@devrouter/cli 0.1.2 → 0.1.3

package/dist/devrouter.js

@@ -4275,7 +4275,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs7.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.1.2" : "0.0.0-dev";
+    const cliVersion = true ? "0.1.3" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -6273,7 +6273,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.1.2" : "0.0.0-dev";
+  return true ? "0.1.3" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -6406,6 +6406,7 @@ function validate2(record5, identity2) {
     "revision",
     "state",
     "worker",
+    "stopWorkStarted",
     "effectSequence",
     "outcome",
     "result",
@@ -6587,6 +6588,9 @@ function validate2(record5, identity2) {
       throw new Error("Reliability worker identity is invalid.");
     }
   }
+  if (record5.stopWorkStarted !== void 0 && record5.stopWorkStarted !== null) {
+    if (record5.stopWorkStarted !== true) throw new Error("Invalid stop work marker.");
+  }
 }
 function journalEntryLocation(name) {
   const printable = name.replace(/[^A-Za-z0-9._-]/g, "?");
@@ -9186,9 +9190,11 @@ function listDevsyWorkspaces() {
   );
   if (result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(
+    const failure2 = new Error(
       `devsy workspace list failed: ${details || "devsy is not installed or unavailable"}`
     );
+    if (result.error) failure2.code = result.error.code;
+    throw failure2;
   }
   let parsed;
   try {
@@ -10254,6 +10260,9 @@ ${JSON.stringify(effective, null, 2)}
     contents
   };
 }
+function writeManagedDevcontainerConfig(plan) {
+  writeFileAtomically(plan.generatedPath, plan.contents);
+}
 function inspectManagedDevcontainerGeneratedConfig(plan) {
   let stat;
   try {
@@ -10422,7 +10431,11 @@ function listDevpodWorkspacesRaw(options = {}) {
   }
   if (result.error || result.status !== 0) {
     const details = [result.error?.message, result.stdout, result.stderr].filter(Boolean).join("\n").trim();
-    throw new Error(`devpod list failed: ${details || "devpod is not installed or unavailable"}`);
+    const failure2 = new Error(
+      `devpod list failed: ${details || "devpod is not installed or unavailable"}`
+    );
+    if (result.error) failure2.code = result.error.code;
+    throw failure2;
   }
   let parsed;
   try {
@@ -10714,25 +10727,23 @@ function writeWorkspaceRuntimeConfig(config) {
   writeFileAtomically(RUNTIME_CONFIG_FILE, `${JSON.stringify(next, null, 2)}
 `);
 }
+function readRegistrySnapshot(runtime, read2, snapshots) {
+  try {
+    return read2();
+  } catch (error) {
+    if (error?.code === "ENOENT") return void 0;
+    snapshots.unavailable.push(runtime);
+    snapshots.errors[runtime] = error instanceof Error ? error.message : String(error);
+    return void 0;
+  }
+}
 function getWorkspaceRegistrySnapshots() {
   if (cachedSnapshots) return cachedSnapshots;
   const snapshots = { unavailable: [], errors: {} };
-  if (isRuntimeInstalled("devsy")) {
-    try {
-      snapshots.devsy = listDevsyWorkspaces();
-    } catch (error) {
-      snapshots.unavailable.push("devsy");
-      snapshots.errors.devsy = error instanceof Error ? error.message : String(error);
-    }
-  }
-  if (isRuntimeInstalled("devpod")) {
-    try {
-      snapshots.devpod = listDevpodWorkspacesRaw();
-    } catch (error) {
-      snapshots.unavailable.push("devpod");
-      snapshots.errors.devpod = error instanceof Error ? error.message : String(error);
-    }
-  }
+  const devsy = readRegistrySnapshot("devsy", listDevsyWorkspaces, snapshots);
+  if (devsy !== void 0) snapshots.devsy = devsy;
+  const devpod = readRegistrySnapshot("devpod", listDevpodWorkspacesRaw, snapshots);
+  if (devpod !== void 0) snapshots.devpod = devpod;
   cachedSnapshots = snapshots;
   return snapshots;
 }
@@ -11511,11 +11522,19 @@ function absentRegistrationIdentity(state) {
   resetWorkspaceRuntimeCaches();
   if (resolveWorkspaceRuntimeOrDefault(state.repoPath) !== "devsy")
     throw new Error("Stop provider changed.");
-  if (!state.workspace || !isLinkedWorktree(state.repoPath))
-    throw new Error("Absent stop requires a linked workspace.");
-  const record5 = readWorkspaceOwnership(state.repoPath, state.workspace);
-  if (!record5 || record5.workspace !== state.workspace || record5.devpodId !== state.devpodId || !sameWorkspacePath(record5.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== state.workspace || inspectWorkspaceOwnership(record5, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
-    throw new Error("Absent stop workspace ownership changed.");
+  const linked = isLinkedWorktree(state.repoPath);
+  if (linked !== (state.workspace !== void 0))
+    throw new Error("Absent stop requires the exact workspace identity.");
+  let identity2;
+  if (linked) {
+    const workspace = state.workspace;
+    const record5 = readWorkspaceOwnership(state.repoPath, workspace);
+    if (!record5 || record5.workspace !== workspace || record5.devpodId !== state.devpodId || !sameWorkspacePath(record5.worktreePath, state.repoPath) || resolveWorktreeWorkspace(state.repoPath) !== workspace || inspectWorkspaceOwnership(record5, listGitWorktrees(state.repoPath), void 0).ownerStatus !== "present")
+      throw new Error("Absent stop workspace ownership changed.");
+    identity2 = { kind: "linked", record: record5, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+  } else {
+    identity2 = { kind: "primary", repoPath: state.repoPath, devpodId: state.devpodId };
+  }
   for (const entries of [
     listDevsyWorkspaces(),
     listDevpodWorkspacesRaw({ allowMissingExecutable: true })
@@ -11525,7 +11544,7 @@ function absentRegistrationIdentity(state) {
     ))
       throw new Error("Absent stop requires both provider registrations to remain absent.");
   }
-  return { record: record5, gitCommonDir: resolveGitCommonDir(state.repoPath) };
+  return identity2;
 }
 function replacementObservation(state) {
   resetWorkspaceRuntimeCaches();
@@ -11635,7 +11654,7 @@ function proveManagedStop(state) {
     const identityKeys = ["context", "providerId", "uid", "sourcePath", "sourceContainer"];
     const current = identityOf(owner.workspace);
     const changed = identityKeys.filter((key) => baseline[key] !== current[key]);
-    if (changed.length === 0 && state.workspace !== void 0 && isLinkedWorktree(state.repoPath) && inspectManagedStopContainers(baseline.project, baseline.endpoint).length === 0) {
+    if (changed.length === 0 && inspectManagedStopContainers(baseline.project, baseline.endpoint).length === 0) {
       proveAbsentPopulationStop(state, baseline, current);
       return { status: "proven-absent", containers: [] };
     }
@@ -12586,6 +12605,41 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     throw new Error("Initial managed stop left a workload running.");
   return true;
 }
+function restoreRecordedManagedDevcontainerConfig(repoPath) {
+  const plan = recordedManagedDevcontainerRestorePlan(repoPath);
+  if (!plan) return false;
+  writeManagedDevcontainerConfig(plan);
+  if (inspectManagedDevcontainerGeneratedConfig(plan).status !== "valid") {
+    throw new Error(
+      `Managed Dev Container path '${plan.generatedPath}' could not be restored from the recorded state.`
+    );
+  }
+  return true;
+}
+function recordedManagedDevcontainerRestorePlan(repoPath) {
+  try {
+    if (!import_node_fs25.default.existsSync(import_node_path33.default.join(repoPath, ".devrouter.yml"))) return void 0;
+    const linked = isLinkedWorktree(repoPath);
+    const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
+    const state = readManagedRuntimeState(repoPath, workspace);
+    if (!state) return void 0;
+    const runtime = loadRuntimeConfig(repoPath, workspace ?? "", state.profile);
+    if (!runtime.config.managedRuntime || runtime.profile !== state.profile || runtime.workspace !== workspace)
+      return void 0;
+    const plan = inspectManagedDevcontainerConfig({
+      repoPath,
+      config: runtime.config,
+      profile: runtime.resolvedProfile,
+      linked
+    });
+    if (inspectManagedDevcontainerGeneratedConfig(plan).status !== "missing") return void 0;
+    if (plan.sourceConfigSha256 !== state.sourceConfigSha256 || plan.effectiveConfigSha256 !== state.effectiveConfigSha256)
+      return void 0;
+    return plan;
+  } catch {
+    return void 0;
+  }
+}
 function stopRetainedManagedDevsyWorkspace(options) {
   const { repoPath, devsyId } = options;
   const linked = isLinkedWorktree(repoPath);
@@ -13984,6 +14038,7 @@ function inspectExactOwnership(devsyId, worktreePath) {
 }
 function mutateOwnedDevsyWorkspace(action2, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action2}`, worktreePath, () => {
+    restoreRecordedManagedDevcontainerConfig(worktreePath);
     if (action2 === "stop") {
       const stopped = stopRetainedManagedDevsyWorkspace({
         repoPath: worktreePath,
@@ -14392,7 +14447,7 @@ function handleOperationRequest(state, event) {
   if (state.phase === "stopping" || state.desired === "parked-for-capacity")
     return blocked(
       state,
-      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish.`
+      `phase is '${state.phase}' with desired '${state.desired}'; wait for the running stop to finish, or when no stop worker is running rerun 'devrouter stop <path> --delete', removing the exact provider registration first when the stop cannot prove the recorded population.`
     );
   if (event.kind === "exec" && (!event.runtimeRunning || state.desired !== "running" && state.intentRevision !== 0))
     return blocked(
@@ -16027,6 +16082,103 @@ var init_managed_post_start = __esm({
   }
 });
 
+// src/core/managed-mount-nesting.ts
+function normalizeDestination(value) {
+  const trimmed = value.trim().replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+}
+function isNestedWithin(destination, candidate) {
+  return candidate === "/" ? destination !== "/" : destination.startsWith(`${candidate}/`);
+}
+function unescapeMountField(value) {
+  return value.replace(
+    /\\([0-7]{3})/g,
+    (_match, octal) => String.fromCharCode(Number.parseInt(octal, 8))
+  );
+}
+function parseMountinfoDestinations(text4) {
+  const destinations = /* @__PURE__ */ new Set();
+  for (const line of text4.split("\n")) {
+    const fields2 = line.split(" ");
+    if (fields2.length < 5 || !/^\d+$/.test(fields2[0] ?? "")) continue;
+    destinations.add(normalizeDestination(unescapeMountField(fields2[4] ?? "")));
+  }
+  return [...destinations];
+}
+function isNestedIndex(destinations, index) {
+  return destinations.some(
+    (candidate, other) => other !== index && isNestedWithin(destinations[index] ?? "", candidate)
+  );
+}
+function configuredDestinations(configured) {
+  return configured.map((mount) => normalizeDestination(mount.Destination));
+}
+function classifyManagedMountNesting(configured, effectiveDestinations, containerId) {
+  const destinations = configuredDestinations(configured);
+  const nested = configured.filter((_mount, index) => isNestedIndex(destinations, index));
+  const identity2 = containerId ? { container: containerId } : {};
+  if (nested.length === 0) {
+    return { status: "not-applicable", checked: [], unwound: [], reason: NESTED_MOUNT_REASON };
+  }
+  if (effectiveDestinations === null) {
+    return {
+      status: "unverified",
+      checked: [],
+      unwound: [],
+      ...identity2,
+      reason: UNREADABLE_MOUNT_REASON
+    };
+  }
+  const effective = new Set(effectiveDestinations.map(normalizeDestination));
+  const checked = [];
+  const unwound = [];
+  for (const mount of nested) {
+    const destination = normalizeDestination(mount.Destination);
+    if (effective.has(destination)) {
+      checked.push(mount.Destination);
+      continue;
+    }
+    const nestedWithin = destinations.filter((candidate) => isNestedWithin(destination, candidate)).sort((a, b) => a.length - b.length)[0];
+    unwound.push({
+      destination: mount.Destination,
+      source: mount.Source,
+      nestedWithin: nestedWithin ?? "/"
+    });
+  }
+  return {
+    status: unwound.length > 0 ? "unwound" : "effective",
+    checked,
+    unwound,
+    ...identity2
+  };
+}
+function readContainerMountinfo(containerId, options) {
+  const result = (0, import_node_child_process24.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
+    encoding: "utf-8",
+    timeout: options.timeoutMs ?? 5e3,
+    stdio: ["ignore", "pipe", "pipe"],
+    ...networkDockerOptions()
+  });
+  if (result.status !== 0 || typeof result.stdout !== "string") return null;
+  const destinations = parseMountinfoDestinations(result.stdout);
+  return destinations.length > 0 ? destinations : null;
+}
+function observeManagedMountNesting(container, options = {}) {
+  const destinations = configuredDestinations(container.mounts);
+  const effective = destinations.some((_destination, index) => isNestedIndex(destinations, index)) ? readContainerMountinfo(container.id, options) : null;
+  return classifyManagedMountNesting(container.mounts, effective, container.id);
+}
+var import_node_child_process24, NESTED_MOUNT_REASON, UNREADABLE_MOUNT_REASON;
+var init_managed_mount_nesting = __esm({
+  "src/core/managed-mount-nesting.ts"() {
+    "use strict";
+    import_node_child_process24 = require("child_process");
+    init_network_effect_scope();
+    NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
+    UNREADABLE_MOUNT_REASON = "the container's own mount table could not be read";
+  }
+});
+
 // src/core/managed-runtime-status.ts
 function recoveryPath(repoPath) {
   if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(repoPath)) return repoPath;
@@ -16302,6 +16454,7 @@ function inspectManagedRuntime(options) {
     (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
   )?.Destination;
   const primaryActive = Boolean(primary?.state.Running);
+  const mountNesting = primary && primaryActive ? observeManagedMountNesting(primary) : void 0;
   if (generatedConfigMissing && (state || primaryActive || managedServicesActive)) {
     drift.push("managed generated Dev Container configuration is missing");
   }
@@ -16368,7 +16521,8 @@ function inspectManagedRuntime(options) {
     processStatuses,
     activeServices: sortedUnique2(activeServices),
     activeProcesses: sortedUnique2(activeProcesses),
-    drift
+    drift,
+    ...mountNesting ? { mountNesting } : {}
   };
 }
 function collectManagedRuntimeStatus(options) {
@@ -16516,6 +16670,7 @@ function collectManagedRuntimeStatus(options) {
     baseServiceStatuses: inspection.baseStatuses,
     processStatuses: inspection.processStatuses,
     drift: sortedUnique2(drift),
+    ...inspection.mountNesting ? { mountNesting: inspection.mountNesting } : {},
     ...inspection.plan?.sourceConfigSha256 || state?.sourceConfigSha256 ? { sourceConfigSha256: inspection.plan?.sourceConfigSha256 ?? state?.sourceConfigSha256 } : {},
     ...inspection.plan?.effectiveConfigSha256 || state?.effectiveConfigSha256 ? {
       effectiveConfigSha256: inspection.plan?.effectiveConfigSha256 ?? state?.effectiveConfigSha256
@@ -16530,6 +16685,7 @@ var init_managed_runtime_status = __esm({
     init_devcontainer_profile();
     init_devpod_environment();
     init_host_routes();
+    init_managed_mount_nesting();
     init_managed_post_start();
     init_managed_runtime_state();
     init_reliability_operation_store();
@@ -16549,7 +16705,7 @@ function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process24.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process25.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -16580,7 +16736,14 @@ function id4(value) {
 }
 function rows(output2) {
   const trimmed = output2.trim();
-  return trimmed ? trimmed.split(/\r?\n/).map((line) => JSON.parse(line)) : [];
+  return trimmed ? trimmed.split(/\r?\n/).map((line) => parseRecord(line)) : [];
+}
+function parseRecord(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    throw new NetworkInventoryError("Docker network inventory contains a malformed record.");
+  }
 }
 function ids(output2) {
   const values = output2.trim() ? output2.trim().split(/\r?\n/).map(id4) : [];
@@ -16625,7 +16788,7 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
       return output2;
     };
     const info = record4(
-      JSON.parse(
+      parseRecord(
         read2(["info", "--format", '{"id":{{json .ID}},"pools":{{json .DefaultAddressPools}}}'])
       )
     );
@@ -16704,18 +16867,18 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
   }
   return result;
 }
-var import_node_child_process24, NetworkInventoryError, MAX_IDS, MAX_OUTPUT_BYTES, FULL_ID, NETWORK_TEMPLATE, CONTAINER_TEMPLATE;
+var import_node_child_process25, NetworkInventoryError, MAX_IDS, MAX_OUTPUT_BYTES, FULL_ID, NETWORK_TEMPLATE, CONTAINER_TEMPLATE;
 var init_network_inventory = __esm({
   "src/core/network-inventory.ts"() {
     "use strict";
-    import_node_child_process24 = require("child_process");
+    import_node_child_process25 = require("child_process");
     init_devpod_environment();
     NetworkInventoryError = class extends Error {
     };
     MAX_IDS = 4096;
     MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
     FULL_ID = /^[a-f0-9]{64}$/;
-    NETWORK_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"driver":{{json .Driver}},"ipam":{{json .IPAM.Config}},"activeEndpoints":{{len .Containers}},"project":{{json (index .Labels "com.docker.compose.project")}},"network":{{json (index .Labels "com.docker.compose.network")}}';
+    NETWORK_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"driver":{{json .Driver}},"ipam":{{json .IPAM.Config}},"activeEndpoints":{{len .Containers}},"project":{{json (index .Labels "com.docker.compose.project")}},"network":{{json (index .Labels "com.docker.compose.network")}}}';
     CONTAINER_TEMPLATE = '{"id":{{json .Id}},"networks":{{json .NetworkSettings.Networks}}}';
   }
 });
@@ -17102,7 +17265,7 @@ function parseLinuxNetworkRoutes(output2) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process25.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process26.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -17110,11 +17273,11 @@ function collectNetworkRoutes(options) {
   if (result.error || result.status !== 0) return { status: "unknown", routes: [] };
   return parseLinuxNetworkRoutes(result.stdout);
 }
-var import_node_child_process25, import_node_net3;
+var import_node_child_process26, import_node_net3;
 var init_network_routes = __esm({
   "src/core/network-routes.ts"() {
     "use strict";
-    import_node_child_process25 = require("child_process");
+    import_node_child_process26 = require("child_process");
     import_node_net3 = require("net");
     init_network_capacity();
     init_network_local_daemon();
@@ -17192,11 +17355,11 @@ var init_network_compose = __esm({
 });
 
 // src/core/network-compose-files.ts
-var import_node_child_process26, import_node_crypto21, import_node_fs35, import_node_path43, import_yaml4, MAX_BYTES3;
+var import_node_child_process27, import_node_crypto21, import_node_fs35, import_node_path43, import_yaml4, MAX_BYTES3;
 var init_network_compose_files = __esm({
   "src/core/network-compose-files.ts"() {
     "use strict";
-    import_node_child_process26 = require("child_process");
+    import_node_child_process27 = require("child_process");
     import_node_crypto21 = require("crypto");
     import_node_fs35 = __toESM(require("fs"));
     import_node_path43 = __toESM(require("path"));
@@ -17209,11 +17372,11 @@ var init_network_compose_files = __esm({
 });
 
 // src/core/network-connected-route.ts
-var import_node_child_process27;
+var import_node_child_process28;
 var init_network_connected_route = __esm({
   "src/core/network-connected-route.ts"() {
     "use strict";
-    import_node_child_process27 = require("child_process");
+    import_node_child_process28 = require("child_process");
     init_network_capacity();
   }
 });
@@ -17303,11 +17466,11 @@ function resolveLinkedTarget(repoPath) {
     gitCommonDir: resolveGitCommonDir(repoPath)
   };
 }
-var import_node_child_process28, import_node_fs36, import_node_path44;
+var import_node_child_process29, import_node_fs36, import_node_path44;
 var init_workspace_ensure = __esm({
   "src/core/workspace-ensure.ts"() {
     "use strict";
-    import_node_child_process28 = require("child_process");
+    import_node_child_process29 = require("child_process");
     import_node_fs36 = __toESM(require("fs"));
     import_node_path44 = __toESM(require("path"));
     init_devcontainer_profile();
@@ -17587,6 +17750,44 @@ function restoreParkedIntentAfterFailedResume(input2) {
     record5.state = transition2.state;
   });
 }
+function snapshotLifecycleStopIntent(state) {
+  return {
+    intentRevision: state.intentRevision,
+    observationsAfterMs: state.observationsAfterMs,
+    desired: state.desired,
+    phase: state.phase,
+    profile: state.profile,
+    admission: state.admission,
+    stopProof: { ...state.stopProof },
+    requests: state.requests.map((request2) => ({ ...request2 })),
+    observations: state.observations.map((observation) => ({ ...observation })),
+    operation: state.operation ? { ...state.operation } : null
+  };
+}
+function withdrawUnstartedLifecycleStop(input2) {
+  return updateReliabilityOperation(input2.identity, (record5) => {
+    const state = record5.state;
+    const intent = input2.intent;
+    if (!intent.wroteIntent) return false;
+    if (!matchesFence(record5, intent.fence)) return false;
+    if (record5.worker || record5.stopWorkStarted) return false;
+    if (state.desired !== "stopped-by-user" || state.phase !== "stopping") return false;
+    if (state.stopProof.workloadsStopped || state.stopProof.routesRemoved) return false;
+    if (!(0, import_node_util11.isDeepStrictEqual)(state.operation, intent.recordedOperation)) return false;
+    const prior = intent.prior;
+    state.intentRevision = prior.intentRevision;
+    state.observationsAfterMs = prior.observationsAfterMs;
+    state.desired = prior.desired;
+    state.phase = prior.phase;
+    state.profile = prior.profile;
+    state.admission = prior.admission;
+    state.stopProof = { ...prior.stopProof };
+    state.requests = prior.requests.map((request2) => ({ ...request2 }));
+    state.observations = prior.observations.map((observation) => ({ ...observation }));
+    state.operation = prior.operation ? { ...prior.operation } : null;
+    return true;
+  });
+}
 function prepareResumeLifecycleOperation(input2) {
   const ids2 = newLifecycleIds();
   return updateReliabilityOperation(input2.identity, (record5) => {
@@ -17739,12 +17940,37 @@ async function superviseLifecycle(kind, repoPath, options = {}, command) {
   const copiedOptions = { ...options };
   const copiedCommand = command ? [...command] : void 0;
   if (kind === "stop") {
-    const fence = updateReliabilityOperation(identity2, (record5) => {
+    const intent = updateReliabilityOperation(identity2, (record5) => {
       reconcileDrained(record5);
+      const prior = snapshotLifecycleStopIntent(record5.state);
       stepRecord(record5, { ...reliabilityFence(record5.state), type: "stop" });
-      return reliabilityFence(record5.state);
+      return {
+        fence: reliabilityFence(record5.state),
+        prior,
+        recordedOperation: record5.state.operation ? { ...record5.state.operation } : null,
+        wroteIntent: record5.state.intentRevision !== prior.intentRevision
+      };
     });
-    return runLifecycleWorker({ kind, repoPath, identity: identity2, ...ids2, fence, options: copiedOptions });
+    try {
+      return await runLifecycleWorker({
+        kind,
+        repoPath,
+        identity: identity2,
+        ...ids2,
+        fence: intent.fence,
+        options: copiedOptions
+      });
+    } catch (error) {
+      try {
+        withdrawUnstartedLifecycleStop({ identity: identity2, intent });
+      } catch (withdrawal) {
+        process.stderr.write(
+          `Lifecycle stop intent could not be withdrawn: ${withdrawal instanceof Error ? withdrawal.message : String(withdrawal)}
+`
+        );
+      }
+      throw error;
+    }
   }
   const initial = readReliabilityOperation(identity2) ?? updateReliabilityOperation(identity2, (record5) => record5);
   if (initial.state.executionPolicy === "capacity-managed" || capacityPolicyTargets(repoPath))
@@ -21995,6 +22221,13 @@ function appendManagedRuntimeRows(rows2, managedRuntime) {
   rows2.push(["Effective config SHA-256", managedRuntime.effectiveConfigSha256 ?? "-"]);
   rows2.push(["Transition phase", managedRuntime.transitionPhase ?? "-"]);
   rows2.push(["Runtime drift", formatResourceNames(managedRuntime.drift)]);
+  if (managedRuntime.mountNesting && managedRuntime.mountNesting.status !== "not-applicable") {
+    const nesting = managedRuntime.mountNesting;
+    rows2.push([
+      "Mount nesting",
+      nesting.status === "unwound" ? `unwound: ${nesting.unwound.map((entry) => entry.destination).join(", ")} (restart the container to re-apply)` : nesting.status === "unverified" ? `unverified (${nesting.reason ?? "unknown"})` : `effective (${nesting.checked.join(", ")})`
+    ]);
+  }
   if (managedRuntime.reliability) {
     const reliability = managedRuntime.reliability;
     rows2.push(["Lifecycle intent", reliability.desired]);
@@ -23106,6 +23339,11 @@ async function collectRouterStatus(repoPath) {
     nextSteps.push(`Run: dev app ls --repo ${repo.path}`);
     nextSteps.push("Run: dev app run <name> --repo <path> --yes");
     nextSteps.push("Run: dev ls");
+    if (repo.managedRuntime?.mountNesting?.status === "unwound") {
+      nextSteps.push(
+        `Run: devrouter stop ${repo.path} and then devrouter ensure ${repo.path} to re-apply the unwound nested mount`
+      );
+    }
   }
   const files = getRouterFileLayout();
   if (files.missing.length > 0) {
@@ -23149,7 +23387,7 @@ function outputFromResult(result) {
   return output2.length > 0 ? output2 : void 0;
 }
 function runTool(command, args = []) {
-  const result = (0, import_node_child_process29.spawnSync)(command, args, {
+  const result = (0, import_node_child_process30.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.error) {
@@ -23340,7 +23578,7 @@ function displayPath(filePath) {
   return `~${filePath.slice(home.length)}`;
 }
 function probeInstalledCliVersion(executable) {
-  const result = (0, import_node_child_process29.spawnSync)(executable, ["-V"], {
+  const result = (0, import_node_child_process30.spawnSync)(executable, ["-V"], {
     encoding: "utf-8",
     timeout: CLI_PATH_PROBE_TIMEOUT_MS
   });
@@ -23351,7 +23589,7 @@ function probeInstalledCliVersion(executable) {
 }
 function buildCliPathCheck(options = {}) {
   const id5 = "global.cli-path";
-  const runningVersion = options.runningVersion ?? (true ? "0.1.2" : "0.0.0-dev");
+  const runningVersion = options.runningVersion ?? (true ? "0.1.3" : "0.0.0-dev");
   if (runningVersion === "0.0.0-dev") {
     return {
       id: id5,
@@ -23526,11 +23764,11 @@ function buildGlobalToolChecksWithoutTelemetry(repoPath) {
   checks.push(nodeToolchainCheck(repoPath));
   return checks;
 }
-var import_node_child_process29, import_node_fs43, import_node_path54, DEVSY_DISABLE_TELEMETRY, CLI_PATH_PROBE_TIMEOUT_MS, INSTALLED_CLI_VERSION_RE;
+var import_node_child_process30, import_node_fs43, import_node_path54, DEVSY_DISABLE_TELEMETRY, CLI_PATH_PROBE_TIMEOUT_MS, INSTALLED_CLI_VERSION_RE;
 var init_tool_diagnostics = __esm({
   "src/core/tool-diagnostics.ts"() {
     "use strict";
-    import_node_child_process29 = require("child_process");
+    import_node_child_process30 = require("child_process");
     import_node_fs43 = __toESM(require("fs"));
     import_node_path54 = __toESM(require("path"));
     init_devsy_agent();
@@ -24186,6 +24424,43 @@ async function buildDoctorReport(options = {}) {
           ...details ? { details } : {},
           suggestion: managedRuntime.mode === "legacy" ? void 0 : managedRuntime.status === "failed-transition" ? `Inspect: dev status --repo ${repo.path}; resolve the reported drift before retrying ensure.` : managedRuntime.status === "ready" ? void 0 : `Run: dev ensure ${repo.path}`
         });
+        const mountNesting = managedRuntime.mountNesting;
+        if (mountNesting && mountNesting.status !== "not-applicable") {
+          const container = mountNesting.container ?? "unknown";
+          const shortContainer = container === "unknown" ? container : container.slice(0, 12);
+          if (mountNesting.status === "unwound") {
+            const first = mountNesting.unwound[0];
+            addCheck(checks, {
+              id: "repo.managed-mount-nesting",
+              level: "warn",
+              summary: `Managed container ${shortContainer} no longer reports ${first?.destination ?? "a nested mount"} in its own mount table, so the mount underneath it is visible in the container.`,
+              details: [
+                `container=${container}`,
+                ...mountNesting.unwound.map(
+                  (entry) => `unwound=${entry.destination} (source ${entry.source} inside ${entry.nestedWithin})`
+                )
+              ].join("; "),
+              suggestion: `Run: devrouter stop ${repo.path} and then devrouter ensure ${repo.path} to restart the exact container, which re-applies the nested mount.`
+            });
+          } else if (mountNesting.status === "unverified") {
+            addCheck(checks, {
+              id: "repo.managed-mount-nesting",
+              level: "warn",
+              summary: `Managed container ${shortContainer} did not report its own mount table, so its nested mounts are unverified.`,
+              details: [
+                `container=${container}`,
+                `reason=${mountNesting.reason ?? "unknown"}`
+              ].join("; "),
+              suggestion: `Run: devrouter exec ${repo.path} -- cat /proc/self/mountinfo to read the container's own mount table.`
+            });
+          } else {
+            addCheck(checks, {
+              id: "repo.managed-mount-nesting",
+              level: "ok",
+              summary: `Managed container ${shortContainer} still reports ${mountNesting.checked.join(", ")} in its own mount table.`
+            });
+          }
+        }
       }
       if (repo.appCount === 0) {
         addCheck(checks, {
@@ -24210,7 +24485,7 @@ async function buildDoctorReport(options = {}) {
           suggestion: `Remedy ${expansionNotice.remedy.code}: set a named default profile other than '${expansionNotice.profile}'${remedyCandidates}.`
         });
       }
-      const cliVersion = true ? "0.1.2" : "0.0.0-dev";
+      const cliVersion = true ? "0.1.3" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       const installedKnown = cliVersion !== "0.0.0-dev";
       const versionComparison = installedKnown && configVersion ? compareSemver(configVersion, cliVersion) : void 0;
@@ -24774,12 +25049,12 @@ function parseSsPortListeners(stdout, port) {
   return listeners;
 }
 function findPortListeners(port) {
-  const result = (0, import_node_child_process30.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+  const result = (0, import_node_child_process31.spawnSync)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process30.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process31.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsPortListeners(ssResult.stdout, port);
       }
@@ -24808,11 +25083,11 @@ function findPortListeners(port) {
     };
   });
 }
-var import_node_child_process30;
+var import_node_child_process31;
 var init_ports = __esm({
   "src/util/ports.ts"() {
     "use strict";
-    import_node_child_process30 = require("child_process");
+    import_node_child_process31 = require("child_process");
   }
 });
 
@@ -25793,7 +26068,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process31.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process32.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -25801,11 +26076,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process31;
+var import_node_child_process32;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process31 = require("child_process");
+    import_node_child_process32 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -25828,7 +26103,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process32.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process33.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -25842,17 +26117,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process32.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process33.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process32;
+var import_node_child_process33;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process32 = require("child_process");
+    import_node_child_process33 = require("child_process");
     init_docker();
     init_router();
   }
@@ -27898,7 +28173,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process33.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process34.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -27926,7 +28201,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process33.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process34.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -27952,7 +28227,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process33.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process34.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -27978,7 +28253,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process33.spawnSync)("docker", args, {
+  (0, import_node_child_process34.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -27990,7 +28265,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process33.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process34.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -28004,11 +28279,11 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process33, import_node_crypto29, import_node_fs51, import_node_path64, import_yaml9;
+var import_node_child_process34, import_node_crypto29, import_node_fs51, import_node_path64, import_yaml9;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process33 = require("child_process");
+    import_node_child_process34 = require("child_process");
     import_node_crypto29 = require("crypto");
     import_node_fs51 = __toESM(require("fs"));
     import_node_path64 = __toESM(require("path"));
@@ -28101,7 +28376,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process34.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process35.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -28212,12 +28487,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process34.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process35.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process34.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process35.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -28276,7 +28551,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process34.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process35.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -28644,7 +28919,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process34.spawn)(wrapped, {
+        child = (0, import_node_child_process35.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -28658,7 +28933,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process34.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process35.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -28666,7 +28941,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process34.spawn)(options.command[0], {
+      child = (0, import_node_child_process35.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -28674,7 +28949,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process34.spawn)(command, args, {
+      child = (0, import_node_child_process35.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -28695,11 +28970,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process34, import_node_net5, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process35, import_node_net5, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process34 = require("child_process");
+    import_node_child_process35 = require("child_process");
     import_node_net5 = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -29623,11 +29898,11 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     networkCapacity: (dependencies.inspectNetworkCapacity ?? inspectNetworkCapacity)()
   };
 }
-var import_node_child_process35, import_node_fs53, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process36, import_node_fs53, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process35 = require("child_process");
+    import_node_child_process36 = require("child_process");
     import_node_fs53 = __toESM(require("fs"));
     init_devpod_workspaces();
     init_host_routes();
@@ -29646,7 +29921,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process35.spawnSync)(command, args, {
+      const result = (0, import_node_child_process36.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -29743,7 +30018,7 @@ function defaultWorktreePath(mainRepo, ws) {
   return import_node_path66.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process37.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
@@ -29871,7 +30146,7 @@ function assertFullDownPreflight(mainRepo, target) {
       `Worktree '${target.worktreePath}' is locked; unlock it before workspace down.`
     );
   }
-  const status = (0, import_node_child_process36.spawnSync)(
+  const status = (0, import_node_child_process37.spawnSync)(
     "git",
     ["-C", target.worktreePath, "status", "--porcelain", "--untracked-files=normal"],
     { encoding: "utf-8" }
@@ -29935,11 +30210,11 @@ async function workspaceUp(branch, opts = {}) {
       return selectedPath;
     }
     if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
-    const add = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
+    const add = (0, import_node_child_process37.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process36.spawnSync)(
+      const addNew = (0, import_node_child_process37.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
         { encoding: "utf-8" }
@@ -30080,7 +30355,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     const result = await mutateWorkspaceRuntime("delete", resolved, worktrees, opts.quiet);
     if (removeWorktree) {
       if (resolved.worktree && !resolved.worktree.prunable && import_node_fs54.default.existsSync(resolved.worktreePath)) {
-        const rm = (0, import_node_child_process36.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
+        const rm = (0, import_node_child_process37.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -30106,11 +30381,11 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process36, import_node_fs54, import_node_path66, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process37, import_node_fs54, import_node_path66, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process36 = require("child_process");
+    import_node_child_process37 = require("child_process");
     import_node_fs54 = __toESM(require("fs"));
     import_node_path66 = __toESM(require("path"));
     init_devpod_mutation();
@@ -30296,7 +30571,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.1.2" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.1.3" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {