@devrouter/cli 0.3.0 → 0.4.0

package/dist/devrouter.js

@@ -4764,7 +4764,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs8.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.3.0" : "0.0.0-dev";
+    const cliVersion = true ? "0.4.0" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -6763,7 +6763,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.3.0" : "0.0.0-dev";
+  return true ? "0.4.0" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -22474,6 +22474,10 @@ var init_ai_prompt = __esm({
         command: "devrouter exec [path] -- <command...>",
         purpose: "Run literal argv inside the exact already-running workspace runtime and proven checkout mount."
       },
+      {
+        command: "devrouter env [path] [--json] | devrouter env [path] -- <command...>",
+        purpose: "Report the checkout's host-reachable URLs, routed and loopback TCP endpoints and CA path without touching the runtime, or run a host command with them exported as DEVROUTER_* variables."
+      },
       {
         command: "devrouter workspace up <branch> [--path <dir>] [--no-devpod] [--open]",
         purpose: "Create a git worktree for <branch>, then run the proven workspace startup unless --no-devpod is set."
@@ -24206,7 +24210,7 @@ function probeInstalledCliVersion(executable) {
 }
 function buildCliPathCheck(options = {}) {
   const id5 = "global.cli-path";
-  const runningVersion = options.runningVersion ?? (true ? "0.3.0" : "0.0.0-dev");
+  const runningVersion = options.runningVersion ?? (true ? "0.4.0" : "0.0.0-dev");
   if (runningVersion === "0.0.0-dev") {
     return {
       id: id5,
@@ -25102,7 +25106,7 @@ async function buildDoctorReport(options = {}) {
           suggestion: `Remedy ${expansionNotice.remedy.code}: set a named default profile other than '${expansionNotice.profile}'${remedyCandidates}.`
         });
       }
-      const cliVersion = true ? "0.3.0" : "0.0.0-dev";
+      const cliVersion = true ? "0.4.0" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       const installedKnown = cliVersion !== "0.0.0-dev";
       const versionComparison = installedKnown && configVersion ? compareSemver(configVersion, cliVersion) : void 0;
@@ -25933,6 +25937,302 @@ var init_exec = __esm({
   }
 });
 
+// src/core/host-env.ts
+function parseLoopbackBinding(output2) {
+  for (const line of output2.split(/\r?\n/)) {
+    const match = line.trim().match(/^(127\.0\.0\.1|\[::1\]):(\d+)$/);
+    if (match) {
+      return { host: match[1] === "[::1]" ? "::1" : "127.0.0.1", port: Number(match[2]) };
+    }
+  }
+  return void 0;
+}
+function resolveLoopback(app, repoPath, evidence) {
+  if (app.runtime !== "proxy") {
+    return { loopback: null, loopbackReason: "unsupported-runtime" };
+  }
+  const upstream = parseUpstream(app.upstream);
+  if (LOOPBACK_UPSTREAM_HOSTS.has(upstream.host)) {
+    return { loopback: { host: "127.0.0.1", port: upstream.port } };
+  }
+  if (!evidence.containers) {
+    return { loopback: null, loopbackReason: "unavailable" };
+  }
+  const devcontainerDir = import_node_path58.default.join(repoPath, ".devcontainer");
+  const owners = evidence.containers.filter(
+    (container) => sameWorkspacePath(
+      container.labels["com.docker.compose.project.working_dir"] ?? "",
+      devcontainerDir
+    ) && (container.networks[DEVNET_NAME]?.Aliases ?? []).includes(upstream.host)
+  );
+  if (owners.length === 0) return { loopback: null, loopbackReason: "not-found" };
+  if (owners.length > 1) return { loopback: null, loopbackReason: "ambiguous" };
+  const [owner] = owners;
+  if (!owner.state.Running) return { loopback: null, loopbackReason: "not-running" };
+  const bindings = evidence.publishedBindings(owner.id, upstream.port);
+  if (bindings === void 0) return { loopback: null, loopbackReason: "unavailable" };
+  const endpoint = parseLoopbackBinding(bindings);
+  return endpoint ? { loopback: endpoint } : { loopback: null, loopbackReason: "not-published" };
+}
+function buildHostEnvReport(input2) {
+  const { repoPath, config, workspace, evidence } = input2;
+  const apps = [];
+  for (const app of config.apps) {
+    if (!("host" in app)) continue;
+    const active = evidence.activeHosts.has(app.host);
+    if (app.protocol === "http") {
+      const scheme = evidence.tlsEnabled ? "https" : "http";
+      apps.push({
+        name: app.name,
+        protocol: "http",
+        host: app.host,
+        active,
+        url: `${scheme}://${app.host}`
+      });
+      continue;
+    }
+    apps.push({
+      name: app.name,
+      protocol: "tcp",
+      tcpProtocol: app.tcpProtocol,
+      host: app.host,
+      active,
+      routed: {
+        host: app.host,
+        port: TCP_PROTOCOL_REGISTRY[app.tcpProtocol]?.port ?? 0,
+        params: { ...ROUTED_TCP_PARAMS[app.tcpProtocol] ?? {} }
+      },
+      ...resolveLoopback(app, repoPath, evidence)
+    });
+  }
+  const ca = evidence.caPath;
+  return {
+    version: 1,
+    repoPath,
+    workspace: workspace ?? null,
+    tls: evidence.tlsEnabled,
+    ...typeof ca === "string" ? { caPath: ca } : { caPath: null, caReason: ca.error },
+    apps
+  };
+}
+function listDevcontainerContainers(repoPath) {
+  const listed = (0, import_node_child_process34.spawnSync)(
+    "docker",
+    [
+      "ps",
+      "-a",
+      "--filter",
+      `label=com.docker.compose.project.working_dir=${import_node_path58.default.join(repoPath, ".devcontainer")}`,
+      "--format",
+      "{{.ID}}"
+    ],
+    { encoding: "utf-8", ...networkDockerOptions() }
+  );
+  if (listed.status !== 0) return void 0;
+  const ids2 = listed.stdout.split(/\r?\n/).map((id5) => id5.trim()).filter(Boolean);
+  try {
+    return inspectWorkspaceContainers({ ids: ids2 });
+  } catch {
+    return void 0;
+  }
+}
+function dockerPortBindings(containerId, port) {
+  const result = (0, import_node_child_process34.spawnSync)("docker", ["port", containerId, `${port}/tcp`], {
+    encoding: "utf-8",
+    ...networkDockerOptions()
+  });
+  if (result.status !== 0) return result.error ? void 0 : "";
+  return result.stdout;
+}
+async function collectActiveHosts(tlsEnabled) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (const route of listHostRoutes(tlsEnabled)) {
+    for (const host of route.hosts) hosts.add(host);
+  }
+  try {
+    const { routes } = discoverRoutes(await listContainers(true), tlsEnabled, DEVNET_NAME);
+    for (const route of routes) {
+      for (const host of route.hosts) hosts.add(host);
+    }
+  } catch {
+  }
+  return hosts;
+}
+async function collectHostEnvReport(repoPath) {
+  const workspace = resolveWorkspace(repoPath);
+  const config = applyWorkspace(loadRepoConfig(repoPath), workspace, repoPath);
+  const tlsEnabled = isTLSEnabled();
+  let caPath;
+  try {
+    caPath = getMkcertRootCAPath({ repoPath });
+  } catch (error) {
+    caPath = { error: error instanceof Error ? error.message : String(error) };
+  }
+  const needsContainers = config.apps.some(
+    (app) => "host" in app && app.protocol === "tcp" && app.runtime === "proxy"
+  );
+  return buildHostEnvReport({
+    repoPath,
+    config,
+    workspace,
+    evidence: {
+      tlsEnabled,
+      activeHosts: await collectActiveHosts(tlsEnabled),
+      caPath,
+      containers: needsContainers ? listDevcontainerContainers(repoPath) : [],
+      publishedBindings: dockerPortBindings
+    }
+  });
+}
+function variablePrefix(appName) {
+  return `DEVROUTER_${appName.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+}
+function hostEnvVariables(report, processEnv) {
+  const variables = {};
+  if (report.workspace) variables.DEVROUTER_WORKSPACE = report.workspace;
+  if (report.caPath && processEnv.NODE_EXTRA_CA_CERTS === void 0) {
+    variables.NODE_EXTRA_CA_CERTS = report.caPath;
+  }
+  for (const app of report.apps) {
+    const prefix = variablePrefix(app.name);
+    if (app.protocol === "http") {
+      variables[`${prefix}_URL`] = app.url;
+      continue;
+    }
+    variables[`${prefix}_ROUTED_HOST`] = app.routed.host;
+    variables[`${prefix}_ROUTED_PORT`] = String(app.routed.port);
+    if (app.loopback) {
+      variables[`${prefix}_HOST`] = app.loopback.host;
+      variables[`${prefix}_PORT`] = String(app.loopback.port);
+    }
+  }
+  return variables;
+}
+var import_node_child_process34, import_node_path58, LOOPBACK_UPSTREAM_HOSTS, ROUTED_TCP_PARAMS;
+var init_host_env = __esm({
+  "src/core/host-env.ts"() {
+    "use strict";
+    import_node_child_process34 = require("child_process");
+    import_node_path58 = __toESM(require("path"));
+    init_devpod_environment();
+    init_docker();
+    init_host_routes();
+    init_network_effect_scope();
+    init_repo_config();
+    init_router();
+    init_routes();
+    init_tls();
+    init_workspace();
+    LOOPBACK_UPSTREAM_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1"]);
+    ROUTED_TCP_PARAMS = {
+      postgres: { sslmode: "require", sslnegotiation: "direct" }
+    };
+  }
+});
+
+// src/commands/env.ts
+var env_exports = {};
+__export(env_exports, {
+  parseEnvInvocation: () => parseEnvInvocation,
+  runEnvCommand: () => runEnvCommand,
+  runHostCommand: () => runHostCommand
+});
+function parseEnvInvocation(args) {
+  const separator = args.indexOf("--");
+  const before = separator < 0 ? args : args.slice(0, separator);
+  const command = separator < 0 ? void 0 : args.slice(separator + 1);
+  const json = before.includes("--json");
+  const positional = before.filter((arg) => arg !== "--json");
+  const unknown = positional.find((arg) => arg.startsWith("-"));
+  if (unknown) throw new Error(`Unknown option '${unknown}' for devrouter env.`);
+  if (positional.length > 1) {
+    throw new Error("devrouter env accepts at most one checkout path.");
+  }
+  if (command !== void 0 && command.length === 0) {
+    throw new Error("No command provided after `--`.");
+  }
+  if (command && json) {
+    throw new Error("--json reports the environment; it cannot be combined with a command.");
+  }
+  return {
+    ...positional[0] ? { path: positional[0] } : {},
+    json,
+    ...command ? { command } : {}
+  };
+}
+function formatEnvReport(report) {
+  const lines = [
+    `Checkout:  ${report.repoPath}`,
+    `Workspace: ${report.workspace ?? "(primary checkout)"}`,
+    `CA:        ${report.caPath ?? `unavailable (${report.caReason})`}`,
+    ""
+  ];
+  for (const app of report.apps) {
+    const state = app.active ? "active" : "inactive";
+    if (app.protocol === "http") {
+      lines.push(`${app.name}  ${app.url}  (${state})`);
+      continue;
+    }
+    const params = new URLSearchParams(app.routed.params).toString();
+    const loopback = app.loopback ? `loopback ${app.loopback.host}:${app.loopback.port}` : `loopback unavailable (${app.loopbackReason})`;
+    lines.push(
+      `${app.name}  ${app.tcpProtocol} routed ${app.routed.host}:${app.routed.port}${params ? ` ?${params}` : ""}; ${loopback}  (${state})`
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+function runHostCommand(command, env) {
+  return new Promise((resolve) => {
+    const child = (0, import_node_child_process35.spawn)(command[0], command.slice(1), { env, stdio: "inherit" });
+    const forward = (signal) => () => child.kill(signal);
+    const handlers = [
+      ["SIGINT", forward("SIGINT")],
+      ["SIGTERM", forward("SIGTERM")]
+    ];
+    for (const [signal, handler] of handlers) process.on(signal, handler);
+    let settled = false;
+    const settle = (code) => {
+      if (settled) return;
+      settled = true;
+      for (const [signal, handler] of handlers) process.off(signal, handler);
+      resolve(code);
+    };
+    child.on("error", (error) => {
+      process.stderr.write(`devrouter env: cannot run '${command[0]}': ${error.message}
+`);
+      settle(error.code === "ENOENT" ? 127 : 126);
+    });
+    child.on("exit", (code, signal) => {
+      settle(code ?? 128 + (signal ? import_node_os6.constants.signals[signal] ?? 0 : 0));
+    });
+  });
+}
+async function runEnvCommand(invocation) {
+  const report = await collectHostEnvReport(resolveGitCheckoutPath(invocation.path));
+  if (invocation.command) {
+    const env = { ...process.env, ...hostEnvVariables(report, process.env) };
+    process.exitCode = await runHostCommand(invocation.command, env);
+    return;
+  }
+  if (invocation.json) {
+    printJSON(report);
+    return;
+  }
+  process.stdout.write(formatEnvReport(report));
+}
+var import_node_child_process35, import_node_os6;
+var init_env = __esm({
+  "src/commands/env.ts"() {
+    "use strict";
+    import_node_child_process35 = require("child_process");
+    import_node_os6 = require("os");
+    init_host_env();
+    init_output();
+    init_environment_path();
+  }
+});
+
 // src/commands/down.ts
 var down_exports = {};
 __export(down_exports, {
@@ -25974,7 +26274,7 @@ var init_status2 = __esm({
 // src/core/harness-continuation.ts
 function harnessContinuationPath(repoRoot) {
   const key = (0, import_node_crypto27.createHash)("sha256").update(comparableWorkspacePath(repoRoot)).digest("hex");
-  return import_node_path58.default.join(DEVROUTER_HOME, "harness", `${key}.json`);
+  return import_node_path59.default.join(DEVROUTER_HOME, "harness", `${key}.json`);
 }
 function counter4(value) {
   return Number.isSafeInteger(value) && value >= 0;
@@ -26015,7 +26315,7 @@ function claimHarnessContinuation(repoRoot, claim2) {
   const nowMs = claim2.nowMs ?? Date.now();
   try {
     const file = harnessContinuationPath(repoRoot);
-    import_node_fs46.default.mkdirSync(import_node_path58.default.dirname(file), { recursive: true, mode: 448 });
+    import_node_fs46.default.mkdirSync(import_node_path59.default.dirname(file), { recursive: true, mode: 448 });
     return withFileLockSync(
       `${file}.lock`,
       { activity: "harness continuation claim", waitMs: HARNESS_CONTINUATION_LOCK_WAIT_MS },
@@ -26047,7 +26347,7 @@ function settleHarnessContinuation(repoRoot, toolUseId, settlement) {
   const nowMs = settlement.nowMs ?? Date.now();
   try {
     const file = harnessContinuationPath(repoRoot);
-    import_node_fs46.default.mkdirSync(import_node_path58.default.dirname(file), { recursive: true, mode: 448 });
+    import_node_fs46.default.mkdirSync(import_node_path59.default.dirname(file), { recursive: true, mode: 448 });
     withFileLockSync(
       `${file}.lock`,
       { activity: "harness continuation settlement", waitMs: HARNESS_CONTINUATION_LOCK_WAIT_MS },
@@ -26071,13 +26371,13 @@ function settleHarnessContinuation(repoRoot, toolUseId, settlement) {
   } catch {
   }
 }
-var import_node_crypto27, import_node_fs46, import_node_path58, HARNESS_CONTINUATION_MAX_ENTRIES, HARNESS_CONTINUATION_TTL_MS, HARNESS_CONTINUATION_LOCK_WAIT_MS, MAX_LEDGER_BYTES, MAX_TOOL_USE_ID_LENGTH, MAX_PHASE_LENGTH;
+var import_node_crypto27, import_node_fs46, import_node_path59, HARNESS_CONTINUATION_MAX_ENTRIES, HARNESS_CONTINUATION_TTL_MS, HARNESS_CONTINUATION_LOCK_WAIT_MS, MAX_LEDGER_BYTES, MAX_TOOL_USE_ID_LENGTH, MAX_PHASE_LENGTH;
 var init_harness_continuation = __esm({
   "src/core/harness-continuation.ts"() {
     "use strict";
     import_node_crypto27 = require("crypto");
     import_node_fs46 = __toESM(require("fs"));
-    import_node_path58 = __toESM(require("path"));
+    import_node_path59 = __toESM(require("path"));
     init_atomic_file();
     init_file_lock();
     init_router();
@@ -26096,12 +26396,12 @@ function isTransitionalHarnessPhase(phase) {
   return TRANSITIONAL_PHASES.includes(phase);
 }
 function findHarnessGateRepoRoot(cwd) {
-  let current = import_node_path59.default.resolve(cwd);
+  let current = import_node_path60.default.resolve(cwd);
   for (let depth = 0; depth < REPO_ROOT_MAX_DEPTH; depth += 1) {
-    if (import_node_fs47.default.existsSync(import_node_path59.default.join(current, ".devrouter.yml"))) {
+    if (import_node_fs47.default.existsSync(import_node_path60.default.join(current, ".devrouter.yml"))) {
       return current;
     }
-    const parent = import_node_path59.default.dirname(current);
+    const parent = import_node_path60.default.dirname(current);
     if (parent === current) {
       return void 0;
     }
@@ -26193,12 +26493,12 @@ function parseHarnessGateBudget(value) {
   }
   return Math.min(Math.trunc(parsed), HARNESS_GATE_MAX_BUDGET_MS);
 }
-var import_node_fs47, import_node_path59, HARNESS_GATE_DEFAULT_BUDGET_MS, HARNESS_GATE_MAX_BUDGET_MS, HARNESS_GATE_POLL_INTERVAL_MS, TRANSITIONAL_PHASES, REPO_ROOT_MAX_DEPTH;
+var import_node_fs47, import_node_path60, HARNESS_GATE_DEFAULT_BUDGET_MS, HARNESS_GATE_MAX_BUDGET_MS, HARNESS_GATE_POLL_INTERVAL_MS, TRANSITIONAL_PHASES, REPO_ROOT_MAX_DEPTH;
 var init_harness_gate = __esm({
   "src/core/harness-gate.ts"() {
     "use strict";
     import_node_fs47 = __toESM(require("fs"));
-    import_node_path59 = __toESM(require("path"));
+    import_node_path60 = __toESM(require("path"));
     init_reliability_operation_store();
     init_workspace();
     init_workspace_runtime();
@@ -26685,7 +26985,7 @@ async function runOpenCommand(name) {
     );
     return;
   }
-  const result = (0, import_node_child_process34.spawnSync)("open", [url], { encoding: "utf-8" });
+  const result = (0, import_node_child_process36.spawnSync)("open", [url], { encoding: "utf-8" });
   if (result.status !== 0) {
     const details = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
     throw new Error(`Unable to open '${url}': ${details || "unknown error"}`);
@@ -26693,11 +26993,11 @@ async function runOpenCommand(name) {
   process.stdout.write(`Opened ${url}
 `);
 }
-var import_node_child_process34;
+var import_node_child_process36;
 var init_open = __esm({
   "src/commands/open.ts"() {
     "use strict";
-    import_node_child_process34 = require("child_process");
+    import_node_child_process36 = require("child_process");
     init_docker();
     init_host_routes();
     init_repo_config();
@@ -26720,7 +27020,7 @@ async function runLogsCommand(options) {
   const args = ["logs", "--tail", tail, ROUTER_CONTAINER_NAME];
   if (options.follow) {
     args.splice(1, 0, "-f");
-    const child = (0, import_node_child_process35.spawn)("docker", args, { stdio: "inherit" });
+    const child = (0, import_node_child_process37.spawn)("docker", args, { stdio: "inherit" });
     const onSignal = () => {
       child.kill("SIGTERM");
     };
@@ -26734,17 +27034,17 @@ async function runLogsCommand(options) {
       });
     });
   } else {
-    const result = (0, import_node_child_process35.spawnSync)("docker", args, { stdio: "inherit" });
+    const result = (0, import_node_child_process37.spawnSync)("docker", args, { stdio: "inherit" });
     if (result.status !== 0) {
       throw new Error("Failed to retrieve router logs.");
     }
   }
 }
-var import_node_child_process35;
+var import_node_child_process37;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_node_child_process35 = require("child_process");
+    import_node_child_process37 = require("child_process");
     init_docker();
     init_router();
   }
@@ -26794,7 +27094,7 @@ function readJson(filePath) {
   }
 }
 function relative(repoPath, filePath) {
-  return import_node_path60.default.relative(repoPath, filePath) || ".";
+  return import_node_path61.default.relative(repoPath, filePath) || ".";
 }
 function redactEnvAssignments(value) {
   return value.replace(
@@ -26835,7 +27135,7 @@ function inspectPackageManager(repoPath, pkg) {
     ["bun.lock", "bun"]
   ];
   for (const [fileName, name] of lockfiles) {
-    if (import_node_fs48.default.existsSync(import_node_path60.default.join(repoPath, fileName))) {
+    if (import_node_fs48.default.existsSync(import_node_path61.default.join(repoPath, fileName))) {
       return { name, source: fileName };
     }
   }
@@ -26850,7 +27150,7 @@ function inspectNode(repoPath, pkg) {
   if (typeof engines?.node === "string") {
     return { version: engines.node, source: "package.json:engines.node" };
   }
-  const nvmrc = import_node_path60.default.join(repoPath, ".nvmrc");
+  const nvmrc = import_node_path61.default.join(repoPath, ".nvmrc");
   if (import_node_fs48.default.existsSync(nvmrc)) {
     const version = import_node_fs48.default.readFileSync(nvmrc, "utf-8").trim();
     return { version, source: ".nvmrc" };
@@ -26913,7 +27213,7 @@ function configuredComposeFiles(repoPath) {
     const files = config.apps.filter(
       (app) => app.runtime === "docker"
     ).flatMap((app) => app.docker.composeFiles).filter(
-      (fileName) => !import_node_path60.default.isAbsolute(fileName) && !import_node_path60.default.normalize(fileName).startsWith("..")
+      (fileName) => !import_node_path61.default.isAbsolute(fileName) && !import_node_path61.default.normalize(fileName).startsWith("..")
     );
     return Array.from(new Set(files));
   } catch {
@@ -26931,7 +27231,7 @@ function composeFiles(repoPath) {
     ...configuredComposeFiles(repoPath)
   ];
   return Array.from(new Set(candidates)).filter(
-    (fileName) => import_node_fs48.default.existsSync(import_node_path60.default.join(repoPath, fileName))
+    (fileName) => import_node_fs48.default.existsSync(import_node_path61.default.join(repoPath, fileName))
   );
 }
 function stringArray2(value) {
@@ -26969,7 +27269,7 @@ function inspectServices(repoPath) {
   const services = [];
   for (const fileName of composeFiles(repoPath)) {
     try {
-      const parsed = import_yaml7.default.parse(import_node_fs48.default.readFileSync(import_node_path60.default.join(repoPath, fileName), "utf-8"));
+      const parsed = import_yaml7.default.parse(import_node_fs48.default.readFileSync(import_node_path61.default.join(repoPath, fileName), "utf-8"));
       const serviceMap = asRecord3(asRecord3(parsed)?.services);
       for (const [name, value] of Object.entries(serviceMap ?? {})) {
         const service = asRecord3(value);
@@ -27005,7 +27305,7 @@ function inspectServices(repoPath) {
 }
 function inspectEnvFiles(repoPath) {
   const files = import_node_fs48.default.readdirSync(repoPath).filter((fileName) => /^\.env(\.|$)/.test(fileName)).sort().map((fileName) => {
-    const content = import_node_fs48.default.readFileSync(import_node_path60.default.join(repoPath, fileName), "utf-8");
+    const content = import_node_fs48.default.readFileSync(import_node_path61.default.join(repoPath, fileName), "utf-8");
     const names = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0]?.trim()).filter((name) => Boolean(name)).sort();
     return { path: fileName, names };
   });
@@ -27019,13 +27319,13 @@ function inspectEnvFiles(repoPath) {
   };
 }
 function inspectDevcontainer(repoPath) {
-  const dir = import_node_path60.default.join(repoPath, ".devcontainer");
+  const dir = import_node_path61.default.join(repoPath, ".devcontainer");
   if (!import_node_fs48.default.existsSync(dir)) {
     return { exists: false, files: [] };
   }
   return {
     exists: true,
-    files: import_node_fs48.default.readdirSync(dir).filter((fileName) => import_node_fs48.default.statSync(import_node_path60.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
+    files: import_node_fs48.default.readdirSync(dir).filter((fileName) => import_node_fs48.default.statSync(import_node_path61.default.join(dir, fileName)).isFile()).sort().map((fileName) => `.devcontainer/${fileName}`)
   };
 }
 function inspectDevrouter(repoPath) {
@@ -27074,14 +27374,14 @@ function inspectAgentGuidance(repoPath) {
     ["AGENTS.md", "agents"],
     ["CLAUDE.md", "claude"]
   ]) {
-    if (import_node_fs48.default.existsSync(import_node_path60.default.join(repoPath, fileName))) {
+    if (import_node_fs48.default.existsSync(import_node_path61.default.join(repoPath, fileName))) {
       results.push({ path: fileName, kind });
     }
   }
-  const skillsDir = import_node_path60.default.join(repoPath, ".agents", "skills");
+  const skillsDir = import_node_path61.default.join(repoPath, ".agents", "skills");
   if (import_node_fs48.default.existsSync(skillsDir)) {
     for (const name of import_node_fs48.default.readdirSync(skillsDir).sort()) {
-      const skillPath = import_node_path60.default.join(skillsDir, name, "SKILL.md");
+      const skillPath = import_node_path61.default.join(skillsDir, name, "SKILL.md");
       if (import_node_fs48.default.existsSync(skillPath)) {
         results.push({ path: relative(repoPath, skillPath), kind: "skill" });
       }
@@ -27125,7 +27425,7 @@ function buildIssues(report) {
 }
 function inspectRepo(options = {}) {
   const repoPath = resolveRepoPath(options.repo);
-  const pkg = readJson(import_node_path60.default.join(repoPath, "package.json"));
+  const pkg = readJson(import_node_path61.default.join(repoPath, "package.json"));
   const scripts = inspectScripts(pkg);
   const reportWithoutIssues = {
     repoPath,
@@ -27144,12 +27444,12 @@ function inspectRepo(options = {}) {
     issues: buildIssues(reportWithoutIssues)
   };
 }
-var import_node_fs48, import_node_path60, import_yaml7;
+var import_node_fs48, import_node_path61, import_yaml7;
 var init_repo_inspect = __esm({
   "src/core/repo-inspect.ts"() {
     "use strict";
     import_node_fs48 = __toESM(require("fs"));
-    import_node_path60 = __toESM(require("path"));
+    import_node_path61 = __toESM(require("path"));
     import_yaml7 = __toESM(require("yaml"));
     init_repo_config();
   }
@@ -27254,7 +27554,7 @@ function requiredFileChecks(repoPath) {
     ".devcontainer/docker-compose.yml",
     ".devrouter.yml"
   ];
-  const missing = required.filter((fileName) => !import_node_fs49.default.existsSync(import_node_path61.default.join(repoPath, fileName)));
+  const missing = required.filter((fileName) => !import_node_fs49.default.existsSync(import_node_path62.default.join(repoPath, fileName)));
   return {
     id: "repo.devcontainer.verify-files",
     level: missing.length === 0 ? "ok" : "error",
@@ -27479,12 +27779,12 @@ async function verifyDevcontainer(options = {}) {
     nextSteps: collectNextSteps3(checks)
   };
 }
-var import_node_fs49, import_node_path61;
+var import_node_fs49, import_node_path62;
 var init_devcontainer_verify = __esm({
   "src/core/devcontainer-verify.ts"() {
     "use strict";
     import_node_fs49 = __toESM(require("fs"));
-    import_node_path61 = __toESM(require("path"));
+    import_node_path62 = __toESM(require("path"));
     init_capabilities();
     init_doctor();
     init_host_routes();
@@ -27781,7 +28081,7 @@ function packageManagerIssues(repo) {
 }
 function plannedFiles(repoPath, version) {
   const repo = inspectRepo({ repo: repoPath });
-  const projectName = sanitizeProjectName(import_node_path62.default.basename(repo.repoPath));
+  const projectName = sanitizeProjectName(import_node_path63.default.basename(repo.repoPath));
   const nodeMajor = majorVersion(repo.node?.version, "24");
   const pnpmVersion = repo.packageManager?.name === "pnpm" && repo.packageManager.version ? repo.packageManager.version : DEFAULT_PNPM_VERSION;
   const port = inferPort2(repo);
@@ -27826,7 +28126,7 @@ function plannedFiles(repoPath, version) {
   };
 }
 function classifyFile(repoPath, file) {
-  const absolutePath = import_node_path62.default.join(repoPath, file.relativePath);
+  const absolutePath = import_node_path63.default.join(repoPath, file.relativePath);
   if (!import_node_fs50.default.existsSync(absolutePath)) {
     return {
       path: file.relativePath,
@@ -27892,8 +28192,8 @@ function buildPlan(repoPath, dryRun, version) {
   };
 }
 function writeFile(repoPath, file) {
-  const absolutePath = import_node_path62.default.join(repoPath, file.relativePath);
-  import_node_fs50.default.mkdirSync(import_node_path62.default.dirname(absolutePath), { recursive: true });
+  const absolutePath = import_node_path63.default.join(repoPath, file.relativePath);
+  import_node_fs50.default.mkdirSync(import_node_path63.default.dirname(absolutePath), { recursive: true });
   import_node_fs50.default.writeFileSync(absolutePath, file.content, "utf-8");
   if (file.executable) {
     import_node_fs50.default.chmodSync(absolutePath, 493);
@@ -27934,12 +28234,12 @@ function writeDevcontainer(options = {}) {
     nextSteps: postWriteNextSteps(repoPath)
   };
 }
-var import_node_fs50, import_node_path62, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
+var import_node_fs50, import_node_path63, MANAGED_MARKER2, DEFAULT_DEVROUTER_VERSION, DEFAULT_PNPM_VERSION, VALID_PACKAGE_VERSION_RE;
 var init_devcontainer_write = __esm({
   "src/core/devcontainer-write.ts"() {
     "use strict";
     import_node_fs50 = __toESM(require("fs"));
-    import_node_path62 = __toESM(require("path"));
+    import_node_path63 = __toESM(require("path"));
     init_repo_config();
     init_repo_inspect();
     MANAGED_MARKER2 = "devrouter:managed devcontainer";
@@ -28273,7 +28573,7 @@ function buildProfilePlanReport(options) {
   return { ...report, contractPath, bindings };
 }
 function loadContract(repoPath, contractPath) {
-  if (import_node_path63.default.isAbsolute(contractPath)) {
+  if (import_node_path64.default.isAbsolute(contractPath)) {
     fail3("profile plan contract path must be relative to the repository.");
   }
   const absolutePath = assertPathWithinRepo(contractPath, repoPath, "Profile plan contract");
@@ -28298,7 +28598,7 @@ function loadContract(repoPath, contractPath) {
   }
   return {
     contract: parseProfilePlanContract(source),
-    contractPath: import_node_path63.default.relative(repoPath, absolutePath).split(import_node_path63.default.sep).join("/")
+    contractPath: import_node_path64.default.relative(repoPath, absolutePath).split(import_node_path64.default.sep).join("/")
   };
 }
 function resolveProfilePlan(options) {
@@ -28312,12 +28612,12 @@ function resolveProfilePlan(options) {
     contractPath: loaded.contractPath
   });
 }
-var import_node_fs51, import_node_path63, import_yaml8, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
+var import_node_fs51, import_node_path64, import_yaml8, CONTRACT_VERSION, MAX_CONTRACT_BYTES, MAX_APP_MAPPINGS, MAX_BINDING_KEYS, MAX_BINDING_VALUES, MAX_LITERAL_LENGTH, BINDING_KEY;
 var init_profile_plan = __esm({
   "src/core/profile-plan.ts"() {
     "use strict";
     import_node_fs51 = __toESM(require("fs"));
-    import_node_path63 = __toESM(require("path"));
+    import_node_path64 = __toESM(require("path"));
     import_yaml8 = require("yaml");
     init_paths();
     init_profile_resolution();
@@ -28349,7 +28649,7 @@ async function runProfileResolveCommand(options) {
 async function runProfilePlanCommand(options) {
   const report = resolveProfilePlan(options);
   if (options.output) {
-    writeFileAtomically(import_node_path64.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
+    writeFileAtomically(import_node_path65.default.resolve(options.output), `${JSON.stringify(report, null, 2)}
 `);
   }
   if (options.json) {
@@ -28396,14 +28696,14 @@ function printProfilePlanSummary(report, output2) {
     process.stdout.write(`Binding ${key}: ${renderValues(report.bindings[key] ?? [])}
 `);
   }
-  if (output2) process.stdout.write(`Output: ${import_node_path64.default.resolve(output2)}
+  if (output2) process.stdout.write(`Output: ${import_node_path65.default.resolve(output2)}
 `);
 }
-var import_node_path64;
+var import_node_path65;
 var init_profile = __esm({
   "src/commands/profile.ts"() {
     "use strict";
-    import_node_path64 = __toESM(require("path"));
+    import_node_path65 = __toESM(require("path"));
     init_atomic_file();
     init_output();
     init_profile_plan();
@@ -28693,7 +28993,7 @@ function sanitizeRouterId(value) {
   return value.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function repoHash(repoPath) {
-  return (0, import_node_crypto29.createHash)("sha1").update(import_node_path65.default.resolve(repoPath)).digest("hex").slice(0, 12);
+  return (0, import_node_crypto29.createHash)("sha1").update(import_node_path66.default.resolve(repoPath)).digest("hex").slice(0, 12);
 }
 function asDockerApp(app) {
   return app.runtime === "docker";
@@ -28772,9 +29072,9 @@ function prepareDockerOverlay(repoPath, appName, apps, publishTcpPorts = false)
   if (dockerApps.length === 0) {
     throw new Error("No docker apps selected to prepare compose overlay.");
   }
-  const cachePath = import_node_path65.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
+  const cachePath = import_node_path66.default.join(CACHE_DIR, repoHash(repoPath), sanitizeRouterId(appName));
   import_node_fs52.default.mkdirSync(cachePath, { recursive: true });
-  const overlayPath = import_node_path65.default.join(cachePath, "compose.devrouter.yml");
+  const overlayPath = import_node_path66.default.join(cachePath, "compose.devrouter.yml");
   const overlayDocument = buildOverlayDocument(dockerApps, publishTcpPorts);
   import_node_fs52.default.writeFileSync(overlayPath, import_yaml9.default.stringify(overlayDocument, { lineWidth: 0 }), "utf-8");
   return {
@@ -28790,7 +29090,7 @@ function runDockerComposeUp(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "up", "-d", "--wait", ...services];
-  const result = (0, import_node_child_process36.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process38.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -28818,7 +29118,7 @@ function queryRunningComposeServices(repoPath, composeFiles2, overlayPath, servi
     "--services",
     ...services
   ];
-  const result = (0, import_node_child_process36.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process38.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -28844,7 +29144,7 @@ function runDockerComposeStop(repoPath, composeFiles2, overlayPath, services) {
     fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "stop", ...services];
-  const result = (0, import_node_child_process36.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process38.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -28870,7 +29170,7 @@ function runDockerComposeLogs(repoPath, composeFiles2, overlayPath, services, ta
     String(tail),
     ...services
   ];
-  (0, import_node_child_process36.spawnSync)("docker", args, {
+  (0, import_node_child_process38.spawnSync)("docker", args, {
     stdio: "inherit",
     cwd: repoPath
   });
@@ -28882,7 +29182,7 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
     fileArgs.push("-f", resolved2);
   }
   const args = ["compose", ...fileArgs, "-f", overlayPath, "port", service, String(internalPort)];
-  const result = (0, import_node_child_process36.spawnSync)("docker", args, {
+  const result = (0, import_node_child_process38.spawnSync)("docker", args, {
     encoding: "utf-8",
     cwd: repoPath
   });
@@ -28896,14 +29196,14 @@ function queryMappedPort(repoPath, composeFiles2, overlayPath, service, internal
   const port = Number(match[1]);
   return Number.isInteger(port) && port > 0 ? port : void 0;
 }
-var import_node_child_process36, import_node_crypto29, import_node_fs52, import_node_path65, import_yaml9;
+var import_node_child_process38, import_node_crypto29, import_node_fs52, import_node_path66, import_yaml9;
 var init_docker_run = __esm({
   "src/core/docker-run.ts"() {
     "use strict";
-    import_node_child_process36 = require("child_process");
+    import_node_child_process38 = require("child_process");
     import_node_crypto29 = require("crypto");
     import_node_fs52 = __toESM(require("fs"));
-    import_node_path65 = __toESM(require("path"));
+    import_node_path66 = __toESM(require("path"));
     import_yaml9 = __toESM(require("yaml"));
     init_docker_error_guidance();
     init_paths();
@@ -28993,7 +29293,7 @@ function isProcessRunning(pid) {
   }
 }
 function readProcessTree(rootPid) {
-  const result = (0, import_node_child_process37.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
+  const result = (0, import_node_child_process39.spawnSync)("ps", ["-ax", "-o", "pid=,ppid="], { encoding: "utf-8" });
   if (result.status !== 0) {
     return [rootPid];
   }
@@ -29104,12 +29404,12 @@ function detectListeningPorts(pids) {
   if (pids.length === 0) {
     return [];
   }
-  const result = (0, import_node_child_process37.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
+  const result = (0, import_node_child_process39.spawnSync)("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN", "-a", "-p", pids.join(",")], {
     encoding: "utf-8"
   });
   if (result.error && result.error.code === "ENOENT") {
     if (process.platform === "linux") {
-      const ssResult = (0, import_node_child_process37.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
+      const ssResult = (0, import_node_child_process39.spawnSync)("ss", ["-H", "-lntp", "-p"], { encoding: "utf-8" });
       if (ssResult.status === 0 && ssResult.stdout) {
         return parseSsListeningPorts(ssResult.stdout, new Set(pids));
       }
@@ -29168,7 +29468,7 @@ async function runHostApp(repoPath, app, extraEnv = {}, secretManager, env, work
     app.hostRun.command,
     true
   ) : app.hostRun.command;
-  const child = (0, import_node_child_process37.spawn)(spawnCommand, {
+  const child = (0, import_node_child_process39.spawn)(spawnCommand, {
     cwd: commandCwd,
     stdio: "inherit",
     shell: true,
@@ -29536,7 +29836,7 @@ async function execWithAppEnv(options) {
           options.command[0],
           true
         );
-        child = (0, import_node_child_process37.spawn)(wrapped, {
+        child = (0, import_node_child_process39.spawn)(wrapped, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: true,
@@ -29550,7 +29850,7 @@ async function execWithAppEnv(options) {
           false
         );
         const [cmd, ...wrappedArgs] = wrapped;
-        child = (0, import_node_child_process37.spawn)(cmd, wrappedArgs, {
+        child = (0, import_node_child_process39.spawn)(cmd, wrappedArgs, {
           cwd: deps.repoPath,
           stdio: "inherit",
           shell: false,
@@ -29558,7 +29858,7 @@ async function execWithAppEnv(options) {
         });
       }
     } else if (options.shell) {
-      child = (0, import_node_child_process37.spawn)(options.command[0], {
+      child = (0, import_node_child_process39.spawn)(options.command[0], {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: true,
@@ -29566,7 +29866,7 @@ async function execWithAppEnv(options) {
       });
     } else {
       const [command, ...args] = options.command;
-      child = (0, import_node_child_process37.spawn)(command, args, {
+      child = (0, import_node_child_process39.spawn)(command, args, {
         cwd: deps.repoPath,
         stdio: "inherit",
         shell: false,
@@ -29587,11 +29887,11 @@ async function execWithAppEnv(options) {
     deps.stopDeps();
   }
 }
-var import_node_child_process37, import_node_net5, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
+var import_node_child_process39, import_node_net5, import_node_process, import_promises, POLL_INTERVAL_MS, DEFAULT_PORT_TIMEOUT_MS, PROCESS_TERMINATION_GRACE_MS;
 var init_app_run = __esm({
   "src/core/app-run.ts"() {
     "use strict";
-    import_node_child_process37 = require("child_process");
+    import_node_child_process39 = require("child_process");
     import_node_net5 = __toESM(require("net"));
     import_node_process = require("process");
     import_promises = require("readline/promises");
@@ -29799,7 +30099,7 @@ function validateCandidate(value, index, action2, legacy) {
     }
   }
   for (const key of ["repo", "path", "commonDir", "gitDir"]) {
-    if (!import_node_path66.default.isAbsolute(candidate[key])) {
+    if (!import_node_path67.default.isAbsolute(candidate[key])) {
       throw new Error(`${label2}.${key} must be an absolute path`);
     }
   }
@@ -29944,7 +30244,7 @@ function selectManifest(file, expectedSha256, ids2) {
   return canonicalJson(subset);
 }
 function gitLine(cwd, args) {
-  const result = (0, import_node_child_process38.spawnSync)("git", ["-C", cwd, ...args], {
+  const result = (0, import_node_child_process40.spawnSync)("git", ["-C", cwd, ...args], {
     encoding: "utf-8",
     env: { ...process.env, GIT_OPTIONAL_LOCKS: "0", LC_ALL: "C" }
   });
@@ -29972,9 +30272,9 @@ function identityMismatch(expected, actual) {
 function unmanagedActivityEpoch(worktreePath, gitDir) {
   let latest;
   for (const file of [
-    import_node_path66.default.join(gitDir, "index"),
-    import_node_path66.default.join(gitDir, "HEAD"),
-    import_node_path66.default.join(gitDir, "logs", "HEAD"),
+    import_node_path67.default.join(gitDir, "index"),
+    import_node_path67.default.join(gitDir, "HEAD"),
+    import_node_path67.default.join(gitDir, "logs", "HEAD"),
     worktreePath
   ]) {
     try {
@@ -30032,7 +30332,7 @@ function buildReclaimManifest(report, createdAtEpoch) {
   return canonicalJson(manifest);
 }
 function receiptPath(commonDir, manifestSha256, id5) {
-  return import_node_path66.default.join(commonDir, "worktree-reclaim", "receipts", manifestSha256, `${id5}.json`);
+  return import_node_path67.default.join(commonDir, "worktree-reclaim", "receipts", manifestSha256, `${id5}.json`);
 }
 function matchingReceipt(candidate, manifestSha256) {
   try {
@@ -30046,7 +30346,7 @@ function matchingReceipt(candidate, manifestSha256) {
 }
 function writeReceipt(candidate, manifestSha256, steps, nowEpoch) {
   const file = receiptPath(candidate.commonDir, manifestSha256, candidate.id);
-  import_node_fs53.default.mkdirSync(import_node_path66.default.dirname(file), { recursive: true });
+  import_node_fs53.default.mkdirSync(import_node_path67.default.dirname(file), { recursive: true });
   writeFileAtomically(
     file,
     canonicalJson({
@@ -30064,7 +30364,7 @@ function writeReceipt(candidate, manifestSha256, steps, nowEpoch) {
   );
 }
 function runVetoCommand(command, worktreePath) {
-  const result = (0, import_node_child_process38.spawnSync)(command, [worktreePath], {
+  const result = (0, import_node_child_process40.spawnSync)(command, [worktreePath], {
     stdio: ["ignore", "ignore", "inherit"],
     timeout: VETO_TIMEOUT_MS
   });
@@ -30077,7 +30377,7 @@ function runVetoCommand(command, worktreePath) {
   return result.status === 0 && !result.error && result.signal === null;
 }
 function assertVetoCommand(command) {
-  if (!import_node_path66.default.isAbsolute(command)) throw new Error("--veto-command must be an absolute path");
+  if (!import_node_path67.default.isAbsolute(command)) throw new Error("--veto-command must be an absolute path");
   try {
     import_node_fs53.default.accessSync(command, import_node_fs53.default.constants.X_OK);
   } catch {
@@ -30105,7 +30405,7 @@ function preflightManifestApply(options, action2, nowEpoch) {
   return { manifest, manifestSha256, now };
 }
 function deleteBranchIfUnmoved(candidate, steps) {
-  const exists2 = (0, import_node_child_process38.spawnSync)(
+  const exists2 = (0, import_node_child_process40.spawnSync)(
     "git",
     ["-C", candidate.repo, "show-ref", "--verify", "--quiet", candidate.branchRef],
     { encoding: "utf-8" }
@@ -30114,7 +30414,7 @@ function deleteBranchIfUnmoved(candidate, steps) {
   if (exists2.status !== 0) {
     throw new Error(`cannot read branch ${candidate.branch}: ${(exists2.stderr ?? "").trim()}`);
   }
-  const result = (0, import_node_child_process38.spawnSync)(
+  const result = (0, import_node_child_process40.spawnSync)(
     "git",
     ["-C", candidate.repo, "update-ref", "-d", candidate.branchRef, candidate.head],
     { encoding: "utf-8" }
@@ -30123,7 +30423,7 @@ function deleteBranchIfUnmoved(candidate, steps) {
     return `branch ${candidate.branch} no longer points at the approved HEAD; it was kept for review`;
   }
   steps.push("branch-deleted");
-  (0, import_node_child_process38.spawnSync)(
+  (0, import_node_child_process40.spawnSync)(
     "git",
     ["-C", candidate.repo, "config", "--remove-section", `branch.${candidate.branch}`],
     { encoding: "utf-8" }
@@ -30230,14 +30530,14 @@ async function applyReclaimManifest(options, dependencies) {
   }
   return { manifestSha256, dryRun: !options.yes, targets, stoppedEarly };
 }
-var import_node_child_process38, import_node_crypto30, import_node_fs53, import_node_path66, MANIFEST_KIND, LEGACY_MANIFEST_KIND, RECEIPT_KIND, SCHEMA_VERSION, HEX_SHA, HEX_ID, VETO_TIMEOUT_MS, FUTURE_TOLERANCE_SECONDS, ROOT_KEYS, SESSION_ROOT_KEYS, LEGACY_ROOT_KEYS, CANDIDATE_KEYS, SESSION_CANDIDATE_KEYS, OPTIONAL_CANDIDATE_KEYS, ReclaimSkip;
+var import_node_child_process40, import_node_crypto30, import_node_fs53, import_node_path67, MANIFEST_KIND, LEGACY_MANIFEST_KIND, RECEIPT_KIND, SCHEMA_VERSION, HEX_SHA, HEX_ID, VETO_TIMEOUT_MS, FUTURE_TOLERANCE_SECONDS, ROOT_KEYS, SESSION_ROOT_KEYS, LEGACY_ROOT_KEYS, CANDIDATE_KEYS, SESSION_CANDIDATE_KEYS, OPTIONAL_CANDIDATE_KEYS, ReclaimSkip;
 var init_worktree_reclaim = __esm({
   "src/core/worktree-reclaim.ts"() {
     "use strict";
-    import_node_child_process38 = require("child_process");
+    import_node_child_process40 = require("child_process");
     import_node_crypto30 = require("crypto");
     import_node_fs53 = __toESM(require("fs"));
-    import_node_path66 = __toESM(require("path"));
+    import_node_path67 = __toESM(require("path"));
     init_atomic_file();
     init_workspace();
     MANIFEST_KIND = "worktree-reclaim-manifest";
@@ -30357,8 +30657,8 @@ function checkoutOf(workingDir) {
   return workingDir.replace(/\/+$/, "").replace(/\/\.devcontainer$/, "");
 }
 function isInsideOrEqual(parent, child) {
-  const relative2 = import_node_path67.default.relative(parent, child);
-  return relative2 === "" || !relative2.startsWith("..") && !import_node_path67.default.isAbsolute(relative2);
+  const relative2 = import_node_path68.default.relative(parent, child);
+  return relative2 === "" || !relative2.startsWith("..") && !import_node_path68.default.isAbsolute(relative2);
 }
 function isAnonymousVolume(volume) {
   return /^[0-9a-f]{64}$/.test(volume.name) && !volume.labels[PROJECT_LABEL];
@@ -30370,9 +30670,9 @@ function vanishedInsideTrees(checkout, context) {
     (prefix) => checkout !== prefix && isInsideOrEqual(prefix, checkout)
   );
   if (!lexical || context.exists(checkout)) return "out-of-scope";
-  let ancestor = import_node_path67.default.dirname(checkout);
+  let ancestor = import_node_path68.default.dirname(checkout);
   while (!context.exists(ancestor)) {
-    const parent = import_node_path67.default.dirname(ancestor);
+    const parent = import_node_path68.default.dirname(ancestor);
     if (parent === ancestor) return "out-of-scope";
     ancestor = parent;
   }
@@ -30380,16 +30680,16 @@ function vanishedInsideTrees(checkout, context) {
   if (ancestorReal === void 0 || !isInsideOrEqual(treesReal, ancestorReal)) {
     return "out-of-scope";
   }
-  for (let current = ancestor; ; current = import_node_path67.default.dirname(current)) {
+  for (let current = ancestor; ; current = import_node_path68.default.dirname(current)) {
     const real = context.realpath(current);
     if (real === void 0 || real === treesReal || !isInsideOrEqual(treesReal, real)) break;
-    if (context.exists(import_node_path67.default.join(current, ".git"))) return "inside-worktree";
+    if (context.exists(import_node_path68.default.join(current, ".git"))) return "inside-worktree";
   }
   return "vanished";
 }
 function resolved(file, context) {
   const real = context.realpath(file);
-  return real && real !== import_node_path67.default.resolve(file) ? [import_node_path67.default.resolve(file), real] : [import_node_path67.default.resolve(file)];
+  return real && real !== import_node_path68.default.resolve(file) ? [import_node_path68.default.resolve(file), real] : [import_node_path68.default.resolve(file)];
 }
 function relation(entry, checkout, context) {
   const entries = resolved(entry, context);
@@ -30494,7 +30794,7 @@ function readLeftoverContext(repoPath) {
   resetWorkspaceRuntimeCaches();
   const snapshots = getWorkspaceRegistrySnapshots();
   return {
-    treesPath: import_node_path67.default.join(repoPath, "trees"),
+    treesPath: import_node_path68.default.join(repoPath, "trees"),
     worktreePaths: listGitWorktrees(repoPath).map((worktree) => worktree.path),
     ownershipPaths: listWorkspaceOwnership(repoPath).map((record5) => record5.worktreePath),
     providerPaths: listMergedRuntimeWorkspaces().map((workspace) => workspace.source.localFolder),
@@ -30572,7 +30872,7 @@ function validateLeftoverManifest(value) {
     throw new Error(`manifest schemaVersion must be ${SCHEMA_VERSION2}`);
   }
   requireString(root.repo, "manifest repo");
-  if (!import_node_path67.default.isAbsolute(root.repo)) throw new Error("manifest repo must be an absolute path");
+  if (!import_node_path68.default.isAbsolute(root.repo)) throw new Error("manifest repo must be an absolute path");
   requireString(root.daemonId, "manifest daemonId");
   if (!Number.isInteger(root.createdAtEpoch) || root.createdAtEpoch < 0) {
     throw new Error("manifest createdAtEpoch must be a non-negative integer");
@@ -30594,7 +30894,7 @@ function validateLeftoverManifest(value) {
     );
     requireString(candidate.project, `${label2}.project`);
     requireString(candidate.checkout, `${label2}.checkout`);
-    if (!import_node_path67.default.isAbsolute(candidate.checkout)) {
+    if (!import_node_path68.default.isAbsolute(candidate.checkout)) {
       throw new Error(`${label2}.checkout must be an absolute path`);
     }
     const members = [
@@ -30646,7 +30946,7 @@ function readLeftoverManifest(file) {
   return { raw, manifest };
 }
 function gitCommonDir(repo) {
-  const result = (0, import_node_child_process39.spawnSync)(
+  const result = (0, import_node_child_process41.spawnSync)(
     "git",
     ["-C", repo, "rev-parse", "--path-format=absolute", "--git-common-dir"],
     { encoding: "utf-8" }
@@ -30814,11 +31114,11 @@ function applyLeftoverManifest(options, dependencies = {}) {
   return { manifestSha256, dryRun: !options.yes, targets };
 }
 function leftoverReceiptPath(commonDir, manifestSha256, id5) {
-  return import_node_path67.default.join(commonDir, "devrouter-leftovers", "receipts", manifestSha256, `${id5}.json`);
+  return import_node_path68.default.join(commonDir, "devrouter-leftovers", "receipts", manifestSha256, `${id5}.json`);
 }
 function writeLeftoverReceipt(commonDir, manifestSha256, candidate, steps, nowEpoch) {
   const file = leftoverReceiptPath(commonDir, manifestSha256, candidate.id);
-  import_node_fs54.default.mkdirSync(import_node_path67.default.dirname(file), { recursive: true });
+  import_node_fs54.default.mkdirSync(import_node_path68.default.dirname(file), { recursive: true });
   writeFileAtomically(
     file,
     canonicalJson({
@@ -30834,13 +31134,13 @@ function writeLeftoverReceipt(commonDir, manifestSha256, candidate, steps, nowEp
     })
   );
 }
-var import_node_child_process39, import_node_fs54, import_node_path67, LEFTOVER_MANIFEST_KIND, LEFTOVER_RECEIPT_KIND, SCHEMA_VERSION2, MAX_DOCKER_OBJECTS, FUTURE_TOLERANCE_SECONDS2, PROJECT_LABEL, WORKING_DIR_LABEL, PROVIDER_LABEL, STOPPED_STATES, HEX_ID2, DockerListingBoundError, defaultDockerRunner, LeftoverSkip, defaultWithLocks;
+var import_node_child_process41, import_node_fs54, import_node_path68, LEFTOVER_MANIFEST_KIND, LEFTOVER_RECEIPT_KIND, SCHEMA_VERSION2, MAX_DOCKER_OBJECTS, FUTURE_TOLERANCE_SECONDS2, PROJECT_LABEL, WORKING_DIR_LABEL, PROVIDER_LABEL, STOPPED_STATES, HEX_ID2, DockerListingBoundError, defaultDockerRunner, LeftoverSkip, defaultWithLocks;
 var init_docker_leftovers = __esm({
   "src/core/docker-leftovers.ts"() {
     "use strict";
-    import_node_child_process39 = require("child_process");
+    import_node_child_process41 = require("child_process");
     import_node_fs54 = __toESM(require("fs"));
-    import_node_path67 = __toESM(require("path"));
+    import_node_path68 = __toESM(require("path"));
     init_atomic_file();
     init_devpod_mutation();
     init_devpod_workspaces();
@@ -30861,7 +31161,7 @@ var init_docker_leftovers = __esm({
     DockerListingBoundError = class extends Error {
     };
     defaultDockerRunner = (args) => {
-      const result = (0, import_node_child_process39.spawnSync)("docker", args, {
+      const result = (0, import_node_child_process41.spawnSync)("docker", args, {
         encoding: "utf-8",
         timeout: 6e4,
         maxBuffer: 256 * 1024 * 1024
@@ -30924,7 +31224,7 @@ function measureWorktreeConsumption(worktreePath, options) {
         timedOut = true;
         break;
       }
-      const entryPath = import_node_path68.default.join(dirPath, entry.name);
+      const entryPath = import_node_path69.default.join(dirPath, entry.name);
       let entryStat;
       try {
         entryStat = import_node_fs55.default.lstatSync(entryPath);
@@ -31001,12 +31301,12 @@ function describeError(error, worktreePath) {
   }
   return `could not stat worktree path '${worktreePath}': ${error?.message ?? String(error)}`;
 }
-var import_node_fs55, import_node_path68, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
+var import_node_fs55, import_node_path69, DEFAULT_DEADLINE_MS, BLOCK_SIZE_BYTES;
 var init_workspace_consumption = __esm({
   "src/core/workspace-consumption.ts"() {
     "use strict";
     import_node_fs55 = __toESM(require("fs"));
-    import_node_path68 = __toESM(require("path"));
+    import_node_path69 = __toESM(require("path"));
     init_devpod_environment();
     DEFAULT_DEADLINE_MS = 1e4;
     BLOCK_SIZE_BYTES = 512;
@@ -31680,7 +31980,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
       containers2 = measureContainersFn(worktreePaths);
     } catch (error) {
       const reason = `container measurement failed: ${describeCause(error)}`;
-      containers2 = new Map(worktreePaths.map((path72) => [path72, unknownContainers(reason)]));
+      containers2 = new Map(worktreePaths.map((path73) => [path73, unknownContainers(reason)]));
     }
   }
   const rows2 = records.map((record5) => {
@@ -31739,7 +32039,7 @@ function buildWorkspaceCleanupReport(options = {}, dependencies = {}) {
     dependencies.listForge ?? ((identity2) => listForgeChanges(identity2))
   );
   const sources = (dependencies.readRuntimeSources ?? readRuntimeSources)(repoPath);
-  const disposable = import_node_fs56.default.existsSync(import_node_path69.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
+  const disposable = import_node_fs56.default.existsSync(import_node_path70.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
   const [primary, ...linked] = worktrees;
   const safetyFor = (worktree, worktreePath, evidence) => toSafety(
     classify({
@@ -31808,7 +32108,7 @@ function readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies) {
   }
   const sources = (dependencies.readRuntimeSources ?? readRuntimeSources)(repoPath);
   const cutoffEpoch = Math.floor(Date.now() / 1e3) - parseInactiveFor(inactiveFor).seconds;
-  const gitDir = (0, import_node_child_process40.spawnSync)(
+  const gitDir = (0, import_node_child_process42.spawnSync)(
     "git",
     ["-C", worktreePath, "rev-parse", "--path-format=absolute", "--git-dir"],
     { encoding: "utf-8", env: READ_ONLY_GIT_ENV2 }
@@ -31854,7 +32154,7 @@ function prepareReclaimVerdicts(repo, inactiveFor, dependencies = {}) {
     dependencies.listForge ?? ((identity2) => listForgeChanges(identity2))
   );
   const forge = evidence.status === "not-checked" ? { status: "unavailable", reason: "forge not checked" } : evidence;
-  const disposable = import_node_fs56.default.existsSync(import_node_path69.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
+  const disposable = import_node_fs56.default.existsSync(import_node_path70.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees?.disposable ?? [] : [];
   const paths = evidenceCache(
     (worktreePath) => readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies)
   );
@@ -31873,7 +32173,7 @@ function prepareReclaimVerdicts(repo, inactiveFor, dependencies = {}) {
 }
 function prepareTrimChecks(repo, inactiveFor, dependencies = {}) {
   const repoPath = resolveRepoPath(repo);
-  const configured = import_node_fs56.default.existsSync(import_node_path69.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
+  const configured = import_node_fs56.default.existsSync(import_node_path70.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
   const patterns = configured?.trim ?? [];
   const paths = evidenceCache(
     (worktreePath) => readPathEvidence(repoPath, worktreePath, inactiveFor, dependencies)
@@ -31898,13 +32198,13 @@ function prepareTrimChecks(repo, inactiveFor, dependencies = {}) {
     isActive: (worktreePath) => paths.last(worktreePath).active
   };
 }
-var import_node_child_process40, import_node_fs56, import_node_path69, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
+var import_node_child_process42, import_node_fs56, import_node_path70, DEFAULT_INACTIVE_FOR, READ_ONLY_GIT_ENV2, ACTIVITY_SOURCES, defaultCommandRunner;
 var init_workspace_cleanup = __esm({
   "src/core/workspace-cleanup.ts"() {
     "use strict";
-    import_node_child_process40 = require("child_process");
+    import_node_child_process42 = require("child_process");
     import_node_fs56 = __toESM(require("fs"));
-    import_node_path69 = __toESM(require("path"));
+    import_node_path70 = __toESM(require("path"));
     init_devpod_workspaces();
     init_docker_leftovers();
     init_forge_changes();
@@ -31927,7 +32227,7 @@ var init_workspace_cleanup = __esm({
     ];
     defaultCommandRunner = (command, args, input2) => {
       const environment = command === "git" ? READ_ONLY_GIT_ENV2 : { ...process.env, LC_ALL: "C" };
-      const result = (0, import_node_child_process40.spawnSync)(command, args, {
+      const result = (0, import_node_child_process42.spawnSync)(command, args, {
         encoding: "utf-8",
         env: environment,
         ...input2 === void 0 ? {} : { input: input2 }
@@ -32021,20 +32321,20 @@ function warnMissingWorkspaceOwnership(repoPath) {
   );
 }
 function defaultWorktreePath(mainRepo, ws) {
-  return import_node_path70.default.join(mainRepo, "trees", ws);
+  return import_node_path71.default.join(mainRepo, "trees", ws);
 }
 function assertDefaultWorktreeRootIgnored(mainRepo) {
-  const ignored = (0, import_node_child_process41.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
+  const ignored = (0, import_node_child_process43.spawnSync)("git", ["-C", mainRepo, "check-ignore", "-q", "--no-index", "trees/"], {
     encoding: "utf-8"
   });
   if (ignored.status !== 0) {
     throw new Error(
-      `Default worktree root '${import_node_path70.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path70.default.join(mainRepo, ".gitignore")}' or use --path.`
+      `Default worktree root '${import_node_path71.default.join(mainRepo, "trees")}' is not ignored. Add 'trees/' to '${import_node_path71.default.join(mainRepo, ".gitignore")}' or use --path.`
     );
   }
 }
 function legacyDefaultWorktreePath(mainRepo, ws) {
-  return import_node_path70.default.join(import_node_path70.default.dirname(mainRepo), `${import_node_path70.default.basename(mainRepo)}-${ws}`);
+  return import_node_path71.default.join(import_node_path71.default.dirname(mainRepo), `${import_node_path71.default.basename(mainRepo)}-${ws}`);
 }
 function teardownFallbackPath(mainRepo, workspace) {
   const candidates = [
@@ -32180,7 +32480,7 @@ async function workspaceUp(branch, opts = {}) {
     const generatedPath = candidatePaths.find(
       (candidate) => !import_node_fs57.default.existsSync(candidate) && !worktrees.some((worktree) => sameWorkspacePath(worktree.path, candidate))
     );
-    const selectedPath = opts.path ? import_node_path70.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
+    const selectedPath = opts.path ? import_node_path71.default.resolve(opts.path) : existingBranch?.path ?? generatedPath;
     if (!selectedPath) {
       throw new Error(`Could not allocate a collision-safe worktree path for branch '${branch}'.`);
     }
@@ -32208,11 +32508,11 @@ async function workspaceUp(branch, opts = {}) {
       return selectedPath;
     }
     if (!opts.path) assertDefaultWorktreeRootIgnored(mainRepo);
-    const add = (0, import_node_child_process41.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
+    const add = (0, import_node_child_process43.spawnSync)("git", ["-C", mainRepo, "worktree", "add", selectedPath, branch], {
       encoding: "utf-8"
     });
     if (add.status !== 0) {
-      const addNew = (0, import_node_child_process41.spawnSync)(
+      const addNew = (0, import_node_child_process43.spawnSync)(
         "git",
         ["-C", mainRepo, "worktree", "add", "-b", branch, selectedPath],
         { encoding: "utf-8" }
@@ -32353,7 +32653,7 @@ async function runWorkspaceLifecycle(action2, target, opts = {}) {
     const result = await mutateWorkspaceRuntime("delete", resolved2, worktrees, opts.quiet);
     if (removeWorktree) {
       if (resolved2.worktree && !resolved2.worktree.prunable && import_node_fs57.default.existsSync(resolved2.worktreePath)) {
-        const rm = (0, import_node_child_process41.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved2.worktreePath], {
+        const rm = (0, import_node_child_process43.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", resolved2.worktreePath], {
           encoding: "utf-8"
         });
         if (rm.status !== 0) {
@@ -32397,7 +32697,7 @@ async function reclaimWorktreeExactPath(mainRepo, worktreePath, verify, afterRem
       );
       steps.push("runtime-deleted");
     }
-    const rm = (0, import_node_child_process41.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", worktreePath], {
+    const rm = (0, import_node_child_process43.spawnSync)("git", ["-C", mainRepo, "worktree", "remove", worktreePath], {
       encoding: "utf-8"
     });
     if (rm.status !== 0) {
@@ -32418,13 +32718,13 @@ async function workspaceStop(target, opts = {}) {
 async function workspaceDown(target, opts = {}) {
   return runWorkspaceLifecycle("down", target, opts);
 }
-var import_node_child_process41, import_node_fs57, import_node_path70, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
+var import_node_child_process43, import_node_fs57, import_node_path71, WORKSPACE_ALLOCATION_LOCK_WAIT_MS;
 var init_workspace_lifecycle = __esm({
   "src/core/workspace-lifecycle.ts"() {
     "use strict";
-    import_node_child_process41 = require("child_process");
+    import_node_child_process43 = require("child_process");
     import_node_fs57 = __toESM(require("fs"));
-    import_node_path70 = __toESM(require("path"));
+    import_node_path71 = __toESM(require("path"));
     init_devpod_mutation();
     init_devpod_workspaces();
     init_devsy_mutation();
@@ -32443,7 +32743,7 @@ var init_workspace_lifecycle = __esm({
 
 // src/core/worktree-trim.ts
 function listIgnoredPaths(worktreePath) {
-  const result = (0, import_node_child_process42.spawnSync)(
+  const result = (0, import_node_child_process44.spawnSync)(
     "git",
     [
       "-C",
@@ -32527,8 +32827,8 @@ function buildTrimManifest(report, patterns, createdAtEpoch) {
   return canonicalJson(manifest);
 }
 function isInside(parent, child) {
-  const relative2 = import_node_path71.default.relative(parent, child);
-  return relative2 !== "" && !relative2.startsWith("..") && !import_node_path71.default.isAbsolute(relative2);
+  const relative2 = import_node_path72.default.relative(parent, child);
+  return relative2 !== "" && !relative2.startsWith("..") && !import_node_path72.default.isAbsolute(relative2);
 }
 function exists(file) {
   try {
@@ -32539,7 +32839,7 @@ function exists(file) {
   }
 }
 function hasTrackedFiles(worktreePath, relative2) {
-  const result = (0, import_node_child_process42.spawnSync)(
+  const result = (0, import_node_child_process44.spawnSync)(
     "git",
     ["-C", worktreePath, "--literal-pathspecs", "ls-files", "-z", "--", relative2],
     { encoding: "utf-8", env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" } }
@@ -32547,7 +32847,7 @@ function hasTrackedFiles(worktreePath, relative2) {
   return result.status !== 0 || Boolean(result.error) || result.stdout.length > 0;
 }
 function trimOnePath(candidate, relative2, patterns, steps) {
-  const target = import_node_path71.default.join(candidate.path, relative2);
+  const target = import_node_path72.default.join(candidate.path, relative2);
   let stat;
   try {
     stat = import_node_fs58.default.lstatSync(target);
@@ -32615,7 +32915,7 @@ async function applyTrimManifest(options, dependencies) {
       continue;
     }
     const listed = candidate.paths ?? [];
-    if (listed.every((relative2) => !exists(import_node_path71.default.join(candidate.path, relative2))) && matchingReceipt(candidate, manifestSha256)) {
+    if (listed.every((relative2) => !exists(import_node_path72.default.join(candidate.path, relative2))) && matchingReceipt(candidate, manifestSha256)) {
       outcome.status = "already-done";
       continue;
     }
@@ -32639,7 +32939,7 @@ async function applyTrimManifest(options, dependencies) {
       if (!options.yes) {
         verify();
         outcome.status = "would-trim";
-        const present = listed.filter((relative2) => exists(import_node_path71.default.join(candidate.path, relative2)));
+        const present = listed.filter((relative2) => exists(import_node_path72.default.join(candidate.path, relative2)));
         outcome.reason = present.length ? `would remove: ${present.join(", ")}` : "nothing present";
         continue;
       }
@@ -32676,13 +32976,13 @@ async function applyTrimManifest(options, dependencies) {
   }
   return { manifestSha256, dryRun: !options.yes, targets, stoppedEarly };
 }
-var import_node_child_process42, import_node_fs58, import_node_path71;
+var import_node_child_process44, import_node_fs58, import_node_path72;
 var init_worktree_trim = __esm({
   "src/core/worktree-trim.ts"() {
     "use strict";
-    import_node_child_process42 = require("child_process");
+    import_node_child_process44 = require("child_process");
     import_node_fs58 = __toESM(require("fs"));
-    import_node_path71 = __toESM(require("path"));
+    import_node_path72 = __toESM(require("path"));
     init_reliability_lifecycle();
     init_worktree_reclaim();
     init_worktree_safety();
@@ -32778,7 +33078,7 @@ function runWorkspaceCleanupCommand(options) {
       throw new Error("--manifest requires --all-worktrees and --check-merged.");
     }
     const createdAtEpoch = Math.floor(Date.now() / 1e3);
-    const worktrees = import_node_fs59.default.existsSync(import_node_path72.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
+    const worktrees = import_node_fs59.default.existsSync(import_node_path73.default.join(repoPath, ".devrouter.yml")) ? loadRepoConfig(repoPath).worktrees : void 0;
     const manifest = action2 === "trim" ? buildTrimManifest(
       report,
       { trim: worktrees?.trim ?? [], disposable: worktrees?.disposable },
@@ -32872,13 +33172,34 @@ function runWorkspaceLeftoverCommand(options) {
       {
         dryRun: report.dryRun,
         stoppedEarly: false,
-        targets: report.targets.map((target) => ({ ...target, path: target.project }))
+        targets: report.targets.map((target) => ({
+          ...target,
+          path: target.project,
+          steps: summarizeLeftoverSteps(target.steps)
+        }))
       },
       "remove the leftovers"
     );
+    if (!report.dryRun && report.targets.some((target) => target.steps.length)) {
+      process.stdout.write(
+        "Each removed object is listed in the stack's receipt; use --json for the full list.\n"
+      );
+    }
   }
   if (report.targets.some((target) => target.status === "failed")) process.exitCode = 1;
 }
+function summarizeLeftoverSteps(steps) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const step of steps) {
+    const [action2, kind] = step.slice(0, step.indexOf(":")).split("-");
+    const byKind = counts.get(action2) ?? /* @__PURE__ */ new Map();
+    byKind.set(kind, (byKind.get(kind) ?? 0) + 1);
+    counts.set(action2, byKind);
+  }
+  return [...counts].map(
+    ([action2, byKind]) => `${action2 === "gone" ? "already gone" : action2} ${[...byKind].map(([kind, count]) => `${count} ${kind}(s)`).join(", ")}`
+  );
+}
 function runWorkspaceManifestSelectCommand(file, options) {
   process.stdout.write(selectManifest(file, options.expectedSha256, options.id));
 }
@@ -32927,12 +33248,12 @@ async function runWorkspaceTrimCommand(options) {
     process.exitCode = 1;
   }
 }
-var import_node_fs59, import_node_path72;
+var import_node_fs59, import_node_path73;
 var init_workspace2 = __esm({
   "src/commands/workspace.ts"() {
     "use strict";
     import_node_fs59 = __toESM(require("fs"));
-    import_node_path72 = __toESM(require("path"));
+    import_node_path73 = __toESM(require("path"));
     init_docker_leftovers();
     init_output();
     init_repo_config();
@@ -32985,7 +33306,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.3.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.4.0" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {
@@ -33111,6 +33432,15 @@ program.command("exec").description("Run one literal command inside the exact ch
     await runExecCommand2(invocation);
   })
 );
+program.command("env").description(
+  "Report one checkout's host-reachable URLs, TCP endpoints and CA path, or run a host command with them"
+).argument("[args...]", "[path] [--json] | [path] -- <command...>").allowUnknownOption(true).action(
+  withErrorHandling(async () => {
+    const commandIndex = process.argv.indexOf("env", 2);
+    const { parseEnvInvocation: parseEnvInvocation2, runEnvCommand: runEnvCommand2 } = await Promise.resolve().then(() => (init_env(), env_exports));
+    await runEnvCommand2(parseEnvInvocation2(process.argv.slice(commandIndex + 1)));
+  })
+);
 program.command("down").description("Stop the shared Traefik router stack").action(
   withErrorHandling(async () => {
     const { runDownCommand: runDownCommand2 } = await Promise.resolve().then(() => (init_down(), down_exports));
@@ -33447,10 +33777,10 @@ workspaceCommand2.command("down").description("Delete a workspace's runtime and
 workspaceCommand2.command("journal").description("Inspect and recover workspace lifecycle journals").command("settle").description(
   "Settle an interrupted lifecycle operation as unobservable so ensure and stop can proceed"
 ).argument("[path]", "Checkout path (defaults to current directory)").option("--json", "Output JSON").action(
-  withErrorHandling(async (path72, _options, command) => {
+  withErrorHandling(async (path73, _options, command) => {
     const options = command.opts();
     const { runWorkspaceJournalSettleCommand: runWorkspaceJournalSettleCommand2 } = await Promise.resolve().then(() => (init_workspace2(), workspace_exports));
-    await runWorkspaceJournalSettleCommand2({ ...path72 ? { path: path72 } : {}, ...options });
+    await runWorkspaceJournalSettleCommand2({ ...path73 ? { path: path73 } : {}, ...options });
   })
 );
 function parseVersionRequest(argv) {