@devrouter/cli 0.5.2 → 0.5.4

package/dist/devrouter-lifecycle-worker.js

@@ -936,6 +936,20 @@ function hasExactComposeIdentity(container, options) {
   const actualFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim()).filter(Boolean);
   const providerGeneratedFiles = actualFiles.filter((file) => {
     const normalized = file.replaceAll("\\", "/");
+    if (process.env.DEVPOD_HOME) {
+      const relative = import_node_path4.default.relative(import_node_path4.default.resolve(process.env.DEVPOD_HOME), file).replaceAll("\\", "/");
+      if (/^agent\/contexts\/[^/]+\/workspaces\/[^/]+\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
+        relative
+      ))
+        return true;
+    }
+    if (process.env.DEVSY_HOME) {
+      const relative = import_node_path4.default.relative(import_node_path4.default.resolve(process.env.DEVSY_HOME), file).replaceAll("\\", "/");
+      if (/^contexts\/[^/]+\/workspaces\/[^/]+\/agent\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
+        relative
+      ))
+        return true;
+    }
     return /\/(?:\.devpod\/agent\/contexts\/[^/]+\/workspaces\/[^/]+|\.devsy\/contexts\/[^/]+\/workspaces\/[^/]+\/agent)\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
       normalized
     );
@@ -2192,7 +2206,7 @@ function installedVersionOutput() {
   return [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || void 0;
 }
 function nativeAssetName(platform, arch) {
-  if (platform !== "darwin") return void 0;
+  if (platform !== "darwin" && platform !== "linux") return void 0;
   if (arch === "arm64") return "devsy-linux-arm64";
   if (arch === "x64") return "devsy-linux-amd64";
   return void 0;
@@ -2738,7 +2752,7 @@ function assertManagedContainerConfigUnchanged(options) {
             cwd: workingDirectory,
             encoding: "utf-8",
             env,
-            input: rendered.stdout,
+            input: rendered.stdout.replaceAll("$$", "$"),
             stdio: ["pipe", "pipe", "ignore"],
             timeout: COMPOSE_HASH_TIMEOUT_MS,
             maxBuffer: 1024 * 1024
@@ -5383,7 +5397,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.5.2" : "0.0.0-dev";
+  return true ? "0.5.4" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -7393,7 +7407,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs19.default.rea
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.5.2" : "0.0.0-dev";
+    const cliVersion = true ? "0.5.4" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -11325,10 +11339,33 @@ var DEFAULT_OUTPUT_PAGE_BYTES = 48 * 1024;
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
-    return false;
   } catch (error) {
     return error.code === "ESRCH";
   }
+  if (process.platform !== "linux") return false;
+  let observedZombie = false;
+  try {
+    for (const entry of import_node_fs29.default.readdirSync("/proc")) {
+      if (!/^\d+$/.test(entry)) continue;
+      let stat;
+      try {
+        stat = import_node_fs29.default.readFileSync(`/proc/${entry}/stat`, "utf8");
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        return false;
+      }
+      const end = stat.lastIndexOf(")");
+      if (end < 0) return false;
+      const fields2 = stat.slice(end + 1).trim().split(/\s+/);
+      if (!/^\d+$/.test(fields2[2] ?? "") || !/^[A-Za-z]$/.test(fields2[0] ?? "")) return false;
+      if (Number(fields2[2]) !== pid) continue;
+      if (fields2[0] !== "Z") return false;
+      observedZombie = true;
+    }
+  } catch {
+    return false;
+  }
+  return observedZombie;
 }
 
 // src/core/workspace-ensure.ts

package/dist/devrouter.js

@@ -1067,6 +1067,20 @@ function hasExactComposeIdentity(container, options) {
   const actualFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").map((file) => file.trim()).filter(Boolean);
   const providerGeneratedFiles = actualFiles.filter((file) => {
     const normalized = file.replaceAll("\\", "/");
+    if (process.env.DEVPOD_HOME) {
+      const relative2 = import_node_path4.default.relative(import_node_path4.default.resolve(process.env.DEVPOD_HOME), file).replaceAll("\\", "/");
+      if (/^agent\/contexts\/[^/]+\/workspaces\/[^/]+\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
+        relative2
+      ))
+        return true;
+    }
+    if (process.env.DEVSY_HOME) {
+      const relative2 = import_node_path4.default.relative(import_node_path4.default.resolve(process.env.DEVSY_HOME), file).replaceAll("\\", "/");
+      if (/^contexts\/[^/]+\/workspaces\/[^/]+\/agent\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
+        relative2
+      ))
+        return true;
+    }
     return /\/(?:\.devpod\/agent\/contexts\/[^/]+\/workspaces\/[^/]+|\.devsy\/contexts\/[^/]+\/workspaces\/[^/]+\/agent)\/\.docker-compose\/docker-compose\.devcontainer\.containerFeatures-[^/]+\.yml$/.test(
       normalized
     );
@@ -4774,7 +4788,7 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs8.default.read
   const config = parseConfig(parsed ?? {}, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.5.2" : "0.0.0-dev";
+    const cliVersion = true ? "0.5.4" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -6773,7 +6787,7 @@ var init_reliability_contract = __esm({
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.5.2" : "0.0.0-dev";
+  return true ? "0.5.4" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -10596,7 +10610,7 @@ function installedVersionOutput() {
   return [result.stdout, result.stderr].filter(Boolean).join("\n").trim() || void 0;
 }
 function nativeAssetName(platform, arch) {
-  if (platform !== "darwin") return void 0;
+  if (platform !== "darwin" && platform !== "linux") return void 0;
   if (arch === "arm64") return "devsy-linux-arm64";
   if (arch === "x64") return "devsy-linux-amd64";
   return void 0;
@@ -11385,7 +11399,7 @@ function assertManagedContainerConfigUnchanged(options) {
             cwd: workingDirectory,
             encoding: "utf-8",
             env,
-            input: rendered.stdout,
+            input: rendered.stdout.replaceAll("$$", "$"),
             stdio: ["pipe", "pipe", "ignore"],
             timeout: COMPOSE_HASH_TIMEOUT_MS,
             maxBuffer: 1024 * 1024
@@ -15586,10 +15600,33 @@ function hasDuplicateOperation(record5, requestId, operationId) {
 function workerGroupAbsent(pid) {
   try {
     process.kill(-pid, 0);
-    return false;
   } catch (error) {
     return error.code === "ESRCH";
   }
+  if (process.platform !== "linux") return false;
+  let observedZombie = false;
+  try {
+    for (const entry of import_node_fs31.default.readdirSync("/proc")) {
+      if (!/^\d+$/.test(entry)) continue;
+      let stat;
+      try {
+        stat = import_node_fs31.default.readFileSync(`/proc/${entry}/stat`, "utf8");
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        return false;
+      }
+      const end = stat.lastIndexOf(")");
+      if (end < 0) return false;
+      const fields2 = stat.slice(end + 1).trim().split(/\s+/);
+      if (!/^\d+$/.test(fields2[2] ?? "") || !/^[A-Za-z]$/.test(fields2[0] ?? "")) return false;
+      if (Number(fields2[2]) !== pid) continue;
+      if (fields2[0] !== "Z") return false;
+      observedZombie = true;
+    }
+  } catch {
+    return false;
+  }
+  return observedZombie;
 }
 function signalOwnedGroup(child, signal) {
   if (!child.pid || child.exitCode !== null || child.signalCode !== null) return;
@@ -22356,7 +22393,7 @@ function buildOnboardingPrompt(options = {}) {
     "- Ensure reconciles interrupted or never-dispatched ensure after positive worker drainage. Unknown arbitrary exec never replays; use explicit stop to reconcile that uncertainty. Preserve journals and generated configuration if evidence is unavailable. This does not detect or prevent OOM; bounded automatic recovery runs only when the operator enables the capacity recovery policy.",
     "- Capacity admission is opt-in: only an operator-enabled capacity policy with an enrolled checkout routes ensure and exec through controller admission. The CLI follows the decision with bounded reconnecting waits that survive controller restarts, worker results are journalled atomically, and stop bypasses admission. Without an enabled policy lifecycle behavior is unchanged. An optional recovery block adds bounded automatic recovery: one journal-admitted corrective ensure per positively failed required capability, bounded by per-scope restart counts, an aggregate corrective-action cap and a rolling observation window. It is inert unless enabled.",
     "- A lock that cannot prove its owner fails closed with the failing inspection stage, the exact lock path, and a portable reproduction command; run the canonical command in a permitted host context. No identity fallback is attempted, and `devrouter controller` prints the underlying cause on stderr while keeping the stable `controller-unavailable` JSON on stdout.",
-    "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once per installed Devsy release, rerunning it after a Devsy update, so Devrouter acquires and verifies the official Linux agent in its own machine cache. Devrouter supports releases in the range >=1.16.2 <2.0.0, verifies a release's published asset against the SHA-256 digest GitHub reports, and never injects a release without one. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access; a supported release with no recorded manifest is `ready` with a drift warning and no injected agent until `setup` records one, while a version outside the supported range or unparseable stays `stale`. `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match the official asset for the installed supported release. `ensure` and `stop` stream bounded phase progress on stderr, so parse command JSON from stdout only.",
+    "- Devsy agent readiness: run `devrouter setup --yes --workspace-runtime devsy` once per installed Devsy release, rerunning it after a Devsy update, so Devrouter acquires and verifies the official Linux agent in its own machine cache. Devrouter selects agents on macOS and Linux arm64/x64 hosts. Use Devsy 1.16.2 for warm profile changes; 1.23.2 refuses changed runServices without recreation, which devrouter never applies automatically. Devrouter supports agent releases in the range >=1.16.2 <2.0.0, verifies a release's published asset against the SHA-256 digest GitHub reports, and never injects a release without one. `doctor` reports `ready`, `missing`, `stale`, or `invalid` without network access; a supported release with no recorded manifest is `ready` with a drift warning and no injected agent until `setup` records one, while a version outside the supported range or unparseable stays `stale`. `ensure` fails before the provider queue when readiness is not `ready`. An explicit `DEVSY_AGENT_BINARY` remains authoritative and must match the official asset for the installed supported release. `ensure` and `stop` stream bounded phase progress on stderr, so parse command JSON from stdout only.",
     "- A managed adapter plus `postCreateCommand` requires `waitFor` exactly `postCreateCommand` or `postStartCommand`; managed selective config preserves lifecycle fields and changes only `runServices`.",
     "- Managed process reuse fingerprints command argv, workspace identity, and the exact adapter snapshot. If a non-secret runtime value also affects reuse, set `DEVROUTER_PROCESS_FINGERPRINT_ENV` to its comma-separated environment names; secret-like names are rejected and raw values are never persisted.",
     "- Managed adapters may use devrouter-process ensure --prepare-command <command> for synchronous dependency preparation under the process lock before app launch. Unchanged owned processes skip preparation; it participates in default fingerprints and must not daemonize or detach.",
@@ -24486,7 +24523,7 @@ function probeInstalledCliVersion(executable) {
 }
 function buildCliPathCheck(options = {}) {
   const id5 = "global.cli-path";
-  const runningVersion = options.runningVersion ?? (true ? "0.5.2" : "0.0.0-dev");
+  const runningVersion = options.runningVersion ?? (true ? "0.5.4" : "0.0.0-dev");
   if (runningVersion === "0.0.0-dev") {
     return {
       id: id5,
@@ -25382,7 +25419,7 @@ async function buildDoctorReport(options = {}) {
           suggestion: `Remedy ${expansionNotice.remedy.code}: set a named default profile other than '${expansionNotice.profile}'${remedyCandidates}.`
         });
       }
-      const cliVersion = true ? "0.5.2" : "0.0.0-dev";
+      const cliVersion = true ? "0.5.4" : "0.0.0-dev";
       const configVersion = config.devrouter?.version;
       const installedKnown = cliVersion !== "0.0.0-dev";
       const versionComparison = installedKnown && configVersion ? compareSemver(configVersion, cliVersion) : void 0;
@@ -34045,7 +34082,7 @@ var init_version = __esm({
 
 // src/cli.ts
 var import_commander = require("commander");
-var CLI_VERSION = true ? "0.5.2" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.5.4" : "0.0.0-dev";
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["-V", "--version"]);
 function withErrorHandling(action2) {
   return async (...args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrouter/cli",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Local dev routing CLI with shared Traefik reverse proxy",
   "author": "Roland Schlaefli",
   "homepage": "https://github.com/rschlaefli/devrouter#readme",

package/upgrade-prompts/0.5.3.md

@@ -0,0 +1,36 @@
+# Upgrade to devrouter 0.5.3
+
+This patch release supports verified Devsy agents on Linux arm64/x64,
+custom DevPod and Devsy runtime homes, and drainage of Linux process groups
+proven to contain only zombies. There is no configuration schema migration.
+
+## Task
+
+Install the published 0.5.3 CLI. Bump a consumer's `devrouter.version` only when
+consumer source changes are authorized. Preserve exact checkout ownership,
+containers, databases, dependency volumes, and existing runtime directories.
+Changing the machine preference does not migrate a DevPod-owned checkout.
+
+For Devsy, run `devrouter setup --yes --workspace-runtime devsy` to verify the
+installed release's official Linux agent. Pin Devsy 1.16.2 when warm profile
+changes are needed: 1.23.2 rejects a changed `runServices` list as structural.
+Do not follow its recreation suggestion on a retained environment. Keep any
+explicit `DEVSY_AGENT_BINARY` consistent with the installed Devsy release.
+
+## Validation
+
+1. Run `devrouter -V` from the consumer checkout and confirm 0.5.3.
+2. Run `devrouter doctor --json` and inspect runtime ownership and agent readiness.
+3. Run `devrouter ensure .` with the consumer's intended profile, then an existing
+   smoke or browser test. Do not replay destructive bootstrap hooks for a
+   retained database just to test an upgrade.
+4. If testing profile changes or stop/resume, verify the exact container and
+   volumes are retained. Never bypass lifecycle fences or edit ownership records.
+
+A zombie lifecycle worker retaining its recorded birth identity remains a
+known recovery limitation on hosts whose PID 1 does not reap children.
+
+## Report
+
+Report the published version and resolved executable, selected runtime and
+version, tested profile and functional outcomes, and any remaining limitations.

package/upgrade-prompts/0.5.4.md

@@ -0,0 +1,29 @@
+# Upgrade to devrouter 0.5.4
+
+This patch release fixes false Compose identity drift when provider-generated
+entrypoints or configuration values contain literal dollar signs. Devrouter
+undoes Compose serialization escaping before hashing the resolved configuration,
+without another interpolation pass. There is no configuration schema migration.
+
+## Task
+
+Install the published 0.5.4 CLI. Remove any temporary local patch for the Compose
+dollar-escaping fix in PR #146 by replacing it with the published package.
+Bump a consumer's `devrouter.version` only when consumer source changes are
+authorized. No generated configuration or agent artifacts require changes.
+Preserve existing runtime ownership, containers, databases and dependency volumes.
+
+## Validation
+
+1. Run `devrouter -V` from the consumer checkout and confirm 0.5.4.
+2. Run `devrouter doctor --json` and inspect runtime ownership and readiness.
+3. Run `devrouter ensure .` with the intended profile and verify that an existing
+   app container is retained without a false Compose drift failure.
+4. Run an existing application smoke test. If stop/resume is tested, confirm
+   the same container and volumes are retained. Do not replay destructive
+   bootstrap hooks or bypass lifecycle ownership checks to test an upgrade.
+
+## Report
+
+Report the installed version, selected runtime, tested profile, container
+retention and functional results, and any remaining limitations.