@devrouter/cli 0.1.0 → 0.1.2

package/dist/devrouter-lifecycle-worker.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/core/devpod-exec.ts
 var import_node_child_process29 = require("child_process");
-var import_node_crypto22 = require("crypto");
+var import_node_crypto23 = require("crypto");
 
 // src/core/devpod-environment.ts
 var import_node_child_process3 = require("child_process");
@@ -4327,12 +4327,13 @@ function reliabilityFence(state) {
 }
 
 // src/core/reliability-operation-store.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var import_node_fs17 = __toESM(require("fs"));
 var import_node_path21 = __toESM(require("path"));
 var import_node_util4 = require("util");
 
 // src/core/capacity-store.ts
+var import_node_crypto7 = require("crypto");
 var import_node_fs15 = __toESM(require("fs"));
 var import_node_path19 = __toESM(require("path"));
 
@@ -4393,11 +4394,13 @@ function evaluateCapacity(budgets, samples, charges, requested, nowMs, maxSample
 // src/core/capacity-store.ts
 var MAX_BYTES = 1048576;
 var CapacityHistoryError = class extends Error {
-  constructor(code) {
+  constructor(code, cause = null, location = null) {
     super(
       code === "capacity-ledger-lost" ? "Capacity ledger history is lost; restore verified capacity-reservations.json." : "Capacity history cannot be proven; inspect the private lifecycle journals."
     );
     this.code = code;
+    this.cause = cause;
+    this.location = location;
     this.name = "CapacityHistoryError";
   }
 };
@@ -4554,9 +4557,10 @@ var CapacityStore = class {
       const buffer = Buffer.alloc(MAX_BYTES + 1);
       const count = import_node_fs15.default.readSync(descriptor, buffer, 0, buffer.length, 0);
       if (count > MAX_BYTES) throw new Error("Capacity reservation snapshot exceeds byte limit.");
-      const value = JSON.parse(buffer.subarray(0, count).toString("utf8"));
+      const bytes2 = buffer.subarray(0, count);
+      const value = JSON.parse(bytes2.toString("utf8"));
       validate(value);
-      this.ledgerGeneration = `${stat.dev}:${stat.ino}`;
+      this.ledgerGeneration = this.generationIdentity(stat, bytes2);
       if (value.revision < minimumRevision) return { kind: "stale", revision: value.revision };
       this.observedLedger = true;
       return { kind: "intact", revision: value.revision, snapshot: value };
@@ -4609,20 +4613,30 @@ var CapacityStore = class {
     return snapshot;
   }
   commit(snapshot) {
-    this.write(this.file, serializeSnapshot(snapshot));
+    const contents = serializeSnapshot(snapshot);
+    this.write(this.file, contents);
     this.observedLedger = true;
-    this.rememberGeneration();
+    this.rememberGeneration(contents);
     this.establish();
   }
   /** Remember the published snapshot identity for the next generation fence. */
-  rememberGeneration() {
+  rememberGeneration(contents) {
     try {
       const stat = import_node_fs15.default.statSync(this.file);
-      this.ledgerGeneration = stat.isFile() ? `${stat.dev}:${stat.ino}` : void 0;
+      this.ledgerGeneration = stat.isFile() ? this.generationIdentity(stat, contents) : void 0;
     } catch {
       this.ledgerGeneration = void 0;
     }
   }
+  /**
+   * File identity plus content digest. Deleting and recreating the snapshot can
+   * reuse its inode number, so the inode alone cannot fence a replacement that
+   * reuses a revision number.
+   */
+  generationIdentity(stat, contents) {
+    const digest = (0, import_node_crypto7.createHash)("sha256").update(contents).digest("hex");
+    return `${stat.dev}:${stat.ino}:${digest}`;
+  }
   /**
    * Durable evidence that recorded history is gone, for a stop whose physical
    * cessation is already proven. The caller holds that proof; this writes no
@@ -4871,7 +4885,7 @@ var CapacityStore = class {
 };
 
 // src/core/controller-store.ts
-var import_node_crypto7 = require("crypto");
+var import_node_crypto8 = require("crypto");
 var import_node_fs16 = __toESM(require("fs"));
 var import_node_path20 = __toESM(require("path"));
 var CONTROLLER_SNAPSHOT_BYTES = 1048576;
@@ -5173,7 +5187,7 @@ var ControllerStore = class {
   provenance(identity2) {
     if (identity2.version !== 2) throw new Error("Controller binding provenance is unavailable.");
     return {
-      digest: (0, import_node_crypto7.createHash)("sha256").update(JSON.stringify(["devrouter-controller-binding-v1", identity2.store, identity2.key])).digest("hex"),
+      digest: (0, import_node_crypto8.createHash)("sha256").update(JSON.stringify(["devrouter-controller-binding-v1", identity2.store, identity2.key])).digest("hex"),
       enrolledEpoch: identity2.enrolledEpoch
     };
   }
@@ -5197,7 +5211,7 @@ var ControllerStore = class {
       if (!current || current.store !== captured.store || current.epoch !== captured.epoch || JSON.stringify(current.fingerprint) !== JSON.stringify(captured.fingerprint) || identity2?.version !== 2)
         throw new Error("Controller binding incarnation changed.");
       this.checkProvenance(current, identity2);
-      return (0, import_node_crypto7.createHmac)("sha256", Buffer.from(identity2.key, "hex")).update(JSON.stringify({ owner, config })).digest("hex");
+      return (0, import_node_crypto8.createHmac)("sha256", Buffer.from(identity2.key, "hex")).update(JSON.stringify({ owner, config })).digest("hex");
     };
   }
   read() {
@@ -5250,7 +5264,7 @@ var ControllerStore = class {
     const identity2 = existing?.version === 2 ? existing : {
       version: 2,
       store,
-      key: (0, import_node_crypto7.randomBytes)(32).toString("hex"),
+      key: (0, import_node_crypto8.randomBytes)(32).toString("hex"),
       enrolledEpoch: epoch
     };
     if (existing?.version !== 2)
@@ -5296,7 +5310,7 @@ var ControllerStore = class {
     if (!previous) {
       previous = {
         version: 2,
-        store: (0, import_node_crypto7.randomUUID)(),
+        store: (0, import_node_crypto8.randomUUID)(),
         epoch: 0,
         revision: 0,
         parkingRevision: 0,
@@ -5347,7 +5361,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.1.0" : "0.0.0-dev";
+  return true ? "0.1.2" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -5370,7 +5384,7 @@ function identityKey(identity2) {
   if (!import_node_path21.default.isAbsolute(identity2.repoPath) || import_node_path21.default.resolve(identity2.repoPath) !== identity2.repoPath || identity2.repoPath.includes("\0") || identity2.workspace !== null && !isReliabilityId(identity2.workspace) || !["devpod", "devsy"].includes(identity2.provider)) {
     throw new Error("Invalid reliability workspace identity.");
   }
-  return (0, import_node_crypto8.createHash)("sha256").update(identity2.repoPath).digest("hex");
+  return (0, import_node_crypto9.createHash)("sha256").update(identity2.repoPath).digest("hex");
 }
 function reliabilityOperationPath(identity2) {
   return import_node_path21.default.join(DEVROUTER_HOME, "reliability", `${identityKey(identity2)}.json`);
@@ -5669,12 +5683,35 @@ function validate2(record5, identity2) {
     }
   }
 }
+var ReliabilityJournalError = class extends Error {
+  constructor(cause, location, message) {
+    super(message);
+    this.cause = cause;
+    this.location = location;
+    this.name = "ReliabilityJournalError";
+  }
+};
+var MAX_REPORTED_ENTRY_NAME = 160;
+var JournalFileGuardError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JournalFileGuardError";
+  }
+};
+function journalEntryLocation(name) {
+  const printable = name.replace(/[^A-Za-z0-9._-]/g, "?");
+  return printable.length > MAX_REPORTED_ENTRY_NAME ? `${printable.slice(0, MAX_REPORTED_ENTRY_NAME - 3)}...` : printable;
+}
 function createLifecycleCapacityStore(directory = import_node_path21.default.join(DEVROUTER_HOME, "controller")) {
   return new CapacityStore(directory, void 0, () => {
     try {
       return listUnsettledCapacityBindings().floor;
-    } catch {
-      throw new CapacityHistoryError("capacity-history-unprovable");
+    } catch (error) {
+      throw error instanceof ReliabilityJournalError ? new CapacityHistoryError("capacity-history-unprovable", error.cause, error.location) : new CapacityHistoryError(
+        "capacity-history-unprovable",
+        "journal-enumeration-failed",
+        null
+      );
     }
   });
 }
@@ -5733,11 +5770,12 @@ function readBoundedPrivateJson(file, label) {
   try {
     const stat = import_node_fs17.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.size > MAX_RECORD_BYTES || (stat.mode & 63) !== 0) {
-      throw new Error(`${label} is not a bounded private file.`);
+      throw new JournalFileGuardError(`${label} is not a bounded private file.`);
     }
     const bytes2 = Buffer.alloc(MAX_RECORD_BYTES + 1);
     const count = import_node_fs17.default.readSync(descriptor, bytes2, 0, bytes2.length, 0);
-    if (count > MAX_RECORD_BYTES) throw new Error(`${label} exceeds its byte limit.`);
+    if (count > MAX_RECORD_BYTES)
+      throw new JournalFileGuardError(`${label} exceeds its byte limit.`);
     return JSON.parse(bytes2.subarray(0, count).toString("utf8"));
   } finally {
     import_node_fs17.default.closeSync(descriptor);
@@ -5745,7 +5783,11 @@ function readBoundedPrivateJson(file, label) {
 }
 function assertReliabilityEnumerationTime(startedAtMs) {
   if (performance.now() - startedAtMs > MAX_RELIABILITY_ENUMERATION_MS)
-    throw new Error("Reliability journal enumeration exceeded its time limit.");
+    throw new ReliabilityJournalError(
+      "journal-enumeration-timeout",
+      null,
+      "Reliability journal enumeration exceeded its time limit."
+    );
 }
 function reliabilityDirectory() {
   return import_node_path21.default.join(DEVROUTER_HOME, "reliability");
@@ -5766,22 +5808,56 @@ function listReliabilityOperations() {
     stat = import_node_fs17.default.lstatSync(directory);
   } catch (error) {
     if (error.code === "ENOENT") return [];
-    throw error;
+    throw new ReliabilityJournalError(
+      "journal-directory-unreadable",
+      null,
+      "Reliability journal directory could not be read."
+    );
   }
   if (!stat.isDirectory() || stat.isSymbolicLink())
-    throw new Error("Reliability journal directory is unsafe.");
+    throw new ReliabilityJournalError(
+      "journal-directory-unsafe",
+      null,
+      "Reliability journal directory is unsafe."
+    );
   if (stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0)
-    throw new Error("Reliability journal directory is not private.");
+    throw new ReliabilityJournalError(
+      "journal-directory-unsafe",
+      null,
+      "Reliability journal directory is not private."
+    );
   const entries = [];
-  const handle = import_node_fs17.default.opendirSync(directory);
+  let handle;
+  try {
+    handle = import_node_fs17.default.opendirSync(directory);
+  } catch {
+    throw new ReliabilityJournalError(
+      "journal-directory-unreadable",
+      null,
+      "Reliability journal directory could not be read."
+    );
+  }
   try {
     for (; ; ) {
       assertReliabilityEnumerationTime(startedAtMs);
-      const entry = handle.readSync();
+      let entry;
+      try {
+        entry = handle.readSync();
+      } catch {
+        throw new ReliabilityJournalError(
+          "journal-directory-unreadable",
+          null,
+          "Reliability journal directory could not be read."
+        );
+      }
       if (!entry) break;
       entries.push(entry);
       if (entries.length > MAX_RELIABILITY_DIRECTORY_ENTRIES)
-        throw new Error("Reliability journal directory exceeds its entry limit.");
+        throw new ReliabilityJournalError(
+          "journal-enumeration-limit",
+          null,
+          "Reliability journal directory exceeds its entry limit."
+        );
     }
   } finally {
     handle.closeSync();
@@ -5790,27 +5866,82 @@ function listReliabilityOperations() {
   for (const entry of entries) {
     assertReliabilityEnumerationTime(startedAtMs);
     if (entry.isSymbolicLink())
-      throw new Error("Reliability journal directory contains a symlink.");
+      throw new ReliabilityJournalError(
+        "journal-entry-unsupported",
+        journalEntryLocation(entry.name),
+        "Reliability journal directory contains a symlink."
+      );
     if (!entry.isFile())
-      throw new Error("Reliability journal directory contains an unsupported entry.");
+      throw new ReliabilityJournalError(
+        "journal-entry-unsupported",
+        journalEntryLocation(entry.name),
+        "Reliability journal directory contains an unsupported entry."
+      );
     if (RELIABILITY_LOCK_NAME_RE.test(entry.name) || RELIABILITY_ATOMIC_TEMP_NAME_RE.test(entry.name))
       continue;
     const match = RELIABILITY_JOURNAL_NAME_RE.exec(entry.name);
-    if (!match) throw new Error("Reliability journal directory contains an unsupported entry.");
+    if (!match)
+      throw new ReliabilityJournalError(
+        "journal-entry-unsupported",
+        journalEntryLocation(entry.name),
+        "Reliability journal directory contains an unsupported entry."
+      );
     journals.push({ name: entry.name, key: match[1] });
   }
   if (journals.length > MAX_RELIABILITY_JOURNALS)
-    throw new Error("Reliability journal directory exceeds its journal limit.");
+    throw new ReliabilityJournalError(
+      "journal-enumeration-limit",
+      null,
+      "Reliability journal directory exceeds its journal limit."
+    );
   journals.sort((left, right) => left.name.localeCompare(right.name));
   const records = [];
   for (const journal of journals) {
     assertReliabilityEnumerationTime(startedAtMs);
     const file = import_node_path21.default.join(directory, journal.name);
-    const identity2 = journalIdentity(readBoundedPrivateJson(file, "Reliability journal"));
-    if (identityKey(identity2) !== journal.key)
-      throw new Error("Reliability journal filename does not match its identity.");
-    const record5 = readReliabilityOperation(identity2);
-    if (!record5) throw new Error("Reliability journal disappeared during enumeration.");
+    let raw;
+    try {
+      raw = readBoundedPrivateJson(file, "Reliability journal");
+    } catch (error) {
+      const fsCode = error?.code;
+      const cause = error instanceof JournalFileGuardError ? "journal-entry-unsafe" : error instanceof SyntaxError || !fsCode ? "journal-invalid" : "journal-unreadable";
+      throw new ReliabilityJournalError(
+        cause,
+        journalEntryLocation(journal.name),
+        error instanceof JournalFileGuardError ? error.message : cause === "journal-invalid" ? "Reliability journal entry is invalid." : "Reliability journal entry could not be read."
+      );
+    }
+    if (raw === void 0)
+      throw new ReliabilityJournalError(
+        "journal-unstable",
+        journalEntryLocation(journal.name),
+        "Reliability journal disappeared during enumeration."
+      );
+    let identity2;
+    let record5;
+    try {
+      identity2 = journalIdentity(raw);
+      if (identityKey(identity2) !== journal.key)
+        throw new ReliabilityJournalError(
+          "journal-identity-mismatch",
+          journalEntryLocation(journal.name),
+          "Reliability journal filename does not match its identity."
+        );
+      record5 = readReliabilityOperation(identity2);
+    } catch (error) {
+      if (error instanceof ReliabilityJournalError) throw error;
+      throw new ReliabilityJournalError(
+        "journal-invalid",
+        journalEntryLocation(journal.name),
+        "Reliability journal entry is invalid."
+      );
+    }
+    if (!record5)
+      throw new ReliabilityJournalError(
+        "journal-unstable",
+        journalEntryLocation(journal.name),
+        "Reliability journal disappeared during enumeration."
+      );
     records.push(record5);
     assertReliabilityEnumerationTime(startedAtMs);
   }
@@ -5886,7 +6017,7 @@ function clearStartupWitness(identity2, fence) {
 }
 
 // src/core/repo-config.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto10 = require("crypto");
 var import_node_fs18 = __toESM(require("fs"));
 var import_node_path22 = __toESM(require("path"));
 var import_yaml3 = __toESM(require("yaml"));
@@ -7163,7 +7294,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.1.0" : "0.0.0-dev";
+    const cliVersion = true ? "0.1.2" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -7342,7 +7473,7 @@ async function ensureNetwork(name) {
 
 // src/core/tls.ts
 var import_node_child_process13 = require("child_process");
-var import_node_crypto10 = require("crypto");
+var import_node_crypto11 = require("crypto");
 var import_node_fs19 = __toESM(require("fs"));
 var import_node_path23 = __toESM(require("path"));
 var DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
@@ -7412,7 +7543,7 @@ function parseDnsHostsFromSubjectAltName(subjectAltName) {
   return normalizeUniqueHosts(names);
 }
 function parseCertificateDnsHosts(pem) {
-  const certificate = new import_node_crypto10.X509Certificate(pem);
+  const certificate = new import_node_crypto11.X509Certificate(pem);
   const subjectAltName = certificate.subjectAltName ?? "";
   if (subjectAltName.length === 0) {
     return [];
@@ -8478,12 +8609,12 @@ function networkProviderEnvironment(binding, source) {
 }
 
 // src/core/network-claim-lookup.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var import_node_fs24 = __toESM(require("fs"));
 var import_node_path28 = __toESM(require("path"));
 
 // src/core/network-claims.ts
-var import_node_crypto11 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var import_node_fs23 = __toESM(require("fs"));
 var import_node_path27 = __toESM(require("path"));
 
@@ -9673,7 +9804,7 @@ function assertDirectory(directory) {
   }
 }
 function hashKey(value) {
-  return (0, import_node_crypto11.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto12.createHash)("sha256").update(value).digest("hex");
 }
 function cloneFence(fence) {
   return { ...fence };
@@ -9701,7 +9832,7 @@ function claimError(code, message) {
 function networkOwnerKey(repoPath) {
   if (!import_node_path28.default.isAbsolute(repoPath) || import_node_path28.default.resolve(repoPath) !== repoPath)
     throw new Error("Invalid network owner path.");
-  return (0, import_node_crypto12.createHash)("sha256").update(repoPath).digest("hex");
+  return (0, import_node_crypto13.createHash)("sha256").update(repoPath).digest("hex");
 }
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
@@ -9741,7 +9872,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     } finally {
       import_node_fs24.default.closeSync(descriptor);
     }
-    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto12.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
+    if (typeof value.daemonId !== "string" || `${(0, import_node_crypto13.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
     const claim2 = readNetworkClaim({
       daemonId: value.daemonId,
@@ -9758,7 +9889,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
 
 // src/core/network-provider-inspect.ts
 var import_node_child_process15 = require("child_process");
-var import_node_crypto13 = require("crypto");
+var import_node_crypto14 = require("crypto");
 function object2(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("Invalid provider evidence.");
@@ -9778,7 +9909,7 @@ function qualifyNetworkProviderDefinition(value, provider) {
   if (definition.name !== "docker" || ![true, "true"].includes(agent.local) || agent.driver !== void 0 && agent.driver !== "docker" && agent.driver !== "" || docker.path !== "${DOCKER_PATH}" || docker.builder !== "${DOCKER_BUILDER}" || ![false, "false"].includes(docker.install) || (provider === "devsy" ? docker.elevation !== "${DOCKER_ELEVATION}" : docker.elevation !== void 0 && docker.elevation !== "") || env.DOCKER_HOST !== "${DOCKER_HOST}" || Object.keys(env).some((key) => key !== "DOCKER_HOST") || host.global !== true || dockerPath.default !== "docker" || actualCommand.length !== 1 || typeof actualCommand[0] !== "string" || actualCommand[0].trim() !== command || Object.keys(exec).some((key) => key !== "command") || agent.path !== void 0 && agent.path !== "" || agent.downloadURL !== void 0 && agent.downloadURL !== "") {
     throw new Error("Docker provider definition is not qualified for network allocation.");
   }
-  return (0, import_node_crypto13.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
+  return (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
 }
 function read(provider, args) {
   const result = (0, import_node_child_process15.spawnSync)(provider, args, {
@@ -10161,7 +10292,7 @@ var ExecutionOutcomeError = class extends Error {
 };
 
 // src/core/reliability-lifecycle.ts
-var import_node_crypto21 = require("crypto");
+var import_node_crypto22 = require("crypto");
 var import_node_path40 = __toESM(require("path"));
 var import_node_util7 = require("util");
 
@@ -10170,7 +10301,7 @@ var import_node_fs26 = __toESM(require("fs"));
 var import_node_path30 = __toESM(require("path"));
 
 // src/core/controller-client.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto15 = require("crypto");
 var import_node_fs27 = __toESM(require("fs"));
 var import_node_net2 = __toESM(require("net"));
 var import_node_path32 = __toESM(require("path"));
@@ -10185,7 +10316,7 @@ var CONTROLLER_PROFILE_RE = new RegExp(
 );
 
 // src/core/controller-monitor.ts
-var import_node_crypto15 = require("crypto");
+var import_node_crypto16 = require("crypto");
 var import_node_util6 = require("util");
 
 // src/core/reliability-output.ts
@@ -10974,7 +11105,7 @@ function stepReliability(state, event, nowMs) {
 
 // src/core/reliability-worker.ts
 var import_node_child_process17 = require("child_process");
-var import_node_crypto16 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var import_node_fs28 = __toESM(require("fs"));
 var import_node_path33 = __toESM(require("path"));
 
@@ -11742,7 +11873,7 @@ async function runManagedHostPreparation(repoPath, config) {
 
 // src/core/managed-post-start.ts
 var import_node_child_process22 = require("child_process");
-var import_node_crypto17 = require("crypto");
+var import_node_crypto18 = require("crypto");
 var import_node_fs31 = __toESM(require("fs"));
 var import_node_path36 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
@@ -11799,7 +11930,7 @@ function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
 }
 function adapterFingerprint(adapter) {
-  return (0, import_node_crypto17.createHash)("sha256").update(adapter).digest("hex");
+  return (0, import_node_crypto18.createHash)("sha256").update(adapter).digest("hex");
 }
 function resolveProcessHelperPath() {
   const candidates = [
@@ -11952,24 +12083,45 @@ function runManagedProcessAction(options) {
 }
 
 // src/core/managed-runtime-status.ts
+function recoveryPath(repoPath) {
+  if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(repoPath)) return repoPath;
+  return `'${repoPath.replaceAll("'", "'\\''")}'`;
+}
 function reliabilityRecovery(reason2, repoPath) {
+  const checkout = recoveryPath(repoPath);
   switch (reason2) {
     case "stop-incomplete":
     case "operation-unknown":
-      return [`Run: devrouter stop ${repoPath}`, `Run: devrouter ensure ${repoPath} --repair`];
+      return [`Run: devrouter stop ${checkout}`, `Run: devrouter ensure ${checkout} --repair`];
+    case "start-refused":
+      return [
+        `Run: devrouter doctor --repo ${checkout} to read the refused fixed host-port claim and its holder`,
+        `Stop the holding workspace or change this repository's own published binding, then run: devrouter ensure ${checkout}`
+      ];
     case "unadmittable":
       return [
-        `Run: devrouter stop ${repoPath}`,
-        `Lower the requested capacity in .devrouter.yml, then run: devrouter ensure ${repoPath}`
+        `Run: devrouter stop ${checkout}`,
+        `Lower the requested capacity in .devrouter.yml, then run: devrouter ensure ${checkout}`
       ];
     case "capacity-parked":
-      return [`Run: devrouter ensure ${repoPath} (waits for capacity to free up)`];
+      return [
+        "Parked for host capacity: the enrolled foreground controller resumes this checkout after its pressure dwell and live-consumer checks pass.",
+        `Inspect the parked intent with: devrouter status --repo ${checkout} --json`,
+        `'devrouter ensure' refuses while the journal stays parked; release the intent instead with: devrouter stop ${checkout}`
+      ];
     case "capacity-waiting":
-      return [`Run: devrouter ensure ${repoPath} (still queued until capacity frees up)`];
+      return [`Run: devrouter ensure ${checkout} (still queued until capacity frees up)`];
     default:
       return [];
   }
 }
+function refusedManagedStart(result) {
+  if (result?.ok !== true) return false;
+  const value = result.value;
+  if (typeof value !== "object" || value === null) return false;
+  const conflicts = value.hostPortConflicts;
+  return Array.isArray(conflicts) && conflicts.length > 0;
+}
 function readReliabilityStatus(options) {
   let provider;
   try {
@@ -11989,7 +12141,7 @@ function readReliabilityStatus(options) {
     return void 0;
   }
   if (!record5) return void 0;
-  const reason2 = reliabilityAttention(record5.state);
+  const reason2 = reliabilityAttention(record5.state) ?? (record5.state.desired === "running" && refusedManagedStart(record5.result) ? "start-refused" : void 0);
   return {
     desired: record5.state.desired,
     phase: record5.state.phase,
@@ -12707,10 +12859,10 @@ function inspectLegacyNetworkCapacity(input) {
 }
 
 // src/core/network-managed.ts
-var import_node_crypto20 = require("crypto");
+var import_node_crypto21 = require("crypto");
 
 // src/core/network-compose.ts
-var import_node_crypto18 = require("crypto");
+var import_node_crypto19 = require("crypto");
 var SAFE_ENDPOINT_UPPER_BOUND_SEMANTICS = "full-lifecycle-demand";
 function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -13516,12 +13668,12 @@ function stableValue(value) {
 }
 function fingerprintComposeNetworkModel(input) {
   const projection = normalizedFingerprintProjection(input);
-  return (0, import_node_crypto18.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
+  return (0, import_node_crypto19.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
 }
 
 // src/core/network-compose-files.ts
 var import_node_child_process25 = require("child_process");
-var import_node_crypto19 = require("crypto");
+var import_node_crypto20 = require("crypto");
 var import_node_fs33 = __toESM(require("fs"));
 var import_node_path38 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
@@ -13622,7 +13774,7 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto19.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto20.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
@@ -13940,7 +14092,7 @@ function createManagedNetworkSession(input) {
           "Insufficient endpoint headroom; request an allowed larger network before first allocation."
         );
       const authority = readNetworkOperationAuthority(identity2);
-      const fingerprint = (0, import_node_crypto20.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
+      const fingerprint = (0, import_node_crypto21.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
       if (!saved) {
         if (policy.status !== "valid")
           throw new Error("New network allocation requires valid machine policy.");
@@ -16267,7 +16419,7 @@ async function devpodExecOutcome(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto22.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto23.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;