@devrouter/cli 0.0.79 → 0.1.0

package/dist/devrouter.js

@@ -4275,7 +4275,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs7.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.0.79" : "0.0.0-dev";
+    const cliVersion = true ? "0.1.0" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -5299,6 +5299,8 @@ var init_capacity_store = __esm({
       file;
       establishedFile;
       observedLedger = false;
+      /** Identity of the snapshot file read last, so a replacement cannot reuse its revision. */
+      ledgerGeneration;
       readEstablished() {
         let descriptor;
         try {
@@ -5325,7 +5327,7 @@ var init_capacity_store = __esm({
           import_node_fs9.default.closeSync(descriptor);
         }
       }
-      read() {
+      inspect() {
         const minimumRevision = this.minimumRevision();
         const established = this.readEstablished();
         let descriptor;
@@ -5336,9 +5338,9 @@ var init_capacity_store = __esm({
           );
         } catch (error) {
           if (error.code === "ENOENT") {
-            if (established || this.observedLedger || minimumRevision > 0)
-              throw new CapacityHistoryError("capacity-ledger-lost");
-            return { version: 1, revision: 0, reservations: [] };
+            this.ledgerGeneration = void 0;
+            if (established || this.observedLedger || minimumRevision > 0) return { kind: "absent" };
+            return { kind: "pristine" };
           }
           throw error;
         }
@@ -5351,16 +5353,36 @@ var init_capacity_store = __esm({
           if (count > MAX_BYTES2) throw new Error("Capacity reservation snapshot exceeds byte limit.");
           const value = JSON.parse(buffer.subarray(0, count).toString("utf8"));
           validate(value);
-          if (value.revision < minimumRevision) throw new CapacityHistoryError("capacity-ledger-lost");
+          this.ledgerGeneration = `${stat.dev}:${stat.ino}`;
+          if (value.revision < minimumRevision) return { kind: "stale", revision: value.revision };
           this.observedLedger = true;
-          return value;
+          return { kind: "intact", revision: value.revision, snapshot: value };
         } finally {
           import_node_fs9.default.closeSync(descriptor);
         }
       }
+      read() {
+        const state = this.inspect();
+        if (state.kind === "intact") return state.snapshot;
+        if (state.kind === "pristine") return { version: 1, revision: 0, reservations: [] };
+        throw new CapacityHistoryError("capacity-ledger-lost");
+      }
       establish() {
         if (!this.readEstablished()) this.write(this.establishedFile, '{"version":1}\n');
-        for (const file of [this.file, this.establishedFile, this.directory]) {
+        this.syncDurability([this.file, this.establishedFile, this.directory]);
+      }
+      /**
+       * Witness for a ledger that is positively absent. The marker records that
+       * history existed here, so no later process can read the store as a fresh
+       * install and start admitting; the snapshot stays absent until reconciliation.
+       * The caller holds the capacity lock and has proven environment cessation.
+       */
+      establishMarkerOnly() {
+        if (!this.readEstablished()) this.write(this.establishedFile, '{"version":1}\n');
+        this.syncDurability([this.establishedFile, this.directory]);
+      }
+      syncDurability(files) {
+        for (const file of files) {
           const descriptor = import_node_fs9.default.openSync(
             file,
             import_node_fs9.default.constants.O_RDONLY | import_node_fs9.default.constants.O_NOFOLLOW | import_node_fs9.default.constants.O_NONBLOCK
@@ -5376,15 +5398,90 @@ var init_capacity_store = __esm({
         }
       }
       readForMutation() {
+        const expectedGeneration = this.ledgerGeneration;
         const snapshot = this.read();
+        if (expectedGeneration !== void 0 && expectedGeneration !== this.ledgerGeneration)
+          throw new CapacitySnapshotChangedError();
         if (this.observedLedger) this.establish();
         return snapshot;
       }
       commit(snapshot) {
         this.write(this.file, serializeSnapshot(snapshot));
         this.observedLedger = true;
+        this.rememberGeneration();
         this.establish();
       }
+      /** Remember the published snapshot identity for the next generation fence. */
+      rememberGeneration() {
+        try {
+          const stat = import_node_fs9.default.statSync(this.file);
+          this.ledgerGeneration = stat.isFile() ? `${stat.dev}:${stat.ino}` : void 0;
+        } catch {
+          this.ledgerGeneration = void 0;
+        }
+      }
+      /**
+       * Durable evidence that recorded history is gone, for a stop whose physical
+       * cessation is already proven. The caller holds that proof; this writes no
+       * row and asserts nothing about any other environment's charge.
+       */
+      recordLedgerLoss() {
+        assertPrivateDirectory(this.directory);
+        withFileLockSync(
+          `${this.file}.lock`,
+          { activity: "capacity loss witness", waitMs: 100 },
+          () => {
+            if (this.inspect().kind !== "absent")
+              throw new CapacityHistoryError("capacity-ledger-lost");
+            this.establishMarkerOnly();
+          }
+        );
+      }
+      /**
+       * Replace a provably absent ledger with a fresh baseline under the capacity
+       * lock. `plan` runs inside the lock with the authoritative classification and
+       * re-verifies the caller's evidence, returning the baseline to write or
+       * undefined to refuse without mutation. `confirm` runs in the same lock after
+       * the write; returning false withdraws the fresh snapshot, so the store reads
+       * as lost again instead of publishing a baseline the caller cannot stand behind.
+       */
+      reconcileLostHistory(plan, confirm) {
+        assertPrivateDirectory(this.directory);
+        return withFileLockSync(
+          `${this.file}.lock`,
+          { activity: "capacity reconciliation", waitMs: 100 },
+          () => {
+            const baseline = plan(this.inspect());
+            if (!baseline) return { reconciled: false };
+            if (!Number.isSafeInteger(baseline.revision) || baseline.revision < 1)
+              throw new Error("Invalid capacity reconciliation revision.");
+            const pools = structuredClone(baseline.pools ?? []);
+            validatePools(pools);
+            const snapshot = pools.length === 0 ? { version: 1, revision: baseline.revision, reservations: [] } : { version: 1, revision: baseline.revision, reservations: [], pools };
+            validate(snapshot);
+            this.commit(snapshot);
+            if (confirm()) return { reconciled: true, revision: snapshot.revision };
+            this.withdrawSnapshot();
+            return { reconciled: false };
+          }
+        );
+      }
+      /** Remove a snapshot this store just wrote, keeping the loss witness durable. */
+      withdrawSnapshot() {
+        try {
+          import_node_fs9.default.unlinkSync(this.file);
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+        this.observedLedger = false;
+        this.ledgerGeneration = void 0;
+        const directory = import_node_fs9.default.openSync(this.directory, "r");
+        try {
+          import_node_fs9.default.fsyncSync(directory);
+        } finally {
+          import_node_fs9.default.closeSync(directory);
+        }
+      }
       /**
        * Caller must revoke journal authority and prove exact physical cessation first.
        * An absent reservation still advances the revision to fence that proof.
@@ -6162,7 +6259,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.0.79" : "0.0.0-dev";
+  return true ? "0.1.0" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -6480,16 +6577,26 @@ function validate2(record5, identity2) {
 function createLifecycleCapacityStore(directory = import_node_path13.default.join(DEVROUTER_HOME, "controller")) {
   return new CapacityStore(directory, void 0, () => {
     try {
-      let revision = 0;
-      for (const record5 of listReliabilityOperations()) {
-        if (record5.capacity) revision = Math.max(revision, record5.capacity.snapshotRevision ?? 1);
-      }
-      return revision;
+      return listUnsettledCapacityBindings().floor;
     } catch {
       throw new CapacityHistoryError("capacity-history-unprovable");
     }
   });
 }
+function listUnsettledCapacityBindings() {
+  let floor = 0;
+  const bindings = [];
+  for (const record5 of listReliabilityOperations()) {
+    if (!record5.capacity) continue;
+    floor = Math.max(floor, record5.capacity.snapshotRevision ?? 1);
+    bindings.push({
+      environmentId: record5.state.environmentId,
+      repoPath: record5.identity.repoPath,
+      workspace: record5.identity.workspace
+    });
+  }
+  return { floor, bindings };
+}
 function assertCapacityEffect(record5, workerId, nowMs, directory = import_node_path13.default.join(DEVROUTER_HOME, "controller")) {
   if (record5.version === 1) return;
   const binding = record5.capacity;
@@ -9167,19 +9274,165 @@ function parseVersion2(output2) {
     /\bv?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)\b/
   )?.[1];
 }
-function compareVersionCore(left, right) {
-  const core = (value) => value.split(/[-+]/, 1)[0].split(".").map((part) => Number.parseInt(part, 10));
-  const leftParts = core(left);
-  const rightParts = core(right);
-  for (let index = 0; index < 3; index += 1) {
-    const difference = (leftParts[index] ?? 0) - (rightParts[index] ?? 0);
-    if (difference !== 0) return difference > 0 ? 1 : -1;
+function parseSemver(value) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(
+    value.trim()
+  );
+  if (!match) return void 0;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ? match[4].split(".") : []
+  };
+}
+function comparePrerelease(left, right) {
+  if (left.length === 0 && right.length === 0) return 0;
+  if (left.length === 0) return 1;
+  if (right.length === 0) return -1;
+  for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
+    const leftPart = left[index];
+    const rightPart = right[index];
+    if (leftPart === void 0) return -1;
+    if (rightPart === void 0) return 1;
+    const leftNumeric = /^\d+$/.test(leftPart);
+    const rightNumeric = /^\d+$/.test(rightPart);
+    if (leftNumeric && rightNumeric) {
+      const difference = Number(leftPart) - Number(rightPart);
+      if (difference !== 0) return difference < 0 ? -1 : 1;
+      continue;
+    }
+    if (leftNumeric) return -1;
+    if (rightNumeric) return 1;
+    if (leftPart !== rightPart) return leftPart < rightPart ? -1 : 1;
   }
   return 0;
 }
+function compareSemver2(left, right) {
+  for (const part of ["major", "minor", "patch"]) {
+    if (left[part] !== right[part]) return left[part] < right[part] ? -1 : 1;
+  }
+  return comparePrerelease(left.prerelease, right.prerelease);
+}
+function isSupportedDevsyVersion(version) {
+  const parsed = version === void 0 ? void 0 : parseSemver(version);
+  const minimum = parseSemver(SUPPORTED_DEVSY_MIN_VERSION);
+  const maximum = parseSemver(SUPPORTED_DEVSY_MAX_VERSION);
+  if (!parsed || !minimum || !maximum) return false;
+  if (compareSemver2(parsed, minimum) < 0) return false;
+  if (parsed.prerelease.length > 0 && parsed.major === maximum.major && parsed.minor === maximum.minor && parsed.patch === maximum.patch) {
+    return false;
+  }
+  return compareSemver2(parsed, maximum) < 0;
+}
+function isDevsyAgentAsset(value) {
+  if (!value || typeof value !== "object") return false;
+  const asset = value;
+  return typeof asset.githubAssetId === "number" && Number.isSafeInteger(asset.githubAssetId) && typeof asset.name === "string" && typeof asset.size === "number" && Number.isSafeInteger(asset.size) && asset.size > 0 && typeof asset.sha256 === "string" && /^[0-9a-f]{64}$/.test(asset.sha256) && typeof asset.url === "string" && asset.url.startsWith("https://");
+}
+function devsyAgentManifestPath(cacheRoot, devsyVersion) {
+  return import_node_path22.default.join(cacheRoot, `v${devsyVersion}`, DEVSY_AGENT_MANIFEST_FILE);
+}
+function readManifestRecord(cacheRoot, devsyVersion) {
+  try {
+    const parsed = JSON.parse(
+      import_node_fs16.default.readFileSync(devsyAgentManifestPath(cacheRoot, devsyVersion), "utf-8")
+    );
+    if (parsed.version !== 1 || parsed.devsyVersion !== devsyVersion) return void 0;
+    if (parsed.origin !== "release") return void 0;
+    if (!Array.isArray(parsed.assets) || parsed.assets.length === 0) return void 0;
+    if (!parsed.assets.every(isDevsyAgentAsset)) return void 0;
+    return { version: devsyVersion, origin: "release", assets: parsed.assets };
+  } catch {
+    return void 0;
+  }
+}
+function writeManifestRecord(cacheRoot, manifest) {
+  const target = devsyAgentManifestPath(cacheRoot, manifest.version);
+  const directory = import_node_path22.default.dirname(target);
+  import_node_fs16.default.mkdirSync(directory, { recursive: true, mode: 448 });
+  const temporary = import_node_path22.default.join(
+    directory,
+    `.${DEVSY_AGENT_MANIFEST_FILE}.${process.pid}.${(0, import_node_crypto11.randomUUID)()}.tmp`
+  );
+  const record5 = {
+    version: 1,
+    devsyVersion: manifest.version,
+    origin: "release",
+    resolvedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    assets: [...manifest.assets]
+  };
+  try {
+    import_node_fs16.default.writeFileSync(temporary, `${JSON.stringify(record5, null, 2)}
+`, { mode: 384 });
+    import_node_fs16.default.renameSync(temporary, target);
+  } finally {
+    import_node_fs16.default.rmSync(temporary, { force: true });
+  }
+}
+function pinnedManifest(version) {
+  return version === PINNED_DEVSY_AGENT_VERSION ? { version, origin: "pinned", assets: DEVSY_AGENT_ASSETS } : void 0;
+}
+function manifestForVersion(resolved, version) {
+  if (resolved.assets) return { version, origin: "pinned", assets: resolved.assets };
+  return pinnedManifest(version) ?? readManifestRecord(resolved.cacheRoot, version);
+}
+async function resolveReleaseDevsyAgentManifest(version, fetcher) {
+  const url = `${DEVSY_RELEASE_METADATA_BASE_URL}/${DEVSY_RELEASE_TAG_PREFIX}${version}`;
+  let response;
+  try {
+    response = await fetcher(url, { headers: { accept: "application/vnd.github+json" } });
+  } catch (error) {
+    throw new Error(`Devsy ${version} release metadata could not be read: ${errorMessage(error)}`);
+  }
+  if (!response.ok) {
+    throw new Error(`Devsy ${version} release metadata is unavailable (HTTP ${response.status}).`);
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch (error) {
+    throw new Error(`Devsy ${version} release metadata is not valid JSON: ${errorMessage(error)}`);
+  }
+  const release = payload;
+  if (release?.tag_name !== `${DEVSY_RELEASE_TAG_PREFIX}${version}`) {
+    throw new Error(`Devsy ${version} release metadata reported an unexpected tag.`);
+  }
+  if (!Array.isArray(release.assets)) {
+    throw new Error(`Devsy ${version} release metadata reported no assets.`);
+  }
+  const assets = [];
+  for (const entry of release.assets) {
+    const candidate = entry ?? {};
+    const name = candidate.name;
+    if (typeof name !== "string" || !DEVSY_AGENT_ASSET_NAMES.some((assetName) => assetName === name))
+      continue;
+    const id5 = candidate.id;
+    const size = candidate.size;
+    const digest3 = candidate.digest;
+    const downloadUrl = candidate.browser_download_url;
+    if (typeof id5 !== "number" || !Number.isSafeInteger(id5) || typeof size !== "number" || !Number.isSafeInteger(size) || size <= 0) {
+      throw new Error(`Devsy ${version} reported an unusable ${String(name)} asset.`);
+    }
+    const sha2562 = typeof digest3 === "string" && digest3.startsWith("sha256:") ? digest3.slice("sha256:".length).toLowerCase() : "";
+    if (!/^[0-9a-f]{64}$/.test(sha2562)) {
+      throw new Error(
+        `Devsy ${version} does not publish a SHA-256 digest for ${String(name)}; Devrouter cannot verify this release.`
+      );
+    }
+    if (typeof downloadUrl !== "string" || !downloadUrl.startsWith("https://")) {
+      throw new Error(`Devsy ${version} reported an unusable ${String(name)} download URL.`);
+    }
+    assets.push({ githubAssetId: id5, name, size, sha256: sha2562, url: downloadUrl });
+  }
+  if (assets.length === 0) {
+    throw new Error(`Devsy ${version} publishes no official Linux agent asset.`);
+  }
+  return { version, origin: "release", assets };
+}
 function devsyAgentRepairSuggestion(inspection) {
   if (inspection.state === "stale") {
-    return `Install Devsy ${SUPPORTED_DEVSY_VERSION} for a supported host, then run: ${DEVSY_AGENT_SETUP_COMMAND}`;
+    return `Install a supported Devsy release (${SUPPORTED_DEVSY_RANGE}) for a supported host, then run: ${DEVSY_AGENT_SETUP_COMMAND}`;
   }
   return inspection.source === "explicit" ? `Fix or unset DEVSY_AGENT_BINARY, then run: ${DEVSY_AGENT_SETUP_COMMAND}` : `Run: ${DEVSY_AGENT_SETUP_COMMAND}`;
 }
@@ -9194,8 +9447,8 @@ function nativeAssetName(platform, arch) {
   if (arch === "x64") return "devsy-linux-amd64";
   return void 0;
 }
-function managedBinaryPath(cacheRoot, asset) {
-  return import_node_path22.default.join(cacheRoot, `v${SUPPORTED_DEVSY_VERSION}`, asset.name);
+function managedBinaryPath(cacheRoot, devsyVersion, asset) {
+  return import_node_path22.default.join(cacheRoot, `v${devsyVersion}`, asset.name);
 }
 function hashOpenFile(file) {
   const digest3 = (0, import_node_crypto11.createHash)("sha256");
@@ -9239,7 +9492,7 @@ function resolvedOptions(options) {
     versionOutput: options.versionOutput ?? installedVersionOutput(),
     cacheRoot: options.cacheRoot ?? import_node_path22.default.join(CACHE_DIR, "devsy", "agents"),
     lockPath: options.lockPath ?? DEVSY_AGENT_CACHE_LOCK,
-    assets: options.assets ?? DEVSY_AGENT_ASSETS,
+    assets: options.assets,
     nativeAssetName: options.nativeAssetName
   };
 }
@@ -9248,48 +9501,67 @@ function inspectDevsyAgent(options = {}) {
   const installedVersion = parseVersion2(resolved.versionOutput);
   const explicitPath = resolved.env.DEVSY_AGENT_BINARY?.trim();
   const source = explicitPath ? "explicit" : "managed";
-  if (installedVersion === void 0 || installedVersion !== SUPPORTED_DEVSY_VERSION && compareVersionCore(installedVersion, SUPPORTED_DEVSY_VERSION) <= 0) {
+  if (!installedVersion) {
     return {
       state: "stale",
       source,
-      reason: installedVersion ? `installed Devsy ${installedVersion} is not supported by this Devrouter release` : "the supported Devsy version is not available",
-      installedVersion
+      reason: `the installed Devsy version could not be determined; Devrouter supports ${SUPPORTED_DEVSY_RANGE}`
     };
   }
-  if (explicitPath) {
+  if (!isSupportedDevsyVersion(installedVersion)) {
     return {
-      ...inspectBinary(explicitPath, resolved.assets, "invalid"),
+      state: "stale",
       source,
-      binaryPath: explicitPath,
+      reason: `installed Devsy ${installedVersion} is outside the supported range ${SUPPORTED_DEVSY_RANGE}`,
       installedVersion
     };
   }
-  if (installedVersion !== SUPPORTED_DEVSY_VERSION) {
+  const manifest = manifestForVersion(resolved, installedVersion);
+  if (!manifest) {
+    if (explicitPath) {
+      return {
+        ...inspectBinary(explicitPath, resolved.assets ?? DEVSY_AGENT_ASSETS, "invalid"),
+        source,
+        binaryPath: explicitPath,
+        installedVersion
+      };
+    }
     return {
       state: "ready",
       source: "host",
-      reason: `installed Devsy ${installedVersion} is newer than the verified ${SUPPORTED_DEVSY_VERSION} agent; the host CLI governs its own agent`,
+      reason: `no verified Devsy ${installedVersion} agent manifest is recorded yet; the host CLI governs its own agent`,
       installedVersion,
-      drift: { installed: installedVersion, supported: SUPPORTED_DEVSY_VERSION }
+      drift: { installed: installedVersion, supported: PINNED_DEVSY_AGENT_VERSION }
     };
   }
   const expectedName = resolved.nativeAssetName ?? nativeAssetName(resolved.platform, resolved.arch);
-  const asset = resolved.assets.find((candidate) => candidate.name === expectedName);
+  const asset = manifest.assets.find((candidate) => candidate.name === expectedName);
   if (!asset) {
     return {
       state: "stale",
       source,
-      reason: `this Devrouter release has no pinned Devsy agent for ${resolved.platform}/${resolved.arch}`,
-      installedVersion
+      reason: `Devsy ${installedVersion} has no official agent for ${resolved.platform}/${resolved.arch}`,
+      installedVersion,
+      manifestOrigin: manifest.origin
+    };
+  }
+  if (explicitPath) {
+    return {
+      ...inspectBinary(explicitPath, [asset], "invalid"),
+      source,
+      binaryPath: explicitPath,
+      installedVersion,
+      manifestOrigin: manifest.origin
     };
   }
-  const binaryPath = managedBinaryPath(resolved.cacheRoot, asset);
+  const binaryPath = managedBinaryPath(resolved.cacheRoot, installedVersion, asset);
   return {
     ...inspectBinary(binaryPath, [asset], "missing"),
     source,
     binaryPath,
     asset,
-    installedVersion
+    installedVersion,
+    manifestOrigin: manifest.origin
   };
 }
 async function writeAll(handle, chunk, position) {
@@ -9392,7 +9664,7 @@ async function downloadAndPublish(asset, binaryPath, fetcher, githubCliDownloade
     const writeChunk = async (chunk) => {
       size += chunk.byteLength;
       if (size > asset.size) {
-        throw new Error("Devsy agent download exceeded the pinned size");
+        throw new Error("Devsy agent download exceeded the expected size");
       }
       digest3.update(chunk);
       await writeAll(handle, chunk, size - chunk.byteLength);
@@ -9442,21 +9714,36 @@ async function downloadAndPublish(asset, binaryPath, fetcher, githubCliDownloade
     await import_node_fs16.default.promises.rm(temporaryPath, { force: true });
   }
 }
+function isReadyInspection(inspection) {
+  return inspection.state === "ready" && inspection.installedVersion !== void 0;
+}
+function preparedFromInspection(inspection) {
+  return {
+    version: inspection.installedVersion,
+    binaryPath: inspection.binaryPath,
+    source: inspection.source,
+    asset: inspection.asset,
+    changed: false,
+    transport: "existing"
+  };
+}
+function expectedAgentName(resolved) {
+  return resolved.nativeAssetName ?? nativeAssetName(resolved.platform, resolved.arch);
+}
+async function loadOrResolveManifest(resolved, version, options) {
+  const manifest = manifestForVersion(resolved, version);
+  if (manifest) return manifest;
+  const release = await resolveReleaseDevsyAgentManifest(version, options.fetcher ?? fetch);
+  writeManifestRecord(resolved.cacheRoot, release);
+  return release;
+}
 async function prepareDevsyAgent(options = {}) {
   const resolved = resolvedOptions(options);
   const inspectOptions = resolved;
   const before = inspectDevsyAgent(inspectOptions);
-  if (before.state === "ready") {
-    return {
-      binaryPath: before.binaryPath,
-      source: before.source,
-      asset: before.asset,
-      changed: false,
-      transport: "existing"
-    };
-  }
-  if (before.source === "explicit" || before.state === "stale" || !before.binaryPath || !before.asset) {
-    throw new DevsyAgentReadinessError(before);
+  if (before.state === "stale") throw new DevsyAgentReadinessError(before);
+  if (isReadyInspection(before) && before.source !== "host") {
+    return preparedFromInspection(before);
   }
   const lock = options.withLock ?? ((operation) => {
     import_node_fs16.default.mkdirSync(import_node_path22.default.dirname(resolved.lockPath), { recursive: true });
@@ -9473,38 +9760,42 @@ async function prepareDevsyAgent(options = {}) {
   });
   return lock(async () => {
     const current = inspectDevsyAgent(inspectOptions);
-    if (current.state === "ready") {
-      return {
-        binaryPath: current.binaryPath,
+    if (current.state === "stale") throw new DevsyAgentReadinessError(current);
+    if (isReadyInspection(current) && current.source !== "host") {
+      return preparedFromInspection(current);
+    }
+    const version = current.installedVersion;
+    if (!version) throw new DevsyAgentReadinessError(current);
+    const manifest = await loadOrResolveManifest(resolved, version, options);
+    if (current.source === "explicit") {
+      const verified = inspectDevsyAgent(inspectOptions);
+      if (isReadyInspection(verified)) return preparedFromInspection(verified);
+      throw new DevsyAgentReadinessError(verified);
+    }
+    const asset = manifest.assets.find(
+      (candidate) => candidate.name === expectedAgentName(resolved)
+    );
+    if (!asset) {
+      throw new DevsyAgentReadinessError({
+        state: "stale",
         source: current.source,
-        asset: current.asset,
-        changed: false,
-        transport: "existing"
-      };
-    }
-    if (current.source === "explicit" || current.state === "stale" || !current.binaryPath || !current.asset) {
-      throw new DevsyAgentReadinessError(current);
+        reason: `Devsy ${version} has no official agent for ${resolved.platform}/${resolved.arch}`,
+        installedVersion: version,
+        manifestOrigin: manifest.origin
+      });
     }
     const transport = await downloadAndPublish(
-      current.asset,
-      current.binaryPath,
+      asset,
+      managedBinaryPath(resolved.cacheRoot, version, asset),
       options.fetcher ?? fetch,
       options.githubCliDownloader ?? downloadWithGitHubCli
     );
     const published = inspectDevsyAgent(inspectOptions);
-    if (published.state !== "ready" || !published.binaryPath || !published.asset) {
-      throw new DevsyAgentReadinessError(published);
-    }
-    return {
-      binaryPath: published.binaryPath,
-      source: published.source,
-      asset: published.asset,
-      changed: true,
-      transport
-    };
+    if (!isReadyInspection(published)) throw new DevsyAgentReadinessError(published);
+    return { ...preparedFromInspection(published), changed: true, transport };
   });
 }
-var import_node_child_process7, import_node_crypto11, import_node_fs16, import_node_path22, SUPPORTED_DEVSY_VERSION, DEVSY_AGENT_SETUP_COMMAND, DEVSY_AGENT_ASSETS, DevsyAgentReadinessError, DEVSY_AGENT_CACHE_LOCK, DEVSY_AGENT_LOCK_WAIT_MS, GITHUB_CLI_STDERR_TAIL_BYTES;
+var import_node_child_process7, import_node_crypto11, import_node_fs16, import_node_path22, PINNED_DEVSY_AGENT_VERSION, SUPPORTED_DEVSY_MIN_VERSION, SUPPORTED_DEVSY_MAX_VERSION, SUPPORTED_DEVSY_RANGE, DEVSY_AGENT_SETUP_COMMAND, DEVSY_RELEASE_TAG_PREFIX, DEVSY_RELEASE_METADATA_BASE_URL, DEVSY_AGENT_ASSETS, DevsyAgentReadinessError, DEVSY_AGENT_CACHE_LOCK, DEVSY_AGENT_LOCK_WAIT_MS, DEVSY_AGENT_MANIFEST_FILE, DEVSY_AGENT_ASSET_NAMES, GITHUB_CLI_STDERR_TAIL_BYTES;
 var init_devsy_agent = __esm({
   "src/core/devsy-agent.ts"() {
     "use strict";
@@ -9514,8 +9805,13 @@ var init_devsy_agent = __esm({
     import_node_path22 = __toESM(require("path"));
     init_file_lock();
     init_router();
-    SUPPORTED_DEVSY_VERSION = "1.16.2";
+    PINNED_DEVSY_AGENT_VERSION = "1.16.2";
+    SUPPORTED_DEVSY_MIN_VERSION = "1.16.2";
+    SUPPORTED_DEVSY_MAX_VERSION = "2.0.0";
+    SUPPORTED_DEVSY_RANGE = `>=${SUPPORTED_DEVSY_MIN_VERSION} <${SUPPORTED_DEVSY_MAX_VERSION}`;
     DEVSY_AGENT_SETUP_COMMAND = "devrouter setup --yes --workspace-runtime devsy";
+    DEVSY_RELEASE_TAG_PREFIX = "v";
+    DEVSY_RELEASE_METADATA_BASE_URL = "https://api.github.com/repos/devsy-org/devsy/releases/tags";
     DEVSY_AGENT_ASSETS = [
       {
         githubAssetId: 529830010,
@@ -9541,6 +9837,8 @@ var init_devsy_agent = __esm({
     };
     DEVSY_AGENT_CACHE_LOCK = import_node_path22.default.join(DEVROUTER_HOME, "devsy-agent-cache.lock");
     DEVSY_AGENT_LOCK_WAIT_MS = 18e5;
+    DEVSY_AGENT_MANIFEST_FILE = "manifest.json";
+    DEVSY_AGENT_ASSET_NAMES = ["devsy-linux-arm64", "devsy-linux-amd64"];
     GITHUB_CLI_STDERR_TAIL_BYTES = 4096;
   }
 });
@@ -13413,8 +13711,9 @@ function inspectNetworkProviderBinding(input2) {
     if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(providerContext)) throw new Error();
     const contextArgs = ["--context", providerContext];
     const version = read(provider, provider === "devsy" ? ["--version"] : ["version"]);
-    const expectedVersion = provider === "devsy" ? "1.16.2" : "0.6.15";
-    if (version.match(/\b(?:v)?(\d+\.\d+\.\d+)\b/)?.[1] !== expectedVersion) throw new Error();
+    const parsedVersion = version.match(/\b(?:v)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\b/)?.[1];
+    if (provider === "devsy" ? !isSupportedDevsyVersion(parsedVersion) : parsedVersion !== "0.6.15")
+      throw new Error();
     const definitions = object3(
       JSON.parse(
         read(
@@ -13480,6 +13779,7 @@ var init_network_provider_inspect = __esm({
     import_node_child_process16 = require("child_process");
     import_node_crypto16 = require("crypto");
     init_devpod_environment();
+    init_devsy_agent();
   }
 });
 
@@ -15255,6 +15555,9 @@ function holderAttribution(holder, repoPath) {
   return attribution;
 }
 function remediationFor(holder, attribution) {
+  if (holder.name === ROUTER_CONTAINER_NAME) {
+    return "The shared devrouter router owns this port as a platform entrypoint and must keep running; change the consumer's fixed host binding, or route the dependency through devrouter's TCP protocol route, then run ensure again.";
+  }
   if (attribution.holderWorktreePath) {
     return `Stop the holding workspace with 'devrouter stop ${attribution.holderWorktreePath}', or override the consumer's published host binding through its own configuration, then run ensure again.`;
   }
@@ -15296,6 +15599,7 @@ var init_host_port_claims = __esm({
     import_node_path40 = __toESM(require("path"));
     init_devcontainer_profile();
     init_network_effect_scope();
+    init_router();
     init_workspace();
     init_workspace_ownership();
     COMPOSE_RENDER_TIMEOUT_MS = 3e4;
@@ -20253,6 +20557,155 @@ var init_controller = __esm({
   }
 });
 
+// src/commands/capacity.ts
+var capacity_exports = {};
+__export(capacity_exports, {
+  CapacityReconcileRefusal: () => CapacityReconcileRefusal,
+  runCapacityCommand: () => runCapacityCommand
+});
+function shellQuote(value) {
+  return "'" + value.split("'").join("'\\''") + "'";
+}
+function enumerateBindings() {
+  try {
+    return listUnsettledCapacityBindings();
+  } catch {
+    throw new CapacityReconcileRefusal("capacity-history-unprovable");
+  }
+}
+async function observeDeclaredPools(directory) {
+  const policy = readCapacityPolicy(directory);
+  if (!policy) return [];
+  const observed = [];
+  const unresolved = [];
+  for (const [runtimeDomain, domain] of Object.entries(policy.domains)) {
+    if (domain.kind !== "runtime") continue;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), POOL_PROBE_TIMEOUT_MS);
+    try {
+      const info = await readDockerCapacityInfo(domain.endpoint, controller.signal);
+      if (info.ID !== domain.daemonId) throw new Error("Pool observation identity changed.");
+      observed.push({
+        daemonId: domain.daemonId,
+        runtimeDomain,
+        hostDomain: domain.hostDomain,
+        hostChargeCeilingBytes: domain.hostChargeCeilingBytes
+      });
+    } catch {
+      unresolved.push(runtimeDomain);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  if (unresolved.length > 0)
+    throw new CapacityReconcileRefusal("capacity-pools-unresolved", { domains: unresolved });
+  return observed;
+}
+function refusalLines(refusal) {
+  const bindings = refusal.detail.bindings ?? [];
+  const domains = refusal.detail.domains ?? [];
+  switch (refusal.reason) {
+    case "capacity-reconcile-confirmation-required":
+      return "Refusing without --yes: reconciliation publishes a fresh empty capacity baseline.";
+    case "capacity-history-intact":
+      return "Capacity ledger history is intact or absent; there is no loss to reconcile.";
+    case "capacity-charges-pending":
+      return [
+        "Capacity reconciliation is blocked by " + bindings.length + " unsettled capacity binding" + (bindings.length === 1 ? "" : "s") + ":",
+        ...bindings.map(
+          (binding) => "  - " + binding.environmentId + (binding.workspace ? " (workspace " + binding.workspace + ")" : "") + ": run: devrouter stop " + shellQuote(binding.repoPath)
+        )
+      ].join("\n");
+    case "capacity-pools-unresolved":
+      return [
+        "Runtime domain" + (domains.length === 1 ? "" : "s") + " could not be observed: " + domains.join(", ") + ".",
+        "Start them so their pool ceiling can be recorded, or remove them from the capacity policy, then retry."
+      ].join("\n");
+    case "capacity-ledger-unusable":
+      return "The capacity ledger exists but cannot satisfy the surviving lifecycle evidence; preserve it and investigate before retrying.";
+    case "capacity-history-unprovable":
+      return "Capacity history cannot be proven; inspect the private lifecycle journals before retrying.";
+  }
+}
+async function runCapacityCommand(method, options, dependencies = {}) {
+  if (method !== "reconcile") throw new Error(`Unsupported capacity command: ${method}`);
+  const directory = dependencies.directory ?? import_node_path50.default.join(DEVROUTER_HOME, "controller");
+  const json = Boolean(options.json);
+  const emit = (payload, human) => {
+    process.stdout.write(json ? `${JSON.stringify(payload, null, 2)}
+` : `${human}
+`);
+  };
+  try {
+    if (!options.yes)
+      throw new CapacityReconcileRefusal("capacity-reconcile-confirmation-required");
+    const store = dependencies.store ?? createLifecycleCapacityStore(directory);
+    const preflight = store.inspect();
+    if (preflight.kind === "intact" || preflight.kind === "pristine")
+      throw new CapacityReconcileRefusal("capacity-history-intact");
+    if (preflight.kind === "stale") throw new CapacityReconcileRefusal("capacity-ledger-unusable");
+    const pending = enumerateBindings().bindings;
+    if (pending.length > 0)
+      throw new CapacityReconcileRefusal("capacity-charges-pending", { bindings: pending });
+    const pools = await (dependencies.observePools ?? observeDeclaredPools)(directory);
+    let appeared = [];
+    const outcome = store.reconcileLostHistory(
+      (state) => {
+        if (state.kind === "intact" || state.kind === "pristine")
+          throw new CapacityReconcileRefusal("capacity-history-intact");
+        if (state.kind === "stale") throw new CapacityReconcileRefusal("capacity-ledger-unusable");
+        const { floor, bindings } = enumerateBindings();
+        if (bindings.length > 0)
+          throw new CapacityReconcileRefusal("capacity-charges-pending", { bindings });
+        return { revision: floor + 1, pools };
+      },
+      () => {
+        appeared = enumerateBindings().bindings;
+        return appeared.length === 0;
+      }
+    );
+    if (!outcome.reconciled)
+      throw new CapacityReconcileRefusal("capacity-charges-pending", { bindings: appeared });
+    emit(
+      { version: 1, ok: true, reconciled: true, revision: outcome.revision, unresolved: 0 },
+      "Reconciled the lost capacity ledger: baseline revision " + outcome.revision + ", no charges carried. No journal-visible charge remained. Charges that were never journal-bound are not recoverable from the journals."
+    );
+  } catch (error) {
+    if (!(error instanceof CapacityReconcileRefusal)) throw error;
+    process.exitCode = 1;
+    emit(
+      {
+        version: 1,
+        ok: false,
+        reason: error.reason,
+        ...error.detail.bindings ? { bindings: error.detail.bindings } : {},
+        ...error.detail.domains ? { domains: error.detail.domains } : {}
+      },
+      refusalLines(error)
+    );
+  }
+}
+var import_node_path50, POOL_PROBE_TIMEOUT_MS, CapacityReconcileRefusal;
+var init_capacity = __esm({
+  "src/commands/capacity.ts"() {
+    "use strict";
+    import_node_path50 = __toESM(require("path"));
+    init_capacity_docker_probe();
+    init_capacity_policy();
+    init_reliability_operation_store();
+    init_router();
+    POOL_PROBE_TIMEOUT_MS = 3e3;
+    CapacityReconcileRefusal = class extends Error {
+      constructor(reason, detail = {}) {
+        super(reason);
+        this.reason = reason;
+        this.detail = detail;
+        this.name = "CapacityReconcileRefusal";
+      }
+    };
+  }
+});
+
 // src/core/agents-md.ts
 function buildDevrouterSection() {
   return [
@@ -20292,13 +20745,13 @@ function replaceDevrouterSection(content) {
   return `${content.slice(0, start)}${buildDevrouterSection()}${content.slice(end)}`;
 }
 function writeRepoFile(repoPath, relPath, content) {
-  const absolutePath = (0, import_node_path50.join)(repoPath, relPath);
-  (0, import_node_fs38.mkdirSync)((0, import_node_path50.dirname)(absolutePath), { recursive: true });
+  const absolutePath = (0, import_node_path51.join)(repoPath, relPath);
+  (0, import_node_fs38.mkdirSync)((0, import_node_path51.dirname)(absolutePath), { recursive: true });
   (0, import_node_fs38.writeFileSync)(absolutePath, content, "utf-8");
   return absolutePath;
 }
 function ensureAgentsMdSection(repoPath) {
-  const filePath = (0, import_node_path50.join)(repoPath, AGENTS_MD);
+  const filePath = (0, import_node_path51.join)(repoPath, AGENTS_MD);
   if ((0, import_node_fs38.existsSync)(filePath)) {
     const content = (0, import_node_fs38.readFileSync)(filePath, "utf-8");
     if (content.includes(DEVROUTER_SENTINEL)) {
@@ -20323,12 +20776,12 @@ function ensureSkillFile(repoPath) {
   const filePath = writeRepoFile(repoPath, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT);
   return { path: filePath, written: true };
 }
-var import_node_fs38, import_node_path50, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
+var import_node_fs38, import_node_path51, DEVROUTER_SENTINEL, DEVROUTER_END_SENTINEL, LEGACY_DEVROUTER_SECTION_END, AGENTS_MD, DEVROUTER_SKILL_REL_PATH, DEVROUTER_SKILL_CONTENT;
 var init_agents_md = __esm({
   "src/core/agents-md.ts"() {
     "use strict";
     import_node_fs38 = require("fs");
-    import_node_path50 = require("path");
+    import_node_path51 = require("path");
     DEVROUTER_SENTINEL = "<!-- devrouter -->";
     DEVROUTER_END_SENTINEL = "<!-- /devrouter -->";
     LEGACY_DEVROUTER_SECTION_END = "- `devrouter ls`";
@@ -20570,7 +21023,7 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - **When active**: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`\${WORKSPACE}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed \`ensure\` rejects every HTTP/TCP proxy upstream outside that exact alias namespace before it mutates DevPod or routes. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.
 - **TLS**: namespaced hosts (\`web.<ws>.localhost\`) are not covered by the \`*.localhost\` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.
 - **devcontainer integration**: managed scaffolds list the base compose file, then \`\${localEnv:DEVCONTAINER_COMPOSE_OVERLAY:docker-compose.default.yml}\`; custom repositories may keep another default overlay. Selecting \`.devcontainer/docker-compose.devrouter.yml\` for linked worktrees must pass \`WORKSPACE\` and \`DEVROUTER_WORKSPACE\` across the combined base/overlay config and bind-mount \`\${DEVROUTER_GIT_COMMON_DIR}\` to the same absolute app-container path. The app exposes \`\${WORKSPACE}-app\`; the proxy uses \`upstream: \${WORKSPACE}-app:<port>\`.
-- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects. For Devsy, run \`devrouter setup --yes --workspace-runtime devsy\` once so Devrouter acquires and verifies the pinned agent in its own machine cache. \`doctor\` reports \`ready\`, \`missing\`, \`stale\`, or \`invalid\` without network access, and \`ensure\` fails before the provider queue when readiness is not \`ready\`. An explicit \`DEVSY_AGENT_BINARY\` remains authoritative and must match a pinned official asset.
+- **Lifecycle**: after one-time \`setup\`, use \`ensure .\` for both primary and linked checkouts; never branch manually on checkout kind or use live verify as startup. \`stop .\` is non-destructive; \`stop . --delete\` is explicit exact-owner cleanup without worktree removal; and \`exec . -- <command...>\` runs one-shot commands only in the exact running workspace runtime (DevPod or Devsy). Never substitute raw \`devpod up\`, \`stop\`, \`delete\`, or the Devsy equivalents: they bypass devrouter's machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. Runtime selection is path-aware: \`DEVROUTER_WORKSPACE_RUNTIME=devpod|devsy\` forces one runtime, an exact-path registry owner wins next, then the machine preference from \`devrouter setup --workspace-runtime\`, then installed-CLI auto-detection. \`workspace up\` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped. Dirty or locked full down fails before side effects. For Devsy, run \`devrouter setup --yes --workspace-runtime devsy\` once per installed Devsy release, rerunning it after a Devsy update, so Devrouter acquires and verifies the official Linux agent in its own machine cache. Devrouter supports Devsy releases in the range >=1.16.2 <2.0.0 and refuses a release whose published asset has no SHA-256 digest. \`doctor\` reports \`ready\`, \`missing\`, \`stale\`, or \`invalid\` without network access, and \`ensure\` fails before the provider queue when readiness is not \`ready\`. An explicit \`DEVSY_AGENT_BINARY\` remains authoritative and must match the official asset for the installed release.
 - **Interrupted lifecycle**: ensure reconciles an interrupted or never-dispatched ensure after positive worker drainage and automatically repairs retained degraded runtimes. Unknown arbitrary exec is never replayed; explicit stop reconciles that uncertainty. Preserve journals and retained configuration when evidence is unavailable. This does not provide OOM prevention or capacity-managed automatic recovery.
 - **Managed process identity**: \`ensure\` executes an exact captured adapter snapshot. Default reuse includes command argv, workspace, and adapter SHA-256. Set \`DEVROUTER_PROCESS_FINGERPRINT_ENV\` only to comma-separated non-secret environment names whose values affect runtime identity; secret-like names are rejected and raw values are never persisted.
 - **Route state**: the versioned Traefik dynamic file is authoritative for both metadata and rendering. JSON is a compatibility mirror; valid headerless generations migrate automatically, while corrupt canonical metadata fails closed.
@@ -20631,6 +21084,8 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter profile plan --repo <path> [--profile <selection>] --contract <repo-relative-yaml> [--output <path>] [--json]\`: validate repository-owned resource policy and emit literal bindings without runtime access
 - \`devrouter stop [path] [--delete] [--json]\`: stop the exact workspace runtime and remove exact routes; \`--delete\` explicitly deletes its ownership-proven data without removing the checkout
 - \`devrouter exec [path] -- <command...>\`: literal one-shot command inside the exact running workspace runtime
+- \`devrouter harness gate [--repo <path>] [--wait-budget-ms <ms>] [--json]\`: defer one harness tool call until this checkout's lifecycle phase settles; prints the harness permission decision
+- \`devrouter capacity reconcile --yes [--json]\`: replace a provably absent capacity ledger with a fresh empty baseline once no journal-visible charge remains
 - \`devrouter up\` / \`devrouter down\`: start/stop shared Traefik router
 - \`devrouter status\`: router/container/network/TLS health
 - \`devrouter doctor [--repo .]\`: deep diagnostics (global + repo)
@@ -20658,6 +21113,61 @@ Run several worktrees of one repo in parallel without host/route collisions. A *
 - \`devrouter workspace down <workspace|branch> [--keep-worktree]\`: delete runtime/routes and optionally remove the clean worktree and record
 - \`devrouter workspace gc [--json] [--yes]\`: report missing owners by default; apply exact eligible cleanup with \`--yes\`
 
+## Agent harness gating
+
+A managed consumer can gate agent tool calls so a command never starts while the
+checkout's environment is mid-transition. Wire \`devrouter harness gate\` as a
+\`PreToolUse\` hook. Claude Code reads it from a settings file:
+
+    {
+      "hooks": {
+        "PreToolUse": [
+          { "matcher": "Bash", "hooks": [
+            { "type": "command", "command": "devrouter harness gate", "timeout": 90 }
+          ] }
+        ]
+      }
+    }
+
+The Codex CLI reads the same hook from \`$CODEX_HOME/hooks.json\`, where the shell
+tool is named \`exec_command\`:
+
+    {
+      "hooks": {
+        "PreToolUse": [
+          { "matcher": "exec_command|Bash|shell", "hooks": [
+            { "type": "command", "command": "devrouter harness gate", "timeout": 180 }
+          ] }
+        ]
+      }
+    }
+
+The gate identifies the requesting harness from its payload and answers in that
+harness's accepted shape: a refusal is a \`deny\` in both, while an allowed call is
+\`permissionDecision: allow\` for Claude Code and Codex receives a bare completion
+carrying the same guidance as \`additionalContext\`, because Codex rejects an
+\`allow\` decision as unsupported hook output.
+
+
+the checkout's durable phase is \`queued\`, \`starting\`, \`verifying\`, \`recovering\`
+or \`stopping\`, and prints the harness permission decision. The deferral consumes
+no model turns because the harness is blocked on the hook. \`--wait-budget-ms\`
+bounds the wait (default 30000); a phase that outlasts it returns one \`deny\` that
+names the phase and asks the agent not to retry automatically. Lifecycle
+commands (\`devrouter ...\`) always pass through, and unreadable journal evidence
+is allowed rather than blocking the agent. Set the harness hook \`timeout\` above
+the wait budget: an overrunning hook is not honored, and the tool proceeds under
+the harness's normal permission rules. Use \`--json\` for the devrouter decision
+envelope with wait metrics.
+
+Gated calls are keyed by the harness \`tool_use_id\` and recorded durably. If the
+harness re-delivers a call it already granted or cancelled, the gate returns one
+refusal naming the earlier decision instead of waiting again, because that call
+may already have run; the agent should verify it and issue a new call. Entries
+expire after 24 hours, the ledger keeps the newest 64 per checkout, and an
+unreadable or unwritable ledger never blocks the agent. Payloads without a
+\`tool_use_id\` keep the wait-only behavior.
+
 ## Validation workflow
 
 For devcontainer onboarding:
@@ -20863,12 +21373,13 @@ function buildOnboardingPrompt(options = {}) {
     `- When a workspace is active: hosts auto-namespace (\`web.localhost\` \u2192 \`web.<ws>.localhost\`), \`${WORKSPACE_PLACEHOLDER}\` in \`upstream\` is substituted with the token, and the docker \`router\` key is suffixed per workspace. Managed ensure rejects every HTTP/TCP upstream outside that exact alias namespace before mutation. The runtime config is computed in memory only \u2014 the committed \`.devrouter.yml\` is never rewritten.`,
     "- TLS: namespaced hosts (`web.<ws>.localhost`) are not covered by the `*.localhost` wildcard; devrouter auto-extends the mkcert cert SANs for active hosts when TLS is enabled.",
     "- Lifecycle: after one-time setup, use `devrouter ensure .` for both primary and linked checkouts; never branch on checkout kind or use live verify as startup. Managed consumer images contain no devrouter package/helper: ensure delivers its matching helper at runtime and invokes an exact captured snapshot of the repository-owned post-start adapter. Keep `.devrouter.yml` as the only consumer-side version pin. Use `devrouter stop .` for a non-destructive pause, `devrouter stop . --delete` only for explicit exact-owner cleanup without removing the checkout, and `devrouter exec . -- <command...>` for container commands. Never substitute raw DevPod/Devsy mutations; they bypass the machine-global ownership lock, which serializes provider mutations in a fair arrival-order queue and lets contenders wait up to thirty minutes with throttled stderr progress before failing with the queue position or holder PID and true durations. `workspace up` creates linked worktrees; destructive worktree removal and GC remain ledger-scoped.",
+    "- Managed agent harnesses can defer tool calls through `devrouter harness gate` wired as a `PreToolUse` hook (Claude Code settings, or `$CODEX_HOME/hooks.json` for the Codex CLI with the `exec_command` shell tool): it waits inside the hook process while the checkout's durable phase is queued, starting, verifying, recovering or stopping (no model turns), allows the tool once the phase settles, and refuses once with recovery guidance when `--wait-budget-ms` (default 30000) runs out. It identifies the requesting harness from its payload and answers in that harness's accepted shape, because Codex rejects an `allow` decision. It also records the gated call by harness tool-use id, so a call re-delivered after a granted or cancelled wait returns one refusal instead of repeating a command that may already have run. Lifecycle commands pass through, unreadable journal evidence is allowed rather than blocking the agent, and the hook timeout must exceed the wait budget.",
     "- After a drained interrupted ensure, manual exec can use an exactly proven retained Devsy runtime with the plain local Docker command. Revalidate identity for each tooling command until later preparation reconciles startup; preserve configuration, data and interrupted history. This does not repair absent stop baselines or provide OOM protection.",
     "- Busy ensure and exec wait up to thirty minutes for a positively identified active lifecycle worker on the same checkout, with stderr progress. Do not stop healthy work to make room. Commands stay serial; timeout or cancellation before admission leaves prior work untouched. A lifecycle fence change cancels admission, and uncertain execution is never replayed.",
     "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not detect or prevent OOM; bounded automatic recovery runs only when the operator enables the capacity recovery policy.",
     "- Capacity admission is opt-in: only an operator-enabled capacity policy with an enrolled checkout routes ensure and exec through controller admission. The CLI follows the decision with bounded reconnecting waits that survive controller restarts, worker results are journalled atomically, and stop bypasses admission. Without an enabled policy lifecycle behavior is unchanged. An optional recovery block adds bounded automatic recovery: one journal-admitted corrective ensure per positively failed required capability, bounded by per-scope restart counts, an aggregate corrective-action cap and a rolling observation window. It is inert unless enabled.",
     "- A lock that cannot prove its owner fails closed with the failing inspection stage, the exact lock path, and a portable reproduction command; run the canonical command in a permitted host context. No identity fallback is attempted, and `devrouter controller` prints the underlying cause on stderr while keeping the stable `controller-unavailable` JSON on stdout.",
-    "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once so Devrouter acquires and verifies the pinned agent in its own machine cache. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access; a host CLI newer than the verified pin is `ready` with a drift warning and no injected agent, while an older or unparseable version stays unsupported. `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match a pinned official asset. `ensure` and `stop` stream bounded phase progress on stderr, so parse command JSON from stdout only.",
+    "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once per installed Devsy release, rerunning it after a Devsy update, so Devrouter acquires and verifies the official Linux agent in its own machine cache. Devrouter supports releases in the range >=1.16.2 <2.0.0, verifies a release's published asset against the SHA-256 digest GitHub reports, and never injects a release without one. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access; a supported release with no recorded manifest is `ready` with a drift warning and no injected agent until `setup` records one, while a version outside the supported range or unparseable stays `stale`. `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match the official asset for the installed supported release. `ensure` and `stop` stream bounded phase progress on stderr, so parse command JSON from stdout only.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Managed adapters may use devrouter-process ensure --prepare-command <command> for synchronous dependency preparation under the process lock before app launch. Unchanged owned processes skip preparation; it participates in default fingerprints and must not daemonize or detach.",
@@ -20897,6 +21408,7 @@ function buildOnboardingPrompt(options = {}) {
     "- `devrouter doctor --repo <REPO_PATH>` warns on risky pre-wrapper DB assignments before `run --` for host apps that depend on postgres.",
     "- With TLS enabled, `devrouter doctor --repo <REPO_PATH>` also warns on cert SAN mismatches for configured hosts (`repo.tls-host-coverage`).",
     "- `devrouter doctor --repo <REPO_PATH>` errors on configured fixed host-port bindings already held by running containers (`repo.host-port-claims`) and warns when that comparison is unavailable.",
+    "- `devrouter doctor` compares every `devrouter` executable on PATH with the running CLI (`global.cli-path`) and warns when a shell would silently run a different version.",
     "- Robust one-shot migrate example (argv-safe, no nested shell quoting): `devrouter app exec <name> --repo <REPO_PATH> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload migrate`.",
     "- Robust one-shot seed example: `devrouter app exec <name> --repo <REPO_PATH> --yes -- infisical run --projectId <id> --env=<env> -- pnpm payload seed`.",
     "- Environment probe/debug example (run before migrations): `devrouter app exec <name> --repo <REPO_PATH> --yes -- printenv DB_URL DB_HOST DB_PORT DB_SHADOW_URL`.",
@@ -21571,7 +22083,7 @@ var init_init = __esm({
 });
 
 // src/core/upgrade.ts
-function parseSemver(version) {
+function parseSemver2(version) {
   const normalized = version.trim();
   const match = normalized.match(SEMVER_RE);
   if (!match) {
@@ -21584,12 +22096,12 @@ function parseSemver(version) {
   };
 }
 function normalizeVersion(version) {
-  const parsed = parseSemver(version);
+  const parsed = parseSemver2(version);
   return `${parsed.major}.${parsed.minor}.${parsed.patch}`;
 }
 function compareVersions(a, b) {
-  const left = parseSemver(a);
-  const right = parseSemver(b);
+  const left = parseSemver2(a);
+  const right = parseSemver2(b);
   if (left.major !== right.major) {
     return left.major - right.major;
   }
@@ -21636,7 +22148,7 @@ function readPromptDirectory(promptDirPath) {
       continue;
     }
     const version = normalizeVersion(basename);
-    const promptPath = import_node_path51.default.join(promptDirPath, file.name);
+    const promptPath = import_node_path52.default.join(promptDirPath, file.name);
     const prompt = import_node_fs39.default.readFileSync(promptPath, "utf-8").trim();
     releases.push({ version, prompt, promptPath });
   }
@@ -21658,17 +22170,17 @@ function listAvailableUpgradeTargets(currentVersion, releases) {
 }
 function resolvePromptDirectory(explicitPath) {
   if (explicitPath) {
-    return import_node_path51.default.resolve(explicitPath);
+    return import_node_path52.default.resolve(explicitPath);
   }
-  const entryFile = process.argv[1] ? import_node_path51.default.resolve(process.argv[1]) : __filename;
-  const entryDir = import_node_path51.default.dirname(entryFile);
-  const resolvedEntryDir = import_node_fs39.default.existsSync(entryFile) ? import_node_path51.default.dirname(import_node_fs39.default.realpathSync(entryFile)) : entryDir;
+  const entryFile = process.argv[1] ? import_node_path52.default.resolve(process.argv[1]) : __filename;
+  const entryDir = import_node_path52.default.dirname(entryFile);
+  const resolvedEntryDir = import_node_fs39.default.existsSync(entryFile) ? import_node_path52.default.dirname(import_node_fs39.default.realpathSync(entryFile)) : entryDir;
   const candidates = [
-    import_node_path51.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path51.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path51.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
-    import_node_path51.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
-    import_node_path51.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
+    import_node_path52.default.resolve(resolvedEntryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path52.default.resolve(entryDir, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path52.default.resolve(__dirname, "..", UPGRADE_PROMPTS_DIR),
+    import_node_path52.default.resolve(__dirname, "..", "..", UPGRADE_PROMPTS_DIR),
+    import_node_path52.default.resolve(process.cwd(), UPGRADE_PROMPTS_DIR)
   ];
   const existing = candidates.find((candidate) => import_node_fs39.default.existsSync(candidate));
   return existing ?? candidates[0];
@@ -21686,12 +22198,12 @@ function loadUpgradeCatalog(options = {}) {
     releases
   };
 }
-var import_node_fs39, import_node_path51, SEMVER_RE, UPGRADE_PROMPTS_DIR;
+var import_node_fs39, import_node_path52, SEMVER_RE, UPGRADE_PROMPTS_DIR;
 var init_upgrade = __esm({
   "src/core/upgrade.ts"() {
     "use strict";
     import_node_fs39 = __toESM(require("fs"));
-    import_node_path51 = __toESM(require("path"));
+    import_node_path52 = __toESM(require("path"));
     init_repo_config();
     SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
     UPGRADE_PROMPTS_DIR = "upgrade-prompts";
@@ -21926,7 +22438,7 @@ function buildHostPortClaimsCheck(repoPath, workspace) {
       details: conflicts.map(
         (conflict) => `${conflict.service}: ${conflict.hostIp ?? "*"}:${conflict.hostPort}/${conflict.protocol} held by '${conflict.holderContainer}'` + (conflict.holderWorkspace ? ` (workspace '${conflict.holderWorkspace}')` : "")
       ).join("; "),
-      suggestion: "Stop the holding workspace or change the consumer's own published binding, then run ensure again. Devrouter never rewrites consumer-declared host bindings."
+      suggestion: conflicts.some((conflict) => conflict.holderContainer === ROUTER_CONTAINER_NAME) ? "The shared devrouter router owns its entrypoint ports and must keep running; change the consumer's own published binding or route that dependency through devrouter's TCP protocol route, then run ensure again. Devrouter never rewrites consumer-declared host bindings." : "Stop the holding workspace or change the consumer's own published binding, then run ensure again. Devrouter never rewrites consumer-declared host bindings."
     };
   } catch (error) {
     return {
@@ -21939,11 +22451,11 @@ function buildHostPortClaimsCheck(repoPath, workspace) {
   }
 }
 function buildDevcontainerChecks(repoPath, config, workspace) {
-  const devcontainerDir = import_node_path52.default.join(repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path53.default.join(repoPath, ".devcontainer");
   if (!import_node_fs40.default.existsSync(devcontainerDir)) {
     return [];
   }
-  const compose = inspectCompose(import_node_path52.default.join(devcontainerDir, "docker-compose.yml"), workspace);
+  const compose = inspectCompose(import_node_path53.default.join(devcontainerDir, "docker-compose.yml"), workspace);
   const checks = [];
   if (compose.parseError) {
     checks.push({
@@ -21970,7 +22482,7 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
     details: compose.publishedPorts.length > 0 ? compose.publishedPorts.join(", ") : void 0,
     suggestion: compose.parseError || compose.publishedPorts.length > 0 ? "Remove published ports and route services through devnet aliases with devrouter proxy apps." : void 0
   });
-  const dockerfilePath = import_node_path52.default.join(devcontainerDir, "Dockerfile");
+  const dockerfilePath = import_node_path53.default.join(devcontainerDir, "Dockerfile");
   const dockerfileExists = import_node_fs40.default.existsSync(dockerfilePath);
   const dockerfile = dockerfileExists ? import_node_fs40.default.readFileSync(dockerfilePath, "utf-8") : "";
   const devrouterArtifacts = ["@devrouter/cli", "devrouter-process"].filter(
@@ -22030,17 +22542,18 @@ function buildDevcontainerChecks(repoPath, config, workspace) {
   });
   return checks;
 }
-var import_node_fs40, import_node_path52, import_yaml5;
+var import_node_fs40, import_node_path53, import_yaml5;
 var init_devcontainer_diagnostics = __esm({
   "src/core/devcontainer-diagnostics.ts"() {
     "use strict";
     import_node_fs40 = __toESM(require("fs"));
-    import_node_path52 = __toESM(require("path"));
+    import_node_path53 = __toESM(require("path"));
     import_yaml5 = __toESM(require("yaml"));
     init_devcontainer_profile();
     init_host_port_claims();
     init_managed_post_start();
     init_repo_config();
+    init_router();
     init_workspace();
     init_workspace_ownership();
   }
@@ -22535,7 +23048,7 @@ function parseMinimumNodeMajor(value) {
   return Number(match[1]);
 }
 function readPackageJson(repoPath) {
-  const packagePath = import_node_path53.default.join(repoPath, "package.json");
+  const packagePath = import_node_path54.default.join(repoPath, "package.json");
   if (!import_node_fs43.default.existsSync(packagePath)) {
     return void 0;
   }
@@ -22610,16 +23123,18 @@ function devsyAgentCheck(inspection) {
     `state=${inspection.state}`,
     `source=${inspection.source}`,
     ...inspection.installedVersion ? [`version=${inspection.installedVersion}`] : [],
-    ...inspection.asset ? [`asset=${inspection.asset.name}`] : []
+    ...inspection.asset ? [`asset=${inspection.asset.name}`] : [],
+    ...inspection.manifestOrigin ? [`manifest=${inspection.manifestOrigin}`] : [],
+    `supported=${SUPPORTED_DEVSY_RANGE}`
   ].join(", ");
   if (inspection.state === "ready") {
     if (inspection.drift) {
       return {
         id: "global.devsy-agent",
         level: "warn",
-        summary: `Devsy ${inspection.drift.installed} is newer than the Devrouter-verified ${inspection.drift.supported} agent, so the host CLI manages its own agent.`,
+        summary: `Devsy ${inspection.drift.installed} governs its own agent; Devrouter injects no agent for it.`,
         details,
-        suggestion: `Devrouter injects its verified agent only for Devsy ${inspection.drift.supported}. To use that pairing, install Devsy ${inspection.drift.supported} and run: ${DEVSY_AGENT_SETUP_COMMAND}`
+        suggestion: `Run: devrouter setup --yes --workspace-runtime devsy to verify and inject the official Devsy ${inspection.drift.installed} agent for managed starts`
       };
     }
     return {
@@ -22629,7 +23144,7 @@ function devsyAgentCheck(inspection) {
       details
     };
   }
-  const summary = inspection.state === "missing" ? "Managed Devsy agent source is missing." : inspection.state === "stale" ? "Devsy agent source is stale for this Devrouter release." : "Devsy agent source is invalid.";
+  const summary = inspection.state === "missing" ? "No verified Devsy agent is cached for the installed Devsy version." : inspection.state === "stale" ? "The installed Devsy version is outside the supported range." : "Devsy agent source is invalid.";
   return {
     id: "global.devsy-agent",
     level: "error",
@@ -22638,6 +23153,125 @@ function devsyAgentCheck(inspection) {
     suggestion: devsyAgentRepairSuggestion(inspection)
   };
 }
+function realpathOrUndefined(value) {
+  if (!value) {
+    return void 0;
+  }
+  try {
+    return import_node_fs43.default.realpathSync(value);
+  } catch {
+    return void 0;
+  }
+}
+function isExecutableFile(filePath) {
+  try {
+    if (!import_node_fs43.default.statSync(filePath).isFile()) {
+      return false;
+    }
+    import_node_fs43.default.accessSync(filePath, import_node_fs43.default.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function displayPath(filePath) {
+  const home = process.env.HOME;
+  if (!home || home.length < 2 || !filePath.startsWith(`${home}${import_node_path54.default.sep}`)) {
+    return filePath;
+  }
+  return `~${filePath.slice(home.length)}`;
+}
+function probeInstalledCliVersion(executable) {
+  const result = (0, import_node_child_process29.spawnSync)(executable, ["-V"], {
+    encoding: "utf-8",
+    timeout: CLI_PATH_PROBE_TIMEOUT_MS
+  });
+  if (result.error) {
+    return void 0;
+  }
+  return INSTALLED_CLI_VERSION_RE.exec(outputFromResult(result) ?? "")?.[1];
+}
+function buildCliPathCheck(options = {}) {
+  const id5 = "global.cli-path";
+  const runningVersion = options.runningVersion ?? (true ? "0.1.0" : "0.0.0-dev");
+  if (runningVersion === "0.0.0-dev") {
+    return {
+      id: id5,
+      level: "ok",
+      summary: "Devrouter runs from an unstamped build, so PATH installs are not compared.",
+      details: "installedVersion=unknown; comparison=skipped"
+    };
+  }
+  const runningEntry = realpathOrUndefined(options.runningEntry ?? process.argv[1]);
+  const probeVersion = options.probeVersion ?? probeInstalledCliVersion;
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const dir of (options.pathValue ?? process.env.PATH ?? "").split(import_node_path54.default.delimiter)) {
+    if (dir.length === 0) {
+      continue;
+    }
+    const executable = import_node_path54.default.join(dir, "devrouter");
+    if (!isExecutableFile(executable)) {
+      continue;
+    }
+    const resolved = realpathOrUndefined(executable) ?? executable;
+    if (seen.has(resolved)) {
+      continue;
+    }
+    seen.add(resolved);
+    const running = runningEntry !== void 0 && resolved === runningEntry;
+    entries.push({
+      executable,
+      running,
+      version: running ? runningVersion : probeVersion(executable)
+    });
+  }
+  const shellInstall = entries[0];
+  if (!shellInstall) {
+    return {
+      id: id5,
+      level: "ok",
+      summary: "No devrouter executable is on PATH.",
+      details: `runningVersion=${runningVersion}`
+    };
+  }
+  const details = entries.slice(0, 4).map(
+    (entry) => `${displayPath(entry.executable)}=${entry.version ?? "unknown"}${entry.running ? " (running)" : ""}`
+  ).join(", ");
+  let newestVersion;
+  for (const entry of entries) {
+    if (entry.version === void 0) {
+      continue;
+    }
+    if (newestVersion === void 0 || compareSemver(entry.version, newestVersion) > 0) {
+      newestVersion = entry.version;
+    }
+  }
+  if (newestVersion !== void 0 && compareSemver(newestVersion, runningVersion) > 0) {
+    return {
+      id: id5,
+      level: "warn",
+      summary: `Another Devrouter install on PATH (${newestVersion}) is newer than the running CLI (${runningVersion}).`,
+      details,
+      suggestion: `Update the installs so one version serves every shell: npm install -g @devrouter/cli@${newestVersion}`
+    };
+  }
+  if (!shellInstall.running && shellInstall.version !== runningVersion) {
+    return {
+      id: id5,
+      level: "warn",
+      summary: `devrouter on PATH resolves to a different install (${shellInstall.version ?? "unknown version"}) than the running CLI (${runningVersion}).`,
+      details,
+      suggestion: `Align the installs so shell commands run the same CLI: npm install -g @devrouter/cli@${runningVersion}`
+    };
+  }
+  return {
+    id: id5,
+    level: "ok",
+    summary: "Devrouter installs on PATH match the running CLI.",
+    details: `${details}; runningVersion=${runningVersion}`
+  };
+}
 function buildGlobalToolChecks(repoPath) {
   const previous = process.env[DEVSY_DISABLE_TELEMETRY];
   process.env[DEVSY_DISABLE_TELEMETRY] = "true";
@@ -22730,19 +23364,23 @@ function buildGlobalToolChecksWithoutTelemetry(repoPath) {
     details: configProblems.length > 0 ? [configDetails, ...configProblems].join(" ") : configDetails,
     suggestion: configProblems.length > 0 ? "Run: devrouter setup --yes --workspace-runtime <devpod|devsy>" : void 0
   });
+  checks.push(buildCliPathCheck());
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process29, import_node_fs43, import_node_path53, DEVSY_DISABLE_TELEMETRY;
+var import_node_child_process29, import_node_fs43, import_node_path54, DEVSY_DISABLE_TELEMETRY, CLI_PATH_PROBE_TIMEOUT_MS, INSTALLED_CLI_VERSION_RE;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
     import_node_child_process29 = require("child_process");
     import_node_fs43 = __toESM(require("fs"));
-    import_node_path53 = __toESM(require("path"));
+    import_node_path54 = __toESM(require("path"));
     init_devsy_agent();
+    init_repo_config();
     init_workspace_runtime();
     DEVSY_DISABLE_TELEMETRY = "DEVSY_DISABLE_TELEMETRY";
+    CLI_PATH_PROBE_TIMEOUT_MS = 5e3;
+    INSTALLED_CLI_VERSION_RE = /Installed CLI version:\s*(\S+)/;
   }
 });
 
@@ -22756,10 +23394,10 @@ function inRepositoryWorkspaceScope(repoPath, worktreePath, livePaths) {
   if (livePaths.some((candidate) => sameWorkspacePath(candidate, worktreePath))) return true;
   const comparableRepo = comparableWorkspacePath(repoPath);
   const comparableWorktree = comparableWorkspacePath(worktreePath);
-  const localRoot = import_node_path54.default.join(comparableRepo, "trees") + import_node_path54.default.sep;
+  const localRoot = import_node_path55.default.join(comparableRepo, "trees") + import_node_path55.default.sep;
   if (comparableWorktree.startsWith(localRoot)) return true;
-  const legacyPrefix = `${import_node_path54.default.basename(comparableRepo)}-`;
-  return import_node_path54.default.dirname(comparableWorktree) === import_node_path54.default.dirname(comparableRepo) && import_node_path54.default.basename(comparableWorktree).startsWith(legacyPrefix);
+  const legacyPrefix = `${import_node_path55.default.basename(comparableRepo)}-`;
+  return import_node_path55.default.dirname(comparableWorktree) === import_node_path55.default.dirname(comparableRepo) && import_node_path55.default.basename(comparableWorktree).startsWith(legacyPrefix);
 }
 function previewActions(devpodStatus, routeCount, includeRecord) {
   const actions = [
@@ -23011,11 +23649,11 @@ function applyWorkspaceGc(plan) {
     candidates
   };
 }
-var import_node_path54;
+var import_node_path55;
 var init_workspace_gc = __esm({
   "src/core/workspace-gc.ts"() {
     "use strict";
-    import_node_path54 = __toESM(require("path"));
+    import_node_path55 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_host_routes();
@@ -23255,12 +23893,19 @@ async function buildDoctorReport(options = {}) {
       summary: "Capacity ledger is consistent with available lifecycle history."
     });
   } catch (error) {
+    const absent = (() => {
+      try {
+        return createLifecycleCapacityStore().inspect().kind === "absent";
+      } catch {
+        return false;
+      }
+    })();
     addCheck(checks, {
       id: "global.capacity-ledger",
       level: "error",
       summary: "Capacity ledger history is unavailable for safe admission.",
       details: error instanceof CapacityHistoryError ? error.code : "capacity-history-unprovable",
-      suggestion: "Preserve ledger and lifecycle records; restore verified history before retrying admission."
+      suggestion: absent ? "Preserve ledger and lifecycle records; with every enrolled environment stopped, run: devrouter capacity reconcile --yes" : "Preserve ledger and lifecycle records; restore verified history before retrying admission."
     });
   }
   let statusNextSteps = [];
@@ -23396,7 +24041,7 @@ async function buildDoctorReport(options = {}) {
           suggestion: `Remedy ${expansionNotice.remedy.code}: set a named default profile other than '${expansionNotice.profile}'${remedyCandidates}.`
         });
       }
-      const cliVersion = true ? "0.0.79" : "0.0.0-dev";
+      const cliVersion = true ? "0.1.0" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       const installedKnown = cliVersion !== "0.0.0-dev";
       const versionComparison = installedKnown && configVersion ? compareSemver(configVersion, cliVersion) : void 0;
@@ -23432,7 +24077,7 @@ async function buildDoctorReport(options = {}) {
         (app) => app.docker.composeFiles.map((filePath) => ({
           app: app.name,
           filePath,
-          absolutePath: import_node_path55.default.resolve(repo.path, filePath)
+          absolutePath: import_node_path56.default.resolve(repo.path, filePath)
         }))
       ).filter((entry) => !import_node_fs44.default.existsSync(entry.absolutePath));
       addCheck(checks, {
@@ -23477,7 +24122,7 @@ async function buildDoctorReport(options = {}) {
       const missingHostCwds = config.apps.filter((app) => app.runtime === "host").map((app) => ({
         app: app.name,
         cwd: app.hostRun.cwd,
-        absolutePath: import_node_path55.default.resolve(repo.path, app.hostRun.cwd)
+        absolutePath: import_node_path56.default.resolve(repo.path, app.hostRun.cwd)
       })).filter((entry) => !import_node_fs44.default.existsSync(entry.absolutePath));
       addCheck(checks, {
         id: "repo.host-cwd",
@@ -23622,12 +24267,12 @@ async function buildDoctorReport(options = {}) {
     nextSteps
   };
 }
-var import_node_fs44, import_node_path55, import_yaml6, POSTGRES_DEFAULTS;
+var import_node_fs44, import_node_path56, import_yaml6, POSTGRES_DEFAULTS;
 var init_doctor = __esm({
   "src/core/doctor.ts"() {
     "use strict";
     import_node_fs44 = __toESM(require("fs"));
-    import_node_path55 = __toESM(require("path"));
+    import_node_path56 = __toESM(require("path"));
     import_yaml6 = __toESM(require("yaml"));
     init_capacity_store();
     init_docker();
@@ -23775,7 +24420,7 @@ async function runSetup(options = {}) {
           id: "global.devsy-agent",
           summary: prepared.changed && asset ? `Downloaded and verified ${asset.name} for Devsy.` : prepared.source === "host" ? "The host Devsy CLI manages its own agent; no Devrouter-managed agent is required." : `Verified the ${prepared.source} Devsy agent source.`,
           details: [
-            `version=${SUPPORTED_DEVSY_VERSION}`,
+            `version=${prepared.version}`,
             ...asset ? [`asset=${asset.name}`] : [],
             `source=${prepared.source}`,
             `transport=${prepared.transport}`
@@ -24257,6 +24902,519 @@ var init_status2 = __esm({
   }
 });
 
+// src/core/harness-continuation.ts
+function harnessContinuationPath(repoRoot) {
+  const key = (0, import_node_crypto26.createHash)("sha256").update(comparableWorkspacePath(repoRoot)).digest("hex");
+  return import_node_path57.default.join(DEVROUTER_HOME, "harness", `${key}.json`);
+}
+function counter4(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function validEntry(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const entry = value;
+  return typeof entry.toolUseId === "string" && entry.toolUseId.length > 0 && entry.toolUseId.length <= MAX_TOOL_USE_ID_LENGTH && typeof entry.payloadSha256 === "string" && /^[0-9a-f]{64}$/.test(entry.payloadSha256) && (entry.state === "waiting" || entry.state === "granted" || entry.state === "refused" || entry.state === "interrupted") && typeof entry.phase === "string" && entry.phase.length <= MAX_PHASE_LENGTH && counter4(entry.budgetMs) && counter4(entry.claimedAtMs) && (entry.settledAtMs === void 0 || counter4(entry.settledAtMs)) && (entry.waitedMs === void 0 || counter4(entry.waitedMs));
+}
+function readLedgerSync(file, nowMs) {
+  let stat;
+  try {
+    stat = import_node_fs45.default.lstatSync(file);
+  } catch {
+    return [];
+  }
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_LEDGER_BYTES) return [];
+  if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(import_node_fs45.default.readFileSync(file, "utf-8"));
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  return parsed.filter(validEntry).filter(
+    (entry) => nowMs - (entry.settledAtMs ?? entry.claimedAtMs) < HARNESS_CONTINUATION_TTL_MS
+  );
+}
+function readHarnessContinuations(repoRoot, nowMs = Date.now()) {
+  try {
+    return readLedgerSync(harnessContinuationPath(repoRoot), nowMs);
+  } catch {
+    return [];
+  }
+}
+function claimHarnessContinuation(repoRoot, claim2) {
+  const nowMs = claim2.nowMs ?? Date.now();
+  try {
+    const file = harnessContinuationPath(repoRoot);
+    import_node_fs45.default.mkdirSync(import_node_path57.default.dirname(file), { recursive: true, mode: 448 });
+    return withFileLockSync(
+      `${file}.lock`,
+      { activity: "harness continuation claim", waitMs: HARNESS_CONTINUATION_LOCK_WAIT_MS },
+      () => {
+        const entries = readLedgerSync(file, nowMs);
+        const existing = entries.find((entry) => entry.toolUseId === claim2.toolUseId);
+        if (existing) return { kind: "replay", entry: existing };
+        entries.push({
+          toolUseId: claim2.toolUseId,
+          payloadSha256: claim2.payloadSha256,
+          state: "waiting",
+          phase: claim2.phase,
+          budgetMs: claim2.budgetMs,
+          claimedAtMs: nowMs
+        });
+        writeFileAtomically(
+          file,
+          `${JSON.stringify(entries.slice(-HARNESS_CONTINUATION_MAX_ENTRIES))}
+`
+        );
+        return { kind: "claimed", recorded: true };
+      }
+    );
+  } catch {
+    return { kind: "claimed", recorded: false };
+  }
+}
+function settleHarnessContinuation(repoRoot, toolUseId, settlement) {
+  const nowMs = settlement.nowMs ?? Date.now();
+  try {
+    const file = harnessContinuationPath(repoRoot);
+    import_node_fs45.default.mkdirSync(import_node_path57.default.dirname(file), { recursive: true, mode: 448 });
+    withFileLockSync(
+      `${file}.lock`,
+      { activity: "harness continuation settlement", waitMs: HARNESS_CONTINUATION_LOCK_WAIT_MS },
+      () => {
+        const entries = readLedgerSync(file, nowMs);
+        const index = entries.findIndex((entry) => entry.toolUseId === toolUseId);
+        if (index < 0 || entries[index]?.state !== "waiting") return;
+        entries[index] = {
+          ...entries[index],
+          state: settlement.state,
+          settledAtMs: nowMs,
+          ...settlement.waitedMs === void 0 ? {} : { waitedMs: settlement.waitedMs }
+        };
+        writeFileAtomically(
+          file,
+          `${JSON.stringify(entries.slice(-HARNESS_CONTINUATION_MAX_ENTRIES))}
+`
+        );
+      }
+    );
+  } catch {
+  }
+}
+var import_node_crypto26, import_node_fs45, import_node_path57, HARNESS_CONTINUATION_MAX_ENTRIES, HARNESS_CONTINUATION_TTL_MS, HARNESS_CONTINUATION_LOCK_WAIT_MS, MAX_LEDGER_BYTES, MAX_TOOL_USE_ID_LENGTH, MAX_PHASE_LENGTH;
+var init_harness_continuation = __esm({
+  "src/core/harness-continuation.ts"() {
+    "use strict";
+    import_node_crypto26 = require("crypto");
+    import_node_fs45 = __toESM(require("fs"));
+    import_node_path57 = __toESM(require("path"));
+    init_atomic_file();
+    init_file_lock();
+    init_router();
+    init_workspace();
+    HARNESS_CONTINUATION_MAX_ENTRIES = 64;
+    HARNESS_CONTINUATION_TTL_MS = 24 * 60 * 60 * 1e3;
+    HARNESS_CONTINUATION_LOCK_WAIT_MS = 200;
+    MAX_LEDGER_BYTES = 256 * 1024;
+    MAX_TOOL_USE_ID_LENGTH = 256;
+    MAX_PHASE_LENGTH = 32;
+  }
+});
+
+// src/core/harness-gate.ts
+function isTransitionalHarnessPhase(phase) {
+  return TRANSITIONAL_PHASES.includes(phase);
+}
+function findHarnessGateRepoRoot(cwd) {
+  let current = import_node_path58.default.resolve(cwd);
+  for (let depth = 0; depth < REPO_ROOT_MAX_DEPTH; depth += 1) {
+    if (import_node_fs46.default.existsSync(import_node_path58.default.join(current, ".devrouter.yml"))) {
+      return current;
+    }
+    const parent = import_node_path58.default.dirname(current);
+    if (parent === current) {
+      return void 0;
+    }
+    current = parent;
+  }
+  return void 0;
+}
+function readHarnessGateObservation(repoRoot) {
+  try {
+    const identity2 = {
+      repoPath: comparableWorkspacePath(repoRoot),
+      workspace: resolveWorktreeWorkspace(repoRoot) ?? null,
+      provider: resolveWorkspaceRuntimeOrDefault(repoRoot)
+    };
+    const record5 = readReliabilityOperation(identity2);
+    if (!record5) {
+      return { phase: "unknown", detail: "no-lifecycle-record" };
+    }
+    return { phase: record5.state.phase, detail: "lifecycle-record" };
+  } catch {
+    return { phase: "unknown", detail: "evidence-unavailable" };
+  }
+}
+async function waitForHarnessGate(options) {
+  const now = options.now ?? (() => Date.now());
+  const sleep3 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const interval = Math.max(1, options.pollIntervalMs ?? HARNESS_GATE_POLL_INTERVAL_MS);
+  const budget = Math.max(0, Math.min(options.budgetMs, HARNESS_GATE_MAX_BUDGET_MS));
+  let started;
+  let observations = 0;
+  let deferred = false;
+  for (; ; ) {
+    const observation = options.observe();
+    if (started === void 0) {
+      started = now();
+    }
+    observations += 1;
+    options.onObservation?.(observation, now() - started);
+    if (!isTransitionalHarnessPhase(observation.phase)) {
+      const waitedMs2 = now() - started;
+      return {
+        version: 1,
+        decision: deferred ? "deferred-allow" : "allow",
+        reason: deferred ? "settled-after-wait" : "settled",
+        waitedMs: waitedMs2,
+        observations,
+        observedPhase: observation.phase
+      };
+    }
+    const waitedMs = now() - started;
+    if (waitedMs + interval > budget) {
+      return {
+        version: 1,
+        decision: "refuse",
+        reason: "budget-exhausted",
+        waitedMs,
+        observations,
+        observedPhase: observation.phase
+      };
+    }
+    if (!deferred && options.claim) {
+      const claim2 = options.claim(observation);
+      if (claim2.kind === "replay") {
+        return {
+          version: 1,
+          decision: "refuse",
+          reason: "continuation-replay",
+          waitedMs,
+          observations,
+          observedPhase: observation.phase,
+          continuation: { state: claim2.state, settledAtMs: claim2.settledAtMs }
+        };
+      }
+    }
+    deferred = true;
+    await sleep3(Math.min(interval, budget - waitedMs));
+  }
+}
+function parseHarnessGateBudget(value) {
+  if (value === void 0) {
+    return HARNESS_GATE_DEFAULT_BUDGET_MS;
+  }
+  const parsed = typeof value === "number" ? value : Number(String(value));
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    return HARNESS_GATE_DEFAULT_BUDGET_MS;
+  }
+  return Math.min(Math.trunc(parsed), HARNESS_GATE_MAX_BUDGET_MS);
+}
+var import_node_fs46, import_node_path58, HARNESS_GATE_DEFAULT_BUDGET_MS, HARNESS_GATE_MAX_BUDGET_MS, HARNESS_GATE_POLL_INTERVAL_MS, TRANSITIONAL_PHASES, REPO_ROOT_MAX_DEPTH;
+var init_harness_gate = __esm({
+  "src/core/harness-gate.ts"() {
+    "use strict";
+    import_node_fs46 = __toESM(require("fs"));
+    import_node_path58 = __toESM(require("path"));
+    init_reliability_operation_store();
+    init_workspace();
+    init_workspace_runtime();
+    HARNESS_GATE_DEFAULT_BUDGET_MS = 3e4;
+    HARNESS_GATE_MAX_BUDGET_MS = 6e5;
+    HARNESS_GATE_POLL_INTERVAL_MS = 2e3;
+    TRANSITIONAL_PHASES = [
+      "queued",
+      "starting",
+      "verifying",
+      "recovering",
+      "stopping"
+    ];
+    REPO_ROOT_MAX_DEPTH = 64;
+  }
+});
+
+// src/commands/harness.ts
+var harness_exports = {};
+__export(harness_exports, {
+  detectHarnessHook: () => detectHarnessHook,
+  runHarnessCommand: () => runHarnessCommand
+});
+function detectHarnessHook(payload) {
+  const turnId = payload.turn_id;
+  return typeof turnId === "string" && turnId.length > 0 ? "codex" : "claude";
+}
+function readStdin() {
+  if (process.stdin.isTTY) {
+    return Promise.resolve("");
+  }
+  return new Promise((resolve) => {
+    let input2 = "";
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(input2);
+    };
+    const timer = setTimeout(finish, STDIN_TIMEOUT_MS);
+    process.stdin.setEncoding("utf-8");
+    process.stdin.on("data", (chunk) => {
+      input2 += chunk;
+      if (input2.length > MAX_HOOK_PAYLOAD_BYTES) {
+        finish();
+        process.stdin.destroy();
+      }
+    });
+    process.stdin.on("end", finish);
+    process.stdin.on("error", finish);
+  });
+}
+function isRecord7(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function permitReason(decision) {
+  const seconds = (decision.waitedMs / 1e3).toFixed(1);
+  if (decision.reason === "continuation-replay") {
+    const settled = decision.continuation?.settledAtMs;
+    const age = settled === void 0 ? "" : ` ${Math.max(0, Math.round((Date.now() - settled) / 1e3))}s ago`;
+    if (decision.continuation?.state === "granted") {
+      return `devrouter: this tool call was already permitted after a wait${age}; it is not re-evaluated. Verify whether it ran before issuing a new call.`;
+    }
+    if (decision.continuation?.state === "refused") {
+      return `devrouter: this tool call was already refused${age}; do not repeat it. Run 'devrouter status .' and issue a new call once it settles.`;
+    }
+    return `devrouter: this tool call's wait was cancelled${age}; the harness may have run it. Verify whether it ran before issuing a new call.`;
+  }
+  switch (decision.decision) {
+    case "refuse":
+      return `devrouter: the managed environment is still ${decision.observedPhase} after waiting ${seconds}s. Do not retry automatically; run 'devrouter status .' and continue once it settles.`;
+    case "deferred-allow":
+      return `devrouter: environment settled after ${seconds}s; the tool may run now.`;
+    default:
+      return "devrouter: environment settled.";
+  }
+}
+function hookOutput(decision, kind) {
+  if (decision.decision === "refuse") {
+    return JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: permitReason(decision)
+      }
+    });
+  }
+  if (kind === "codex") {
+    return JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        additionalContext: permitReason(decision)
+      }
+    });
+  }
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "allow",
+      permissionDecisionReason: permitReason(decision)
+    }
+  });
+}
+function gateDecision(decision, reason, observedPhase = "unknown") {
+  return {
+    version: 1,
+    decision,
+    reason,
+    waitedMs: 0,
+    observations: 0,
+    observedPhase
+  };
+}
+async function runHarnessCommand(method, options, repoPath, dependencies = {}) {
+  if (method !== "gate") {
+    throw new Error(`Unsupported harness method: ${method}`);
+  }
+  const json = options.json === true;
+  const stderr = dependencies.stderr ?? ((line) => process.stderr.write(`${line}
+`));
+  const observe = dependencies.observe ?? readHarnessGateObservation;
+  const raw = await (dependencies.stdin ?? readStdin)();
+  let kind = "claude";
+  let payload;
+  try {
+    const parsed = JSON.parse(raw);
+    if (isRecord7(parsed)) payload = parsed;
+  } catch {
+    payload = void 0;
+  }
+  if (!payload) {
+    const decision2 = gateDecision("allow", "hook-payload-invalid");
+    process.stdout.write(
+      json ? `${JSON.stringify(decision2)}
+` : `${hookOutput(decision2, kind)}
+`
+    );
+    return;
+  }
+  kind = detectHarnessHook(payload);
+  const toolName = typeof payload.tool_name === "string" ? payload.tool_name : "";
+  const toolInput = isRecord7(payload.tool_input) ? payload.tool_input : {};
+  const command = typeof toolInput.command === "string" ? toolInput.command : "";
+  if (toolName === "Bash" && DEVROUTER_COMMAND_RE.test(command)) {
+    const decision2 = gateDecision("allow", "devrouter-command");
+    process.stdout.write(
+      json ? `${JSON.stringify(decision2)}
+` : `${hookOutput(decision2, kind)}
+`
+    );
+    return;
+  }
+  const sessionCwd = repoPath ?? (typeof payload.cwd === "string" && payload.cwd.length > 0 ? payload.cwd : void 0);
+  const repoRoot = sessionCwd ? findHarnessGateRepoRoot(sessionCwd) : void 0;
+  if (!repoRoot) {
+    const decision2 = gateDecision("allow", "unmanaged-checkout");
+    process.stdout.write(
+      json ? `${JSON.stringify(decision2)}
+` : `${hookOutput(decision2, kind)}
+`
+    );
+    return;
+  }
+  const budgetMs = parseHarnessGateBudget(options.waitBudgetMs);
+  const toolUseId = typeof payload.tool_use_id === "string" && payload.tool_use_id.length > 0 && payload.tool_use_id.length <= MAX_TOOL_USE_ID_LENGTH2 ? payload.tool_use_id : void 0;
+  const payloadSha256 = (0, import_node_crypto27.createHash)("sha256").update(JSON.stringify(toolInput)).digest("hex");
+  const claim2 = dependencies.claim ?? ((root, input2) => {
+    const outcome = claimHarnessContinuation(root, input2);
+    if (outcome.kind === "claimed") {
+      if (!outcome.recorded) {
+        stderr(
+          "devrouter harness gate: continuation ledger is unavailable; repeat protection is off for this checkout"
+        );
+      }
+      return { kind: "claimed" };
+    }
+    const entry = outcome.entry;
+    return {
+      kind: "replay",
+      state: entry.state === "granted" ? "granted" : entry.state === "refused" ? "refused" : "interrupted",
+      settledAtMs: entry.settledAtMs
+    };
+  });
+  const settle = dependencies.settle ?? ((root, id5, settlement) => {
+    settleHarnessContinuation(root, id5, settlement);
+  });
+  const lookup = dependencies.lookup ?? ((root, id5) => {
+    const entry = readHarnessContinuations(root).find((candidate) => candidate.toolUseId === id5);
+    if (!entry) return void 0;
+    return {
+      state: entry.state === "granted" ? "granted" : entry.state === "refused" ? "refused" : (
+        // A claim still waiting belongs to a hook that never returned.
+        "interrupted"
+      ),
+      settledAtMs: entry.settledAtMs
+    };
+  });
+  if (toolUseId) {
+    const replay = lookup(repoRoot, toolUseId);
+    if (replay) {
+      const decision2 = {
+        version: 1,
+        decision: "refuse",
+        reason: "continuation-replay",
+        waitedMs: 0,
+        observations: 0,
+        observedPhase: "unknown",
+        continuation: { state: replay.state, settledAtMs: replay.settledAtMs }
+      };
+      process.stdout.write(
+        json ? `${JSON.stringify({ ...decision2, checkout: repoRoot })}
+` : `${hookOutput(decision2, kind)}
+`
+      );
+      return;
+    }
+  }
+  const interruption = (signal) => {
+    if (toolUseId) {
+      settle(repoRoot, toolUseId, { state: "interrupted" });
+    }
+    process.exit(signal === "SIGINT" ? 130 : 143);
+  };
+  if (toolUseId) {
+    process.once("SIGINT", interruption);
+    process.once("SIGTERM", interruption);
+  }
+  let announced = false;
+  let decision;
+  try {
+    decision = await waitForHarnessGate({
+      observe: () => observe(repoRoot),
+      budgetMs,
+      now: dependencies.now,
+      sleep: dependencies.sleep,
+      claim: toolUseId ? (observation) => claim2(repoRoot, {
+        toolUseId,
+        payloadSha256,
+        phase: observation.phase,
+        budgetMs
+      }) : void 0,
+      onObservation: (observation) => {
+        if (!announced && isTransitionalHarnessPhase(observation.phase)) {
+          announced = true;
+          stderr(
+            `devrouter harness gate: ${observation.phase} in progress; deferring this tool call for up to ${Math.round(budgetMs / 1e3)}s without model turns`
+          );
+        }
+      }
+    });
+  } finally {
+    if (toolUseId) {
+      process.removeListener("SIGINT", interruption);
+      process.removeListener("SIGTERM", interruption);
+    }
+  }
+  if (toolUseId && decision.reason !== "continuation-replay" && decision.decision !== "allow") {
+    settle(repoRoot, toolUseId, {
+      state: decision.decision === "refuse" ? "refused" : "granted",
+      waitedMs: decision.waitedMs
+    });
+  }
+  if (decision.decision === "deferred-allow") {
+    stderr(
+      `devrouter harness gate: settled after ${(decision.waitedMs / 1e3).toFixed(1)}s (${decision.observations} checks)`
+    );
+  }
+  process.stdout.write(
+    json ? `${JSON.stringify({ ...decision, checkout: repoRoot })}
+` : `${hookOutput(decision, kind)}
+`
+  );
+}
+var import_node_crypto27, MAX_HOOK_PAYLOAD_BYTES, STDIN_TIMEOUT_MS, MAX_TOOL_USE_ID_LENGTH2, DEVROUTER_COMMAND_RE;
+var init_harness = __esm({
+  "src/commands/harness.ts"() {
+    "use strict";
+    import_node_crypto27 = require("crypto");
+    init_harness_continuation();
+    init_harness_gate();
+    MAX_HOOK_PAYLOAD_BYTES = 256 * 1024;
+    STDIN_TIMEOUT_MS = 5e3;
+    MAX_TOOL_USE_ID_LENGTH2 = 256;
+    DEVROUTER_COMMAND_RE = /(?:^|[\s;&|()])(?:npx\s+|pnpm\s+(?:exec\s+)?|npm\s+(?:exec\s+)?|yarn\s+)?devrouter(?:-process)?(?:\s|$)/;
+  }
+});
+
 // src/commands/doctor.ts
 var doctor_exports = {};
 __export(doctor_exports, {
@@ -24459,17 +25617,17 @@ function asRecord3(value) {
   return value;
 }
 function readJson(filePath) {
-  if (!import_node_fs45.default.existsSync(filePath)) {
+  if (!import_node_fs47.default.existsSync(filePath)) {
     return void 0;
   }
   try {
-    return JSON.parse(import_node_fs45.default.readFileSync(filePath, "utf-8"));
+    return JSON.parse(import_node_fs47.default.readFileSync(filePath, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path56.default.relative(repoPath, filePath) || ".";
+  return import_node_path59.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -24510,7 +25668,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs45.default.existsSync(import_node_path56.default.join(repoPath, fileName))) {
+    if (import_node_fs47.default.existsSync(import_node_path59.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -24525,9 +25683,9 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path56.default.join(repoPath, ".nvmrc");
-  if (import_node_fs45.default.existsSync(nvmrc)) {
-    const version = import_node_fs45.default.readFileSync(nvmrc, "utf-8").trim();
+  const nvmrc = import_node_path59.default.join(repoPath, ".nvmrc");
+  if (import_node_fs47.default.existsSync(nvmrc)) {
+    const version = import_node_fs47.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
   }
   return void 0;
@@ -24588,7 +25746,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path56.default.isAbsolute(fileName) && !import_node_path56.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path59.default.isAbsolute(fileName) && !import_node_path59.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -24606,7 +25764,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs45.default.existsSync(import_node_path56.default.join(repoPath, fileName))
+    (fileName) => import_node_fs47.default.existsSync(import_node_path59.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -24644,7 +25802,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml7.default.parse(import_node_fs45.default.readFileSync(import_node_path56.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml7.default.parse(import_node_fs47.default.readFileSync(import_node_path59.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -24679,8 +25837,8 @@ function inspectServices(repoPath) {
   return services;
 }
 function inspectEnvFiles(repoPath) {
-  const files = import_node_fs45.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs45.default.readFileSync(import_node_path56.default.join(repoPath, fileName), "utf-8");
+  const files = import_node_fs47.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
+    const content = import_node_fs47.default.readFileSync(import_node_path59.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -24694,18 +25852,18 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path56.default.join(repoPath, ".devcontainer");
-  if (!import_node_fs45.default.existsSync(dir)) {
+  const dir = import_node_path59.default.join(repoPath, ".devcontainer");
+  if (!import_node_fs47.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs45.default.readdirSync(dir).filter((fileName) => import_node_fs45.default.statSync(import_node_path56.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs47.default.readdirSync(dir).filter((fileName) => import_node_fs47.default.statSync(import_node_path59.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
   const configPath = getRepoConfigPath(repoPath);
-  if (!import_node_fs45.default.existsSync(configPath)) {
+  if (!import_node_fs47.default.existsSync(configPath)) {
     return {
       exists: false,
       configPath,
@@ -24749,15 +25907,15 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs45.default.existsSync(import_node_path56.default.join(repoPath, fileName))) {
+    if (import_node_fs47.default.existsSync(import_node_path59.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path56.default.join(repoPath, ".agents", "skills");
-  if (import_node_fs45.default.existsSync(skillsDir)) {
-    for (const name of import_node_fs45.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path56.default.join(skillsDir, name, "SKILL.md");
-      if (import_node_fs45.default.existsSync(skillPath)) {
+  const skillsDir = import_node_path59.default.join(repoPath, ".agents", "skills");
+  if (import_node_fs47.default.existsSync(skillsDir)) {
+    for (const name of import_node_fs47.default.readdirSync(skillsDir).sort()) {
+      const skillPath = import_node_path59.default.join(skillsDir, name, "SKILL.md");
+      if (import_node_fs47.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
     }
@@ -24800,7 +25958,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path56.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path59.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -24819,12 +25977,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs45, import_node_path56, import_yaml7;
+var import_node_fs47, import_node_path59, import_yaml7;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
-    import_node_fs45 = __toESM(require("fs"));
-    import_node_path56 = __toESM(require("path"));
+    import_node_fs47 = __toESM(require("fs"));
+    import_node_path59 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -24929,7 +26087,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs46.default.existsSync(import_node_path57.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs48.default.existsSync(import_node_path60.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -25154,12 +26312,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs46, import_node_path57;
+var import_node_fs48, import_node_path60;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
-    import_node_fs46 = __toESM(require("fs"));
-    import_node_path57 = __toESM(require("path"));
+    import_node_fs48 = __toESM(require("fs"));
+    import_node_path60 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -25456,7 +26614,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path58.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path61.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -25501,8 +26659,8 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path58.default.join(repoPath, file.relativePath);
-  if (!import_node_fs47.default.existsSync(absolutePath)) {
+  const absolutePath = import_node_path61.default.join(repoPath, file.relativePath);
+  if (!import_node_fs49.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
       action: "create",
@@ -25510,7 +26668,7 @@ function classifyFile(repoPath, file) {
       bytes: Buffer.byteLength(file.content)
     };
   }
-  const current = import_node_fs47.default.readFileSync(absolutePath, "utf-8");
+  const current = import_node_fs49.default.readFileSync(absolutePath, "utf-8");
   if (!current.includes(MANAGED_MARKER2)) {
     return {
       path: file.relativePath,
@@ -25567,11 +26725,11 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path58.default.join(repoPath, file.relativePath);
-  import_node_fs47.default.mkdirSync(import_node_path58.default.dirname(absolutePath), { recursive: true });
-  import_node_fs47.default.writeFileSync(absolutePath, file.content, "utf-8");
+  const absolutePath = import_node_path61.default.join(repoPath, file.relativePath);
+  import_node_fs49.default.mkdirSync(import_node_path61.default.dirname(absolutePath), { recursive: true });
+  import_node_fs49.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
-    import_node_fs47.default.chmodSync(absolutePath, 493);
+    import_node_fs49.default.chmodSync(absolutePath, 493);
   }
 }
 function writeDevcontainer(options = {}) {
@@ -25609,12 +26767,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs47, import_node_path58, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs49, import_node_path61, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
-    import_node_fs47 = __toESM(require("fs"));
-    import_node_path58 = __toESM(require("path"));
+    import_node_fs49 = __toESM(require("fs"));
+    import_node_path61 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -25727,11 +26885,11 @@ var init_repo_devcontainer = __esm({
 function fail3(message) {
   throw new Error(message);
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requireRecord(value, label2) {
-  if (!isRecord7(value)) fail3(`${label2} must be a mapping.`);
+  if (!isRecord8(value)) fail3(`${label2} must be a mapping.`);
   return value;
 }
 function requireExactKeys(value, allowed, label2) {
@@ -25948,13 +27106,13 @@ function buildProfilePlanReport(options) {
   return { ...report, contractPath, bindings };
 }
 function loadContract(repoPath, contractPath) {
-  if (import_node_path59.default.isAbsolute(contractPath)) {
+  if (import_node_path62.default.isAbsolute(contractPath)) {
     fail3("profile plan contract path must be relative to the repository.");
   }
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
   let metadata;
   try {
-    metadata = import_node_fs48.default.lstatSync(absolutePath);
+    metadata = import_node_fs50.default.lstatSync(absolutePath);
   } catch (error) {
     fail3(`could not inspect profile plan contract '${contractPath}': ${error.message}`);
   }
@@ -25964,16 +27122,16 @@ function loadContract(repoPath, contractPath) {
   if (metadata.size > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
-  const realRepo = import_node_fs48.default.realpathSync(repoPath);
-  const realContract = import_node_fs48.default.realpathSync(absolutePath);
+  const realRepo = import_node_fs50.default.realpathSync(repoPath);
+  const realContract = import_node_fs50.default.realpathSync(absolutePath);
   assertPathWithinRepo(realContract, realRepo, "Profile plan contract");
-  const source = import_node_fs48.default.readFileSync(absolutePath, "utf-8");
+  const source = import_node_fs50.default.readFileSync(absolutePath, "utf-8");
   if (Buffer.byteLength(source, "utf-8") > MAX_CONTRACT_BYTES) {
     fail3(`profile plan contract exceeds the ${MAX_CONTRACT_BYTES}-byte limit.`);
   }
   return {
     contract: parseProfilePlanContract(source),
-    contractPath: import_node_path59.default.relative(repoPath, absolutePath).split(import_node_path59.default.sep).join("/")
+    contractPath: import_node_path62.default.relative(repoPath, absolutePath).split(import_node_path62.default.sep).join("/")
   };
 }
 function resolveProfilePlan(options) {
@@ -25987,12 +27145,12 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs48, import_node_path59, import_yaml8, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs50, import_node_path62, import_yaml8, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
-    import_node_fs48 = __toESM(require("fs"));
-    import_node_path59 = __toESM(require("path"));
+    import_node_fs50 = __toESM(require("fs"));
+    import_node_path62 = __toESM(require("path"));
     import_yaml8 = require("yaml");
     init_paths();
     init_profile_resolution();
@@ -26024,7 +27182,7 @@ async function runProfileResolveCommand(options) {
 async function runProfilePlanCommand(options) {
   const report = resolveProfilePlan(options);
   if (options.output) {
-    writeFileAtomically(import_node_path60.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
+    writeFileAtomically(import_node_path63.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
 `);
   }
   if (options.json) {
@@ -26071,14 +27229,14 @@ function printProfilePlanSummary(report, output2) {
     process.stdout.write(`Binding ${key}: ${renderValues(report.bindings[key] ?? [])}
 `);
   }
-  if (output2) process.stdout.write(`Output: ${import_node_path60.default.resolve(output2)}
+  if (output2) process.stdout.write(`Output: ${import_node_path63.default.resolve(output2)}
 `);
 }
-var import_node_path60;
+var import_node_path63;
 var init_profile = __esm({
   "src/commands/profile.ts"() {
     "use strict";
-    import_node_path60 = __toESM(require("path"));
+    import_node_path63 = __toESM(require("path"));
     init_atomic_file();
     init_output();
     init_profile_plan();
@@ -26368,7 +27526,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto26.createHash)("sha1").update(import_node_path61.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto28.createHash)("sha1").update(import_node_path64.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -26447,11 +27605,11 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path61.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
-  import_node_fs49.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path61.default.join(cachePath, "compose.devrouter.yml");
+  const cachePath = import_node_path64.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  import_node_fs51.default.mkdirSync(cachePath, { recursive: true });
+  const overlayPath = import_node_path64.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
-  import_node_fs49.default.writeFileSync(overlayPath, import_yaml9.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
+  import_node_fs51.default.writeFileSync(overlayPath, import_yaml9.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
     overlayPath,
     composeFiles: ensureComposeFiles(dockerApps),
@@ -26571,14 +27729,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process33, import_node_crypto26, import_node_fs49, import_node_path61, import_yaml9;
+var import_node_child_process33, import_node_crypto28, import_node_fs51, import_node_path64, import_yaml9;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
     import_node_child_process33 = require("child_process");
-    import_node_crypto26 = require("crypto");
-    import_node_fs49 = __toESM(require("fs"));
-    import_node_path61 = __toESM(require("path"));
+    import_node_crypto28 = require("crypto");
+    import_node_fs51 = __toESM(require("fs"));
+    import_node_path64 = __toESM(require("path"));
     import_yaml9 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -27400,13 +28558,13 @@ function measureWorktreeConsumption(worktreePath, options) {
   const startedAt = Date.now();
   let rootStat;
   try {
-    rootStat = import_node_fs50.default.lstatSync(worktreePath);
+    rootStat = import_node_fs52.default.lstatSync(worktreePath);
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
   let rootEntries;
   try {
-    rootEntries = import_node_fs50.default.readdirSync(worktreePath, { withFileTypes: true });
+    rootEntries = import_node_fs52.default.readdirSync(worktreePath, { withFileTypes: true });
   } catch (error) {
     return { status: "unknown", reason: describeError(error, worktreePath) };
   }
@@ -27432,10 +28590,10 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path62.default.join(dirPath, entry.name);
+      const entryPath = import_node_path65.default.join(dirPath, entry.name);
       let entryStat;
       try {
-        entryStat = import_node_fs50.default.lstatSync(entryPath);
+        entryStat = import_node_fs52.default.lstatSync(entryPath);
       } catch (error) {
         if (error?.code === "ENOENT") continue;
         unreadableReason = describeIncompleteWalk(error);
@@ -27445,7 +28603,7 @@ function measureWorktreeConsumption(worktreePath, options) {
       if (!entryStat.isDirectory()) continue;
       let childEntries;
       try {
-        childEntries = import_node_fs50.default.readdirSync(entryPath, { withFileTypes: true });
+        childEntries = import_node_fs52.default.readdirSync(entryPath, { withFileTypes: true });
       } catch (error) {
         unreadableReason = describeIncompleteWalk(error);
         break;
@@ -27509,12 +28667,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs50, import_node_path62, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs52, import_node_path65, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
-    import_node_fs50 = __toESM(require("fs"));
-    import_node_path62 = __toESM(require("path"));
+    import_node_fs52 = __toESM(require("fs"));
+    import_node_path65 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -27522,7 +28680,7 @@ var init_workspace_consumption = __esm({
 });
 
 // src/core/workspace-cleanup.ts
-function isRecord8(value) {
+function isRecord9(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isSha(value) {
@@ -27615,7 +28773,7 @@ function evaluateWorkspaceActivity(evidence, cutoff) {
 }
 function readGitSnapshot(worktree, commandRunner) {
   const comparablePath = comparableWorkspacePath(worktree.path);
-  if (worktree.prunable || !import_node_fs51.default.existsSync(comparablePath)) {
+  if (worktree.prunable || !import_node_fs53.default.existsSync(comparablePath)) {
     return { worktree, checkout: "missing", head: null, committerDate: null };
   }
   const head = gitOutput(comparablePath, ["rev-parse", "--verify", "HEAD"], commandRunner);
@@ -27666,14 +28824,14 @@ function parseGitHubChanges(value, project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord8(item)) return void 0;
-    const repository = isRecord8(item.repository) ? item.repository.nameWithOwner : void 0;
-    const headRepository = isRecord8(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
+    if (!isRecord9(item)) return void 0;
+    const repository = isRecord9(item.repository) ? item.repository.nameWithOwner : void 0;
+    const headRepository = isRecord9(item.headRepository) ? item.headRepository.nameWithOwner : void 0;
     if (repository !== project || headRepository !== project || item.headRefName !== branch || !isSha(item.headRefOid) || typeof item.baseRefName !== "string") {
       continue;
     }
     const merged = item.state === "MERGED" && validTimestamp(item.mergedAt);
-    const mergeCommit = isRecord8(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
+    const mergeCommit = isRecord9(item.mergeCommit) && isSha(item.mergeCommit.oid) ? item.mergeCommit.oid : void 0;
     const baseSha = isSha(item.baseRefOid) ? item.baseRefOid : void 0;
     changes.push({
       sourceBranch: branch,
@@ -27690,14 +28848,14 @@ function parseGitLabChanges(value, _project, branch) {
   if (!Array.isArray(value)) return void 0;
   const changes = [];
   for (const item of value) {
-    if (!isRecord8(item)) return void 0;
+    if (!isRecord9(item)) return void 0;
     const sourceProjectId = item.source_project_id;
     const targetProjectId = item.target_project_id;
     const sameProject = typeof sourceProjectId === "number" && typeof targetProjectId === "number" && sourceProjectId === targetProjectId;
     if (!sameProject || item.source_branch !== branch || !isSha(item.sha) || typeof item.target_branch !== "string") {
       continue;
     }
-    const diffRefs = isRecord8(item.diff_refs) ? item.diff_refs : void 0;
+    const diffRefs = isRecord9(item.diff_refs) ? item.diff_refs : void 0;
     const mergeCommitSha = isSha(item.merge_commit_sha) ? item.merge_commit_sha : void 0;
     const baseSha = diffRefs && isSha(diffRefs.base_sha) ? diffRefs.base_sha : void 0;
     changes.push({
@@ -28140,7 +29298,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers2 = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers2 = new Map(worktreePaths.map((path63) => [path63, unknownContainers(reason)]));
+      containers2 = new Map(worktreePaths.map((path66) => [path66, unknownContainers(reason)]));
     }
   }
   const rows2 = records.map((record5) => {
@@ -28190,12 +29348,12 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     networkCapacity: (dependencies.inspectNetworkCapacity ?? inspectNetworkCapacity)()
   };
 }
-var import_node_child_process35, import_node_fs51, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process35, import_node_fs53, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
     import_node_child_process35 = require("child_process");
-    import_node_fs51 = __toESM(require("fs"));
+    import_node_fs53 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
     init_network_diagnostics();
@@ -28307,7 +29465,7 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path63.default.join(mainRepo, "trees", ws);
+  return import_node_path66.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
   const ignored = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
@@ -28315,12 +29473,12 @@ function assertDefaultWorktreeRootIgnored(mainRepo) {
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path63.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path63.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path66.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path66.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path63.default.join(import_node_path63.default.dirname(mainRepo), `${import_node_path63.default.basename(mainRepo)}-${ws}`);
+  return import_node_path66.default.join(import_node_path66.default.dirname(mainRepo), `${import_node_path66.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -28432,7 +29590,7 @@ function assertFullDownPreflight(mainRepo, target) {
   if (sameWorkspacePath(target.worktreePath, mainRepo)) {
     throw new Error("Refusing to remove the primary Git checkout.");
   }
-  if (!target.worktree || target.worktree.prunable || !import_node_fs52.default.existsSync(target.worktreePath)) return;
+  if (!target.worktree || target.worktree.prunable || !import_node_fs54.default.existsSync(target.worktreePath)) return;
   if (target.worktree.locked) {
     throw new Error(
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
@@ -28472,9 +29630,9 @@ async function workspaceUp(branch, opts = {}) {
       (candidate) => defaultWorktreePath(mainRepo, candidate)
     );
     const generatedPath = candidatePaths.find(
-      (candidate) => !import_node_fs52.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
+      (candidate) => !import_node_fs54.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path63.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path66.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -28483,7 +29641,7 @@ async function workspaceUp(branch, opts = {}) {
         `Branch '${branch}' already uses worktree '${existingBranch.path}', not '${selectedPath}'.`
       );
     }
-    if (import_node_fs52.default.existsSync(selectedPath)) {
+    if (import_node_fs54.default.existsSync(selectedPath)) {
       const registered = worktrees.find(
         (worktree) => sameWorkspacePath(worktree.path, selectedPath)
       );
@@ -28646,7 +29804,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     const result = await mutateWorkspaceRuntime("delete", resolved, worktrees, opts.quiet);
     if (removeWorktree) {
-      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs52.default.existsSync(resolved.worktreePath)) {
+      if (resolved.worktree && !resolved.worktree.prunable && import_node_fs54.default.existsSync(resolved.worktreePath)) {
         const rm = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
@@ -28665,7 +29823,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     }
     return result;
   };
-  return resolved.worktree && !resolved.worktree.prunable && import_node_fs52.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
+  return resolved.worktree && !resolved.worktree.prunable && import_node_fs54.default.existsSync(resolved.worktreePath) ? withLifecycleOperationLock(resolved.worktreePath, operation) : operation();
 }
 async function workspaceStop(target, opts = {}) {
   return runWorkspaceLifecycle("stop", target, opts);
@@ -28673,13 +29831,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process36, import_node_fs52, import_node_path63, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process36, import_node_fs54, import_node_path66, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
     import_node_child_process36 = require("child_process");
-    import_node_fs52 = __toESM(require("fs"));
-    import_node_path63 = __toESM(require("path"));
+    import_node_fs54 = __toESM(require("fs"));
+    import_node_path66 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_devsy_mutation();
@@ -28863,7 +30021,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.0.79" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.1.0" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -28911,6 +30069,13 @@ controllerCommand.command("status").option("--session <id>").option("--cursor <c
     await runControllerCommand2("status", options);
   })
 );
+var capacityCommand = program.command("capacity").description("Inspect machines-local capacity ledger state");
+capacityCommand.command("reconcile").description("Replace a provably lost capacity ledger with a fresh empty baseline").option("--yes").option("--json").action(
+  withErrorHandling(async (options) => {
+    const { runCapacityCommand: runCapacityCommand2 } = await Promise.resolve().then(() => (init_capacity(), capacity_exports));
+    await runCapacityCommand2("reconcile", options);
+  })
+);
 program.command("init").description("Print an AI onboarding prompt template for adapting a repository to devrouter").option("--repo <path>", "Repository path to embed in the prompt (defaults to current directory)").option("--entries-json <json>", "Optional JSON array of app entries to embed in the prompt").option("--json", "Output prompt and command intents as JSON").option("--write-agents", "Write/update devrouter section in AGENTS.md").option("--write-skill", "Write .agents/skills/devrouter/SKILL.md").action(
   withErrorHandling(
     async (options) => {
@@ -28994,6 +30159,13 @@ program.command("status").description("Show router/container/network/TLS status
     await runStatusCommand2(options);
   })
 );
+var harnessCommand = program.command("harness").description("Agent harness integration for managed environments");
+harnessCommand.command("gate").description("Defer one harness tool call until this checkout's lifecycle phase settles").option("--repo <path>", "Repository path (defaults to the harness payload cwd)").option("--wait-budget-ms <ms>", "Bounded defer budget in milliseconds before one refusal").option("--json", "Print the devrouter decision envelope instead of the hook decision").action(
+  withErrorHandling(async (options) => {
+    const { runHarnessCommand: runHarnessCommand2 } = await Promise.resolve().then(() => (init_harness(), harness_exports));
+    await runHarnessCommand2("gate", options, options.repo);
+  })
+);
 program.command("doctor").alias("verify").description("Run global + repo diagnostics with actionable fixes for humans and AI agents").option("--repo <path>", "Repository path to validate (defaults to current directory)").option("--json", "Output JSON").action(
   withErrorHandling(async (options) => {
     const { runDoctorCommand: runDoctorCommand2 } = await Promise.resolve().then(() => (init_doctor2(), doctor_exports));
@@ -29238,10 +30410,10 @@ workspaceCommand2.command("down").description("Delete a workspace's runtime and
 workspaceCommand2.command("journal").description("Inspect and recover workspace lifecycle journals").command("settle").description(
   "Settle an interrupted lifecycle operation as unobservable so ensure and stop can proceed"
 ).argument("[path]", "Checkout path (defaults to current directory)").option("--json", "Output JSON").action(
-  withErrorHandling(async (path63, _options, command) => {
+  withErrorHandling(async (path66, _options, command) => {
     const options = command.opts();
     const { runWorkspaceJournalSettleCommand: runWorkspaceJournalSettleCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
-    await runWorkspaceJournalSettleCommand2({ ...path63 ? { path: path63 } : {}, ...options });
+    await runWorkspaceJournalSettleCommand2({ ...path66 ? { path: path66 } : {}, ...options });
   })
 );
 function parseVersionRequest(argv) {