@devrouter/cli 0.5.6 → 0.6.1

package/dist/devrouter-lifecycle-worker.js

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/core/devpod-exec.ts
 var import_node_child_process33 = require("child_process");
-var import_node_crypto24 = require("crypto");
+var import_node_crypto25 = require("crypto");
 
 // src/core/devpod-environment.ts
 var import_node_child_process3 = require("child_process");
@@ -2695,6 +2695,72 @@ function assertReadableComposeFile(file) {
     throw new Error("Managed container Compose configuration contains an unreadable file.");
   }
 }
+function resolveManagedServiceNetworkNamespace(options) {
+  const { plan, containers, container, serviceConfig, env } = options;
+  const service = container.labels["com.docker.compose.service"];
+  const targetService = String(serviceConfig.network_mode).slice("service:".length);
+  const target = containers.filter(
+    (item) => item.labels["com.docker.compose.service"] === targetService
+  );
+  const primary = containers.filter(
+    (item) => item.labels["com.docker.compose.service"] === plan.primaryService
+  );
+  const repoPath = import_node_path12.default.dirname(plan.composeDirectory);
+  const owned = (item) => /^[a-f0-9]{64}$/.test(item.id) && containers.filter((candidate) => candidate.id === item.id).length === 1 && containers.filter(
+    (candidate) => candidate.labels["com.docker.compose.service"] === item.labels["com.docker.compose.service"]
+  ).length === 1 && plan.desiredServices.includes(item.labels["com.docker.compose.service"] ?? "") && hasExactComposeIdentity(item, {
+    repoPath,
+    service: item.labels["com.docker.compose.service"] ?? "",
+    composeProject: container.labels["com.docker.compose.project"],
+    composeFiles: plan.composeFiles
+  });
+  if (targetService === service || target.length !== 1 || primary.length !== 1 || !owned(container) || !owned(target[0]) || !owned(primary[0]) || primary[0].mounts.filter(
+    (mount) => mount.Type === "bind" && sameWorkspacePath(mount.Source, repoPath)
+  ).length !== 1) {
+    throw new Error("Managed service network namespace ownership is unavailable.");
+  }
+  const namespace = `container:${target[0].id}`;
+  const ids2 = [container.id, target[0].id];
+  const inspect = () => {
+    const result = (0, import_node_child_process10.spawnSync)(
+      "docker",
+      [
+        "inspect",
+        "--type",
+        "container",
+        "--format",
+        '{"id":{{json .Id}},"networkMode":{{json .HostConfig.NetworkMode}}}',
+        ...ids2
+      ],
+      {
+        env,
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: COMPOSE_HASH_TIMEOUT_MS,
+        maxBuffer: 1024 * 1024
+      }
+    );
+    if (result.status !== 0 || result.error || !result.stdout?.trim()) {
+      throw new Error("Managed service network namespace inspection failed.");
+    }
+    const rows2 = result.stdout.trim().split(/\r?\n/).map((line) => JSON.parse(line));
+    if (rows2.length !== ids2.length || ids2.some(
+      (id5) => rows2.filter(
+        (row) => isObject2(row) && row.id === id5 && typeof row.networkMode === "string"
+      ).length !== 1
+    ) || !rows2.some((row) => isObject2(row) && row.id === container.id && row.networkMode === namespace)) {
+      throw new Error("Managed service network namespace identity changed.");
+    }
+    return ids2.map((id5) => rows2.find((row) => isObject2(row) && row.id === id5));
+  };
+  const before = JSON.stringify(inspect());
+  serviceConfig.network_mode = namespace;
+  return () => {
+    if (JSON.stringify(inspect()) !== before) {
+      throw new Error("Managed service network namespace changed during configuration inspection.");
+    }
+  };
+}
 function assertManagedContainerConfigUnchanged(options) {
   if (options.containers.length === 0) {
     throw new Error("Managed container configuration cannot be verified without containers.");
@@ -2730,6 +2796,10 @@ function assertManagedContainerConfigUnchanged(options) {
           workingDirectory
         ];
         const env = managedComposeEnvironment(options.workspace);
+        if (options.endpoint) {
+          env.DOCKER_HOST = options.endpoint;
+          delete env.DOCKER_CONTEXT;
+        }
         const rendered = (0, import_node_child_process10.spawnSync)(
           "docker",
           [...composeArgs, ...fileArgs, "config", "--format", "json"],
@@ -2745,19 +2815,38 @@ function assertManagedContainerConfigUnchanged(options) {
         if (rendered.status !== 0 || rendered.error || !rendered.stdout?.trim()) {
           throw new Error("Compose configuration rendering failed.");
         }
-        return (0, import_node_child_process10.spawnSync)(
+        const hash = (input2) => (0, import_node_child_process10.spawnSync)(
           "docker",
           [...composeArgs, "-f", "-", "config", "--no-interpolate", "--hash", service],
           {
             cwd: workingDirectory,
             encoding: "utf-8",
             env,
-            input: rendered.stdout.replaceAll("$$", "$"),
+            input: input2,
             stdio: ["pipe", "pipe", "ignore"],
             timeout: COMPOSE_HASH_TIMEOUT_MS,
             maxBuffer: 1024 * 1024
           }
         );
+        const input = rendered.stdout.replaceAll("$$", "$");
+        const result2 = hash(input);
+        const match2 = typeof result2.stdout === "string" ? /^(\S+)\s+([a-f0-9]{64})$/.exec(result2.stdout.trim()) : null;
+        if (result2.status !== 0 || result2.error || !match2 || match2[1] !== service || match2[2] === expectedHash)
+          return result2;
+        const model = JSON.parse(input);
+        const serviceConfig = isObject2(model) && isObject2(model.services) ? model.services[service] : void 0;
+        if (!isObject2(serviceConfig) || typeof serviceConfig.network_mode !== "string" || !serviceConfig.network_mode.startsWith("service:"))
+          return result2;
+        const revalidate = resolveManagedServiceNetworkNamespace({
+          plan: options.plan,
+          containers: options.containers,
+          container,
+          serviceConfig,
+          env
+        });
+        const resolved = hash(JSON.stringify(model));
+        revalidate();
+        return resolved;
       } catch {
         throw new Error(`Could not verify managed Compose configuration for service '${service}'.`);
       }
@@ -4083,11 +4172,20 @@ function recoverManagedStopBaseline(state, readPlan, beforePersist) {
     );
     if (currentOwner.status !== "owned") throw new Error("Stop recovery owner is unavailable.");
     proveLocalDockerSelection(currentOwner.workspace);
-    assertManagedStopContainersAbsent(
-      baseline.endpoint,
-      baseline.containers.map((container) => container.id)
-    );
     const containers = inspectManagedStopContainers(baseline.project, baseline.endpoint);
+    const missingIds = [];
+    for (const recorded of baseline.containers) {
+      const retained = containers.find((container) => container.id === recorded.id);
+      if (!retained) {
+        missingIds.push(recorded.id);
+      } else if (!(0, import_node_util3.isDeepStrictEqual)(
+        { ...recorded, mounts: orderedMounts(recorded.mounts) },
+        identity(retained)
+      )) {
+        throw new Error("Stop recovery retained container identity changed.");
+      }
+    }
+    if (missingIds.length > 0) assertManagedStopContainersAbsent(baseline.endpoint, missingIds);
     if (!(0, import_node_util3.isDeepStrictEqual)(
       containers.map((container) => container.labels["com.docker.compose.service"]).sort(),
       [...plan.desiredServices].sort()
@@ -4107,6 +4205,7 @@ function recoverManagedStopBaseline(state, readPlan, beforePersist) {
     assertManagedContainerConfigUnchanged({
       plan,
       containers,
+      endpoint: baseline.endpoint,
       workspace: state.workspace ? {
         token: state.workspace,
         gitCommonDir: resolveGitCommonDir(state.repoPath)
@@ -5490,7 +5589,7 @@ function retain(session, previous) {
 
 // src/core/reliability-operation-store.ts
 function installedCliVersion() {
-  return true ? "0.5.6" : "0.0.0-dev";
+  return true ? "0.6.1" : "0.0.0-dev";
 }
 function compareCliVersions(left, right) {
   const parts = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
@@ -7578,6 +7677,9 @@ function resolveRepoPath(repoPath) {
 function getRepoConfigPath(repoPath) {
   return import_node_path23.default.join(resolveRepoPath(repoPath), CONFIG_FILE_NAME);
 }
+function parseRepoConfigSource(source, configPath) {
+  return parseConfig(import_yaml3.default.parse(source) ?? {}, configPath);
+}
 function loadRepoConfig(repoPath, read2 = (file) => import_node_fs19.default.readFileSync(file, "utf-8")) {
   const resolvedRepoPath = resolveRepoPath(repoPath);
   const configPath = getRepoConfigPath(resolvedRepoPath);
@@ -7587,11 +7689,10 @@ function loadRepoConfig(repoPath, read2 = (file) => import_node_fs19.default.rea
     );
   }
   const raw = read2(configPath);
-  const parsed = import_yaml3.default.parse(raw);
-  const config = parseConfig(parsed ?? {}, configPath);
+  const config = parseRepoConfigSource(raw, configPath);
   const requiredVersion = config.devrouter?.version;
   if (requiredVersion && !hasWarnedVersionMismatch) {
-    const cliVersion = true ? "0.5.6" : "0.0.0-dev";
+    const cliVersion = true ? "0.6.1" : "0.0.0-dev";
     if (cliVersion !== "0.0.0-dev" && compareSemver2(requiredVersion, cliVersion) > 0) {
       hasWarnedVersionMismatch = true;
       process.stderr.write(
@@ -8634,6 +8735,7 @@ function stopInitialManagedDevsyWorkspace(repoPath, devsyId) {
     assertManagedContainerConfigUnchanged({
       plan,
       containers: population,
+      endpoint,
       workspace: workspaceEnv
     });
     if (!(0, import_node_util5.isDeepStrictEqual)(readAuthority(), authority) || !(0, import_node_util5.isDeepStrictEqual)(registration2(), owner) || resolveManagedStopEndpoint() !== endpoint || inspectManagedStopDaemon(endpoint) !== daemon)
@@ -10648,9 +10750,9 @@ var ExecutionOutcomeError = class extends Error {
 };
 
 // src/core/reliability-lifecycle.ts
-var import_node_crypto23 = require("crypto");
-var import_node_path41 = __toESM(require("path"));
-var import_node_util7 = require("util");
+var import_node_crypto24 = require("crypto");
+var import_node_path42 = __toESM(require("path"));
+var import_node_util8 = require("util");
 
 // src/core/capacity-policy.ts
 var import_node_fs27 = __toESM(require("fs"));
@@ -12481,9 +12583,15 @@ function stepReliability(state, event, nowMs) {
 
 // src/core/reliability-worker.ts
 var import_node_child_process21 = require("child_process");
+var import_node_crypto20 = require("crypto");
+var import_node_fs31 = __toESM(require("fs"));
+var import_node_path36 = __toESM(require("path"));
+
+// src/core/lifecycle-diagnostics.ts
 var import_node_crypto19 = require("crypto");
 var import_node_fs30 = __toESM(require("fs"));
 var import_node_path35 = __toESM(require("path"));
+var import_node_util7 = require("util");
 
 // src/core/lifecycle-progress.ts
 var ROLES = {
@@ -12538,6 +12646,89 @@ function reportLifecycleProgress(phase) {
   sender?.(phase);
 }
 
+// src/core/lifecycle-diagnostics.ts
+var MAX_TAIL_BYTES = 32768;
+var MAX_RECEIPT_BYTES = 65536;
+function privateDirectory(directory) {
+  const stat = import_node_fs30.default.lstatSync(directory);
+  return stat.isDirectory() && stat.uid === process.getuid?.() && (stat.mode & 63) === 0;
+}
+function lifecycleDiagnosticsPath(identity2) {
+  return import_node_path35.default.join(
+    DEVROUTER_HOME,
+    "lifecycle-diagnostics",
+    `${(0, import_node_crypto19.createHash)("sha256").update(identity2.repoPath).digest("hex")}.json`
+  );
+}
+function readReceipt(identity2) {
+  let descriptor;
+  try {
+    const file = lifecycleDiagnosticsPath(identity2);
+    if (!privateDirectory(import_node_path35.default.dirname(file))) return void 0;
+    descriptor = import_node_fs30.default.openSync(
+      file,
+      import_node_fs30.default.constants.O_RDONLY | import_node_fs30.default.constants.O_NOFOLLOW | import_node_fs30.default.constants.O_NONBLOCK
+    );
+    const stat = import_node_fs30.default.fstatSync(descriptor);
+    if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 63) !== 0 || stat.size > MAX_RECEIPT_BYTES)
+      return void 0;
+    const buffer = Buffer.alloc(MAX_RECEIPT_BYTES + 1);
+    const size = import_node_fs30.default.readSync(descriptor, buffer, 0, buffer.length, 0);
+    if (size > MAX_RECEIPT_BYTES) return void 0;
+    const receipt = JSON.parse(buffer.subarray(0, size).toString("utf8"));
+    const timestamp = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+    const optionalTime = (value) => value === null || timestamp(value);
+    if (receipt.version !== 1 || !(0, import_node_util7.isDeepStrictEqual)(receipt.identity, identity2) || typeof receipt.operationId !== "string" || typeof receipt.workerId !== "string" || !timestamp(receipt.startedAtMs) || !timestamp(receipt.updatedAtMs) || receipt.updatedAtMs < receipt.startedAtMs || !(receipt.phase === null || isLifecycleProgressPhase(receipt.phase)) || !optionalTime(receipt.phaseAtMs) || !optionalTime(receipt.lastOutputAtMs) || !optionalTime(receipt.lastProgressAtMs) || !(receipt.buildPackage === null || typeof receipt.buildPackage === "string" && receipt.buildPackage.length <= 128 && /^(?:@[a-zA-Z0-9_.-]+\/)?[a-zA-Z0-9_.-]+$/.test(receipt.buildPackage)) || typeof receipt.cancellationRequested !== "boolean" || typeof receipt.closed !== "boolean" || !Array.isArray(receipt.output) || receipt.output.length > 64)
+      return void 0;
+    let bytes2 = 0;
+    for (const chunk of receipt.output) {
+      if (!chunk || !["stdout", "stderr"].includes(chunk.stream) || typeof chunk.data !== "string" || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(chunk.data))
+        return void 0;
+      bytes2 += Buffer.byteLength(chunk.data, "base64");
+    }
+    return bytes2 <= MAX_TAIL_BYTES ? receipt : void 0;
+  } catch {
+    return void 0;
+  } finally {
+    if (descriptor !== void 0) import_node_fs30.default.closeSync(descriptor);
+  }
+}
+function readLifecycleDiagnostics(identity2, now = Date.now()) {
+  try {
+    const before = readReliabilityOperation(identity2);
+    const receipt = readReceipt(identity2);
+    const after = readReliabilityOperation(identity2);
+    if (!before || !after || !receipt || before.revision !== after.revision || !(0, import_node_util7.isDeepStrictEqual)(before, after) || !(0, import_node_util7.isDeepStrictEqual)(receipt.fence, reliabilityFence(after.state)) || after.state.operation?.id !== receipt.operationId || after.state.operation.kind !== "ensure" || after.worker !== null && after.worker.id !== receipt.workerId || !receipt.closed && !after.worker || now < receipt.updatedAtMs || [receipt.phaseAtMs, receipt.lastOutputAtMs, receipt.lastProgressAtMs].some(
+      (time) => time !== null && (time < receipt.startedAtMs || time > receipt.updatedAtMs)
+    ))
+      return void 0;
+    const age = (time) => time === null ? null : now - time;
+    const metadata = {
+      stage: receipt.phase ?? "unknown",
+      elapsedMs: Math.max(0, (receipt.closed ? receipt.updatedAtMs : now) - receipt.startedAtMs),
+      stageAgeMs: age(receipt.phaseAtMs),
+      outputAgeMs: age(receipt.lastOutputAtMs),
+      progressAgeMs: age(receipt.lastProgressAtMs),
+      evidence: now - receipt.updatedAtMs < 3e4 ? "recent" : "stale",
+      buildPackage: receipt.buildPackage,
+      liveness: "unknown",
+      executionDeadlineAtMs: null,
+      handshakeTimeoutMs: 3e4,
+      cancellationGraceMs: 2e3,
+      cancellationRequested: receipt.cancellationRequested,
+      workerDrained: after.state.operation.drained
+    };
+    return {
+      operationId: receipt.operationId,
+      revision: after.revision,
+      metadata,
+      output: receipt.output
+    };
+  } catch {
+    return void 0;
+  }
+}
+
 // src/core/reliability-worker.ts
 var DEFAULT_OUTPUT_PAGE_BYTES = 48 * 1024;
 function workerGroupAbsent(pid) {
@@ -12549,11 +12740,11 @@ function workerGroupAbsent(pid) {
   if (process.platform !== "linux") return false;
   let observedZombie = false;
   try {
-    for (const entry of import_node_fs30.default.readdirSync("/proc")) {
+    for (const entry of import_node_fs31.default.readdirSync("/proc")) {
       if (!/^\d+$/.test(entry)) continue;
       let stat;
       try {
-        stat = import_node_fs30.default.readFileSync(`/proc/${entry}/stat`, "utf8");
+        stat = import_node_fs31.default.readFileSync(`/proc/${entry}/stat`, "utf8");
       } catch (error) {
         if (error.code === "ENOENT") continue;
         return false;
@@ -12574,19 +12765,19 @@ function workerGroupAbsent(pid) {
 
 // src/core/workspace-ensure.ts
 var import_node_child_process31 = require("child_process");
-var import_node_fs35 = __toESM(require("fs"));
-var import_node_path40 = __toESM(require("path"));
+var import_node_fs36 = __toESM(require("fs"));
+var import_node_path41 = __toESM(require("path"));
 
 // src/core/devpod-mutation.ts
 var import_node_child_process22 = require("child_process");
-var import_node_fs31 = __toESM(require("fs"));
-var import_node_path36 = __toESM(require("path"));
-var DEVPOD_MUTATION_LOCK_FILE = import_node_path36.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
+var import_node_fs32 = __toESM(require("fs"));
+var import_node_path37 = __toESM(require("path"));
+var DEVPOD_MUTATION_LOCK_FILE = import_node_path37.default.join(DEVROUTER_HOME, "devpod-mutation.lock");
 var DEVPOD_MUTATION_WAIT_MS = 18e5;
 var DevpodStartPostconditionError = class extends Error {
 };
 function withMutationLock2(activity, target, operation) {
-  import_node_fs31.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+  import_node_fs32.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
   return withFileLockSync(
     DEVPOD_MUTATION_LOCK_FILE,
     {
@@ -12788,7 +12979,7 @@ async function startDevpodWorkspace(options) {
 
 // src/core/host-port-claims.ts
 var import_node_child_process23 = require("child_process");
-var import_node_path37 = __toESM(require("path"));
+var import_node_path38 = __toESM(require("path"));
 var COMPOSE_RENDER_TIMEOUT_MS = 3e4;
 var COMPOSE_RENDER_MAX_BUFFER = 8 * 1024 * 1024;
 var DOCKER_TIMEOUT_MS = 1e4;
@@ -12996,8 +13187,8 @@ function renderManagedComposeModel(plan, workspace) {
   }
 }
 function attributeHolderWorktree(workingDir) {
-  if (import_node_path37.default.basename(workingDir) !== ".devcontainer") return void 0;
-  return comparableWorkspacePath(import_node_path37.default.dirname(workingDir));
+  if (import_node_path38.default.basename(workingDir) !== ".devcontainer") return void 0;
+  return comparableWorkspacePath(import_node_path38.default.dirname(workingDir));
 }
 function holderAttribution(holder, repoPath) {
   const attribution = {};
@@ -13032,7 +13223,7 @@ function detectHostPortClaimConflicts(options) {
   );
   if (desired.length === 0) return [];
   const holders = listHolderSnapshots();
-  const devcontainerDir = import_node_path37.default.join(options.repoPath, ".devcontainer");
+  const devcontainerDir = import_node_path38.default.join(options.repoPath, ".devcontainer");
   const conflicts = [];
   for (const binding of desired) {
     for (const holder of holders) {
@@ -13193,7 +13384,7 @@ function transportFailure() {
 
 // src/core/managed-host-preparation.ts
 var import_node_child_process25 = require("child_process");
-var import_node_fs32 = __toESM(require("fs"));
+var import_node_fs33 = __toESM(require("fs"));
 var PREPARATION_TIMEOUT_MS = 6e4;
 var CONFIG_READ_ERROR = "Managed host preparation could not read .devrouter.yml.";
 var CONFIG_CHANGED_ERROR = "Managed host preparation changed .devrouter.yml; refusing to continue.";
@@ -13236,7 +13427,7 @@ function runPreparationCommand(argv, cwd) {
 }
 function readConfigBytes(configPath) {
   try {
-    return import_node_fs32.default.readFileSync(configPath);
+    return import_node_fs33.default.readFileSync(configPath);
   } catch {
     return void 0;
   }
@@ -13269,6 +13460,43 @@ async function runManagedHostPreparation(repoPath, config) {
   }
 }
 
+// src/core/lifecycle-operation-status.ts
+function projectLifecycleOperation(operation) {
+  const result = {
+    operationId: operation.id,
+    phase: "terminal",
+    outcome: null,
+    reason: null,
+    exitCode: null
+  };
+  switch (operation.status) {
+    case "NOT_STARTED":
+      if (operation.drained) result.outcome = "NOT_STARTED";
+      else result.phase = "queued";
+      break;
+    case "DISPATCH_PENDING":
+    case "DISPATCH_RECORDED":
+    case "RUNNING":
+      if (operation.drained) {
+        result.outcome = "COMPLETION_UNKNOWN";
+        result.reason = "worker-drained-without-result";
+      } else result.phase = operation.status === "RUNNING" ? "running" : "dispatching";
+      break;
+    case "COMPLETED":
+      result.outcome = "COMPLETED";
+      result.exitCode = operation.exitCode;
+      break;
+    case "NOT_LAUNCHED":
+      result.outcome = "NOT_STARTED";
+      break;
+    case "INTERRUPTED":
+    case "COMPLETION_UNKNOWN":
+      result.outcome = operation.status;
+      break;
+  }
+  return result;
+}
+
 // src/core/managed-mount-nesting.ts
 var import_node_child_process26 = require("child_process");
 var NESTED_MOUNT_REASON = "no configured mount is nested inside another configured mount";
@@ -13421,6 +13649,8 @@ function readReliabilityStatus(options) {
     return void 0;
   }
   if (!record5) return void 0;
+  const diagnosticReceipt = record5.state.operation ? readLifecycleDiagnostics(record5.identity) : void 0;
+  const diagnostics = diagnosticReceipt?.operationId === record5.state.operation?.id && diagnosticReceipt?.revision === record5.revision ? diagnosticReceipt?.metadata : void 0;
   const reason2 = reliabilityAttention(record5.state) ?? (record5.state.desired === "running" && refusedManagedStart(record5.result) ? "start-refused" : void 0);
   return {
     desired: record5.state.desired,
@@ -13431,6 +13661,14 @@ function readReliabilityStatus(options) {
       correctiveActionsTaken: record5.state.incident.correctiveActionsTaken,
       actionLimit: record5.state.incident.actionLimit
     } : null,
+    ...record5.state.operation ? {
+      operation: {
+        ...projectLifecycleOperation(record5.state.operation),
+        kind: record5.state.operation.kind,
+        drained: record5.state.operation.drained,
+        ...diagnostics ? { diagnostics } : {}
+      }
+    } : {},
     ...reason2 ? {
       attention: {
         reason: reason2,
@@ -14058,33 +14296,33 @@ var import_node_child_process28 = require("child_process");
 var import_node_net3 = require("net");
 
 // src/core/network-local-daemon.ts
-var import_node_fs33 = __toESM(require("fs"));
-var import_node_path38 = __toESM(require("path"));
+var import_node_fs34 = __toESM(require("fs"));
+var import_node_path39 = __toESM(require("path"));
 function hasLocalDockerNetworkNamespace(endpoint, procRoot = "/proc") {
   const deadline = Date.now() + 2e3;
   try {
     if (!endpoint.startsWith("unix:///")) return false;
     const socket = endpoint.slice("unix://".length);
-    const table = import_node_fs33.default.readFileSync(import_node_path38.default.join(procRoot, "net/unix"), "utf8");
+    const table = import_node_fs34.default.readFileSync(import_node_path39.default.join(procRoot, "net/unix"), "utf8");
     if (Buffer.byteLength(table) > 1024 * 1024) return false;
     const rows2 = table.split("\n").map((line) => line.trim().split(/\s+/)).filter((row) => row[7] === socket && row[3] === "00010000");
     if (rows2.length !== 1 || !/^\d+$/.test(rows2[0][6])) return false;
     const inode = `socket:[${rows2[0][6]}]`;
-    const ownNamespace = import_node_fs33.default.readlinkSync(import_node_path38.default.join(procRoot, "self/ns/net"));
-    const pids = import_node_fs33.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
+    const ownNamespace = import_node_fs34.default.readlinkSync(import_node_path39.default.join(procRoot, "self/ns/net"));
+    const pids = import_node_fs34.default.readdirSync(procRoot).filter((name) => /^\d+$/.test(name));
     if (pids.length > 4096) return false;
     for (const pid of pids) {
       if (Date.now() > deadline) return false;
       try {
-        const root = import_node_path38.default.join(procRoot, pid);
-        if (import_node_path38.default.basename(import_node_fs33.default.readlinkSync(import_node_path38.default.join(root, "exe"))) !== "dockerd") continue;
-        if (import_node_fs33.default.readlinkSync(import_node_path38.default.join(root, "ns/net")) !== ownNamespace) continue;
-        const descriptors = import_node_fs33.default.readdirSync(import_node_path38.default.join(root, "fd"));
+        const root = import_node_path39.default.join(procRoot, pid);
+        if (import_node_path39.default.basename(import_node_fs34.default.readlinkSync(import_node_path39.default.join(root, "exe"))) !== "dockerd") continue;
+        if (import_node_fs34.default.readlinkSync(import_node_path39.default.join(root, "ns/net")) !== ownNamespace) continue;
+        const descriptors = import_node_fs34.default.readdirSync(import_node_path39.default.join(root, "fd"));
         if (descriptors.length > 4096) continue;
         if (descriptors.some((fd) => {
           if (Date.now() > deadline) return false;
           try {
-            return import_node_fs33.default.readlinkSync(import_node_path38.default.join(root, "fd", fd)) === inode;
+            return import_node_fs34.default.readlinkSync(import_node_path39.default.join(root, "fd", fd)) === inode;
           } catch {
             return false;
           }
@@ -14159,10 +14397,10 @@ function inspectLegacyNetworkCapacity(input) {
 }
 
 // src/core/network-managed.ts
-var import_node_crypto22 = require("crypto");
+var import_node_crypto23 = require("crypto");
 
 // src/core/network-compose.ts
-var import_node_crypto20 = require("crypto");
+var import_node_crypto21 = require("crypto");
 var SAFE_ENDPOINT_UPPER_BOUND_SEMANTICS = "full-lifecycle-demand";
 function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -14968,14 +15206,14 @@ function stableValue(value) {
 }
 function fingerprintComposeNetworkModel(input) {
   const projection = normalizedFingerprintProjection(input);
-  return (0, import_node_crypto20.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
+  return (0, import_node_crypto21.createHash)("sha256").update(stableValue(projection), "utf8").digest("hex");
 }
 
 // src/core/network-compose-files.ts
 var import_node_child_process29 = require("child_process");
-var import_node_crypto21 = require("crypto");
-var import_node_fs34 = __toESM(require("fs"));
-var import_node_path39 = __toESM(require("path"));
+var import_node_crypto22 = require("crypto");
+var import_node_fs35 = __toESM(require("fs"));
+var import_node_path40 = __toESM(require("path"));
 var import_yaml4 = __toESM(require("yaml"));
 var OVERLAY = "docker-compose.devrouter-network.yml";
 var MARKER = "# devrouter:managed workspace network";
@@ -14988,12 +15226,12 @@ function object3(value) {
 function inspectNetworkComposeFiles(input) {
   const authoredNetworks = {};
   for (const file of input.plan.composeFiles) {
-    const stat = import_node_fs34.default.lstatSync(file);
+    const stat = import_node_fs35.default.lstatSync(file);
     if (!stat.isFile() || stat.size > MAX_BYTES2)
       throw new Error("Network Compose source is unavailable or too large.");
     let source;
     try {
-      source = object3(import_yaml4.default.parse(import_node_fs34.default.readFileSync(file, "utf8")));
+      source = object3(import_yaml4.default.parse(import_node_fs35.default.readFileSync(file, "utf8")));
     } catch {
       throw new Error("Network Compose source could not be parsed safely.");
     }
@@ -15043,7 +15281,7 @@ function inspectNetworkComposeFiles(input) {
 function prepareNetworkComposeFiles(plan, subnet) {
   const overlay = deriveComposeNetworkOverlay(subnet);
   if (overlay.status !== "ready" || !overlay.overlay) throw new Error("Network subnet is invalid.");
-  const overlayPath = import_node_path39.default.join(plan.composeDirectory, OVERLAY);
+  const overlayPath = import_node_path40.default.join(plan.composeDirectory, OVERLAY);
   const ignored = (0, import_node_child_process29.spawnSync)("git", [
     "-C",
     plan.composeDirectory,
@@ -15058,9 +15296,9 @@ function prepareNetworkComposeFiles(plan, subnet) {
   const bytes2 = `${MARKER}
 ${import_yaml4.default.stringify(overlay.overlay)}`;
   const assertOwnership = () => {
-    if (!import_node_fs34.default.existsSync(overlayPath)) return;
-    const stat = import_node_fs34.default.lstatSync(overlayPath);
-    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs34.default.readFileSync(overlayPath, "utf8") !== bytes2)
+    if (!import_node_fs35.default.existsSync(overlayPath)) return;
+    const stat = import_node_fs35.default.lstatSync(overlayPath);
+    if (!stat.isFile() || stat.size > MAX_BYTES2 || import_node_fs35.default.readFileSync(overlayPath, "utf8") !== bytes2)
       throw new Error("Retained network overlay changed; repair is required.");
   };
   assertOwnership();
@@ -15074,7 +15312,7 @@ ${JSON.stringify(extended.config, null, 2)}
     ...plan,
     contents,
     composeFiles: [...plan.composeFiles, overlayPath],
-    effectiveConfigSha256: (0, import_node_crypto21.createHash)("sha256").update(contents).digest("hex")
+    effectiveConfigSha256: (0, import_node_crypto22.createHash)("sha256").update(contents).digest("hex")
   };
   return {
     plan: result,
@@ -15392,7 +15630,7 @@ function createManagedNetworkSession(input) {
           "Insufficient endpoint headroom; request an allowed larger network before first allocation."
         );
       const authority = readNetworkOperationAuthority(identity2);
-      const fingerprint = (0, import_node_crypto22.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
+      const fingerprint = (0, import_node_crypto23.createHash)("sha256").update(input.plan().sourceConfigSha256).update(fingerprintComposeNetworkModel(model)).digest("hex");
       if (!saved) {
         if (policy.status !== "valid")
           throw new Error("New network allocation requires valid machine policy.");
@@ -15576,11 +15814,11 @@ var DEFAULT_READINESS_TIMEOUT_MS = 12e4;
 var POLL_INTERVAL_MS = 1e3;
 function assertOverlay(container, repoPath) {
   const workingDir = container.labels["com.docker.compose.project.working_dir"];
-  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path40.default.join(repoPath, ".devcontainer"))) {
+  if (!workingDir || !sameWorkspacePath(workingDir, import_node_path41.default.join(repoPath, ".devcontainer"))) {
     throw new Error(`Container '${container.id}' does not belong to the exact worktree.`);
   }
   const configFiles = (container.labels["com.docker.compose.project.config_files"] ?? "").split(",").filter(Boolean);
-  const expectedOverlay = import_node_path40.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+  const expectedOverlay = import_node_path41.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
   if (!configFiles.some((configFile) => sameWorkspacePath(configFile, expectedOverlay))) {
     throw new Error(`Container '${container.id}' was not started with ${DEVCONTAINER_OVERLAY}.`);
   }
@@ -15594,7 +15832,7 @@ function assertWorktreeOwnership(container, repoPath) {
 function isInsideWorktree(candidate, repoPath) {
   const normalizedCandidate = comparableWorkspacePath(candidate);
   const normalizedRoot = comparableWorkspacePath(repoPath);
-  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${import_node_path40.default.sep}`);
+  return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}${import_node_path41.default.sep}`);
 }
 function assertReady(container, label) {
   if (!container.state.Running) {
@@ -15786,7 +16024,7 @@ function hasExactManagedComposeProject(repoPath, state) {
     }).some((container) => {
       const workingDir = container.labels["com.docker.compose.project.working_dir"];
       return Boolean(
-        workingDir && sameWorkspacePath(workingDir, import_node_path40.default.join(repoPath, ".devcontainer"))
+        workingDir && sameWorkspacePath(workingDir, import_node_path41.default.join(repoPath, ".devcontainer"))
       );
     });
   } catch {
@@ -16191,7 +16429,7 @@ function resolvePrimaryTarget(repoPath) {
 }
 function isPrimaryCheckout(repoPath) {
   try {
-    return import_node_fs35.default.statSync(import_node_path40.default.join(repoPath, ".git")).isDirectory();
+    return import_node_fs36.default.statSync(import_node_path41.default.join(repoPath, ".git")).isDirectory();
   } catch {
     return false;
   }
@@ -16255,8 +16493,8 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       const target = options.repair ? resolveRepairTarget(repoPath, linked) : linked ? resolveLinkedTarget(repoPath) : resolvePrimaryTarget(repoPath);
       let devpodId = target.devpodId;
       if (target.kind === "linked") {
-        const overlayPath = import_node_path40.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
-        if (!import_node_fs35.default.existsSync(overlayPath)) {
+        const overlayPath = import_node_path41.default.join(repoPath, ".devcontainer", DEVCONTAINER_OVERLAY);
+        if (!import_node_fs36.default.existsSync(overlayPath)) {
           throw new Error(`Missing required DevPod compose overlay: ${overlayPath}`);
         }
       }
@@ -16276,6 +16514,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       if (variant !== "default" && managedPostStart.kind !== "runtime")
         throw new Error("Runtime variants require a managed runtime post-start adapter.");
       const managedRuntime = runtime.config.managedRuntime;
+      const hostPortDeclarationsSha256 = managedHostPortDeclarationsIdentity(
+        managedRuntime?.devcontainer.hostPorts ?? {}
+      );
       if (options.repair && !managedRuntime)
         throw new Error("Repair requires managedRuntime configuration.");
       previousRoutes = listHostRouteState().filter(
@@ -16363,7 +16604,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
       }
       const apps = proxyAppsFromConfig(runtime.config);
       const parsedUpstreams = apps.map((app) => parseUpstream(app.upstream));
-      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path40.default.basename(repoPath)) ?? "app";
+      const aliasPrefix = target.kind === "linked" ? target.workspace : wsFromBranch(runtime.config.project?.name ?? import_node_path41.default.basename(repoPath)) ?? "app";
       for (const [index, app] of apps.entries()) {
         if (!parsedUpstreams[index].host.startsWith(`${aliasPrefix}-`)) {
           const owner = target.kind === "linked" ? "workspace" : "checkout";
@@ -16600,9 +16841,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
                 composeProject: captureProject,
                 profile: runtime.profile,
                 variant,
-                hostPortDeclarationsSha256: managedHostPortDeclarationsIdentity(
-                  managedRuntime?.devcontainer.hostPorts ?? {}
-                ),
+                ...hostPortDeclarationsSha256 !== void 0 ? { hostPortDeclarationsSha256 } : {},
                 desired: {
                   apps: apps.map((app) => app.name).sort(),
                   services: [...capturePlan.desiredProfileServices].sort(),
@@ -16813,9 +17052,7 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
           composeProject: managedComposeProject,
           profile: runtime.profile,
           variant,
-          hostPortDeclarationsSha256: managedHostPortDeclarationsIdentity(
-            managedRuntime?.devcontainer.hostPorts ?? {}
-          ),
+          ...hostPortDeclarationsSha256 !== void 0 ? { hostPortDeclarationsSha256 } : {},
           desired: {
             apps: apps.map((app) => app.name).sort(),
             services: [...managedPlan.desiredProfileServices].sort(),
@@ -17252,9 +17489,9 @@ async function workspaceEnsure(requestedRepoPath, options = {}) {
     }
     const repairLocked = () => {
       const runtime = resolveWorkspaceRuntimeOrDefault(repoPath);
-      import_node_fs35.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
+      import_node_fs36.default.mkdirSync(DEVROUTER_HOME, { recursive: true });
       return withFileLock(
-        import_node_path40.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
+        import_node_path41.default.join(DEVROUTER_HOME, `${runtime}-mutation.lock`),
         {
           activity: "Managed runtime repair",
           target: repoPath,
@@ -17432,7 +17669,7 @@ function preflightRuntimeVariant(repoPath, options) {
   return variant;
 }
 function capacityPolicyTargets(repoPath) {
-  const policy = readCapacityPolicy(import_node_path41.default.join(DEVROUTER_HOME, "controller"));
+  const policy = readCapacityPolicy(import_node_path42.default.join(DEVROUTER_HOME, "controller"));
   return policy?.admissions === "enabled" && policy.enrollments.some((entry) => entry.repoPath === repoPath);
 }
 function clearActiveLifecycleStartupWitness() {
@@ -17538,7 +17775,7 @@ async function executeLifecycleWorker(request, operation) {
           const owned = containers.filter(
             (container) => sameWorkspacePath(
               container.labels["com.docker.compose.project.working_dir"] ?? "",
-              import_node_path41.default.join(request.repoPath, ".devcontainer")
+              import_node_path42.default.join(request.repoPath, ".devcontainer")
             )
           );
           const projects = owned.map((container) => container.labels["com.docker.compose.project"]);
@@ -17625,7 +17862,7 @@ function proveLifecycleStopped() {
     throw new Error("Full stop proof requires an explicit stop worker.");
   const settle = () => {
     claimLifecycleEffect();
-    if (initialStopAbsence && !(0, import_node_util7.isDeepStrictEqual)(
+    if (initialStopAbsence && !(0, import_node_util8.isDeepStrictEqual)(
       proveInitialManagedDevsyAbsence(request.repoPath, initialStopAbsence.record.devpodId),
       initialStopAbsence
     ))
@@ -17645,7 +17882,7 @@ function proveLifecycleStopped() {
       const remaining = inspectWorkspaceContainers().filter(
         (container) => sameWorkspacePath(
           container.labels["com.docker.compose.project.working_dir"] ?? "",
-          import_node_path41.default.join(request.repoPath, ".devcontainer")
+          import_node_path42.default.join(request.repoPath, ".devcontainer")
         )
       );
       if (remaining.some(
@@ -17675,7 +17912,7 @@ function proveLifecycleStopped() {
       return void 0;
     });
     if (settlement) {
-      const capacity = createLifecycleCapacityStore(import_node_path41.default.join(DEVROUTER_HOME, "controller"));
+      const capacity = createLifecycleCapacityStore(import_node_path42.default.join(DEVROUTER_HOME, "controller"));
       for (let attempt = 0; ; attempt++) {
         try {
           const state = capacity.inspect();
@@ -17849,7 +18086,7 @@ async function devpodExecOutcome(repoPath, command) {
     }
     assertRunningDevpod(devpod.id, repoPath);
     const workspaceDirectory = resolveWorkspaceDirectory(repoPath);
-    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto24.randomUUID)()}__:`;
+    const statusMarker = `__DEVROUTER_EXIT_${(0, import_node_crypto25.randomUUID)()}__:`;
     const statusMarkerBytes = Buffer.from(statusMarker, "ascii");
     const literalCommand = command.map(quotePosixArg).join(" ");
     const wrappedCommand = `${literalCommand}; __devrouter_status=$?; printf '${statusMarker}%s\\n' "$__devrouter_status" >&2; exit 0`;
@@ -18039,11 +18276,11 @@ async function devpodExecOutcome(repoPath, command) {
 
 // src/core/workspace-lifecycle.ts
 var import_node_child_process34 = require("child_process");
-var import_node_fs37 = __toESM(require("fs"));
-var import_node_path42 = __toESM(require("path"));
+var import_node_fs38 = __toESM(require("fs"));
+var import_node_path43 = __toESM(require("path"));
 
 // src/core/route-state.ts
-var import_node_fs36 = __toESM(require("fs"));
+var import_node_fs37 = __toESM(require("fs"));
 function listRoutesForWorktreePath(worktreePath, routes = listHostRouteState()) {
   return routes.filter((route) => sameWorkspacePath(route.repoPath, worktreePath));
 }