");
+var import_node_fs29 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -10065,7 +10428,7 @@ function runPreparationCommand(argv, cwd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = (0, import_node_child_process20.spawn)(argv[0], argv.slice(1), {
+      child = (0, import_node_child_process21.spawn)(argv[0], argv.slice(1), {
         cwd,
         detached: true,
         shell: false,
@@ -10097,7 +10460,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs28.default.readFileSync(configPath);
+    return import_node_fs29.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -10131,10 +10494,10 @@ async function runManagedHostPreparation(repoPath, config) {
 }
 
 // src/core/managed-post-start.ts
-var import_node_child_process21 = require("child_process");
+var import_node_child_process22 = require("child_process");
 var import_node_crypto16 = require("crypto");
-var import_node_fs29 = __toESM(require("fs"));
-var import_node_path34 = __toESM(require("path"));
+var import_node_fs30 = __toESM(require("fs"));
+var import_node_path35 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
 var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
 var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
@@ -10147,7 +10510,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path34.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path35.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -10171,7 +10534,7 @@ function commandFailure3(result) {
   return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
 }
 function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process21.spawnSync)(
+  const result = (0, import_node_child_process22.spawnSync)(
     "docker",
     ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
     { input: contents, encoding: "utf-8", ...networkDockerOptions() }
@@ -10182,8 +10545,8 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs29.default.existsSync(filePath) || !import_node_fs29.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs29.default.readFileSync(filePath);
+  if (!import_node_fs30.default.existsSync(filePath) || !import_node_fs30.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs30.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
@@ -10193,21 +10556,21 @@ function adapterFingerprint(adapter) {
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path34.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path34.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path35.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path35.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs29.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs30.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path34.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path35.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path34.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path34.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path35.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path35.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -10248,7 +10611,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs29.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs30.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -10262,7 +10625,7 @@ function runManagedPostStart(options) {
     options.plan.adapterContents,
     "the managed post-start adapter"
   );
-  const started2 = (0, import_node_child_process21.spawnSync)(
+  const started2 = (0, import_node_child_process22.spawnSync)(
     "docker",
     [
       "exec",
@@ -10303,7 +10666,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process21.spawnSync)(
+  const result = (0, import_node_child_process22.spawnSync)(
     "docker",
     [
       "exec",
@@ -10768,7 +11131,7 @@ function collectManagedRuntimeStatus(options) {
 }
 
 // src/core/network-inventory.ts
-var import_node_child_process22 = require("child_process");
+var import_node_child_process23 = require("child_process");
 var NetworkInventoryError = class extends Error {
 };
 var MAX_IDS = 4096;
@@ -10780,7 +11143,7 @@ function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process22.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process23.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -10937,37 +11300,37 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
 }
 
 // src/core/network-routes.ts
-var import_node_child_process23 = require("child_process");
+var import_node_child_process24 = require("child_process");
 var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
-var import_node_fs30 = __toESM(require("fs"));
-var import_node_path35 = __toESM(require("path"));
+var import_node_fs31 = __toESM(require("fs"));
+var import_node_path36 = __toESM(require("path"));
 function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   const deadline = Date.now() + 2e3;
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs30.default.readFileSync(import_node_path35.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs31.default.readFileSync(import_node_path36.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs30.default.readlinkSync(import_node_path35.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs30.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs31.default.readlinkSync(import_node_path36.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs31.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path35.default.join(procRoot, pid);
-        if (import_node_path35.default.basename(import_node_fs30.default.readlinkSync(import_node_path35.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs30.default.readlinkSync(import_node_path35.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs30.default.readdirSync(import_node_path35.default.join(root, "fd"));
+        const root = import_node_path36.default.join(procRoot, pid);
+        if (import_node_path36.default.basename(import_node_fs31.default.readlinkSync(import_node_path36.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs31.default.readlinkSync(import_node_path36.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs31.default.readdirSync(import_node_path36.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs30.default.readlinkSync(import_node_path35.default.join(root, "fd", fd)) === inode;
+            return import_node_fs31.default.readlinkSync(import_node_path36.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -11006,7 +11369,7 @@ function parseLinuxNetworkRoutes(output) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process23.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process24.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -11047,7 +11410,7 @@ var import_node_crypto19 = require("crypto");
 // src/core/network-compose.ts
 var import_node_crypto17 = require("crypto");
 var SAFE_ENDPOINT_UPPER_BOUND_SEMANTICS = "full-lifecycle-demand";
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function hasOwn(record5, key) {
@@ -11065,13 +11428,13 @@ function sortedUnique2(values) {
   return [...new Set(values)].sort((left, right) => left.localeCompare(right));
 }
 function readMap(value) {
-  return isRecord4(value) ? value : void 0;
+  return isRecord5(value) ? value : void 0;
 }
 function readMode(input) {
   if (input.mode !== void 0) {
     return input.mode;
   }
-  if (!isRecord4(input.metadata)) {
+  if (!isRecord5(input.metadata)) {
     return void 0;
   }
   for (const key of ["mode", "runtimeMode", "checkoutMode"]) {
@@ -11088,7 +11451,7 @@ function readExternal(value) {
   if (typeof value === "boolean") {
     return { value, known: true };
   }
-  if (isRecord4(value)) {
+  if (isRecord5(value)) {
     return { value: true, known: true };
   }
   return { known: false };
@@ -11103,7 +11466,7 @@ function readDriver(value) {
   return { value: value.toLowerCase(), known: true };
 }
 function inspectNetworks(input, reasons) {
-  const compose = isRecord4(input.compose) ? input.compose : {};
+  const compose = isRecord5(input.compose) ? input.compose : {};
   const normalizedValue2 = compose.networks;
   const authoredValue2 = input.authoredNetworks;
   const normalized = normalizedValue2 === void 0 ? {} : readMap(normalizedValue2);
@@ -11132,7 +11495,7 @@ function inspectNetworks(input, reasons) {
     );
   } else {
     for (const [serviceName, rawService] of Object.entries(services)) {
-      if (!isRecord4(rawService)) {
+      if (!isRecord5(rawService)) {
         addReason(reasons, reason("malformed-service", `Service ${serviceName} is not an object.`));
         continue;
       }
@@ -11177,7 +11540,7 @@ function parseServiceNetworks(value, serviceName, reasons) {
     }
     return { names: sortedUnique2(names), known: true };
   }
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     addReason(
       reasons,
       reason(
@@ -11197,7 +11560,7 @@ function parseServiceNetworks(value, serviceName, reasons) {
       );
       continue;
     }
-    if (attachment !== null && !isRecord4(attachment)) {
+    if (attachment !== null && !isRecord5(attachment)) {
       known = false;
       addReason(
         reasons,
@@ -11212,27 +11575,27 @@ function parseServiceNetworks(value, serviceName, reasons) {
 }
 function authoredHas(authored, name, key) {
   const declaration = authored[name];
-  return isRecord4(declaration) && hasOwn(declaration, key);
+  return isRecord5(declaration) && hasOwn(declaration, key);
 }
 function authoredValue(authored, name, key) {
   const declaration = authored[name];
-  return isRecord4(declaration) ? declaration[key] : void 0;
+  return isRecord5(declaration) ? declaration[key] : void 0;
 }
 function normalizedValue(normalized, name, key) {
   const declaration = normalized[name];
-  return isRecord4(declaration) ? declaration[key] : void 0;
+  return isRecord5(declaration) ? declaration[key] : void 0;
 }
 function classifyNetwork(name, inspection, reasons) {
   const authoredDeclaration = inspection.authored[name];
   const normalizedDeclaration = inspection.normalized[name];
-  if (authoredDeclaration !== void 0 && !isRecord4(authoredDeclaration)) {
+  if (authoredDeclaration !== void 0 && !isRecord5(authoredDeclaration)) {
     addReason(
       reasons,
       reason("malformed-authored-network", `Authored network ${name} is not an object.`)
     );
     return { external: false, private: false };
   }
-  if (normalizedDeclaration !== void 0 && !isRecord4(normalizedDeclaration)) {
+  if (normalizedDeclaration !== void 0 && !isRecord5(normalizedDeclaration)) {
     addReason(
       reasons,
       reason("malformed-normalized-network", `Normalized network ${name} is not an object.`)
@@ -11313,7 +11676,7 @@ function classifyNetwork(name, inspection, reasons) {
   } else {
     const normalizedIpam = normalizedValue(inspection.normalized, name, "ipam");
     if (normalizedIpam !== void 0) {
-      if (!isRecord4(normalizedIpam)) {
+      if (!isRecord5(normalizedIpam)) {
         addReason(
           reasons,
           reason("malformed-normalized-ipam", `Network ${name} has malformed normalized IPAM.`)
@@ -11415,7 +11778,7 @@ function parseCount(value, field, reasons) {
   if (value === void 0) {
     return { value: 0, known: true };
   }
-  const candidate = isRecord4(value) && hasOwn(value, "count") ? value.count : value;
+  const candidate = isRecord5(value) && hasOwn(value, "count") ? value.count : value;
   if (typeof candidate !== "number" || !Number.isSafeInteger(candidate) || candidate < 0) {
     addReason(reasons, reason("malformed-count", `${field} must be a non-negative integer.`));
     return { value: 0, known: false };
@@ -11431,7 +11794,7 @@ function parseReplicas(service, serviceName, reasons) {
     candidates.push({ field: "scale", value: service.scale });
   }
   if (hasOwn(service, "deploy")) {
-    if (!isRecord4(service.deploy)) {
+    if (!isRecord5(service.deploy)) {
       addReason(
         reasons,
         reason("malformed-replicas", `Service ${serviceName} deploy metadata is malformed.`)
@@ -11486,7 +11849,7 @@ function parseUpperBound(input, reasons) {
   const raw = input.endpointUpperBound;
   let value = raw;
   let semantics = input.endpointUpperBoundSemantics;
-  if (isRecord4(raw)) {
+  if (isRecord5(raw)) {
     value = raw.value ?? raw.endpoints ?? raw.count;
     semantics = raw.semantics ?? semantics;
   }
@@ -11551,7 +11914,7 @@ function deriveComposeNetworkDemand(input) {
       )
     );
   }
-  const compose = isRecord4(input.compose) ? input.compose : {};
+  const compose = isRecord5(input.compose) ? input.compose : {};
   const services = readMap(compose.services);
   const serviceEndpointsByService = {};
   const replicasByService = {};
@@ -11569,7 +11932,7 @@ function deriveComposeNetworkDemand(input) {
     serviceDemandKnown = false;
   } else {
     for (const [serviceName, rawService] of Object.entries(services)) {
-      if (!isRecord4(rawService)) {
+      if (!isRecord5(rawService)) {
         addReason(reasons, reason("malformed-service", `Service ${serviceName} is not an object.`));
         serviceDemandKnown = false;
         continue;
@@ -11671,7 +12034,7 @@ function deriveComposeNetworkOverlay(subnet) {
   };
 }
 function extendDockerComposeFile(nativeConfig, overlayPath) {
-  if (!isRecord4(nativeConfig)) {
+  if (!isRecord5(nativeConfig)) {
     return {
       status: "unknown",
       reasons: [
@@ -11722,7 +12085,7 @@ function replicaProjection(service) {
   return replicas.known ? replicas.value : "unknown";
 }
 function redactedNetworkProjection(value) {
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     return value === void 0 ? void 0 : "unknown";
   }
   const projection = {};
@@ -11741,7 +12104,7 @@ function redactedNetworkProjection(value) {
         const config = Array.isArray(ipam?.config) ? ipam.config : void 0;
         projection.ipam = {
           config: config === void 0 ? "unknown" : config.map(
-            (entry) => isRecord4(entry) && typeof entry.subnet === "string" ? entry.subnet : "unknown"
+            (entry) => isRecord5(entry) && typeof entry.subnet === "string" ? entry.subnet : "unknown"
           )
         };
       } else if (key === "enable_ipv6") {
@@ -11757,7 +12120,7 @@ function redactedCountProjection(value) {
   if (value === void 0) {
     return 0;
   }
-  const candidate = isRecord4(value) && hasOwn(value, "count") ? value.count : value;
+  const candidate = isRecord5(value) && hasOwn(value, "count") ? value.count : value;
   return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate >= 0 ? candidate : "unknown";
 }
 function redactedUpperBoundProjection(value) {
@@ -11767,7 +12130,7 @@ function redactedUpperBoundProjection(value) {
   if (typeof value === "number") {
     return Number.isSafeInteger(value) && value >= 0 ? value : "unknown";
   }
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     return "unknown";
   }
   const candidate = value.value ?? value.endpoints ?? value.count;
@@ -11777,12 +12140,12 @@ function redactedUpperBoundProjection(value) {
   };
 }
 function normalizedFingerprintProjection(input) {
-  const compose = isRecord4(input.compose) ? input.compose : {};
+  const compose = isRecord5(input.compose) ? input.compose : {};
   const services = readMap(compose.services);
   const serviceProjection = {};
   for (const serviceName of Object.keys(services ?? {}).sort()) {
     const service = services?.[serviceName];
-    serviceProjection[serviceName] = isRecord4(service) ? {
+    serviceProjection[serviceName] = isRecord5(service) ? {
       networks: projectionNetworkMembership(service.networks),
       replicas: replicaProjection(service)
     } : "unknown";
@@ -11814,14 +12177,14 @@ function normalizedFingerprintProjection(input) {
   };
 }
 function redactedOverlayProjection(value) {
-  if (!isRecord4(value)) {
+  if (!isRecord5(value)) {
     return value === void 0 ? void 0 : "unknown";
   }
   const networks = readMap(value.networks);
   const defaultNetwork = readMap(networks?.default);
   const ipam = readMap(defaultNetwork?.ipam);
   const config = Array.isArray(ipam?.config) ? ipam.config : void 0;
-  if (config === void 0 || config.some((entry) => !isRecord4(entry) || typeof entry.subnet !== "string")) {
+  if (config === void 0 || config.some((entry) => !isRecord5(entry) || typeof entry.subnet !== "string")) {
     return "unknown";
   }
   return {
@@ -11844,7 +12207,7 @@ function stableValue(value) {
   if (Array.isArray(value)) {
     return `[${value.map((item) => stableValue(item)).join(",")}]`;
   }
-  if (isRecord4(value)) {
+  if (isRecord5(value)) {
     return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableValue(value[key])}`).join(",")}}`;
   }
   return JSON.stringify(String(value));
@@ -11855,10 +12218,10 @@ function fingerprintComposeNetworkModel(input) {
 }
 
 // src/core/network-compose-files.ts
-var import_node_child_process24 = require("child_process");
+var import_node_child_process25 = require("child_process");
 var import_node_crypto18 = require("crypto");
-var import_node_fs31 = __toESM(require("fs"));
-var import_node_path36 = __toESM(require("path"));
+var import_node_fs32 = __toESM(require("fs"));
+var import_node_path37 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
 var OVERLAY = "docker-compose.devrouter-network.yml";
 var MARKER = "# devrouter:managed workspace network";
@@ -11871,12 +12234,12 @@ function object3(value) {
 function inspectNetworkComposeFiles(input) {
   const authoredNetworks = {};
   for (const file of input.plan.composeFiles) {
-    const stat = import_node_fs31.default.lstatSync(file);
+    const stat = import_node_fs32.default.lstatSync(file);
     if (!stat.isFile() || stat.size > MAX_BYTES2)
       throw new Error("Network Compose source is unavailable or too large.");
     let source;
     try {
-      source = object3(import_yaml4.default.parse(import_node_fs31.default.readFileSync(file, "utf8")));
+      source = object3(import_yaml4.default.parse(import_node_fs32.default.readFileSync(file, "utf8")));
     } catch {
       throw new Error("Network Compose source could not be parsed safely.");
     }
@@ -11892,7 +12255,7 @@ function inspectNetworkComposeFiles(input) {
   const env = managedComposeEnvironment(input.workspace);
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process24.spawnSync)(
+  const result = (0, import_node_child_process25.spawnSync)(
     "docker",
     [
       "--host",
@@ -11926,8 +12289,8 @@ function inspectNetworkComposeFiles(input) {
 function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
-  const overlayPath = import_node_path36.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process24.spawnSync)("git", [
+  const overlayPath = import_node_path37.default.join(plan.composeDirectory, OVERLAY);
+  const ignored = (0, import_node_child_process25.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -11941,9 +12304,9 @@ function prepareNetworkComposeFiles(plan, subnet) {
   const bytes2 = `${MARKER}
 ${import_yaml4.default.stringify(overlay.overlay)}`;
   const assertOwnership = () => {
-    if (!import_node_fs31.default.existsSync(overlayPath)) return;
-    const stat = import_node_fs31.default.lstatSync(overlayPath);
-    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs31.default.readFileSync(overlayPath, "utf8") !== bytes2)
+    if (!import_node_fs32.default.existsSync(overlayPath)) return;
+    const stat = import_node_fs32.default.lstatSync(overlayPath);
+    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs32.default.readFileSync(overlayPath, "utf8") !== bytes2)
       throw new Error("Retained network overlay changed; repair is required.");
   };
   assertOwnership();
@@ -11969,7 +12332,7 @@ ${JSON.stringify(extended.config, null, 2)}
 }
 
 // src/core/network-connected-route.ts
-var import_node_child_process25 = require("child_process");
+var import_node_child_process26 = require("child_process");
 function bounds(cidr) {
   const canonical = parseIPv4Cidr(cidr);
   if (!canonical) throw new Error("Invalid connected route.");
@@ -11994,7 +12357,7 @@ function inspectClaimedBridge(claim2, networkId) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process25.spawnSync)(
+  const result = (0, import_node_child_process26.spawnSync)(
     "docker",
     [
       "--host",
@@ -12021,7 +12384,7 @@ function inspectClaimedBridge(claim2, networkId) {
     const [first, last] = bounds(claim2.subnet);
     const [address] = bounds(gateway);
     if (address <= first || address >= last) throw new Error();
-    const interfaces = (0, import_node_child_process25.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
+    const interfaces = (0, import_node_child_process26.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
       encoding: "utf8",
       timeout: 5e3,
       maxBuffer: 65536
@@ -12459,11 +12822,11 @@ var DEFAULT_READINESS_TIMEOUT_MS = 12e4;
 var POLL_INTERVAL_MS = 1e3;
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path37.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path38.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path37.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path38.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -12658,7 +13021,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path37.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path38.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -12766,7 +13129,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process26.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process27.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -12776,7 +13139,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process26.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process27.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -12787,7 +13150,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process26.spawnSync)(
+      const gitCheck = (0, import_node_child_process27.spawnSync)(
         "docker",
         [
           "exec",
@@ -13042,14 +13405,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs32.default.statSync(import_node_path37.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs33.default.statSync(import_node_path38.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process26.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process27.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -13105,8 +13468,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path37.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs32.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path38.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs33.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -13174,9 +13537,38 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           });
         }
       }
+      if (managedPlan) {
+        let hostPortConflicts = [];
+        try {
+          hostPortConflicts = detectHostPortClaimConflicts({
+            repoPath,
+            plan: managedPlan,
+            workspace: managedWorkspaceEnv
+          });
+        } catch (error) {
+          throw new Error(
+            `Managed admission could not verify fixed host-port claims before start: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+        if (hostPortConflicts.length > 0) {
+          return {
+            kind: target.kind,
+            repoPath,
+            ...target.kind === "linked" ? { workspace: target.workspace } : {},
+            profile: runtime.profile,
+            // A refusal precedes the provider start, so the exact id may not
+            // be known yet on a primary checkout.
+            devpodId: devpodId ?? "(absent)",
+            urls: [],
+            recreated: false,
+            tlsRefreshed: false,
+            hostPortConflicts
+          };
+        }
+      }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path37.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path38.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -13291,7 +13683,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               repairMutationStarted = true;
               transitionPhase = "service-start";
               claimLifecycleEffect();
-              const result = (0, import_node_child_process26.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+              const result = (0, import_node_child_process27.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 ...networkDockerOptions(),
                 encoding: "utf-8",
                 timeout: DEFAULT_READINESS_TIMEOUT_MS,
@@ -13996,9 +14388,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs33.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
-        import_node_path37.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+        import_node_path38.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
           activity: "Managed runtime repair",
           target: repoPath,
@@ -14205,7 +14597,7 @@ async function executeLifecycleWorker(request, operation) {
           const owned = containers.filter(
             (container) => sameWorkspacePath(
               container.labels["com.docker.compose.project.working_dir"] ?? "",
-              import_node_path38.default.join(request.repoPath, ".devcontainer")
+              import_node_path39.default.join(request.repoPath, ".devcontainer")
             )
           );
           const projects = owned.map((container) => container.labels["com.docker.compose.project"]);
@@ -14306,7 +14698,7 @@ function proveLifecycleStopped() {
       const remaining = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path38.default.join(request.repoPath, ".devcontainer")
+          import_node_path39.default.join(request.repoPath, ".devcontainer")
         )
       );
       if (remaining.some(
@@ -14335,7 +14727,7 @@ function proveLifecycleStopped() {
       return void 0;
     });
     if (settlement) {
-      const capacity = new CapacityStore(import_node_path38.default.join(DEVROUTER_HOME, "controller"));
+      const capacity = new CapacityStore(import_node_path39.default.join(DEVROUTER_HOME, "controller"));
       for (let attempt = 0; ; attempt++) {
         try {
           capacity.settleEnvironmentAfterStop(settlement, capacity.read().revision);
@@ -14401,7 +14793,7 @@ async function devsyExecOutcome(repoPath, command, retainedProof) {
         const launch = () => {
           if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
           claimLifecycleEffect();
-          return (0, import_node_child_process27.spawn)("devsy", args, { stdio: "inherit" });
+          return (0, import_node_child_process28.spawn)("devsy", args, { stdio: "inherit" });
         };
         child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
@@ -14449,7 +14841,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process28.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process29.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -14628,7 +15020,7 @@ async function devpodExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process28.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+        child = (0, import_node_child_process29.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       } catch (error) {
         settled = true;
         reject(
@@ -14685,12 +15077,12 @@ async function devpodExecOutcome(repoPath, command) {
 }
 
 // src/core/workspace-lifecycle.ts
-var import_node_child_process29 = require("child_process");
-var import_node_fs34 = __toESM(require("fs"));
-var import_node_path39 = __toESM(require("path"));
+var import_node_child_process30 = require("child_process");
+var import_node_fs35 = __toESM(require("fs"));
+var import_node_path40 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs33 = __toESM(require("fs"));
+var import_node_fs34 = __toESM(require("fs"));
 function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
   return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
 }
@@ -14900,7 +15292,7 @@ process.once("message", async (message) => {
       }
       const ensured = await workspaceEnsure(request.repoPath, request.options);
       recordLifecycleCompletion(
-        ensured.applicationReadiness?.status === "application-error" ? 1 : 0,
+        ensured.applicationReadiness?.status === "application-error" || (ensured.hostPortConflicts?.length ?? 0) > 0 ? 1 : 0,
         ensured.managedRuntime?.status === "ready" ? ensured.profile : void 0,
         { ok: true, value: ensured }
       );