@devrouter/cli 0.5.1 → 0.5.3

package/dist/devrouter-lifecycle-worker.js

@@ -936,6 +936,20 @@ function hasExactComposeIdentity(container, options) {
   const actualFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim()).filter(Boolean);
   const providerGeneratedFiles = actualFiles.filter((file) => {
     const normalized = file.replaceAll("\\", "/");
+    if (process.env.DEVPOD_HOME) {
+      const relative = import_node_path4.default.relative(import_node_path4.default.resolve(process.env.DEVPOD_HOME), file).replaceAll("\\", "/");
+      if (/^agent\/contexts\/[^/]+\/workspaces\/[^/]+\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
+        relative
+      ))
+        return true;
+    }
+    if (process.env.DEVSY_HOME) {
+      const relative = import_node_path4.default.relative(import_node_path4.default.resolve(process.env.DEVSY_HOME), file).replaceAll("\\", "/");
+      if (/^contexts\/[^/]+\/workspaces\/[^/]+\/agent\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
+        relative
+      ))
+        return true;
+    }
     return /\/(?:\.devpod\/agent\/contexts\/[^/]+\/workspaces\/[^/]+|\.devsy\/contexts\/[^/]+\/workspaces\/[^/]+\/agent)\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
       normalized
     );
@@ -2192,7 +2206,7 @@ function installedVersionOutput() {
   return [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || void 0;
 }
 function nativeAssetName(platform, arch) {
-  if (platform !== "darwin") return void 0;
+  if (platform !== "darwin" && platform !== "linux") return void 0;
   if (arch === "arm64") return "devsy-linux-arm64";
   if (arch === "x64") return "devsy-linux-amd64";
   return void 0;
@@ -5383,7 +5397,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.5.1" : "0.0.0-dev";
+  return true ? "0.5.3" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -7393,7 +7407,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs19.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.5.1" : "0.0.0-dev";
+    const cliVersion = true ? "0.5.3" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -11325,10 +11339,33 @@ var DEFAULT_OUTPUT_PAGE_BYTES = 48 * 1024;
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
-    return false;
   } catch (error) {
     return error.code === "ESRCH";
   }
+  if (process.platform !== "linux") return false;
+  let observedZombie = false;
+  try {
+    for (const entry of import_node_fs29.default.readdirSync("/proc")) {
+      if (!/^\d+$/.test(entry)) continue;
+      let stat;
+      try {
+        stat = import_node_fs29.default.readFileSync(`/proc/${entry}/stat`, "utf8");
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        return false;
+      }
+      const end = stat.lastIndexOf(")");
+      if (end < 0) return false;
+      const fields2 = stat.slice(end + 1).trim().split(/\s+/);
+      if (!/^\d+$/.test(fields2[2] ?? "") || !/^[A-Za-z]$/.test(fields2[0] ?? "")) return false;
+      if (Number(fields2[2]) !== pid) continue;
+      if (fields2[0] !== "Z") return false;
+      observedZombie = true;
+    }
+  } catch {
+    return false;
+  }
+  return observedZombie;
 }
 
 // src/core/workspace-ensure.ts

package/dist/devrouter.js

@@ -1067,6 +1067,20 @@ function hasExactComposeIdentity(container, options) {
   const actualFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim()).filter(Boolean);
   const providerGeneratedFiles = actualFiles.filter((file) => {
     const normalized = file.replaceAll("\\", "/");
+    if (process.env.DEVPOD_HOME) {
+      const relative2 = import_node_path4.default.relative(import_node_path4.default.resolve(process.env.DEVPOD_HOME), file).replaceAll("\\", "/");
+      if (/^agent\/contexts\/[^/]+\/workspaces\/[^/]+\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
+        relative2
+      ))
+        return true;
+    }
+    if (process.env.DEVSY_HOME) {
+      const relative2 = import_node_path4.default.relative(import_node_path4.default.resolve(process.env.DEVSY_HOME), file).replaceAll("\\", "/");
+      if (/^contexts\/[^/]+\/workspaces\/[^/]+\/agent\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
+        relative2
+      ))
+        return true;
+    }
     return /\/(?:\.devpod\/agent\/contexts\/[^/]+\/workspaces\/[^/]+|\.devsy\/contexts\/[^/]+\/workspaces\/[^/]+\/agent)\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
       normalized
     );
@@ -4774,7 +4788,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs8.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.5.1" : "0.0.0-dev";
+    const cliVersion = true ? "0.5.3" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -6773,7 +6787,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.5.1" : "0.0.0-dev";
+  return true ? "0.5.3" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -10596,7 +10610,7 @@ function installedVersionOutput() {
   return [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || void 0;
 }
 function nativeAssetName(platform, arch) {
-  if (platform !== "darwin") return void 0;
+  if (platform !== "darwin" && platform !== "linux") return void 0;
   if (arch === "arm64") return "devsy-linux-arm64";
   if (arch === "x64") return "devsy-linux-amd64";
   return void 0;
@@ -15530,6 +15544,12 @@ var init_reliability_model = __esm({
 function isLifecycleProgressPhase(value) {
   return typeof value === "string" && Object.hasOwn(ROLES, value);
 }
+function muteLifecycleProgressHeartbeat() {
+  heartbeatMuted = true;
+}
+function lifecycleProgressHeartbeatMuted() {
+  return heartbeatMuted;
+}
 function lifecycleProgressSnapshot(phase, receivedAt, now) {
   const elapsedMs = receivedAt === void 0 ? null : Math.max(0, Math.floor(now - receivedAt));
   return {
@@ -15541,7 +15561,7 @@ function lifecycleProgressSnapshot(phase, receivedAt, now) {
     liveness: "unknown"
   };
 }
-var ROLES;
+var ROLES, heartbeatMuted;
 var init_lifecycle_progress = __esm({
   "src/core/lifecycle-progress.ts"() {
     "use strict";
@@ -15559,6 +15579,7 @@ var init_lifecycle_progress = __esm({
       rollback: "lifecycle-worker",
       stop: "lifecycle-stop"
     };
+    heartbeatMuted = false;
   }
 });
 
@@ -15579,10 +15600,33 @@ function hasDuplicateOperation(record5, requestId, operationId) {
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
-    return false;
   } catch (error) {
     return error.code === "ESRCH";
   }
+  if (process.platform !== "linux") return false;
+  let observedZombie = false;
+  try {
+    for (const entry of import_node_fs31.default.readdirSync("/proc")) {
+      if (!/^\d+$/.test(entry)) continue;
+      let stat;
+      try {
+        stat = import_node_fs31.default.readFileSync(`/proc/${entry}/stat`, "utf8");
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        return false;
+      }
+      const end = stat.lastIndexOf(")");
+      if (end < 0) return false;
+      const fields2 = stat.slice(end + 1).trim().split(/\s+/);
+      if (!/^\d+$/.test(fields2[2] ?? "") || !/^[A-Za-z]$/.test(fields2[0] ?? "")) return false;
+      if (Number(fields2[2]) !== pid) continue;
+      if (fields2[0] !== "Z") return false;
+      observedZombie = true;
+    }
+  } catch {
+    return false;
+  }
+  return observedZombie;
 }
 function signalOwnedGroup(child, signal) {
   if (!child.pid || child.exitCode !== null || child.signalCode !== null) return;
@@ -15620,7 +15664,7 @@ async function runLifecycleWorker(request2, supervision, beforeAdmission) {
   let progressReceivedAt;
   let progressTimer;
   const emitProgress = () => {
-    if (closed || cancelled || request2.kind === "exec") return;
+    if (closed || cancelled || request2.kind === "exec" || lifecycleProgressHeartbeatMuted()) return;
     const data = `${JSON.stringify(lifecycleProgressSnapshot(progressPhase, progressReceivedAt, performance.now()))}
 `;
     try {
@@ -22349,7 +22393,7 @@ function buildOnboardingPrompt(options = {}) {
     "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not detect or prevent OOM; bounded automatic recovery runs only when the operator enables the capacity recovery policy.",
     "- Capacity admission is opt-in: only an operator-enabled capacity policy with an enrolled checkout routes ensure and exec through controller admission. The CLI follows the decision with bounded reconnecting waits that survive controller restarts, worker results are journalled atomically, and stop bypasses admission. Without an enabled policy lifecycle behavior is unchanged. An optional recovery block adds bounded automatic recovery: one journal-admitted corrective ensure per positively failed required capability, bounded by per-scope restart counts, an aggregate corrective-action cap and a rolling observation window. It is inert unless enabled.",
     "- A lock that cannot prove its owner fails closed with the failing inspection stage, the exact lock path, and a portable reproduction command; run the canonical command in a permitted host context. No identity fallback is attempted, and `devrouter controller` prints the underlying cause on stderr while keeping the stable `controller-unavailable` JSON on stdout.",
-    "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once per installed Devsy release, rerunning it after a Devsy update, so Devrouter acquires and verifies the official Linux agent in its own machine cache. Devrouter supports releases in the range >=1.16.2 <2.0.0, verifies a release's published asset against the SHA-256 digest GitHub reports, and never injects a release without one. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access; a supported release with no recorded manifest is `ready` with a drift warning and no injected agent until `setup` records one, while a version outside the supported range or unparseable stays `stale`. `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match the official asset for the installed supported release. `ensure` and `stop` stream bounded phase progress on stderr, so parse command JSON from stdout only.",
+    "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once per installed Devsy release, rerunning it after a Devsy update, so Devrouter acquires and verifies the official Linux agent in its own machine cache. Devrouter selects agents on macOS and Linux arm64/x64 hosts. Use Devsy 1.16.2 for warm profile changes; 1.23.2 refuses changed runServices without recreation, which devrouter never applies automatically. Devrouter supports agent releases in the range >=1.16.2 <2.0.0, verifies a release's published asset against the SHA-256 digest GitHub reports, and never injects a release without one. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access; a supported release with no recorded manifest is `ready` with a drift warning and no injected agent until `setup` records one, while a version outside the supported range or unparseable stays `stale`. `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match the official asset for the installed supported release. `ensure` and `stop` stream bounded phase progress on stderr, so parse command JSON from stdout only.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Managed adapters may use devrouter-process ensure --prepare-command <command> for synchronous dependency preparation under the process lock before app launch. Unchanged owned processes skip preparation; it participates in default fingerprints and must not daemonize or detach.",
@@ -24479,7 +24523,7 @@ function probeInstalledCliVersion(executable) {
 }
 function buildCliPathCheck(options = {}) {
   const id5 = "global.cli-path";
-  const runningVersion = options.runningVersion ?? (true ? "0.5.1" : "0.0.0-dev");
+  const runningVersion = options.runningVersion ?? (true ? "0.5.3" : "0.0.0-dev");
   if (runningVersion === "0.0.0-dev") {
     return {
       id: id5,
@@ -25375,7 +25419,7 @@ async function buildDoctorReport(options = {}) {
           suggestion: `Remedy ${expansionNotice.remedy.code}: set a named default profile other than '${expansionNotice.profile}'${remedyCandidates}.`
         });
       }
-      const cliVersion = true ? "0.5.1" : "0.0.0-dev";
+      const cliVersion = true ? "0.5.3" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       const installedKnown = cliVersion !== "0.0.0-dev";
       const versionComparison = installedKnown && configVersion ? compareSemver(configVersion, cliVersion) : void 0;
@@ -33775,6 +33819,7 @@ async function runWorkspaceIdleCommand(options) {
   let stops = [];
   if (options.stop) {
     const paths = idleSweepPaths();
+    if (!process.stderr.isTTY) muteLifecycleProgressHeartbeat();
     import_node_fs61.default.mkdirSync(paths.directory, { recursive: true, mode: 448 });
     const result = await withFileLock(paths.lock, { activity: "idle sweep" }, async () => {
       try {
@@ -33983,6 +34028,7 @@ var init_workspace2 = __esm({
     init_docker_leftovers();
     init_file_lock();
     init_idle_sweep();
+    init_lifecycle_progress();
     init_output();
     init_reliability_lifecycle();
     init_repo_config();
@@ -34036,7 +34082,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.5.1" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.5.3" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.5.2.md

@@ -0,0 +1,25 @@
+# Upgrade to devrouter 0.5.2
+
+This patch release keeps the idle-stop agent's `sweep.log` readable.
+`workspace idle --stop` no longer writes a lifecycle progress line every ten
+seconds of each stop when its stderr is not a terminal, as under launchd, so
+the log records only stop outcomes and errors. An interactive sweep still shows
+progress. There is no configuration change and no migration.
+
+## Task
+
+Install the published 0.5.2 CLI. No repository change is needed. Bump a
+repository's `devrouter.version` to 0.5.2 only when consumer source changes are
+authorized. A machine that uses the idle-stop agent needs no setup rerun when
+devrouter is installed through Volta, because the agent's entry path does not
+change between versions.
+
+## Validation
+
+1. Run `devrouter -V` from the consumer checkout.
+2. Run `devrouter workspace idle --json` and confirm it completes.
+
+## Report
+
+Report the release revision and the resolved executable with its installed
+version.

package/upgrade-prompts/0.5.3.md

@@ -0,0 +1,36 @@
+# Upgrade to devrouter 0.5.3
+
+This patch release supports verified Devsy agents on Linux arm64/x64,
+custom DevPod and Devsy runtime homes, and drainage of Linux process groups
+proven to contain only zombies. There is no configuration schema migration.
+
+## Task
+
+Install the published 0.5.3 CLI. Bump a consumer's `devrouter.version` only when
+consumer source changes are authorized. Preserve exact checkout ownership,
+containers, databases, dependency volumes, and existing runtime directories.
+Changing the machine preference does not migrate a DevPod-owned checkout.
+
+For Devsy, run `devrouter setup --yes --workspace-runtime devsy` to verify the
+installed release's official Linux agent. Pin Devsy 1.16.2 when warm profile
+changes are needed: 1.23.2 rejects a changed `runServices` list as structural.
+Do not follow its recreation suggestion on a retained environment. Keep any
+explicit `DEVSY_AGENT_BINARY` consistent with the installed Devsy release.
+
+## Validation
+
+1. Run `devrouter -V` from the consumer checkout and confirm 0.5.3.
+2. Run `devrouter doctor --json` and inspect runtime ownership and agent readiness.
+3. Run `devrouter ensure .` with the consumer's intended profile, then an existing
+   smoke or browser test. Do not replay destructive bootstrap hooks for a
+   retained database just to test an upgrade.
+4. If testing profile changes or stop/resume, verify the exact container and
+   volumes are retained. Never bypass lifecycle fences or edit ownership records.
+
+A zombie lifecycle worker retaining its recorded birth identity remains a
+known recovery limitation on hosts whose PID 1 does not reap children.
+
+## Report
+
+Report the published version and resolved executable, selected runtime and
+version, tested profile and functional outcomes, and any remaining limitations.