@devrouter/cli 0.1.3 → 0.3.0

package/dist/devrouter-lifecycle-worker.js

@@ -23,7 +23,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/core/devpod-exec.ts
-var import_node_child_process30 = require("child_process");
+var import_node_child_process32 = require("child_process");
 var import_node_crypto23 = require("crypto");
 
 // src/core/devpod-environment.ts
@@ -1958,7 +1958,7 @@ function selectDevpodWorkspace(workspaces, repoPath) {
 }
 
 // src/core/devsy-exec.ts
-var import_node_child_process29 = require("child_process");
+var import_node_child_process31 = require("child_process");
 
 // src/core/devsy-exec-proof.ts
 var import_node_fs7 = __toESM(require("fs"));
@@ -2046,9 +2046,9 @@ function revalidateDevsyExecProof(repoPath, proof) {
 }
 
 // src/core/devsy-mutation.ts
-var import_node_child_process16 = require("child_process");
-var import_node_fs25 = __toESM(require("fs"));
-var import_node_path29 = __toESM(require("path"));
+var import_node_child_process18 = require("child_process");
+var import_node_fs26 = __toESM(require("fs"));
+var import_node_path30 = __toESM(require("path"));
 
 // src/core/devsy-agent.ts
 var import_node_child_process9 = require("child_process");
@@ -2324,9 +2324,9 @@ function requireReadyDevsyAgent(options = {}) {
 }
 
 // src/core/managed-devsy-stop.ts
-var import_node_fs21 = __toESM(require("fs"));
+var import_node_fs22 = __toESM(require("fs"));
 var import_node_os5 = __toESM(require("os"));
-var import_node_path25 = __toESM(require("path"));
+var import_node_path26 = __toESM(require("path"));
 var import_node_util5 = require("util");
 
 // src/core/devcontainer-profile.ts
@@ -5373,7 +5373,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.1.3" : "0.0.0-dev";
+  return true ? "0.3.0" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -6034,8 +6034,8 @@ function clearStartupWitness(identity2, fence) {
 
 // src/core/repo-config.ts
 var import_node_crypto10 = require("crypto");
-var import_node_fs18 = __toESM(require("fs"));
-var import_node_path22 = __toESM(require("path"));
+var import_node_fs19 = __toESM(require("fs"));
+var import_node_path23 = __toESM(require("path"));
 var import_yaml3 = __toESM(require("yaml"));
 
 // src/core/capabilities.ts
@@ -6060,6 +6060,44 @@ function formatSupportedTcpProtocols() {
   return SUPPORTED_TCP_PROTOCOLS.join(", ");
 }
 
+// src/core/worktree-safety.ts
+var import_node_child_process13 = require("child_process");
+var import_node_fs18 = __toESM(require("fs"));
+var import_node_path22 = __toESM(require("path"));
+
+// src/core/forge-changes.ts
+var import_node_child_process12 = require("child_process");
+
+// src/core/worktree-safety.ts
+var WORKTREE_LOCAL_SAFETY_CODES = [
+  "git-error",
+  "detached",
+  "index-lock",
+  "operation-in-progress",
+  "submodule",
+  "dirty",
+  "untracked",
+  "ignored-state"
+];
+var WORKTREE_SAFETY_CODES = [
+  ...WORKTREE_LOCAL_SAFETY_CODES,
+  "primary",
+  "locked",
+  "runtime-present",
+  "forge-not-checked",
+  "forge-unavailable",
+  "no-change",
+  "change-open",
+  "change-closed",
+  "head-beyond-merge",
+  "active"
+];
+var DISPOSABLE_OVERRIDE_FILE = import_node_path22.default.join("info", "worktree-reclaim-disposable");
+function isValidWorktreePattern(pattern) {
+  if (!pattern || pattern.startsWith("/") || pattern.includes("\\")) return false;
+  return pattern.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+}
+
 // src/core/repo-config.ts
 function compareSemver2(a, b) {
   const parse2 = (v) => {
@@ -6894,6 +6932,7 @@ function parseConfig(raw, configPath) {
       "managedRuntime",
       "profiles",
       "capacity",
+      "worktrees",
       "apps"
     ],
     configPath
@@ -6968,6 +7007,7 @@ function parseConfig(raw, configPath) {
   const managedRuntime = parseManagedRuntime(root.managedRuntime, configPath);
   const profiles = parseProfiles(root.profiles, configPath, apps, managedRuntime);
   const capacity = parseCapacityEstimates(root.capacity, configPath, profiles);
+  const worktrees = parseWorktreesConfig(root.worktrees, configPath);
   return {
     version: 1,
     ...devrouter ? { devrouter } : {},
@@ -6976,9 +7016,30 @@ function parseConfig(raw, configPath) {
     ...managedRuntime ? { managedRuntime } : {},
     ...profiles ? { profiles } : {},
     ...capacity ? { capacity } : {},
+    ...worktrees ? { worktrees } : {},
     apps
   };
 }
+function parseWorktreesConfig(value, configPath) {
+  if (value === void 0) return void 0;
+  const raw = ensureObject(value, `${configPath}.worktrees`);
+  ensureAllowedKeys(raw, ["disposable", "trim"], `${configPath}.worktrees`);
+  const result = {};
+  for (const key of ["disposable", "trim"]) {
+    if (raw[key] === void 0) continue;
+    const label = `${configPath}.worktrees.${key}`;
+    if (!Array.isArray(raw[key])) throw new Error(`${label} must be an array of patterns.`);
+    result[key] = raw[key].map((pattern, index) => {
+      if (typeof pattern !== "string" || !isValidWorktreePattern(pattern)) {
+        throw new Error(
+          `${label}[${index}] must be a worktree-relative pattern without '..' or a leading '/'.`
+        );
+      }
+      return pattern;
+    });
+  }
+  return result;
+}
 var PROFILE_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
 var MAX_PROFILES = 32;
 function parseProfiles(value, configPath, apps, managedRuntime) {
@@ -7292,15 +7353,15 @@ function applyProfile(config, profile) {
   return next;
 }
 function resolveRepoPath(repoPath) {
-  return import_node_path22.default.resolve(repoPath ?? process.cwd());
+  return import_node_path23.default.resolve(repoPath ?? process.cwd());
 }
 function getRepoConfigPath(repoPath) {
-  return import_node_path22.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
+  return import_node_path23.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
 }
-function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.readFileSync(file, "utf-8")) {
+function loadRepoConfig(repoPath, read2 = (file) => import_node_fs19.default.readFileSync(file, "utf-8")) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
-  if (!import_node_fs18.default.existsSync(configPath)) {
+  if (!import_node_fs19.default.existsSync(configPath)) {
     throw new Error(
       `Missing ${CONFIG_FILE_NAME} in ${resolvedRepoPath}. Run 'dev repo init --repo ${resolvedRepoPath}' first.`
     );
@@ -7310,7 +7371,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs18.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.1.3" : "0.0.0-dev";
+    const cliVersion = true ? "0.3.0" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -7330,7 +7391,7 @@ function namespaceHost(host, workspace) {
   return `${base}.${workspace}${suffix}`;
 }
 function applyWorkspace(config, workspace, repoPath) {
-  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path22.default.basename(import_node_path22.default.resolve(repoPath))) ?? "app";
+  const defaultToken = wsFromBranch(config.project?.name ?? import_node_path23.default.basename(import_node_path23.default.resolve(repoPath))) ?? "app";
   const substitutionToken = workspace ?? defaultToken;
   const next = structuredClone(config);
   for (const app of next.apps) {
@@ -7403,7 +7464,7 @@ function resolveAppDependencies(config, app) {
 }
 
 // src/core/docker.ts
-var import_node_child_process12 = require("child_process");
+var import_node_child_process14 = require("child_process");
 var dockerodeConstructorPromise = null;
 async function getDockerodeConstructor() {
   if (!dockerodeConstructorPromise) {
@@ -7415,7 +7476,7 @@ async function getDockerodeConstructor() {
   return dockerodeConstructorPromise;
 }
 function runDockerContextCommand(args) {
-  const result = (0, import_node_child_process12.spawnSync)("docker", ["context", ...args], {
+  const result = (0, import_node_child_process14.spawnSync)("docker", ["context", ...args], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -7428,7 +7489,7 @@ function getCurrentDockerContext() {
   return runDockerContextCommand(["show"]);
 }
 function getDockerHostFromContext(context) {
-  const result = (0, import_node_child_process12.spawnSync)(
+  const result = (0, import_node_child_process14.spawnSync)(
     "docker",
     ["context", "inspect", context, "--format", "{{ .Endpoints.docker.Host }}"],
     { encoding: "utf-8" }
@@ -7488,16 +7549,16 @@ async function ensureNetwork(name) {
 }
 
 // src/core/tls.ts
-var import_node_child_process13 = require("child_process");
+var import_node_child_process15 = require("child_process");
 var import_node_crypto11 = require("crypto");
-var import_node_fs19 = __toESM(require("fs"));
-var import_node_path23 = __toESM(require("path"));
+var import_node_fs20 = __toESM(require("fs"));
+var import_node_path24 = __toESM(require("path"));
 var DEFAULT_TLS_CERT_HOSTS = ["localhost", "*.localhost"];
-var TLS_CERTIFICATE_LOCK_FILE = import_node_path23.default.join(DEVROUTER_HOME, "tls-certificate.lock");
+var TLS_CERTIFICATE_LOCK_FILE = import_node_path24.default.join(DEVROUTER_HOME, "tls-certificate.lock");
 var TLS_CERTIFICATE_LOCK_WAIT_MS = 6e4;
 var TLS_CERTIFICATE_WRITE_ATTEMPTS = 2;
 function runOrThrow(command, args) {
-  const result = (0, import_node_child_process13.spawnSync)(command, args, {
+  const result = (0, import_node_child_process15.spawnSync)(command, args, {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -7507,7 +7568,7 @@ function runOrThrow(command, args) {
   return result.stdout.trim();
 }
 function commandExists(command) {
-  const result = (0, import_node_child_process13.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
+  const result = (0, import_node_child_process15.spawnSync)("sh", ["-c", `command -v ${command}`], { encoding: "utf-8" });
   return result.status === 0;
 }
 function ensureMkcert() {
@@ -7525,8 +7586,8 @@ function tlsSetupCommand(repoPath) {
 }
 function getMkcertRootCAPath(options = {}) {
   ensureMkcert();
-  const rootCAPath = import_node_path23.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
-  if (!import_node_fs19.default.existsSync(rootCAPath)) {
+  const rootCAPath = import_node_path24.default.join(runOrThrow("mkcert", ["-CAROOT"]), "rootCA.pem");
+  if (!import_node_fs20.default.existsSync(rootCAPath)) {
     throw new Error(
       `mkcert root CA was not found at '${rootCAPath}'. Run: ${tlsSetupCommand(options.repoPath)}`
     );
@@ -7627,11 +7688,11 @@ function compactTLSCertificateHosts(hosts) {
   );
 }
 function readCurrentCertificateHosts(options = {}) {
-  if (!import_node_fs19.default.existsSync(CERT_FILE)) {
+  if (!import_node_fs20.default.existsSync(CERT_FILE)) {
     return [];
   }
   try {
-    const pem = import_node_fs19.default.readFileSync(CERT_FILE, "utf-8");
+    const pem = import_node_fs20.default.readFileSync(CERT_FILE, "utf-8");
     return parseCertificateDnsHosts(pem);
   } catch (error) {
     if (options.replaceMalformed) {
@@ -7823,11 +7884,11 @@ async function replacePublishedProxyRoutes(repoPath, config, workspace, options
 }
 
 // src/core/traefik-route-health.ts
-var import_node_child_process14 = require("child_process");
-var import_node_fs20 = __toESM(require("fs"));
-var import_node_path24 = __toESM(require("path"));
+var import_node_child_process16 = require("child_process");
+var import_node_fs21 = __toESM(require("fs"));
+var import_node_path25 = __toESM(require("path"));
 var ROUTER_API_BASE = "http://127.0.0.1:8080/api";
-var ROUTER_RELOAD_LOCK_FILE = import_node_path24.default.join(DEVROUTER_HOME, "router-reload.lock");
+var ROUTER_RELOAD_LOCK_FILE = import_node_path25.default.join(DEVROUTER_HOME, "router-reload.lock");
 var ROUTER_API_REQUEST_TIMEOUT_SECONDS = "2";
 var DEFAULT_INITIAL_TIMEOUT_MS = 3e3;
 var DEFAULT_RECOVERY_TIMEOUT_MS = 1e4;
@@ -7837,7 +7898,7 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function inspectRouterApi(protocol) {
-  const result = (0, import_node_child_process14.spawnSync)(
+  const result = (0, import_node_child_process16.spawnSync)(
     "curl",
     [
       "--silent",
@@ -7885,7 +7946,7 @@ function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function inspectNamedRouterApi(protocol, resource, name) {
-  const result = (0, import_node_child_process14.spawnSync)(
+  const result = (0, import_node_child_process16.spawnSync)(
     "curl",
     [
       "--silent",
@@ -8096,7 +8157,7 @@ async function ensureTraefikRouteExpectation(routes, expectation, options) {
     throw new Error(
       "Traefik routes did not reload; shared router restart is disabled for this operation."
     );
-  import_node_fs20.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs21.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     ROUTER_RELOAD_LOCK_FILE,
     {
@@ -8162,7 +8223,7 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
   if (!isLinkedWorktree(repoPath)) return void 0;
   const workspace = resolveWorktreeWorkspace(repoPath);
   if (!workspace || readManagedRuntimeState(repoPath, workspace)) return void 0;
-  if (!import_node_fs21.default.existsSync(import_node_path25.default.join(repoPath, ".devrouter.yml"))) return void 0;
+  if (!import_node_fs22.default.existsSync(import_node_path26.default.join(repoPath, ".devrouter.yml"))) return void 0;
   const runtime = loadRuntimeConfig(repoPath, workspace);
   if (!runtime.config.managedRuntime) return void 0;
   const routes = proxyAppsFromConfig(runtime.config).flatMap(
@@ -8222,7 +8283,7 @@ function proveInitialManagedDevsyAbsence(repoPath, expectedId) {
   };
 }
 function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
-  if (!import_node_fs21.default.existsSync(import_node_path25.default.join(repoPath, ".devrouter.yml"))) return false;
+  if (!import_node_fs22.default.existsSync(import_node_path26.default.join(repoPath, ".devrouter.yml"))) return false;
   if (!loadRepoConfig(repoPath).managedRuntime) return false;
   const linked = isLinkedWorktree(repoPath);
   const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
@@ -8279,8 +8340,8 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     profile: runtime.resolvedProfile,
     linked
   });
-  const providerRoot = import_node_path25.default.resolve(process.env.DEVSY_HOME || import_node_path25.default.join(import_node_os5.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path25.default.join(
+  const providerRoot = import_node_path26.default.resolve(process.env.DEVSY_HOME || import_node_path26.default.join(import_node_os5.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path26.default.join(
     providerRoot,
     "contexts",
     owner.context,
@@ -8401,7 +8462,7 @@ function restoreRecordedManagedDevcontainerConfig(repoPath) {
 }
 function recordedManagedDevcontainerRestorePlan(repoPath) {
   try {
-    if (!import_node_fs21.default.existsSync(import_node_path25.default.join(repoPath, ".devrouter.yml"))) return void 0;
+    if (!import_node_fs22.default.existsSync(import_node_path26.default.join(repoPath, ".devrouter.yml"))) return void 0;
     const linked = isLinkedWorktree(repoPath);
     const workspace = linked ? resolveWorktreeWorkspace(repoPath) : void 0;
     const state = readManagedRuntimeState(repoPath, workspace);
@@ -8492,7 +8553,7 @@ function stopRetainedManagedDevsyWorkspace(options) {
       const owned = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path25.default.join(repoPath, ".devcontainer")
+          import_node_path26.default.join(repoPath, ".devcontainer")
         )
       );
       if (owned.length !== 0) {
@@ -8521,8 +8582,8 @@ function stopRetainedManagedDevsyWorkspace(options) {
   if (!context || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(context) || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(devsyId)) {
     throw new Error("Managed stop requires a valid exact Devsy context and workspace ID.");
   }
-  const devsyRoot = import_node_path25.default.resolve(process.env.DEVSY_HOME || import_node_path25.default.join(import_node_os5.default.homedir(), ".devsy"));
-  const featureDirectory = import_node_path25.default.join(
+  const devsyRoot = import_node_path26.default.resolve(process.env.DEVSY_HOME || import_node_path26.default.join(import_node_os5.default.homedir(), ".devsy"));
+  const featureDirectory = import_node_path26.default.join(
     devsyRoot,
     "contexts",
     context,
@@ -8661,13 +8722,13 @@ function networkProviderEnvironment(binding, source) {
 
 // src/core/network-claim-lookup.ts
 var import_node_crypto13 = require("crypto");
-var import_node_fs24 = __toESM(require("fs"));
-var import_node_path28 = __toESM(require("path"));
+var import_node_fs25 = __toESM(require("fs"));
+var import_node_path29 = __toESM(require("path"));
 
 // src/core/network-claims.ts
 var import_node_crypto12 = require("crypto");
-var import_node_fs23 = __toESM(require("fs"));
-var import_node_path27 = __toESM(require("path"));
+var import_node_fs24 = __toESM(require("fs"));
+var import_node_path28 = __toESM(require("path"));
 
 // src/core/network-capacity.ts
 var import_node_net = require("net");
@@ -9008,10 +9069,10 @@ function overlaps(left, right) {
 }
 
 // src/core/network-policy.ts
-var import_node_fs22 = __toESM(require("fs"));
-var import_node_path26 = __toESM(require("path"));
+var import_node_fs23 = __toESM(require("fs"));
+var import_node_path27 = __toESM(require("path"));
 var NETWORK_POLICY_VERSION = 1;
-var NETWORK_POLICY_FILE = import_node_path26.default.join(DEVROUTER_HOME, "network-policy.json");
+var NETWORK_POLICY_FILE = import_node_path27.default.join(DEVROUTER_HOME, "network-policy.json");
 var DEFAULT_NETWORK_POLICY_ENDPOINT_RESERVE = 8;
 var NETWORK_POLICY_PREFIX_LENGTHS = [24, 25, 26];
 var MAX_NETWORK_POLICY_FILE_BYTES = 64 * 1024;
@@ -9204,7 +9265,7 @@ function hasControlCharacter(value) {
 function readPolicyFile(filePath) {
   let initialStats;
   try {
-    initialStats = import_node_fs22.default.lstatSync(filePath);
+    initialStats = import_node_fs23.default.lstatSync(filePath);
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
@@ -9217,16 +9278,16 @@ function readPolicyFile(filePath) {
   }
   let fileDescriptor;
   try {
-    fileDescriptor = import_node_fs22.default.openSync(
+    fileDescriptor = import_node_fs23.default.openSync(
       filePath,
-      import_node_fs22.default.constants.O_RDONLY | import_node_fs22.default.constants.O_NONBLOCK | (import_node_fs22.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs23.default.constants.O_RDONLY | import_node_fs23.default.constants.O_NONBLOCK | (import_node_fs23.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno(error, "ENOENT")) return { status: "absent" };
     return { status: "invalid", error: "network policy could not be read" };
   }
   try {
-    const openedStats = import_node_fs22.default.fstatSync(fileDescriptor);
+    const openedStats = import_node_fs23.default.fstatSync(fileDescriptor);
     if (!openedStats.isFile()) {
       return { status: "invalid", error: "network policy must be a regular file" };
     }
@@ -9239,12 +9300,12 @@ function readPolicyFile(filePath) {
     const buffer = Buffer.alloc(openedStats.size);
     let offset = 0;
     while (offset < buffer.length) {
-      const bytesRead = import_node_fs22.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
+      const bytesRead = import_node_fs23.default.readSync(fileDescriptor, buffer, offset, buffer.length - offset, null);
       if (bytesRead === 0)
         return { status: "invalid", error: "network policy changed during read" };
       offset += bytesRead;
     }
-    const finalStats = import_node_fs22.default.fstatSync(fileDescriptor);
+    const finalStats = import_node_fs23.default.fstatSync(fileDescriptor);
     if (!finalStats.isFile() || finalStats.size !== openedStats.size) {
       return { status: "invalid", error: "network policy changed during read" };
     }
@@ -9253,7 +9314,7 @@ function readPolicyFile(filePath) {
     return { status: "invalid", error: "network policy could not be read" };
   } finally {
     try {
-      import_node_fs22.default.closeSync(fileDescriptor);
+      import_node_fs23.default.closeSync(fileDescriptor);
     } catch {
     }
   }
@@ -9273,7 +9334,7 @@ function isErrno(error, code) {
 
 // src/core/network-claims.ts
 var NETWORK_CLAIMS_VERSION = 1;
-var NETWORK_CLAIMS_ROOT = import_node_path27.default.join(DEVROUTER_HOME, "networks");
+var NETWORK_CLAIMS_ROOT = import_node_path28.default.join(DEVROUTER_HOME, "networks");
 var NETWORK_CLAIMS_MAX_RECORDS = 256;
 var NETWORK_CLAIMS_MAX_FILE_BYTES = 512 * 1024;
 var NETWORK_CLAIMS_DEFAULT_PREFIX = 26;
@@ -9679,27 +9740,27 @@ function assertExactKeys(value, keys2) {
 function readDocument(store) {
   let descriptor;
   try {
-    descriptor = import_node_fs23.default.openSync(
+    descriptor = import_node_fs24.default.openSync(
       store.filePath,
-      import_node_fs23.default.constants.O_RDONLY | import_node_fs23.default.constants.O_NONBLOCK | (import_node_fs23.default.constants.O_NOFOLLOW ?? 0)
+      import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NONBLOCK | (import_node_fs24.default.constants.O_NOFOLLOW ?? 0)
     );
   } catch (error) {
     if (isErrno2(error, "ENOENT")) return void 0;
     throw claimError("invalid-state", "network claim state could not be read");
   }
   try {
-    const stat = import_node_fs23.default.fstatSync(descriptor);
+    const stat = import_node_fs24.default.fstatSync(descriptor);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES || (stat.mode & 63) !== 0) {
       throw claimError("invalid-state", "network claim state is not a bounded private file");
     }
     const buffer = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
     let count = 0;
     while (count < buffer.length) {
-      const bytesRead = import_node_fs23.default.readSync(descriptor, buffer, count, buffer.length - count, null);
+      const bytesRead = import_node_fs24.default.readSync(descriptor, buffer, count, buffer.length - count, null);
       if (bytesRead === 0) break;
       count += bytesRead;
     }
-    const finalStat = import_node_fs23.default.fstatSync(descriptor);
+    const finalStat = import_node_fs24.default.fstatSync(descriptor);
     if (count > NETWORK_CLAIMS_MAX_FILE_BYTES || finalStat.size !== stat.size) {
       throw claimError("invalid-state", "network claim state changed during read");
     }
@@ -9711,7 +9772,7 @@ function readDocument(store) {
     }
     return validateDocument(parsed, store.daemonId);
   } finally {
-    import_node_fs23.default.closeSync(descriptor);
+    import_node_fs24.default.closeSync(descriptor);
   }
 }
 function validateDocument(value, daemonId) {
@@ -9815,7 +9876,7 @@ function withStoreLock(daemonId, options, operation) {
   if (!Number.isSafeInteger(waitMs) || waitMs < 0 || waitMs > MAX_LOCK_WAIT_MS) {
     throw claimError("invalid-input", "network claim lock wait is invalid");
   }
-  import_node_fs23.default.mkdirSync(store.root, { recursive: true, mode: 448 });
+  import_node_fs24.default.mkdirSync(store.root, { recursive: true, mode: 448 });
   assertDirectory(store.root);
   return withFileLockSync(
     store.lockPath,
@@ -9830,23 +9891,23 @@ function createStore(daemonId, options) {
   return {
     root,
     daemonId,
-    filePath: import_node_path27.default.join(root, `${key}.json`),
-    lockPath: import_node_path27.default.join(root, `${key}.lock`),
+    filePath: import_node_path28.default.join(root, `${key}.json`),
+    lockPath: import_node_path28.default.join(root, `${key}.lock`),
     writeAtomic: options.writeAtomic ?? writeFileAtomically
   };
 }
 function validateRoot(root) {
-  if (typeof root !== "string" || !import_node_path27.default.isAbsolute(root) || root.includes("\0")) {
+  if (typeof root !== "string" || !import_node_path28.default.isAbsolute(root) || root.includes("\0")) {
     throw claimError("invalid-input", "network claim root is invalid");
   }
-  const resolved = import_node_path27.default.resolve(root);
+  const resolved = import_node_path28.default.resolve(root);
   if (resolved !== root) throw claimError("invalid-input", "network claim root is invalid");
   return resolved;
 }
 function assertDirectory(directory) {
   let stat;
   try {
-    stat = import_node_fs23.default.lstatSync(directory);
+    stat = import_node_fs24.default.lstatSync(directory);
   } catch {
     throw claimError("invalid-state", "network claim root could not be read");
   }
@@ -9881,14 +9942,14 @@ function claimError(code, message) {
 
 // src/core/network-claim-lookup.ts
 function networkOwnerKey(repoPath) {
-  if (!import_node_path28.default.isAbsolute(repoPath) || import_node_path28.default.resolve(repoPath) !== repoPath)
+  if (!import_node_path29.default.isAbsolute(repoPath) || import_node_path29.default.resolve(repoPath) !== repoPath)
     throw new Error("Invalid network owner path.");
   return (0, import_node_crypto13.createHash)("sha256").update(repoPath).digest("hex");
 }
 function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   let names;
   try {
-    names = import_node_fs24.default.readdirSync(root);
+    names = import_node_fs25.default.readdirSync(root);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw new Error("Network claims cannot be inspected; repair is required.");
@@ -9897,21 +9958,21 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
   if (files.length > 128) throw new Error("Network daemon inventory exceeds its bound.");
   let found;
   for (const file of files) {
-    const full = import_node_path28.default.join(root, file);
-    const stat = import_node_fs24.default.lstatSync(full);
+    const full = import_node_path29.default.join(root, file);
+    const stat = import_node_fs25.default.lstatSync(full);
     if (!stat.isFile() || stat.size > NETWORK_CLAIMS_MAX_FILE_BYTES)
       throw new Error("Invalid retained network claim file.");
     let value;
-    const descriptor = import_node_fs24.default.openSync(
+    const descriptor = import_node_fs25.default.openSync(
       full,
-      import_node_fs24.default.constants.O_RDONLY | import_node_fs24.default.constants.O_NONBLOCK | import_node_fs24.default.constants.O_NOFOLLOW
+      import_node_fs25.default.constants.O_RDONLY | import_node_fs25.default.constants.O_NONBLOCK | import_node_fs25.default.constants.O_NOFOLLOW
     );
     try {
-      if (!import_node_fs24.default.fstatSync(descriptor).isFile()) throw new Error();
+      if (!import_node_fs25.default.fstatSync(descriptor).isFile()) throw new Error();
       const bytes2 = Buffer.alloc(NETWORK_CLAIMS_MAX_FILE_BYTES + 1);
       let size = 0;
       while (size < bytes2.length) {
-        const count = import_node_fs24.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
+        const count = import_node_fs25.default.readSync(descriptor, bytes2, size, bytes2.length - size, null);
         if (!count) break;
         size += count;
       }
@@ -9921,7 +9982,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
     } catch {
       throw new Error("Retained network claim could not be read safely.");
     } finally {
-      import_node_fs24.default.closeSync(descriptor);
+      import_node_fs25.default.closeSync(descriptor);
     }
     if (typeof value.daemonId !== "string" || `${(0, import_node_crypto13.createHash)("sha256").update(value.daemonId).digest("hex")}.json` !== file)
       throw new Error("Retained network daemon identity is invalid.");
@@ -9939,7 +10000,7 @@ function findOwnedNetworkClaim(repoPath, root = NETWORK_CLAIMS_ROOT) {
 }
 
 // src/core/network-provider-inspect.ts
-var import_node_child_process15 = require("child_process");
+var import_node_child_process17 = require("child_process");
 var import_node_crypto14 = require("crypto");
 function object2(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -9963,7 +10024,7 @@ function qualifyNetworkProviderDefinition(value, provider) {
   return (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify({ name: definition.name, agent, options, exec })).digest("hex");
 }
 function read(provider, args) {
-  const result = (0, import_node_child_process15.spawnSync)(provider, args, {
+  const result = (0, import_node_child_process17.spawnSync)(provider, args, {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 2 * 1024 * 1024
@@ -10077,7 +10138,7 @@ function networkProviderEffectOptions(provider, providerId, repoPath) {
 }
 
 // src/core/devsy-mutation.ts
-var DEVSY_MUTATION_LOCK_FILE = import_node_path29.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
+var DEVSY_MUTATION_LOCK_FILE = import_node_path30.default.join(DEVROUTER_HOME, "devsy-mutation.lock");
 var DEVSY_MUTATION_WAIT_MS = 18e5;
 var DevsyStartPostconditionError = class extends Error {
 };
@@ -10092,7 +10153,7 @@ function failedStartMayHaveAttached(devsyId, repoPath) {
   }
 }
 function withMutationLock(activity, target, operation) {
-  import_node_fs25.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs26.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -10106,7 +10167,7 @@ function withMutationLock(activity, target, operation) {
   );
 }
 function withMutationLockAsync(activity, target, operation) {
-  import_node_fs25.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs26.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLock(
     DEVSY_MUTATION_LOCK_FILE,
     {
@@ -10127,7 +10188,7 @@ var DEVSY_STDERR_TAIL_BYTES = 8192;
 function runDevsyUp(args, env, quiet) {
   return new Promise((resolve) => {
     claimLifecycleEffect();
-    const child = (0, import_node_child_process16.spawn)("devsy", args, {
+    const child = (0, import_node_child_process18.spawn)("devsy", args, {
       stdio: ["inherit", quiet ? 2 : "inherit", "pipe"],
       env
     });
@@ -10161,7 +10222,7 @@ function runDevsyAction(action, devsyId, force = false, repoPath) {
   const args = action === "delete" ? ["delete", devsyId, ...force ? ["--force"] : [], "--ignore-not-found"] : ["stop", devsyId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devsy", devsyId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process16.spawnSync)("devsy", ["workspace", ...args, ...binding.args], {
+  const result = (0, import_node_child_process18.spawnSync)("devsy", ["workspace", ...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
@@ -10176,6 +10237,25 @@ function inspectExactOwnership(devsyId, worktreePath) {
   if (ownership.status === "conflict") throw new Error(ownership.reason);
   return ownership;
 }
+function checkoutVanished(worktreePath) {
+  try {
+    import_node_fs26.default.lstatSync(worktreePath);
+    return false;
+  } catch (error) {
+    return error.code === "ENOENT";
+  }
+}
+function deleteVanishedCheckoutRegistration(devsyId, worktreePath, originalError) {
+  if (!checkoutVanished(worktreePath)) throw originalError;
+  const runtime = inspectDevsyRuntimeStatus(devsyId);
+  if (runtime !== "stopped" && runtime !== "not-found") throw originalError;
+  runDevsyAction("delete", devsyId, true, worktreePath);
+  if (inspectExactOwnership(devsyId, worktreePath).status !== "absent") {
+    throw new Error(
+      `Devsy workspace '${devsyId}' still owns vanished checkout '${worktreePath}' after forced provider delete.`
+    );
+  }
+}
 function mutateOwnedDevsyWorkspace(action, devsyId, worktreePath) {
   return withMutationLock(`Devsy ${action}`, worktreePath, () => {
     restoreRecordedManagedDevcontainerConfig(worktreePath);
@@ -10189,7 +10269,13 @@ function mutateOwnedDevsyWorkspace(action, devsyId, worktreePath) {
     }
     const before = inspectExactOwnership(devsyId, worktreePath);
     if (before.status === "absent") return { status: "absent" };
-    runDevsyAction(action, devsyId, false, worktreePath);
+    try {
+      runDevsyAction(action, devsyId, false, worktreePath);
+    } catch (error) {
+      if (action !== "delete") throw error;
+      deleteVanishedCheckoutRegistration(devsyId, worktreePath, error);
+      return { status: "changed" };
+    }
     let after = inspectExactOwnership(devsyId, worktreePath);
     if (action === "stop" && after.status !== "owned") {
       throw new Error(
@@ -10345,21 +10431,21 @@ var ExecutionOutcomeError = class extends Error {
 
 // src/core/reliability-lifecycle.ts
 var import_node_crypto22 = require("crypto");
-var import_node_path40 = __toESM(require("path"));
+var import_node_path41 = __toESM(require("path"));
 var import_node_util7 = require("util");
 
 // src/core/capacity-policy.ts
-var import_node_fs26 = __toESM(require("fs"));
-var import_node_path30 = __toESM(require("path"));
+var import_node_fs27 = __toESM(require("fs"));
+var import_node_path31 = __toESM(require("path"));
 
 // src/core/controller-client.ts
 var import_node_crypto15 = require("crypto");
-var import_node_fs27 = __toESM(require("fs"));
+var import_node_fs28 = __toESM(require("fs"));
 var import_node_net2 = __toESM(require("net"));
-var import_node_path32 = __toESM(require("path"));
+var import_node_path33 = __toESM(require("path"));
 
 // src/core/controller-protocol.ts
-var import_node_path31 = __toESM(require("path"));
+var import_node_path32 = __toESM(require("path"));
 var CONTROLLER_FRAME_BYTES = 64 * 1024;
 var CONTROLLER_MAX_OPERATION_REQUEST_BYTES = 32 * 1024;
 var CONTROLLER_PROFILE_TOKEN_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -11156,10 +11242,10 @@ function stepReliability(state, event, nowMs) {
 }
 
 // src/core/reliability-worker.ts
-var import_node_child_process17 = require("child_process");
+var import_node_child_process19 = require("child_process");
 var import_node_crypto17 = require("crypto");
-var import_node_fs28 = __toESM(require("fs"));
-var import_node_path33 = __toESM(require("path"));
+var import_node_fs29 = __toESM(require("fs"));
+var import_node_path34 = __toESM(require("path"));
 
 // src/core/lifecycle-progress.ts
 var ROLES = {
@@ -11226,20 +11312,20 @@ function workerGroupAbsent(pid) {
 }
 
 // src/core/workspace-ensure.ts
-var import_node_child_process28 = require("child_process");
-var import_node_fs34 = __toESM(require("fs"));
-var import_node_path39 = __toESM(require("path"));
+var import_node_child_process30 = require("child_process");
+var import_node_fs35 = __toESM(require("fs"));
+var import_node_path40 = __toESM(require("path"));
 
 // src/core/devpod-mutation.ts
-var import_node_child_process18 = require("child_process");
-var import_node_fs29 = __toESM(require("fs"));
-var import_node_path34 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path34.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var import_node_child_process20 = require("child_process");
+var import_node_fs30 = __toESM(require("fs"));
+var import_node_path35 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path35.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
 var DEVPOD_MUTATION_WAIT_MS = 18e5;
 var DevpodStartPostconditionError = class extends Error {
 };
 function withMutationLock2(activity, target, operation) {
-  import_node_fs29.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs30.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -11259,7 +11345,7 @@ function runDevpodAction(action, devpodId, force = false, repoPath) {
   const args = action === "delete" ? [action, devpodId, ...force ? ["--force"] : [], "--ignore-not-found"] : [action, devpodId];
   claimLifecycleEffect();
   const binding = repoPath ? networkProviderEffectOptions("devpod", devpodId, repoPath) : { args: [] };
-  const result = (0, import_node_child_process18.spawnSync)("devpod", [...args, ...binding.args], {
+  const result = (0, import_node_child_process20.spawnSync)("devpod", [...args, ...binding.args], {
     encoding: "utf-8",
     ...binding.env ? { env: binding.env } : {}
   });
@@ -11401,7 +11487,7 @@ async function startDevpodWorkspace(options) {
     }
     claimLifecycleEffect();
     network?.beforeDispatch?.();
-    const result = (0, import_node_child_process18.spawnSync)("devpod", args, {
+    const result = (0, import_node_child_process20.spawnSync)("devpod", args, {
       stdio: options.quiet ? ["inherit", 2, "inherit"] : "inherit",
       env
     });
@@ -11441,8 +11527,8 @@ async function startDevpodWorkspace(options) {
 }
 
 // src/core/host-port-claims.ts
-var import_node_child_process19 = require("child_process");
-var import_node_path35 = __toESM(require("path"));
+var import_node_child_process21 = require("child_process");
+var import_node_path36 = __toESM(require("path"));
 var COMPOSE_RENDER_TIMEOUT_MS = 3e4;
 var COMPOSE_RENDER_MAX_BUFFER = 8 * 1024 * 1024;
 var DOCKER_TIMEOUT_MS = 1e4;
@@ -11545,7 +11631,7 @@ function hostPortBindingsConflict(desired, holder) {
 }
 var HOST_PORT_INSPECT_TEMPLATE = '{"id":{{json .Id}},"name":{{json .Name}},"labels":{"com.docker.compose.project":{{json (index .Config.Labels "com.docker.compose.project")}},"com.docker.compose.project.working_dir":{{json (index .Config.Labels "com.docker.compose.project.working_dir")}}},"ports":{{json .NetworkSettings.Ports}}}';
 function runDocker(args) {
-  const result = (0, import_node_child_process19.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process21.spawnSync)("docker", args, {
     ...networkDockerOptions(),
     encoding: "utf-8",
     timeout: DOCKER_TIMEOUT_MS,
@@ -11615,7 +11701,7 @@ function listHolderSnapshots() {
 }
 function renderManagedComposeModel(plan, workspace) {
   const fileArgs = plan.composeFiles.flatMap((file) => ["-f", file]);
-  const result = (0, import_node_child_process19.spawnSync)(
+  const result = (0, import_node_child_process21.spawnSync)(
     "docker",
     [
       "compose",
@@ -11650,8 +11736,8 @@ function renderManagedComposeModel(plan, workspace) {
   }
 }
 function attributeHolderWorktree(workingDir) {
-  if (import_node_path35.default.basename(workingDir) !== ".devcontainer") return void 0;
-  return comparableWorkspacePath(import_node_path35.default.dirname(workingDir));
+  if (import_node_path36.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path36.default.dirname(workingDir));
 }
 function holderAttribution(holder, repoPath) {
   const attribution = {};
@@ -11686,7 +11772,7 @@ function detectHostPortClaimConflicts(options) {
   );
   if (desired.length === 0) return [];
   const holders = listHolderSnapshots();
-  const devcontainerDir = import_node_path35.default.join(options.repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path36.default.join(options.repoPath, ".devcontainer");
   const conflicts = [];
   for (const binding of desired) {
     for (const holder of holders) {
@@ -11710,7 +11796,7 @@ function detectHostPortClaimConflicts(options) {
 }
 
 // src/core/http-route-probe.ts
-var import_node_child_process20 = require("child_process");
+var import_node_child_process22 = require("child_process");
 var DEFAULT_MAX_TIME_SECONDS = 5;
 var PARENT_TIMEOUT_PADDING_MS = 250;
 var CONTRACT_MAX_BUFFER = 1024;
@@ -11743,7 +11829,7 @@ function probeHttpRoute(host, options = {}) {
     args.push("--cacert", CERT_FILE);
   }
   args.push(url);
-  const result = (0, import_node_child_process20.spawnSync)("curl", args, { encoding: "utf-8" });
+  const result = (0, import_node_child_process22.spawnSync)("curl", args, { encoding: "utf-8" });
   const stdout = result.stdout?.trim() ?? "";
   const status = /^\d{3}$/.test(stdout) ? Number(stdout) : void 0;
   const ok = result.status === 0 && status !== void 0 && status >= 100 && status < 500;
@@ -11762,7 +11848,7 @@ function probeHttpReadinessSync(host, readiness, maxTimeSeconds, repoPath) {
   }
   let result;
   try {
-    result = (0, import_node_child_process20.spawnSync)("curl", args, {
+    result = (0, import_node_child_process22.spawnSync)("curl", args, {
       encoding: "utf-8",
       maxBuffer: CONTRACT_MAX_BUFFER,
       timeout: Math.ceil(parentTimeoutMs)
@@ -11846,8 +11932,8 @@ function transportFailure() {
 }
 
 // src/core/managed-host-preparation.ts
-var import_node_child_process21 = require("child_process");
-var import_node_fs30 = __toESM(require("fs"));
+var import_node_child_process23 = require("child_process");
+var import_node_fs31 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -11858,7 +11944,7 @@ function runPreparationCommand(argv, cwd) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = (0, import_node_child_process21.spawn)(argv[0], argv.slice(1), {
+      child = (0, import_node_child_process23.spawn)(argv[0], argv.slice(1), {
         cwd,
         detached: true,
         shell: false,
@@ -11890,7 +11976,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs30.default.readFileSync(configPath);
+    return import_node_fs31.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -11924,10 +12010,10 @@ async function runManagedHostPreparation(repoPath, config) {
 }
 
 // src/core/managed-post-start.ts
-var import_node_child_process22 = require("child_process");
+var import_node_child_process24 = require("child_process");
 var import_node_crypto18 = require("crypto");
-var import_node_fs31 = __toESM(require("fs"));
-var import_node_path36 = __toESM(require("path"));
+var import_node_fs32 = __toESM(require("fs"));
+var import_node_path37 = __toESM(require("path"));
 var MANAGED_MARKER = "devrouter:managed devcontainer";
 var MANAGED_ADAPTER_PATH = ".devcontainer/post-start.sh";
 var RUNTIME_HELPER_PATH = "/tmp/devrouter/bin/devrouter-process";
@@ -11940,7 +12026,7 @@ function renderDeliveryScript(targetPath) {
   if (!/^\/tmp\/devrouter\/bin\/[a-zA-Z0-9._-]+$/.test(targetPath)) {
     throw new Error(`Unsafe managed runtime delivery path: ${targetPath}`);
   }
-  const temporaryPrefix = import_node_path36.default.posix.basename(targetPath);
+  const temporaryPrefix = import_node_path37.default.posix.basename(targetPath);
   return `set -eu
 umask 077
 runtime_root=/tmp/devrouter
@@ -11964,7 +12050,7 @@ function commandFailure3(result) {
   return [result.error?.message, result.stderr, result.stdout].filter(Boolean).map((value) => String(value).trim()).filter(Boolean).join("\n");
 }
 function deliverRuntimeFile(containerId, targetPath, contents, label) {
-  const result = (0, import_node_child_process22.spawnSync)(
+  const result = (0, import_node_child_process24.spawnSync)(
     "docker",
     ["exec", "-i", containerId, "sh", "-c", renderDeliveryScript(targetPath)],
     { input: contents, encoding: "utf-8", ...networkDockerOptions() }
@@ -11975,8 +12061,8 @@ function deliverRuntimeFile(containerId, targetPath, contents, label) {
   }
 }
 function readRegularFileBytes(filePath) {
-  if (!import_node_fs31.default.existsSync(filePath) || !import_node_fs31.default.lstatSync(filePath).isFile()) return void 0;
-  return import_node_fs31.default.readFileSync(filePath);
+  if (!import_node_fs32.default.existsSync(filePath) || !import_node_fs32.default.lstatSync(filePath).isFile()) return void 0;
+  return import_node_fs32.default.readFileSync(filePath);
 }
 function readRegularFile(filePath) {
   return readRegularFileBytes(filePath)?.toString("utf-8");
@@ -11986,21 +12072,21 @@ function adapterFingerprint(adapter) {
 }
 function resolveProcessHelperPath() {
   const candidates = [
-    import_node_path36.default.resolve(__dirname, "..", "bin", "devrouter-process"),
-    import_node_path36.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
+    import_node_path37.default.resolve(__dirname, "..", "bin", "devrouter-process"),
+    import_node_path37.default.resolve(__dirname, "..", "..", "bin", "devrouter-process")
   ];
-  const helperPath = candidates.find((candidate) => import_node_fs31.default.existsSync(candidate));
+  const helperPath = candidates.find((candidate) => import_node_fs32.default.existsSync(candidate));
   if (!helperPath) {
     throw new Error("Could not locate the packaged devrouter-process helper.");
   }
   return helperPath;
 }
 function resolveManagedPostStartPlan(repoPath) {
-  const adapterPath = import_node_path36.default.join(repoPath, MANAGED_ADAPTER_PATH);
+  const adapterPath = import_node_path37.default.join(repoPath, MANAGED_ADAPTER_PATH);
   const adapterBytes = readRegularFileBytes(adapterPath);
   const adapterText = adapterBytes?.toString("utf-8");
-  const dockerfilePath = import_node_path36.default.join(repoPath, ".devcontainer", "Dockerfile");
-  const devcontainerPath = import_node_path36.default.join(repoPath, ".devcontainer", "devcontainer.json");
+  const dockerfilePath = import_node_path37.default.join(repoPath, ".devcontainer", "Dockerfile");
+  const devcontainerPath = import_node_path37.default.join(repoPath, ".devcontainer", "devcontainer.json");
   const dockerfile = readRegularFile(dockerfilePath) ?? "";
   const devcontainer = readRegularFile(devcontainerPath) ?? "";
   const devrouterPattern = [adapterText, dockerfile, devcontainer].filter((value) => value !== void 0).some(
@@ -12041,7 +12127,7 @@ function resolveManagedPostStartPlan(repoPath) {
 }
 function runManagedPostStart(options) {
   if (options.plan.kind !== "runtime") return;
-  const helper = import_node_fs31.default.readFileSync(resolveProcessHelperPath());
+  const helper = import_node_fs32.default.readFileSync(resolveProcessHelperPath());
   deliverRuntimeFile(
     options.container.id,
     RUNTIME_HELPER_PATH,
@@ -12055,7 +12141,7 @@ function runManagedPostStart(options) {
     options.plan.adapterContents,
     "the managed post-start adapter"
   );
-  const started2 = (0, import_node_child_process22.spawnSync)(
+  const started2 = (0, import_node_child_process24.spawnSync)(
     "docker",
     [
       "exec",
@@ -12096,7 +12182,7 @@ function assertSafeProcessName(name) {
 }
 function runManagedProcessAction(options) {
   assertSafeProcessName(options.name);
-  const result = (0, import_node_child_process22.spawnSync)(
+  const result = (0, import_node_child_process24.spawnSync)(
     "docker",
     [
       "exec",
@@ -12135,7 +12221,7 @@ function runManagedProcessAction(options) {
 }
 
 // src/core/managed-mount-nesting.ts
-var import_node_child_process23 = require("child_process");
+var import_node_child_process25 = require("child_process");
 var NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
 var UNREADABLE_MOUNT_REASON = "the container's own mount table could not be read";
 function normalizeDestination(value) {
@@ -12208,7 +12294,7 @@ function classifyManagedMountNesting(configured, effectiveDestinations, containe
   };
 }
 function readContainerMountinfo(containerId, options) {
-  const result = (0, import_node_child_process23.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
+  const result = (0, import_node_child_process25.spawnSync)("docker", ["exec", containerId, "cat", "/proc/self/mountinfo"], {
     encoding: "utf-8",
     timeout: options.timeoutMs ?? 5e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -12730,7 +12816,7 @@ function collectManagedRuntimeStatus(options) {
 }
 
 // src/core/network-inventory.ts
-var import_node_child_process24 = require("child_process");
+var import_node_child_process26 = require("child_process");
 var NetworkInventoryError = class extends Error {
 };
 var MAX_IDS = 4096;
@@ -12742,7 +12828,7 @@ function readDocker(endpoint, args, timeoutMs) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process24.spawnSync)("docker", ["--host", endpoint, ...args], {
+  const result = (0, import_node_child_process26.spawnSync)("docker", ["--host", endpoint, ...args], {
     env,
     encoding: "utf-8",
     timeout: timeoutMs,
@@ -12906,37 +12992,37 @@ function collectDockerNetworkInventory(options = {}, dependencies = {}) {
 }
 
 // src/core/network-routes.ts
-var import_node_child_process25 = require("child_process");
+var import_node_child_process27 = require("child_process");
 var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
-var import_node_fs32 = __toESM(require("fs"));
-var import_node_path37 = __toESM(require("path"));
+var import_node_fs33 = __toESM(require("fs"));
+var import_node_path38 = __toESM(require("path"));
 function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   const deadline = Date.now() + 2e3;
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs32.default.readFileSync(import_node_path37.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs33.default.readFileSync(import_node_path38.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs32.default.readlinkSync(import_node_path37.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs32.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs33.default.readlinkSync(import_node_path38.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs33.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path37.default.join(procRoot, pid);
-        if (import_node_path37.default.basename(import_node_fs32.default.readlinkSync(import_node_path37.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs32.default.readlinkSync(import_node_path37.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs32.default.readdirSync(import_node_path37.default.join(root, "fd"));
+        const root = import_node_path38.default.join(procRoot, pid);
+        if (import_node_path38.default.basename(import_node_fs33.default.readlinkSync(import_node_path38.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs33.default.readlinkSync(import_node_path38.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs33.default.readdirSync(import_node_path38.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs32.default.readlinkSync(import_node_path37.default.join(root, "fd", fd)) === inode;
+            return import_node_fs33.default.readlinkSync(import_node_path38.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -12975,7 +13061,7 @@ function parseLinuxNetworkRoutes(output) {
 function collectNetworkRoutes(options) {
   if ((options.platform ?? process.platform) !== "linux" || !hasLocalDockerNetworkNamespace(options.endpoint))
     return { status: "unknown", routes: [] };
-  const result = (0, import_node_child_process25.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
+  const result = (0, import_node_child_process27.spawnSync)("ip", ["-j", "-4", "route", "show", "table", "all"], {
     encoding: "utf8",
     timeout: 5e3,
     maxBuffer: 1024 * 1024
@@ -13824,10 +13910,10 @@ function fingerprintComposeNetworkModel(input) {
 }
 
 // src/core/network-compose-files.ts
-var import_node_child_process26 = require("child_process");
+var import_node_child_process28 = require("child_process");
 var import_node_crypto20 = require("crypto");
-var import_node_fs33 = __toESM(require("fs"));
-var import_node_path38 = __toESM(require("path"));
+var import_node_fs34 = __toESM(require("fs"));
+var import_node_path39 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
 var OVERLAY = "docker-compose.devrouter-network.yml";
 var MARKER = "# devrouter:managed workspace network";
@@ -13840,12 +13926,12 @@ function object3(value) {
 function inspectNetworkComposeFiles(input) {
   const authoredNetworks = {};
   for (const file of input.plan.composeFiles) {
-    const stat = import_node_fs33.default.lstatSync(file);
+    const stat = import_node_fs34.default.lstatSync(file);
     if (!stat.isFile() || stat.size > MAX_BYTES2)
       throw new Error("Network Compose source is unavailable or too large.");
     let source;
     try {
-      source = object3(import_yaml4.default.parse(import_node_fs33.default.readFileSync(file, "utf8")));
+      source = object3(import_yaml4.default.parse(import_node_fs34.default.readFileSync(file, "utf8")));
     } catch {
       throw new Error("Network Compose source could not be parsed safely.");
     }
@@ -13861,7 +13947,7 @@ function inspectNetworkComposeFiles(input) {
   const env = managedComposeEnvironment(input.workspace);
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process26.spawnSync)(
+  const result = (0, import_node_child_process28.spawnSync)(
     "docker",
     [
       "--host",
@@ -13895,8 +13981,8 @@ function inspectNetworkComposeFiles(input) {
 function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
-  const overlayPath = import_node_path38.default.join(plan.composeDirectory, OVERLAY);
-  const ignored = (0, import_node_child_process26.spawnSync)("git", [
+  const overlayPath = import_node_path39.default.join(plan.composeDirectory, OVERLAY);
+  const ignored = (0, import_node_child_process28.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
     "check-ignore",
@@ -13910,9 +13996,9 @@ function prepareNetworkComposeFiles(plan, subnet) {
   const bytes2 = `${MARKER}
 ${import_yaml4.default.stringify(overlay.overlay)}`;
   const assertOwnership = () => {
-    if (!import_node_fs33.default.existsSync(overlayPath)) return;
-    const stat = import_node_fs33.default.lstatSync(overlayPath);
-    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs33.default.readFileSync(overlayPath, "utf8") !== bytes2)
+    if (!import_node_fs34.default.existsSync(overlayPath)) return;
+    const stat = import_node_fs34.default.lstatSync(overlayPath);
+    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs34.default.readFileSync(overlayPath, "utf8") !== bytes2)
       throw new Error("Retained network overlay changed; repair is required.");
   };
   assertOwnership();
@@ -13938,7 +14024,7 @@ ${JSON.stringify(extended.config, null, 2)}
 }
 
 // src/core/network-connected-route.ts
-var import_node_child_process27 = require("child_process");
+var import_node_child_process29 = require("child_process");
 function bounds(cidr) {
   const canonical = parseIPv4Cidr(cidr);
   if (!canonical) throw new Error("Invalid connected route.");
@@ -13963,7 +14049,7 @@ function inspectClaimedBridge(claim2, networkId) {
   const env = { ...process.env };
   delete env.DOCKER_CONTEXT;
   delete env.DOCKER_HOST;
-  const result = (0, import_node_child_process27.spawnSync)(
+  const result = (0, import_node_child_process29.spawnSync)(
     "docker",
     [
       "--host",
@@ -13990,7 +14076,7 @@ function inspectClaimedBridge(claim2, networkId) {
     const [first, last] = bounds(claim2.subnet);
     const [address] = bounds(gateway);
     if (address <= first || address >= last) throw new Error();
-    const interfaces = (0, import_node_child_process27.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
+    const interfaces = (0, import_node_child_process29.spawnSync)("ip", ["-j", "-d", "-4", "address", "show", "dev", bridge], {
       encoding: "utf8",
       timeout: 5e3,
       maxBuffer: 65536
@@ -14428,11 +14514,11 @@ var DEFAULT_READINESS_TIMEOUT_MS = 12e4;
 var POLL_INTERVAL_MS = 1e3;
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path39.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path40.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path39.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path40.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -14446,7 +14532,7 @@ function assertWorktreeOwnership(container, repoPath) {
 function isInsideWorktree(candidate, repoPath) {
   const normalizedCandidate = comparableWorkspacePath(candidate);
   const normalizedRoot = comparableWorkspacePath(repoPath);
-  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${import_node_path39.default.sep}`);
+  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${import_node_path40.default.sep}`);
 }
 function assertReady(container, label) {
   if (!container.state.Running) {
@@ -14638,7 +14724,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path39.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path40.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -14746,7 +14832,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
         target
       });
       if (target.kind === "linked") {
-        const workspaceEnv = (0, import_node_child_process28.spawnSync)(
+        const workspaceEnv = (0, import_node_child_process30.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14756,7 +14842,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
             `Workspace app container must expose WORKSPACE='${target.workspace}' (got '${workspaceEnv.stdout.trim() || "(empty)"}').`
           );
         }
-        const devrouterWorkspaceEnv = (0, import_node_child_process28.spawnSync)(
+        const devrouterWorkspaceEnv = (0, import_node_child_process30.spawnSync)(
           "docker",
           ["exec", appContainer.id, "printenv", "DEVROUTER_WORKSPACE"],
           { encoding: "utf-8", ...networkDockerOptions() }
@@ -14767,7 +14853,7 @@ async function waitForContainerPreflight(repoPath, target, upstreamHosts, timeou
           );
         }
       }
-      const gitCheck = (0, import_node_child_process28.spawnSync)(
+      const gitCheck = (0, import_node_child_process30.spawnSync)(
         "docker",
         [
           "exec",
@@ -15040,14 +15126,14 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs34.default.statSync(import_node_path39.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs35.default.statSync(import_node_path40.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
 }
 function openUrls(urls) {
   for (const url of urls) {
-    const opened = (0, import_node_child_process28.spawnSync)("open", [url], { encoding: "utf-8" });
+    const opened = (0, import_node_child_process30.spawnSync)("open", [url], { encoding: "utf-8" });
     if (opened.status !== 0) {
       process.stderr.write(`Warning: could not open '${url}'.
 `);
@@ -15104,8 +15190,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path39.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs34.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path40.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs35.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -15205,7 +15291,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path39.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path40.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -15330,7 +15416,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
               transitionPhase = "service-start";
               reportLifecycleProgress("service-start");
               claimLifecycleEffect();
-              const result = (0, import_node_child_process28.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
+              const result = (0, import_node_child_process30.spawnSync)("docker", ["start", ...stopped.map((entry) => entry.id)], {
                 ...networkDockerOptions(),
                 encoding: "utf-8",
                 timeout: DEFAULT_READINESS_TIMEOUT_MS,
@@ -16047,9 +16133,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs34.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs35.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
-        import_node_path39.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+        import_node_path40.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
           activity: "Managed runtime repair",
           target: repoPath,
@@ -16263,7 +16349,7 @@ async function executeLifecycleWorker(request, operation) {
           const owned = containers.filter(
             (container) => sameWorkspacePath(
               container.labels["com.docker.compose.project.working_dir"] ?? "",
-              import_node_path40.default.join(request.repoPath, ".devcontainer")
+              import_node_path41.default.join(request.repoPath, ".devcontainer")
             )
           );
           const projects = owned.map((container) => container.labels["com.docker.compose.project"]);
@@ -16374,7 +16460,7 @@ function proveLifecycleStopped() {
       const remaining = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path40.default.join(request.repoPath, ".devcontainer")
+          import_node_path41.default.join(request.repoPath, ".devcontainer")
         )
       );
       if (remaining.some(
@@ -16404,7 +16490,7 @@ function proveLifecycleStopped() {
       return void 0;
     });
     if (settlement) {
-      const capacity = createLifecycleCapacityStore(import_node_path40.default.join(DEVROUTER_HOME, "controller"));
+      const capacity = createLifecycleCapacityStore(import_node_path41.default.join(DEVROUTER_HOME, "controller"));
       for (let attempt = 0; ; attempt++) {
         try {
           const state = capacity.inspect();
@@ -16483,7 +16569,7 @@ async function devsyExecOutcome(repoPath, command, retainedProof) {
         const launch = () => {
           if (retainedProof) revalidateDevsyExecProof(repoPath, retainedProof);
           claimLifecycleEffect();
-          return (0, import_node_child_process29.spawn)("devsy", args, { stdio: "inherit" });
+          return (0, import_node_child_process31.spawn)("devsy", args, { stdio: "inherit" });
         };
         child = retainedProof ? withMutationLock("Execute retained workspace", repoPath, launch) : launch();
       } catch (error) {
@@ -16531,7 +16617,7 @@ function ensureGuidance2(repoPath) {
   return `Run 'devrouter ensure ${repoPath}' first.`;
 }
 function assertRunningDevpod(devpodId, repoPath) {
-  const result = (0, import_node_child_process30.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
+  const result = (0, import_node_child_process32.spawnSync)("devpod", ["status", devpodId, "--output", "json"], {
     encoding: "utf-8"
   });
   if (result.status !== 0) {
@@ -16710,7 +16796,7 @@ async function devpodExecOutcome(repoPath, command) {
       let child;
       try {
         claimLifecycleEffect();
-        child = (0, import_node_child_process30.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
+        child = (0, import_node_child_process32.spawn)("devpod", args, { stdio: ["inherit", "inherit", "pipe"] });
       } catch (error) {
         settled = true;
         reject(
@@ -16767,12 +16853,12 @@ async function devpodExecOutcome(repoPath, command) {
 }
 
 // src/core/workspace-lifecycle.ts
-var import_node_child_process31 = require("child_process");
-var import_node_fs36 = __toESM(require("fs"));
-var import_node_path41 = __toESM(require("path"));
+var import_node_child_process33 = require("child_process");
+var import_node_fs37 = __toESM(require("fs"));
+var import_node_path42 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs35 = __toESM(require("fs"));
+var import_node_fs36 = __toESM(require("fs"));
 function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
   return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
 }