deepspace 0.8.0 → 0.8.2

package/dist/cli.js

@@ -3,8 +3,8 @@
 // src/cli/cli.ts
 import { defineCommand as defineCommand14, runMain, runCommand } from "citty";
 import { sync as spawnSync8 } from "cross-spawn";
-import { readFileSync as readFileSync24, existsSync as existsSync25 } from "fs";
-import { dirname as dirname9, join as join25 } from "path";
+import { readFileSync as readFileSync25, existsSync as existsSync24 } from "fs";
+import { dirname as dirname10, join as join23 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/spinner.ts
@@ -836,7 +836,7 @@ ${line}
 }
 
 // src/cli/commands/dev.ts
-import { resolve as resolve5, basename as basename2, join as join11 } from "path";
+import { resolve as resolve6, basename as basename2, join as join12 } from "path";
 import spawn from "cross-spawn";
 
 // src/cli/lib/app-context.ts
@@ -874,10 +874,231 @@ function findChildApps(dir) {
 }
 
 // src/cli/lib/launch-config.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, renameSync, unlinkSync } from "fs";
-import { join as join5, resolve as resolve3, dirname as dirname2, basename, isAbsolute as isAbsolute2, sep } from "path";
+import {
+  existsSync as existsSync5,
+  readFileSync as readFileSync7,
+  realpathSync,
+  writeFileSync as writeFileSync4,
+  mkdirSync as mkdirSync4,
+  renameSync,
+  unlinkSync
+} from "fs";
+import { join as join6, resolve as resolve4, dirname as dirname3, basename, isAbsolute as isAbsolute2, sep } from "path";
+
+// src/cli/lib/git/repository.ts
+import { appendFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync6 } from "fs";
+import { dirname as dirname2, join as join5, resolve as resolve3 } from "path";
+
+// src/cli/lib/git/process.ts
+import { sync as spawnSync } from "cross-spawn";
+var MAX_GIT_BUFFER = 512 * 1024 * 1024;
+var GitError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "GitError";
+  }
+};
+function runGit(cwd, args, opts = {}) {
+  const result = spawnSync("git", args, {
+    cwd,
+    input: opts.input,
+    maxBuffer: MAX_GIT_BUFFER,
+    stdio: ["pipe", "pipe", "pipe"],
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      LC_ALL: "C",
+      ...opts.env ?? {}
+    }
+  });
+  if (result.error) {
+    const code = result.error.code;
+    if (code === "ENOENT") {
+      throw new GitError(
+        "git is not installed or not on PATH \u2014 install git and retry.",
+        "git_not_installed"
+      );
+    }
+    throw new GitError(`git ${args[0]} failed: ${result.error.message}`);
+  }
+  const status3 = result.status ?? 1;
+  if (status3 !== 0 && !opts.allowFail) {
+    const stderr = result.stderr?.toString("utf-8").trim() ?? "";
+    throw new GitError(`git ${args.join(" ")} exited ${status3}${stderr ? `: ${stderr}` : ""}`);
+  }
+  return {
+    stdout: result.stdout ?? Buffer.alloc(0),
+    stderr: result.stderr ?? Buffer.alloc(0),
+    status: status3
+  };
+}
+function gitLine(cwd, args) {
+  return runGit(cwd, args).stdout.toString("utf-8").trim();
+}
+function splitNulFields(buffer) {
+  const fields = [];
+  let start = 0;
+  for (let index = 0; index < buffer.length; index++) {
+    if (buffer[index] === 0) {
+      fields.push(buffer.toString("utf-8", start, index));
+      start = index + 1;
+    }
+  }
+  if (start < buffer.length) fields.push(buffer.toString("utf-8", start));
+  return fields;
+}
+function parseGitVersion(output) {
+  const match = /(\d+)\.(\d+)/.exec(output);
+  return match ? [Number(match[1]), Number(match[2])] : null;
+}
+function gitMeetsFloor(version) {
+  if (!version) return true;
+  const [major, minor] = version;
+  return major > 2 || major === 2 && minor >= 29;
+}
+
+// src/cli/lib/git/repository.ts
+function isPlausibleBranchName(name) {
+  if (!name || name === "HEAD" || name === "@") return false;
+  if (name.startsWith("/") || name.startsWith("-") || name.startsWith(".")) return false;
+  if (name.endsWith("/") || name.endsWith(".") || name.endsWith(".lock")) return false;
+  if (name.includes("/.") || name.includes(".lock/")) return false;
+  return !/(\.\.|\/\/|@\{|[\x00-\x20\x7f~^:?*[\\])/.test(name);
+}
+function assertSyncableRepo(cwd) {
+  const inside = runGit(cwd, ["rev-parse", "--is-inside-work-tree"], { allowFail: true });
+  if (inside.status !== 0 || inside.stdout.toString().trim() !== "true") {
+    throw new InputError(
+      `${cwd} is not a git repository. DeepSpace apps are scaffolded as git repos \u2014 run \`git init\` first.`,
+      "not_git_repo"
+    );
+  }
+  const versionOutput = runGit(cwd, ["--version"], { allowFail: true }).stdout.toString("utf-8").trim();
+  if (!gitMeetsFloor(parseGitVersion(versionOutput))) {
+    throw gitTooOld(versionOutput);
+  }
+  const formatResult = runGit(cwd, ["rev-parse", "--show-object-format"], { allowFail: true });
+  const format = formatResult.stdout.toString("utf-8").trim();
+  if (formatResult.status !== 0 || format.startsWith("--")) throw gitTooOld(versionOutput);
+  if (format !== "sha1") {
+    throw new InputError(
+      `This repo uses object format "${format}" \u2014 DeepSpace version control supports sha1 repos only (git's default) for now.`,
+      "unsupported_object_format"
+    );
+  }
+  if (gitLine(cwd, ["rev-parse", "--is-shallow-repository"]) === "true") {
+    throw new InputError(
+      "This is a shallow clone. Run `git fetch --unshallow` before pushing to DeepSpace.",
+      "shallow_repo"
+    );
+  }
+}
+function gitTooOld(versionOutput) {
+  return new InputError(
+    `DeepSpace version control needs git \u2265 2.29 \u2014 found ${versionOutput || "an unknown git version"}. Upgrade git and retry.`,
+    "git_too_old"
+  );
+}
+function repoToplevel(cwd) {
+  return gitLine(cwd, ["rev-parse", "--show-toplevel"]);
+}
+function currentBranch(cwd) {
+  const result = runGit(cwd, ["symbolic-ref", "--short", "-q", "HEAD"], { allowFail: true });
+  const name = result.stdout.toString("utf-8").trim();
+  return result.status === 0 && name ? name : null;
+}
+function resolveCommit(cwd, ref) {
+  const result = runGit(cwd, ["rev-parse", "-q", "--verify", `${ref}^{commit}`], {
+    allowFail: true
+  });
+  const oid = result.stdout.toString("utf-8").trim();
+  return result.status === 0 && /^[0-9a-f]{40}$/.test(oid) ? oid : null;
+}
+function isWorkTreeClean(cwd) {
+  return gitLine(cwd, ["status", "--porcelain"]) === "";
+}
+function updateRef(cwd, ref, oid) {
+  runGit(cwd, ["update-ref", ref, oid]);
+}
+function isAncestor(cwd, ancestor, descendant) {
+  return runGit(cwd, ["merge-base", "--is-ancestor", ancestor, descendant], { allowFail: true }).status === 0;
+}
+function mergeBase(cwd, left, right) {
+  const result = runGit(cwd, ["merge-base", left, right], { allowFail: true });
+  if (result.status !== 0) return null;
+  const oid = result.stdout.toString("utf-8").trim();
+  return /^[0-9a-f]{40}$/.test(oid) ? oid : null;
+}
+function fastForwardCurrentBranch(cwd, oid) {
+  runGit(cwd, ["merge", "--ff-only", oid]);
+}
+function checkoutHead(cwd) {
+  runGit(cwd, ["reset", "--hard", "--quiet"]);
+}
+function switchToNewBranch(cwd, name, oid) {
+  runGit(cwd, ["switch", "--quiet", "-c", name, oid]);
+}
+function diffNameOnly(cwd, base, head) {
+  return splitNulFields(
+    runGit(cwd, [
+      "-c",
+      "core.quotePath=false",
+      "diff",
+      "--name-only",
+      "--no-renames",
+      "-z",
+      base,
+      head
+    ]).stdout
+  );
+}
+function revListCount(cwd, exclude, include) {
+  const count = Number(gitLine(cwd, ["rev-list", "--count", `${exclude}..${include}`]));
+  return Number.isFinite(count) ? count : 0;
+}
+function addWorktreeNewBranch(cwd, dir, branch, oid) {
+  runGit(cwd, ["worktree", "add", "--quiet", "-b", branch, dir, oid]);
+}
+function listWorktrees(cwd) {
+  const result = runGit(cwd, ["worktree", "list", "--porcelain"], { allowFail: true });
+  if (result.status !== 0) return [];
+  const worktrees = [];
+  let current = null;
+  for (const line of result.stdout.toString("utf-8").split("\n")) {
+    if (line.startsWith("worktree ")) {
+      current = { path: line.slice("worktree ".length), branch: null };
+      worktrees.push(current);
+    } else if (line.startsWith("branch ") && current) {
+      const ref = line.slice("branch ".length);
+      current.branch = ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref;
+    }
+  }
+  return worktrees;
+}
+function ensureLocalExclude(cwd, pattern) {
+  const commonDir = resolve3(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
+  const excludePath = join5(commonDir, "info", "exclude");
+  let current = "";
+  try {
+    current = readFileSync6(excludePath, "utf-8");
+  } catch {
+  }
+  if (current.split("\n").some((line) => line.trim() === pattern)) return;
+  try {
+    mkdirSync3(dirname2(excludePath), { recursive: true });
+    appendFileSync(
+      excludePath,
+      `${current.endsWith("\n") || current === "" ? "" : "\n"}${pattern}
+`
+    );
+  } catch {
+  }
+}
+
+// src/cli/lib/launch-config.ts
 function writeLaunchFile(launchPath, config) {
-  mkdirSync3(dirname2(launchPath), { recursive: true });
+  mkdirSync4(dirname3(launchPath), { recursive: true });
   const tmpPath = `${launchPath}.${process.pid}.tmp`;
   writeFileSync4(tmpPath, JSON.stringify(config, null, 2) + "\n");
   try {
@@ -893,14 +1114,14 @@ function writeLaunchFile(launchPath, config) {
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
   if (!existsSync5(launchPath)) return empty;
-  const raw = readFileSync6(launchPath, "utf-8").trim();
+  const raw = readFileSync7(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.configurations)) return null;
   return parsed;
 }
 function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
-  const launchPath = join5(appDir, ".claude", "launch.json");
+  const launchPath = join6(appDir, ".claude", "launch.json");
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return;
@@ -941,7 +1162,7 @@ function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
 }
 function resolveAppLaunchPort(appDir) {
   try {
-    const config = readLaunchFile(join5(appDir, ".claude", "launch.json"));
+    const config = readLaunchFile(join6(appDir, ".claude", "launch.json"));
     if (!config) return null;
     const appName = detectAppName(appDir) ?? basename(appDir);
     const entry = config.configurations.find((c) => c?.name === appName) ?? (config.configurations.length === 1 ? config.configurations[0] : void 0);
@@ -952,32 +1173,55 @@ function resolveAppLaunchPort(appDir) {
   }
 }
 function detectClaudeWorktree(appDir) {
-  const segments = resolve3(appDir).split(sep);
-  for (let i = segments.length - 3; i >= 1; i--) {
-    if (segments[i] === ".claude" && segments[i + 1] === "worktrees" && segments[i + 2]) {
-      return {
-        mainRepoRoot: segments.slice(0, i).join(sep) || sep,
-        worktreeName: segments[i + 2]
-      };
-    }
+  try {
+    const worktreeRoot = canonicalPath(repoToplevel(appDir));
+    const registered = new Set(
+      listWorktrees(appDir).map((worktree) => canonicalPath(worktree.path))
+    );
+    if (!registered.has(worktreeRoot)) return null;
+    const worktreesDir = dirname3(worktreeRoot);
+    const claudeDir = dirname3(worktreesDir);
+    if (basename(worktreesDir) !== "worktrees" || basename(claudeDir) !== ".claude") return null;
+    const ownerRoot = canonicalPath(dirname3(claudeDir));
+    if (!registered.has(ownerRoot)) return null;
+    return { mainRepoRoot: ownerRoot, worktreeName: basename(worktreeRoot) };
+  } catch {
+    return null;
+  }
+}
+function canonicalPath(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve4(path);
+  }
+}
+function detectLinkedWorktree(appDir) {
+  try {
+    const worktreeRoot = canonicalPath(repoToplevel(appDir));
+    const registered = listWorktrees(appDir).map((worktree) => canonicalPath(worktree.path));
+    const currentIndex = registered.indexOf(worktreeRoot);
+    if (currentIndex <= 0 || !registered[0]) return null;
+    return { worktreeRoot, mainRepoRoot: registered[0] };
+  } catch {
+    return null;
   }
-  return null;
 }
 var WORKTREE_ENTRY_PREFIX = "wt-";
 var WORKTREE_PORT_MIN = 5180;
-var WORKTREE_PORT_RANGE = 20;
-function deriveWorktreePort(worktreeName) {
+var WORKTREE_PORT_RANGE = 1e3;
+function deriveWorktreePort(worktreeKey) {
   let hash = 0;
-  for (const ch of worktreeName) hash = hash * 31 + ch.charCodeAt(0) >>> 0;
+  for (const ch of worktreeKey) hash = hash * 31 + ch.charCodeAt(0) >>> 0;
   return WORKTREE_PORT_MIN + hash % WORKTREE_PORT_RANGE;
 }
 function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
-  const launchPath = join5(mainRepoRoot, ".claude", "launch.json");
+  const launchPath = join6(mainRepoRoot, ".claude", "launch.json");
   const entryName = WORKTREE_ENTRY_PREFIX + worktreeName;
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return null;
-    const worktreesRoot = join5(mainRepoRoot, ".claude", "worktrees") + sep;
+    const worktreesRoot = join6(mainRepoRoot, ".claude", "worktrees") + sep;
     config.configurations = config.configurations.filter((c) => {
       if (c?.name === entryName) return false;
       const isStaleWorktreeEntry = typeof c?.name === "string" && c.name.startsWith(WORKTREE_ENTRY_PREFIX) && typeof c.cwd === "string" && isAbsolute2(c.cwd) && c.cwd.startsWith(worktreesRoot) && !existsSync5(c.cwd);
@@ -1001,7 +1245,7 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
       // the Claude Code desktop launch.json reference alongside `port`) and
       // verified end-to-end: with it set, the preview server builds from the
       // worktree instead of the session's main repo.
-      cwd: resolve3(appDir)
+      cwd: resolve4(appDir)
     });
     writeLaunchFile(launchPath, config);
     return { entryName, port };
@@ -1010,22 +1254,25 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
   }
 }
 function resolveWorktreePort(appDir) {
-  const worktree = detectClaudeWorktree(appDir);
-  if (!worktree) return null;
-  try {
-    const config = readLaunchFile(join5(worktree.mainRepoRoot, ".claude", "launch.json"));
-    const entry = config?.configurations.find(
-      (c) => c?.name === WORKTREE_ENTRY_PREFIX + worktree.worktreeName
-    );
-    const port = Number(entry?.port);
-    if (Number.isInteger(port) && port > 0) return port;
-  } catch {
+  const linked = detectLinkedWorktree(appDir);
+  if (!linked) return null;
+  const claude = detectClaudeWorktree(appDir);
+  if (claude) {
+    try {
+      const config = readLaunchFile(join6(claude.mainRepoRoot, ".claude", "launch.json"));
+      const entry = config?.configurations.find(
+        (c) => c?.name === WORKTREE_ENTRY_PREFIX + claude.worktreeName
+      );
+      const port = Number(entry?.port);
+      if (Number.isInteger(port) && port > 0) return port;
+    } catch {
+    }
   }
-  return deriveWorktreePort(worktree.worktreeName);
+  return deriveWorktreePort(linked.worktreeRoot);
 }
 
 // src/cli/lib/dev-vars.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "fs";
 
 // src/cli/lib/app-tokens.ts
 async function fetchPublicKey(authUrl) {
@@ -1542,8 +1789,8 @@ function writeSecretFileSync(path, content) {
 }
 
 // src/cli/lib/wrangler-env.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join7 } from "path";
 import { parse as parseToml3, stringify as stringifyToml } from "smol-toml";
 
 // src/server/rooms/app-name.ts
@@ -1643,11 +1890,11 @@ function resolveAppNameForEnv(config, envName) {
   return resolveAppName(envBlock.name);
 }
 function devVarsPathFor(appDir, envName, opts = {}) {
-  if (opts.sharedDevVarsCache || !envName) return join6(appDir, ".dev.vars");
-  return join6(appDir, `.dev.vars.${envName}`);
+  if (opts.sharedDevVarsCache || !envName) return join7(appDir, ".dev.vars");
+  return join7(appDir, `.dev.vars.${envName}`);
 }
 function legacyEnvDevVarsPathFor(appDir, envName) {
-  return envName ? join6(appDir, `.dev.vars.${envName}`) : void 0;
+  return envName ? join7(appDir, `.dev.vars.${envName}`) : void 0;
 }
 function warnIfLegacyEnvDevVarsExists(appDir, envName, warn = console.warn) {
   const legacyPath = legacyEnvDevVarsPathFor(appDir, envName);
@@ -1666,7 +1913,7 @@ function prepareWranglerEnvConfig(appDir, envName, opts = {}) {
   const resolved = resolveAppNameForEnv(config, envName);
   if (!resolved.ok) throw new Error(resolved.reason);
   const flattened = flattenWranglerEnvConfig(config, envName);
-  const configPath = join6(
+  const configPath = join7(
     appDir,
     `.wrangler.deepspace.${safeGeneratedConfigSegment(envName)}.${process.pid}.${++generatedConfigSeq}.toml`
   );
@@ -1727,8 +1974,8 @@ var WranglerConfigError = class extends Error {
   }
 };
 function readWranglerConfig(appDir) {
-  const path = join6(appDir, "wrangler.toml");
-  const raw = readFileSync7(path, "utf-8");
+  const path = join7(appDir, "wrangler.toml");
+  const raw = readFileSync8(path, "utf-8");
   try {
     return parseToml3(raw);
   } catch (err) {
@@ -1736,7 +1983,7 @@ function readWranglerConfig(appDir) {
   }
 }
 function hasWranglerConfig(appDir) {
-  return existsSync6(join6(appDir, "wrangler.toml"));
+  return existsSync6(join7(appDir, "wrangler.toml"));
 }
 
 // src/cli/lib/dev-vars.ts
@@ -1901,7 +2148,7 @@ async function writeDevVars(appDir, ownerId, callerJwt, wranglerEnv, opts = {})
   const devVarsPath = devVarsPathFor(appDir, wranglerEnv, {
     sharedDevVarsCache: useSharedDevVarsCache
   });
-  const existing = existsSync7(devVarsPath) ? readFileSync8(devVarsPath, "utf-8") : "";
+  const existing = existsSync7(devVarsPath) ? readFileSync9(devVarsPath, "utf-8") : "";
   const custom = opts.generatedSecretsCache ?? extractCustomDevVars(stripGeneratedSecretsCache(existing).trimEnd());
   let body;
   if (!custom) {
@@ -1923,22 +2170,22 @@ ${custom}
 }
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname3, join as join8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname4, join as join9 } from "path";
 
 // src/cli/lib/package-manager.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync10 } from "fs";
+import { join as join8 } from "path";
 function detectPackageManager(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync9(join7(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync10(join8(appDir, "package.json"), "utf-8"));
     const name = typeof pkg2.packageManager === "string" ? pkg2.packageManager.split("@")[0] : "";
     if (name === "npm" || name === "pnpm" || name === "yarn" || name === "bun") return name;
   } catch {
   }
-  if (existsSync8(join7(appDir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(join7(appDir, "yarn.lock"))) return "yarn";
-  if (existsSync8(join7(appDir, "bun.lock")) || existsSync8(join7(appDir, "bun.lockb"))) return "bun";
+  if (existsSync8(join8(appDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync8(join8(appDir, "yarn.lock"))) return "yarn";
+  if (existsSync8(join8(appDir, "bun.lock")) || existsSync8(join8(appDir, "bun.lockb"))) return "bun";
   return "npm";
 }
 function installCommand(appDir) {
@@ -1948,10 +2195,10 @@ function installCommand(appDir) {
 // src/cli/lib/install-status.ts
 function installState(appDir) {
   if (resolvesDeepspace(appDir)) return "ready";
-  const sentinelDir = join8(appDir, ".deepspace");
-  if (existsSync9(join8(sentinelDir, "install.err"))) return "failed";
-  if (existsSync9(join8(sentinelDir, "install.started"))) {
-    if (!existsSync9(join8(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
+  const sentinelDir = join9(appDir, ".deepspace");
+  if (existsSync9(join9(sentinelDir, "install.err"))) return "failed";
+  if (existsSync9(join9(sentinelDir, "install.started"))) {
+    if (!existsSync9(join9(sentinelDir, "install.done")) && installWorkerAlive(sentinelDir)) {
       return "installing";
     }
     return "failed";
@@ -1963,16 +2210,16 @@ function tailHint(logPath, platform = process.platform) {
 }
 function ensureInstallReady(appDir) {
   if (resolvesDeepspace(appDir)) return;
-  const sentinelDir = join8(appDir, ".deepspace");
-  const errPath = join8(sentinelDir, "install.err");
-  const startedPath = join8(sentinelDir, "install.started");
-  const donePath = join8(sentinelDir, "install.done");
-  const logPath = join8(sentinelDir, "install.log");
+  const sentinelDir = join9(appDir, ".deepspace");
+  const errPath = join9(sentinelDir, "install.err");
+  const startedPath = join9(sentinelDir, "install.started");
+  const donePath = join9(sentinelDir, "install.done");
+  const logPath = join9(sentinelDir, "install.log");
   if (existsSync9(errPath)) {
-    const detail = readFileSync10(errPath, "utf-8").trimEnd();
+    const detail = readFileSync11(errPath, "utf-8").trimEnd();
     const log28 = existsSync9(logPath) ? ` Full log: ${logPath}.` : "";
     throw new Refusal(
-      `Background install failed: ${detail}.${log28} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+      `Dependency install failed: ${detail}.${log28} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
       "install_failed",
       { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
     );
@@ -1981,14 +2228,14 @@ function ensureInstallReady(appDir) {
     if (!installWorkerAlive(sentinelDir)) {
       const log28 = existsSync9(logPath) ? ` See what happened: ${logPath}.` : "";
       throw new Refusal(
-        `The background install is no longer running and never finished.${log28} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
+        `The dependency install is no longer running and never finished.${log28} Run \`npm install\` (or \`bun install\`) manually, then retry.`,
         "install_failed",
         { action: { cwd: appDir, argv: [detectPackageManager(appDir), "install"] } }
       );
     }
     const tail = existsSync9(logPath) ? ` Tail progress: ${tailHint(logPath)}.` : "";
     throw new Refusal(
-      `Dependencies are still installing in the background.${tail} Retry once it finishes.`,
+      `Dependencies are still installing.${tail} Retry once it finishes.`,
       "install_in_progress"
     );
   }
@@ -2003,16 +2250,16 @@ function ensureInstallReady(appDir) {
 function resolvesDeepspace(fromDir) {
   let dir = fromDir;
   for (; ; ) {
-    if (existsSync9(join8(dir, "node_modules", "deepspace", "package.json"))) return true;
-    const parent = dirname3(dir);
+    if (existsSync9(join9(dir, "node_modules", "deepspace", "package.json"))) return true;
+    const parent = dirname4(dir);
     if (parent === dir) return false;
     dir = parent;
   }
 }
 function installWorkerAlive(sentinelDir) {
-  const pidPath = join8(sentinelDir, "install.pid");
+  const pidPath = join9(sentinelDir, "install.pid");
   if (!existsSync9(pidPath)) return false;
-  const pid = Number(readFileSync10(pidPath, "utf-8").trim());
+  const pid = Number(readFileSync11(pidPath, "utf-8").trim());
   if (!Number.isSafeInteger(pid) || pid <= 0) return false;
   try {
     process.kill(pid, 0);
@@ -2026,7 +2273,7 @@ function installWorkerAlive(sentinelDir) {
 import { execFileSync } from "child_process";
 import { existsSync as existsSync10 } from "fs";
 import * as nodeModule from "module";
-import { resolve as resolve4 } from "path";
+import { resolve as resolve5 } from "path";
 function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.registerHooks === "function") {
   if (hasRegisterHooks) return;
   throw new Refusal(
@@ -2037,7 +2284,7 @@ function preflightNodeVersion(command, hasRegisterHooks = typeof nodeModule.regi
 var DLL_NOT_FOUND = -1073741515;
 function preflightWindowsWorkerd(appDir) {
   if (process.platform !== "win32") return;
-  const workerdExe = resolve4(
+  const workerdExe = resolve5(
     appDir,
     "node_modules",
     "@cloudflare",
@@ -2061,7 +2308,7 @@ function preflightWindowsWorkerd(appDir) {
 
 // src/cli/lib/macos-junk.ts
 import { readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler", ".vite"]);
 function removeMacosJunk(dir) {
   let removed = 0;
@@ -2072,7 +2319,7 @@ function removeMacosJunk(dir) {
     return removed;
   }
   for (const entry of entries) {
-    const path = join9(dir, entry.name);
+    const path = join10(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name)) removed += removeMacosJunk(path);
       continue;
@@ -2090,7 +2337,7 @@ function removeMacosJunk(dir) {
 
 // src/cli/lib/schema-lint.ts
 import { existsSync as existsSync11 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { pathToFileURL } from "url";
 
 // src/server/schemas/registry.ts
@@ -2146,12 +2393,12 @@ function lintSchema(schema) {
 
 // src/cli/lib/schema-lint.ts
 async function lintProjectSchemas(appDir) {
-  const schemasPath = join10(appDir, "src", "schemas.ts");
+  const schemasPath = join11(appDir, "src", "schemas.ts");
   if (!existsSync11(schemasPath)) return null;
   let schemas;
   try {
     const esbuild = await import("esbuild");
-    const outFile = join10(appDir, ".wrangler", "deploy", "schemas.lint.bundle.mjs");
+    const outFile = join11(appDir, ".wrangler", "deploy", "schemas.lint.bundle.mjs");
     await esbuild.build({
       entryPoints: [schemasPath],
       bundle: true,
@@ -2256,7 +2503,7 @@ var dev_default = defineDeepspaceCommand({
     };
     preflightNodeVersion("dev start");
     const wranglerEnv = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    const start = resolve5(args.dir ?? ".");
+    const start = resolve6(args.dir ?? ".");
     const appDir = findAppDir(start);
     if (!appDir) {
       throw new Refusal(noAppDirMessage(start, findChildApps(start)), "no_app_dir");
@@ -2264,8 +2511,10 @@ var dev_default = defineDeepspaceCommand({
     const junk = removeMacosJunk(appDir);
     if (junk > 0) say(`Removed ${junk} macOS metadata file(s) (._*, .DS_Store)`);
     const worktree = detectClaudeWorktree(appDir);
+    const linkedWorktree = detectLinkedWorktree(appDir);
     const explicitPort = Boolean(args.port);
-    let port = worktree && !explicitPort ? deriveWorktreePort(worktree.worktreeName) : resolvePort(args.port);
+    const configuredPort = explicitPort || Boolean(process.env.DEEPSPACE_PORT);
+    let port = linkedWorktree && !configuredPort ? deriveWorktreePort(linkedWorktree.worktreeRoot) : resolvePort(args.port);
     if (worktree) {
       const upserted = upsertWorktreeLaunchConfig(
         worktree.mainRepoRoot,
@@ -2273,7 +2522,7 @@ var dev_default = defineDeepspaceCommand({
         appDir,
         {
           port,
-          probePort: !explicitPort,
+          probePort: !configuredPort,
           extraArgs: [...wranglerEnv ? ["--env", wranglerEnv] : []]
         }
       );
@@ -2284,12 +2533,7 @@ var dev_default = defineDeepspaceCommand({
         );
       } else if (!args.json) {
         console.warn(
-          `Warning: could not update ${join11(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
-        );
-      }
-      if (!explicitPort && process.env.DEEPSPACE_PORT) {
-        say(
-          `Ignoring DEEPSPACE_PORT=${process.env.DEEPSPACE_PORT} inside a worktree \u2014 using per-worktree port ${port}. Pass --port to override.`
+          `Warning: could not update ${join12(worktree.mainRepoRoot, ".claude", "launch.json")} (malformed or unwritable) \u2014 the Claude preview tool may serve the main repo's code instead of this worktree.`
         );
       }
     }
@@ -2388,15 +2632,15 @@ Free it with \`${killCmd}\`, or start on another port: \`deepspace dev start --p
 });
 
 // src/cli/commands/kill.ts
-import { spawnSync } from "child_process";
-import { readFileSync as readFileSync11, readdirSync as readdirSync3, readlinkSync } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { readFileSync as readFileSync12, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
 function pickKillPort(opts) {
   if (opts.explicit != null) return opts.explicit;
-  if (opts.worktree != null) return opts.worktree;
   if (opts.env != null) return opts.env;
+  if (opts.worktree != null) return opts.worktree;
   return opts.appLaunch ?? DEFAULT_PORT;
 }
 var kill_default = defineDeepspaceCommand({
@@ -2523,7 +2767,7 @@ function listenerPids(port) {
 }
 function runLsof(port) {
   try {
-    const r = spawnSync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"], {
+    const r = spawnSync2("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"], {
       encoding: "utf-8"
     });
     if (r.error) return { pids: [], ran: false };
@@ -2540,7 +2784,7 @@ function listenerPidsViaProc(port) {
     for (const f of ["/proc/net/tcp", "/proc/net/tcp6"]) {
       let data;
       try {
-        data = readFileSync11(f, "utf-8");
+        data = readFileSync12(f, "utf-8");
       } catch {
         continue;
       }
@@ -2608,16 +2852,19 @@ function sweepByName(names) {
 }
 function runPgrep(pgrepArgs) {
   try {
-    const r = spawnSync("pgrep", pgrepArgs, { encoding: "utf-8" });
+    const r = spawnSync2("pgrep", pgrepArgs, { encoding: "utf-8" });
     if (r.error) return { pids: [], ran: false };
-    return { pids: r.status === 0 ? parsePidLines(r.stdout) : [], ran: r.status === 0 || r.status === 1 };
+    return {
+      pids: r.status === 0 ? parsePidLines(r.stdout) : [],
+      ran: r.status === 0 || r.status === 1
+    };
   } catch {
     return { pids: [], ran: false };
   }
 }
 function run(cmd) {
   try {
-    const r = spawnSync(cmd[0], cmd.slice(1), { encoding: "utf-8" });
+    const r = spawnSync2(cmd[0], cmd.slice(1), { encoding: "utf-8" });
     if (r.status !== 0) return [];
     return parsePidLines(r.stdout);
   } catch {
@@ -2630,7 +2877,7 @@ function runPowershell(script) {
 function runPowershellChecked(script) {
   const exe = pwshOrPowershell();
   try {
-    const r = spawnSync(exe, ["-NoProfile", "-NonInteractive", "-Command", script], {
+    const r = spawnSync2(exe, ["-NoProfile", "-NonInteractive", "-Command", script], {
       encoding: "utf-8"
     });
     if (r.error) return { pids: [], ran: false };
@@ -2640,7 +2887,7 @@ function runPowershellChecked(script) {
   }
 }
 function pwshOrPowershell() {
-  const probe = spawnSync("pwsh", ["-NoProfile", "-Command", "$PSVersionTable.PSVersion.Major"], {
+  const probe = spawnSync2("pwsh", ["-NoProfile", "-Command", "$PSVersionTable.PSVersion.Major"], {
     encoding: "utf-8"
   });
   if (probe.status === 0) return "pwsh";
@@ -2667,12 +2914,12 @@ function isAlive(pid) {
 }
 
 // src/cli/commands/test.ts
-import { resolve as resolve6 } from "path";
-import { sync as spawnSync3 } from "cross-spawn";
+import { resolve as resolve7 } from "path";
+import { sync as spawnSync4 } from "cross-spawn";
 
 // src/cli/lib/playwright.ts
 import { execSync } from "child_process";
-import { sync as spawnSync2 } from "cross-spawn";
+import { sync as spawnSync3 } from "cross-spawn";
 function ensurePlaywright(appDir) {
   try {
     execSync("npx playwright --version", { cwd: appDir, stdio: "pipe" });
@@ -2683,7 +2930,7 @@ function ensurePlaywright(appDir) {
   const isLinux = process.platform === "linux";
   const isRoot = isLinux && typeof process.getuid === "function" && process.getuid() === 0;
   const args = isRoot ? ["install", "--with-deps", "chromium"] : ["install", "chromium"];
-  const result = spawnSync2("npx", ["playwright", ...args], {
+  const result = spawnSync3("npx", ["playwright", ...args], {
     cwd: appDir,
     stdio: "inherit"
   });
@@ -2727,18 +2974,14 @@ var test_default = defineDeepspaceCommand({
     preflightNodeVersion("test run");
     const suite = args.suite ?? "default";
     const wranglerEnv = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    const start = resolve6(".");
+    const start = resolve7(".");
     const appDir = findAppDir(start);
     if (!appDir) {
       throw new Refusal(noAppDirMessage(start, findChildApps(start)), "no_app_dir");
     }
-    const worktreePort = args.port ? null : resolveWorktreePort(appDir);
+    const configuredPort = Boolean(args.port) || Boolean(process.env.DEEPSPACE_PORT);
+    const worktreePort = configuredPort ? null : resolveWorktreePort(appDir);
     const port = worktreePort ?? resolvePort(args.port);
-    if (worktreePort && process.env.DEEPSPACE_PORT) {
-      say(
-        `Ignoring DEEPSPACE_PORT=${process.env.DEEPSPACE_PORT} inside a worktree \u2014 targeting per-worktree port ${port}. Pass --port to override.`
-      );
-    }
     ensureInstallReady(appDir);
     let token;
     let ownerId;
@@ -2846,7 +3089,7 @@ function runPlaywright(appDir, testFiles, port, wranglerEnv, sharedDevVarsCache
     return 1;
   }
   try {
-    const result = spawnSync3(
+    const result = spawnSync4(
       "npx",
       ["playwright", "test", "--config", "tests/playwright.config.ts", ...testFiles],
       {
@@ -2861,7 +3104,7 @@ function runPlaywright(appDir, testFiles, port, wranglerEnv, sharedDevVarsCache
   }
 }
 function runVitest(appDir) {
-  const result = spawnSync3("npx", ["vitest", "run", "--passWithNoTests"], {
+  const result = spawnSync4("npx", ["vitest", "run", "--passWithNoTests"], {
     cwd: appDir,
     stdio: "inherit"
   });
@@ -2869,8 +3112,8 @@ function runVitest(appDir) {
 }
 
 // src/cli/commands/screenshot.ts
-import { sync as spawnSync4 } from "cross-spawn";
-import { resolve as resolve7 } from "path";
+import { sync as spawnSync5 } from "cross-spawn";
+import { resolve as resolve8 } from "path";
 var screenshot_default = defineDeepspaceCommand({
   meta: {
     name: "screenshot",
@@ -2899,7 +3142,7 @@ var screenshot_default = defineDeepspaceCommand({
     }
   },
   async run({ args }) {
-    const appDir = resolve7(".");
+    const appDir = resolve8(".");
     ensurePlaywright(appDir);
     const url = String(args.url);
     const output = String(args.output);
@@ -2908,7 +3151,7 @@ var screenshot_default = defineDeepspaceCommand({
     if (args["wait-for-timeout"]) {
       playwrightArgs.push("--wait-for-timeout", String(args["wait-for-timeout"]));
     }
-    const result = spawnSync4("npx", playwrightArgs, {
+    const result = spawnSync5("npx", playwrightArgs, {
       cwd: appDir,
       stdio: "inherit"
     });
@@ -2925,27 +3168,27 @@ var screenshot_default = defineDeepspaceCommand({
 // src/cli/commands/test-accounts.ts
 import { defineCommand as defineCommand2 } from "citty";
 import * as p5 from "@clack/prompts";
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, existsSync as existsSync12, mkdirSync as mkdirSync4 } from "fs";
-import { join as join12 } from "path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync7, existsSync as existsSync12, mkdirSync as mkdirSync5 } from "fs";
+import { join as join13 } from "path";
 import { homedir as homedir3 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
 var AUTH_URL4 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
-var DIR2 = join12(homedir3(), ".deepspace");
-var ACCOUNTS_PATH = join12(DIR2, "test-accounts.json");
+var DIR2 = join13(homedir3(), ".deepspace");
+var ACCOUNTS_PATH = join13(DIR2, "test-accounts.json");
 function loadAccounts() {
   if (!existsSync12(ACCOUNTS_PATH)) return [];
   try {
-    return JSON.parse(readFileSync12(ACCOUNTS_PATH, "utf-8"));
+    return JSON.parse(readFileSync13(ACCOUNTS_PATH, "utf-8"));
   } catch {
     return [];
   }
 }
 function saveAccounts(accounts) {
-  mkdirSync4(DIR2, { recursive: true });
+  mkdirSync5(DIR2, { recursive: true });
   writeFileSync7(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
 }
 function sessionCookie() {
-  const token = readFileSync12(SESSION_PATH, "utf-8").trim();
+  const token = readFileSync13(SESSION_PATH, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteAccounts() {
@@ -3261,8 +3504,8 @@ import { resolve as resolve11 } from "path";
 // src/cli/commands/deploy/build.ts
 import * as p6 from "@clack/prompts";
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync4 } from "fs";
-import { dirname as dirname4, join as join13, resolve as resolve8 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync14, readdirSync as readdirSync4 } from "fs";
+import { dirname as dirname5, join as join14, resolve as resolve9 } from "path";
 var RESERVED_RUN_WORKER_FIRST = /* @__PURE__ */ new Set([
   "/api/*",
   "/ws/*",
@@ -3298,19 +3541,19 @@ async function buildDeployBundle(options) {
     preparedWranglerConfig?.cleanup();
   }
   spinner2.stop("Built");
-  const deployConfigPath = join13(appDir, ".wrangler", "deploy", "config.json");
+  const deployConfigPath = join14(appDir, ".wrangler", "deploy", "config.json");
   if (!existsSync13(deployConfigPath)) {
     output.die(
       "Build output config not found at .wrangler/deploy/config.json",
       "build_output_missing"
     );
   }
-  const deployConfig = JSON.parse(readFileSync13(deployConfigPath, "utf-8"));
-  const outputWranglerPath = resolve8(dirname4(deployConfigPath), deployConfig.configPath);
+  const deployConfig = JSON.parse(readFileSync14(deployConfigPath, "utf-8"));
+  const outputWranglerPath = resolve9(dirname5(deployConfigPath), deployConfig.configPath);
   if (!existsSync13(outputWranglerPath)) {
     output.die(`Output wrangler.json not found at ${outputWranglerPath}`, "build_output_missing");
   }
-  const outputConfig = JSON.parse(readFileSync13(outputWranglerPath, "utf-8"));
+  const outputConfig = JSON.parse(readFileSync14(outputWranglerPath, "utf-8"));
   if (outputConfig.name && outputConfig.name !== appName) {
     const envHint = envName ? ` (--env ${envName})` : "";
     output.die(
@@ -3318,9 +3561,9 @@ async function buildDeployBundle(options) {
       "build_output_mismatch"
     );
   }
-  const workerDir = dirname4(outputWranglerPath);
-  const workerBundlePath = join13(workerDir, outputConfig.main);
-  const clientDir = outputConfig.assets?.directory ? resolve8(workerDir, outputConfig.assets.directory) : null;
+  const workerDir = dirname5(outputWranglerPath);
+  const workerBundlePath = join14(workerDir, outputConfig.main);
+  const clientDir = outputConfig.assets?.directory ? resolve9(workerDir, outputConfig.assets.directory) : null;
   if (!existsSync13(workerBundlePath)) {
     output.die(`Worker bundle not found at ${workerBundlePath}`, "build_output_missing");
   }
@@ -3330,7 +3573,7 @@ async function buildDeployBundle(options) {
   spinner2.start("Collecting assets...");
   const assets = collectAssets(clientDir);
   spinner2.stop(`Collected ${assets.length} assets`);
-  const workerJs = readFileSync13(workerBundlePath, "utf-8");
+  const workerJs = readFileSync14(workerBundlePath, "utf-8");
   const doBindings = outputConfig.durable_objects?.bindings;
   const sqliteClasses = new Set(
     outputConfig.migrations?.flatMap((migration) => migration.new_sqlite_classes ?? []) ?? []
@@ -3383,14 +3626,14 @@ function collectAssets(dir) {
   const walk = (currentDir, prefix) => {
     for (const entry of readdirSync4(currentDir, { withFileTypes: true })) {
       if (entry.name === ".assetsignore") continue;
-      const fullPath = join13(currentDir, entry.name);
+      const fullPath = join14(currentDir, entry.name);
       const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk(fullPath, relativePath);
       } else {
         assets.push({
           path: `/${relativePath}`,
-          contentBase64: readFileSync13(fullPath).toString("base64")
+          contentBase64: readFileSync14(fullPath).toString("base64")
         });
       }
     }
@@ -3405,17 +3648,17 @@ function errorMessage(error) {
 // src/cli/commands/deploy/commerce.ts
 import * as p7 from "@clack/prompts";
 import { existsSync as existsSync14 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var API_URL2 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 async function loadDeclaration(appDir, sourceFile, outputFile, exportName) {
-  const sourcePath = join14(appDir, "src", sourceFile);
+  const sourcePath = join15(appDir, "src", sourceFile);
   if (!existsSync14(sourcePath)) return void 0;
   const esbuild = await import("esbuild");
-  const outputPath = join14(appDir, ".wrangler", "deploy", outputFile);
+  const outputPath = join15(appDir, ".wrangler", "deploy", outputFile);
   await esbuild.build({
     entryPoints: [sourcePath],
     bundle: true,
@@ -3508,7 +3751,7 @@ Stripe will keep charging them until you cancel. Cancel at the end of their curr
   }
 }
 async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
-  if (!existsSync14(join14(appDir, "src", "subscriptions.ts"))) return;
+  if (!existsSync14(join15(appDir, "src", "subscriptions.ts"))) return;
   let plans;
   try {
     plans = await loadDeclaration(
@@ -3563,7 +3806,7 @@ async function syncSubscriptionPlans(appDir, appName, token, nonInteractive) {
   }
 }
 async function syncOneTimeProducts(appDir, appName, token) {
-  if (!existsSync14(join14(appDir, "src", "products.ts"))) return;
+  if (!existsSync14(join15(appDir, "src", "products.ts"))) return;
   let products;
   try {
     products = await loadDeclaration(
@@ -3669,217 +3912,6 @@ import { randomUUID as randomUUID2 } from "crypto";
 // src/cli/commands/deploy/repository.ts
 import * as p9 from "@clack/prompts";
 
-// src/cli/lib/git/repository.ts
-import { appendFileSync, mkdirSync as mkdirSync5, readFileSync as readFileSync14 } from "fs";
-import { dirname as dirname5, join as join15, resolve as resolve9 } from "path";
-
-// src/cli/lib/git/process.ts
-import { sync as spawnSync5 } from "cross-spawn";
-var MAX_GIT_BUFFER = 512 * 1024 * 1024;
-var GitError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "GitError";
-  }
-};
-function runGit(cwd, args, opts = {}) {
-  const result = spawnSync5("git", args, {
-    cwd,
-    input: opts.input,
-    maxBuffer: MAX_GIT_BUFFER,
-    stdio: ["pipe", "pipe", "pipe"],
-    env: {
-      ...process.env,
-      GIT_TERMINAL_PROMPT: "0",
-      LC_ALL: "C",
-      ...opts.env ?? {}
-    }
-  });
-  if (result.error) {
-    const code = result.error.code;
-    if (code === "ENOENT") {
-      throw new GitError(
-        "git is not installed or not on PATH \u2014 install git and retry.",
-        "git_not_installed"
-      );
-    }
-    throw new GitError(`git ${args[0]} failed: ${result.error.message}`);
-  }
-  const status3 = result.status ?? 1;
-  if (status3 !== 0 && !opts.allowFail) {
-    const stderr = result.stderr?.toString("utf-8").trim() ?? "";
-    throw new GitError(`git ${args.join(" ")} exited ${status3}${stderr ? `: ${stderr}` : ""}`);
-  }
-  return {
-    stdout: result.stdout ?? Buffer.alloc(0),
-    stderr: result.stderr ?? Buffer.alloc(0),
-    status: status3
-  };
-}
-function gitLine(cwd, args) {
-  return runGit(cwd, args).stdout.toString("utf-8").trim();
-}
-function splitNulFields(buffer) {
-  const fields = [];
-  let start = 0;
-  for (let index = 0; index < buffer.length; index++) {
-    if (buffer[index] === 0) {
-      fields.push(buffer.toString("utf-8", start, index));
-      start = index + 1;
-    }
-  }
-  if (start < buffer.length) fields.push(buffer.toString("utf-8", start));
-  return fields;
-}
-function parseGitVersion(output) {
-  const match = /(\d+)\.(\d+)/.exec(output);
-  return match ? [Number(match[1]), Number(match[2])] : null;
-}
-function gitMeetsFloor(version) {
-  if (!version) return true;
-  const [major, minor] = version;
-  return major > 2 || major === 2 && minor >= 29;
-}
-
-// src/cli/lib/git/repository.ts
-function isPlausibleBranchName(name) {
-  if (!name || name === "HEAD" || name === "@") return false;
-  if (name.startsWith("/") || name.startsWith("-") || name.startsWith(".")) return false;
-  if (name.endsWith("/") || name.endsWith(".") || name.endsWith(".lock")) return false;
-  if (name.includes("/.") || name.includes(".lock/")) return false;
-  return !/(\.\.|\/\/|@\{|[\x00-\x20\x7f~^:?*[\\])/.test(name);
-}
-function assertSyncableRepo(cwd) {
-  const inside = runGit(cwd, ["rev-parse", "--is-inside-work-tree"], { allowFail: true });
-  if (inside.status !== 0 || inside.stdout.toString().trim() !== "true") {
-    throw new InputError(
-      `${cwd} is not a git repository. DeepSpace apps are scaffolded as git repos \u2014 run \`git init\` first.`,
-      "not_git_repo"
-    );
-  }
-  const versionOutput = runGit(cwd, ["--version"], { allowFail: true }).stdout.toString("utf-8").trim();
-  if (!gitMeetsFloor(parseGitVersion(versionOutput))) {
-    throw gitTooOld(versionOutput);
-  }
-  const formatResult = runGit(cwd, ["rev-parse", "--show-object-format"], { allowFail: true });
-  const format = formatResult.stdout.toString("utf-8").trim();
-  if (formatResult.status !== 0 || format.startsWith("--")) throw gitTooOld(versionOutput);
-  if (format !== "sha1") {
-    throw new InputError(
-      `This repo uses object format "${format}" \u2014 DeepSpace version control supports sha1 repos only (git's default) for now.`,
-      "unsupported_object_format"
-    );
-  }
-  if (gitLine(cwd, ["rev-parse", "--is-shallow-repository"]) === "true") {
-    throw new InputError(
-      "This is a shallow clone. Run `git fetch --unshallow` before pushing to DeepSpace.",
-      "shallow_repo"
-    );
-  }
-}
-function gitTooOld(versionOutput) {
-  return new InputError(
-    `DeepSpace version control needs git \u2265 2.29 \u2014 found ${versionOutput || "an unknown git version"}. Upgrade git and retry.`,
-    "git_too_old"
-  );
-}
-function repoToplevel(cwd) {
-  return gitLine(cwd, ["rev-parse", "--show-toplevel"]);
-}
-function currentBranch(cwd) {
-  const result = runGit(cwd, ["symbolic-ref", "--short", "-q", "HEAD"], { allowFail: true });
-  const name = result.stdout.toString("utf-8").trim();
-  return result.status === 0 && name ? name : null;
-}
-function resolveCommit(cwd, ref) {
-  const result = runGit(cwd, ["rev-parse", "-q", "--verify", `${ref}^{commit}`], {
-    allowFail: true
-  });
-  const oid = result.stdout.toString("utf-8").trim();
-  return result.status === 0 && /^[0-9a-f]{40}$/.test(oid) ? oid : null;
-}
-function isWorkTreeClean(cwd) {
-  return gitLine(cwd, ["status", "--porcelain"]) === "";
-}
-function updateRef(cwd, ref, oid) {
-  runGit(cwd, ["update-ref", ref, oid]);
-}
-function isAncestor(cwd, ancestor, descendant) {
-  return runGit(cwd, ["merge-base", "--is-ancestor", ancestor, descendant], { allowFail: true }).status === 0;
-}
-function mergeBase(cwd, left, right) {
-  const result = runGit(cwd, ["merge-base", left, right], { allowFail: true });
-  if (result.status !== 0) return null;
-  const oid = result.stdout.toString("utf-8").trim();
-  return /^[0-9a-f]{40}$/.test(oid) ? oid : null;
-}
-function fastForwardCurrentBranch(cwd, oid) {
-  runGit(cwd, ["merge", "--ff-only", oid]);
-}
-function checkoutHead(cwd) {
-  runGit(cwd, ["reset", "--hard", "--quiet"]);
-}
-function switchToNewBranch(cwd, name, oid) {
-  runGit(cwd, ["switch", "--quiet", "-c", name, oid]);
-}
-function diffNameOnly(cwd, base, head) {
-  return splitNulFields(
-    runGit(cwd, [
-      "-c",
-      "core.quotePath=false",
-      "diff",
-      "--name-only",
-      "--no-renames",
-      "-z",
-      base,
-      head
-    ]).stdout
-  );
-}
-function revListCount(cwd, exclude, include) {
-  const count = Number(gitLine(cwd, ["rev-list", "--count", `${exclude}..${include}`]));
-  return Number.isFinite(count) ? count : 0;
-}
-function addWorktreeNewBranch(cwd, dir, branch, oid) {
-  runGit(cwd, ["worktree", "add", "--quiet", "-b", branch, dir, oid]);
-}
-function listWorktrees(cwd) {
-  const result = runGit(cwd, ["worktree", "list", "--porcelain"], { allowFail: true });
-  if (result.status !== 0) return [];
-  const worktrees = [];
-  let current = null;
-  for (const line of result.stdout.toString("utf-8").split("\n")) {
-    if (line.startsWith("worktree ")) {
-      current = { path: line.slice("worktree ".length), branch: null };
-      worktrees.push(current);
-    } else if (line.startsWith("branch ") && current) {
-      const ref = line.slice("branch ".length);
-      current.branch = ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref;
-    }
-  }
-  return worktrees;
-}
-function ensureLocalExclude(cwd, pattern) {
-  const commonDir = resolve9(cwd, gitLine(cwd, ["rev-parse", "--git-common-dir"]));
-  const excludePath = join15(commonDir, "info", "exclude");
-  let current = "";
-  try {
-    current = readFileSync14(excludePath, "utf-8");
-  } catch {
-  }
-  if (current.split("\n").some((line) => line.trim() === pattern)) return;
-  try {
-    mkdirSync5(dirname5(excludePath), { recursive: true });
-    appendFileSync(
-      excludePath,
-      `${current.endsWith("\n") || current === "" ? "" : "\n"}${pattern}
-`
-    );
-  } catch {
-  }
-}
-
 // src/cli/lib/git/safety.ts
 var SECRET_FILE_RE = /(^|\/)(\.dev\.vars(\.[^/]*)?|\.env(\.[^/]*)?|\.npmrc|\.envrc|\.mcp\.json)$/i;
 var SECRET_TEMPLATE_RE = /\.(example|sample|template)$/i;
@@ -4110,7 +4142,15 @@ function installCredentialHelper(cwd, url) {
     const key = `credential.${origin.protocol}//${origin.host}.helper`;
     const helper = credentialHelperCommand();
     const wanted = ["", helper];
-    const scope = entryIsTransient(cwd) ? "--local" : "--global";
+    const transient = entryIsTransient(cwd);
+    const scope = transient ? "--worktree" : "--global";
+    if (transient) {
+      const enabled = runGit(cwd, ["config", "--local", "extensions.worktreeConfig", "true"], {
+        allowFail: true
+      });
+      if (enabled.status !== 0) return;
+      runGit(cwd, ["config", "--local", "--unset-all", key], { allowFail: true });
+    }
     const current = runGit(cwd, ["config", scope, "--get-all", key], { allowFail: true });
     if (current.status === 0) {
       const existing = current.stdout.toString("utf-8").split("\n").filter((_, index, lines) => index < lines.length - 1);
@@ -4306,8 +4346,9 @@ async function syncDeployRepository(options) {
       output.die(refusal.error, refusal.code);
     }
     if (!branch) {
-      commitOid = resolveCommit(appDir, "HEAD");
-      return { commitOid, recoverable, deployKey };
+      const refusal = detachedHeadRefusal();
+      output.die(refusal.error, refusal.code);
+      throw new Error(refusal.error);
     }
     const tip = resolveCommit(appDir, `refs/heads/${branch}`);
     if (!tip) return { commitOid, recoverable, deployKey };
@@ -4453,6 +4494,12 @@ function dirtyWorktreeRefusal(branch) {
     error: "The worktree has uncommitted changes, and a deploy records the commit it ships. " + (workspaceId ? `Commit them to this workspace branch (${branch}) \u2014 WIP commits are fine \u2014 then redeploy. ` : 'Commit them (to a workspace branch if this is work in progress: `deepspace workspace new -t "\u2026"`), then redeploy. ') + "Or pass --no-push to deploy without version-control sync \u2014 the release then records no source lineage."
   };
 }
+function detachedHeadRefusal() {
+  return {
+    code: "detached_head",
+    error: "HEAD is detached, so DeepSpace cannot publish this commit to a recoverable branch. Create or switch to a branch before deploying, or pass `--no-push` to explicitly deploy without source lineage."
+  };
+}
 
 // src/cli/commands/deploy/request.ts
 var CLOUDFLARE_DEPLOY_ERROR_HINT = "Deployment reached the DeepSpace deploy worker, but Cloudflare's deployment control-plane API failed. This is often caused by a Cloudflare Dashboard/API incident or Workers for Platforms entitlement outage. Already deployed apps should keep serving; wait for Cloudflare to recover and retry.";
@@ -5694,7 +5741,7 @@ var usage_default = defineDeepspaceCommand({
 });
 
 // src/cli/commands/add.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17, realpathSync } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync17, realpathSync as realpathSync2 } from "fs";
 import { dirname as dirname7, join as join17, resolve as resolve13 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
@@ -6435,7 +6482,7 @@ async function targetInstaller(appDir) {
       "feature_installer_missing"
     );
   }
-  if (realpathSync(installedRoot) === realpathSync(featurePackageRoot())) {
+  if (realpathSync2(installedRoot) === realpathSync2(featurePackageRoot())) {
     return { installFeature };
   }
   const entry = join17(installedRoot, "dist", "feature-installer.js");
@@ -8588,7 +8635,7 @@ var status_default = defineCommand11({
       const depsInstallCommand = installCommand(appDir);
       lines.push([
         "Deps",
-        deps === "ready" ? "installed" : deps === "installing" ? "still installing (scaffold background install)" : `${deps} \u2014 run ${depsInstallCommand}`
+        deps === "ready" ? "installed" : deps === "installing" ? "dependency installation is still running" : `${deps} \u2014 run ${depsInstallCommand}`
       ]);
       json.deps = deps;
       let branch = null;
@@ -8918,7 +8965,7 @@ var push_default = defineDeepspaceCommand({
 
 // src/cli/commands/pull.ts
 import * as p20 from "@clack/prompts";
-import { realpathSync as realpathSync2 } from "fs";
+import { realpathSync as realpathSync3 } from "fs";
 function targetedVcAction(command, cwd, appId, branch) {
   return {
     cwd,
@@ -8942,7 +8989,7 @@ function workspaceBranchPullRefusal(branch, trunkBranch) {
 function worktreeHoldingBranch(worktrees, branch, selfPath) {
   const real = (pth) => {
     try {
-      return realpathSync2(pth);
+      return realpathSync3(pth);
     } catch {
       return pth;
     }
@@ -9506,7 +9553,7 @@ import { defineCommand as defineCommand12 } from "citty";
 
 // src/cli/commands/workspace/new.ts
 import * as p26 from "@clack/prompts";
-import { isAbsolute as isAbsolute6, join as join22, resolve as resolve16 } from "path";
+import { isAbsolute as isAbsolute6, resolve as resolve16 } from "path";
 
 // src/cli/commands/workspace/analysis.ts
 import * as p24 from "@clack/prompts";
@@ -9631,44 +9678,75 @@ function printOverlaps(overlaps, json) {
 
 // src/cli/commands/workspace/local.ts
 import * as p25 from "@clack/prompts";
-import { existsSync as existsSync23, realpathSync as realpathSync3, statSync, symlinkSync } from "fs";
-import { isAbsolute as isAbsolute5, join as join21, relative as relative2, sep as sep2 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync23, realpathSync as realpathSync4, renameSync as renameSync2, statSync, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join21, relative as relative2, sep as sep2 } from "path";
+var WORKSPACE_MARKER = "deepspace-workspace.json";
 function excludeWorktreeDir(appDir, dir) {
   try {
     ensureLocalExclude(appDir, ".deepspace/");
-    const realDir = realpathSync3(dir);
-    const rel = relative2(realpathSync3(repoToplevel(appDir)), realDir);
+    const realDir = realpathSync4(dir);
+    const rel = relative2(realpathSync4(repoToplevel(appDir)), realDir);
     if (!rel || rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute5(rel)) return;
     const pattern = rel.split(sep2).join("/");
     if (pattern === ".deepspace" || pattern.startsWith(".deepspace/")) return;
-    const relApp = relative2(realpathSync3(appDir), realDir).split(sep2).join("/");
+    const relApp = relative2(realpathSync4(appDir), realDir).split(sep2).join("/");
     if (relApp === ".deepspace" || relApp.startsWith(".deepspace/")) return;
     ensureLocalExclude(appDir, `/${pattern}/`);
   } catch {
   }
 }
-function provisionWorktreeDeps(appDir, dir) {
-  const linked = [];
+function worktreeMarkerPath(worktreeRoot) {
   try {
-    const src = join21(appDir, "node_modules");
-    const dest = join21(dir, "node_modules");
-    if (existsSync23(src) && !existsSync23(dest)) {
-      symlinkSync(src, dest, process.platform === "win32" ? "junction" : "dir");
-      linked.push("node_modules");
-    }
+    const result = runGit(worktreeRoot, ["rev-parse", "--absolute-git-dir"], { allowFail: true });
+    if (result.status !== 0) return null;
+    const gitDir = result.stdout.toString("utf-8").trim();
+    return isAbsolute5(gitDir) ? join21(gitDir, WORKSPACE_MARKER) : null;
+  } catch {
+    return null;
+  }
+}
+function markManagedWorkspace(worktreeRoot, workspaceId) {
+  const markerPath = worktreeMarkerPath(worktreeRoot);
+  if (!markerPath) return false;
+  const marker = { version: 1, workspaceId, mode: "managed-linked" };
+  const tempPath = `${markerPath}.${process.pid}.tmp`;
+  try {
+    mkdirSync7(dirname9(markerPath), { recursive: true });
+    writeFileSync9(tempPath, JSON.stringify(marker) + "\n");
+    renameSync2(tempPath, markerPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isManagedWorkspaceWorktree(worktreeRoot, workspaceId) {
+  const markerPath = worktreeMarkerPath(worktreeRoot);
+  if (!markerPath) return false;
+  try {
+    const marker = JSON.parse(readFileSync23(markerPath, "utf-8"));
+    return marker.version === 1 && marker.workspaceId === workspaceId && marker.mode === "managed-linked";
   } catch {
+    return false;
   }
-  return linked;
 }
-function materializeWorkspaceWorktree(appDir, dir, branch, startPoint) {
-  addWorktreeNewBranch(appDir, dir, branch, startPoint);
-  excludeWorktreeDir(appDir, dir);
-  return provisionWorktreeDeps(appDir, dir);
+function defaultWorkspaceRoot(appDir, workspaceId) {
+  const primary = listWorktrees(appDir)[0];
+  if (!primary) throw new Error("Git did not report a primary worktree");
+  return join21(primary.path, ".deepspace", "ws", workspaceId.slice(3).toLowerCase());
+}
+function appDirInWorktree(appDir, worktreeRoot) {
+  const appRelative = relative2(realpathSync4(repoToplevel(appDir)), realpathSync4(appDir));
+  return appRelative ? join21(worktreeRoot, appRelative) : worktreeRoot;
+}
+function materializeWorkspaceWorktree(appDir, worktreeRoot, branch, startPoint, workspaceId) {
+  addWorktreeNewBranch(appDir, worktreeRoot, branch, startPoint);
+  excludeWorktreeDir(appDir, worktreeRoot);
+  markManagedWorkspace(worktreeRoot, workspaceId);
 }
 function inOwnLinkedWorktree(appDir, id) {
   if (workspaceIdFromBranch(currentBranch(appDir)) !== id) return false;
   try {
-    return statSync(join21(appDir, ".git")).isFile();
+    return statSync(join21(repoToplevel(appDir), ".git")).isFile();
   } catch {
     return false;
   }
@@ -9676,6 +9754,7 @@ function inOwnLinkedWorktree(appDir, id) {
 function cleanupJson(outcome) {
   return {
     worktreeRemoved: outcome.worktreeRemoved,
+    worktreeRetained: outcome.worktreeRetained,
     branchDeleted: outcome.branchDeleted,
     ...outcome.mainDir ? { mainDir: outcome.mainDir } : {},
     ...outcome.error ? { error: outcome.error } : {}
@@ -9703,6 +9782,7 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch) {
   const branch = workspaceBranchName(id);
   const out = {
     worktreeRemoved: null,
+    worktreeRetained: null,
     branchDeleted: null,
     worktreeDir: null,
     branch
@@ -9713,9 +9793,13 @@ function cleanupWorkspaceLocal(appDir, id, trunkBranch) {
     const linked = worktrees.find((worktree, index) => index > 0 && worktree.branch === branch);
     if (linked) {
       out.worktreeDir = linked.path;
+      if (!isManagedWorkspaceWorktree(linked.path, id)) {
+        out.worktreeRetained = linked.path;
+        return out;
+      }
       let inside = false;
       try {
-        inside = realpathSync3(appDir) === realpathSync3(linked.path);
+        inside = realpathSync4(repoToplevel(appDir)) === realpathSync4(linked.path);
       } catch {
         inside = false;
       }
@@ -9769,6 +9853,9 @@ function reportCleanupHuman(outcome) {
     outcome.branchDeleted ? `branch ${outcome.branch}` : null
   ].filter(Boolean);
   if (parts.length) p25.log.success(`Removed ${parts.join(" + ")}.`);
+  if (outcome.worktreeRetained) {
+    p25.log.info(`Retained externally managed worktree: ${outcome.worktreeRetained}`);
+  }
   if (outcome.worktreeRemoved && outcome.mainDir) {
     p25.log.info(`This directory was removed \u2014 run: cd ${shQuote(outcome.mainDir)}`);
   }
@@ -9952,11 +10039,10 @@ var newWorkspaceCommand = defineDeepspaceCommand({
       idempotencyKey: mintIdempotencyKey()
     });
     const dirInput = typeof args.dir === "string" ? args.dir.trim() : "";
-    const dirArg = dirInput || join22(".deepspace", "ws", id.slice(3).toLowerCase());
-    const dir = isAbsolute6(dirArg) ? dirArg : resolve16(appDir, dirArg);
-    let provisioned = [];
+    const worktreeRoot = dirInput ? isAbsolute6(dirInput) ? dirInput : resolve16(appDir, dirInput) : defaultWorkspaceRoot(appDir, id);
+    const dir = appDirInWorktree(appDir, worktreeRoot);
     try {
-      provisioned = materializeWorkspaceWorktree(appDir, dir, branch, baseOid);
+      materializeWorkspaceWorktree(appDir, worktreeRoot, branch, baseOid, id);
     } catch (error) {
       spinner2?.stop("Worktree failed.");
       const reason = error instanceof Error ? error.message : String(error);
@@ -9968,13 +10054,12 @@ var newWorkspaceCommand = defineDeepspaceCommand({
     }
     spinner2?.stop(`Workspace ${id} created.`);
     if (!args.json) {
-      if (provisioned.length > 0)
-        p26.log.info(`Linked from the main checkout: ${provisioned.join(", ")}`);
       p26.log.info(`Work in: cd ${dir}`);
       p26.log.info(
         `Then: commit as usual, \`deepspace workspace sync\` to publish, \`deepspace workspace land\` when done.`
       );
     }
+    const action = { cwd: dir, argv: [detectPackageManager(dir), "install"] };
     return {
       data: {
         workspaceId: id,
@@ -9983,16 +10068,17 @@ var newWorkspaceCommand = defineDeepspaceCommand({
         baseOid,
         branch,
         dir,
-        provisioned
-      }
+        worktreeRoot
+      },
+      action
     };
   }
 });
 
 // src/cli/commands/workspace/attach.ts
 import * as p27 from "@clack/prompts";
-import { existsSync as existsSync24, readdirSync as readdirSync7, rmSync as rmSync6 } from "fs";
-import { isAbsolute as isAbsolute7, join as join23, resolve as resolve17 } from "path";
+import { existsSync as existsSync23, readdirSync as readdirSync7, rmSync as rmSync6 } from "fs";
+import { isAbsolute as isAbsolute7, resolve as resolve17 } from "path";
 function finishedWorkspaceMessage(id, view) {
   const workspace = view.workspace;
   if (workspace.status === "landed") {
@@ -10001,7 +10087,7 @@ function finishedWorkspaceMessage(id, view) {
   return `Workspace ${id} is ${workspace.status} \u2014 its ref is retained briefly (fetch ${workspace.ref} to inspect), but attach only works on active workspaces.`;
 }
 function cleanFailedFreshAttachDir(dir) {
-  if (!existsSync24(dir)) return [];
+  if (!existsSync23(dir)) return [];
   let entries;
   try {
     entries = readdirSync7(dir);
@@ -10076,32 +10162,32 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
         );
       }
       const requestedDir = typeof args.dir === "string" ? args.dir.trim() : "";
-      const dirArg = requestedDir || join23(".deepspace", "ws", id.slice(3).toLowerCase());
-      const dir2 = isAbsolute7(dirArg) ? dirArg : resolve17(appDir, dirArg);
+      const worktreeRoot = requestedDir ? isAbsolute7(requestedDir) ? requestedDir : resolve17(appDir, requestedDir) : defaultWorkspaceRoot(appDir, id);
+      const dir2 = appDirInWorktree(appDir, worktreeRoot);
       if (resolveCommit(appDir, `refs/heads/${branch}`)) {
         throw new Refusal(
           `Branch ${branch} already exists locally (this workspace has a worktree here). Find it with \`git worktree list\` and continue there.`,
           "branch_exists"
         );
       }
-      const provisioned = materializeWorkspaceWorktree(appDir, dir2, branch, tip2);
+      materializeWorkspaceWorktree(appDir, worktreeRoot, branch, tip2, id);
       spinner2?.stop(`Attached ${id}.`);
       if (!args.json) {
-        if (provisioned.length > 0)
-          p27.log.info(`Linked from the main checkout: ${provisioned.join(", ")}`);
         p27.log.info(`Task: ${view2.workspace.task}`);
         p27.log.info(`Work in: cd ${dir2}`);
       }
+      const action2 = { cwd: dir2, argv: [detectPackageManager(dir2), "install"] };
       return {
         data: {
           workspaceId: id,
           mode: "worktree",
           dir: dir2,
+          worktreeRoot,
           branch,
           tipOid: tip2,
-          task: view2.workspace.task,
-          provisioned
-        }
+          task: view2.workspace.task
+        },
+        action: action2
       };
     }
     const token = await ensureToken();
@@ -10119,7 +10205,7 @@ var attachWorkspaceCommand = defineDeepspaceCommand({
       process.cwd(),
       (typeof args.dir === "string" ? args.dir.trim() : "") || `ws-${id.slice(3).toLowerCase()}`
     );
-    if (existsSync24(dir)) {
+    if (existsSync23(dir)) {
       spinner2?.stop("Target exists.");
       throw new Refusal(`${dir} already exists \u2014 pass a different directory.`, "dir_exists");
     }
@@ -10436,13 +10522,13 @@ import * as p31 from "@clack/prompts";
 
 // src/cli/lib/validation.ts
 import { sync as spawnSync7 } from "cross-spawn";
-import { readFileSync as readFileSync23 } from "fs";
-import { join as join24 } from "path";
+import { readFileSync as readFileSync24 } from "fs";
+import { join as join22 } from "path";
 var MAX_SUMMARY_CHARS = 4e3;
 var MAX_OUTPUT_BUFFER = 64 * 1024 * 1024;
 function configuredCommand(appDir) {
   try {
-    const pkg2 = JSON.parse(readFileSync23(join24(appDir, "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync24(join22(appDir, "package.json"), "utf-8"));
     if (pkg2.scripts?.validate) return `${detectPackageManager(appDir)} run --silent validate`;
   } catch {
   }
@@ -10706,7 +10792,7 @@ var landWorkspaceCommand = defineDeepspaceCommand({
     spinner2?.stop(`Landed ${id} into ${intoBranch} at ${landedOid.slice(0, 10)}.`);
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, intoBranch);
     const inOwnWorktree = !cleanup && inOwnLinkedWorktree(appDir, id);
-    const retainedWorktree = keepWorktree || inOwnWorktree ? appDir : null;
+    const retainedWorktree = cleanup?.worktreeRetained ?? (keepWorktree || inOwnWorktree ? appDir : null);
     const data = {
       workspaceId: id,
       into: intoBranch,
@@ -10776,7 +10862,9 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     }
     const { appDir, api: api4 } = await resolveTarget2(appArg);
     const id = inferWorkspaceId(appDir, explicitId);
-    if (!keepWorktree && !isWorkTreeClean(appDir)) {
+    const ownLinkedWorktree = inOwnLinkedWorktree(appDir, id);
+    const cleanupOwnsCheckout = !ownLinkedWorktree || isManagedWorkspaceWorktree(appDir, id);
+    if (!keepWorktree && cleanupOwnsCheckout && !isWorkTreeClean(appDir)) {
       const dropArgv = ["deepspace", "workspace", "drop", ...explicitId ? [explicitId] : []];
       const dropNext = humanCommand(dropArgv);
       throw new Refusal(
@@ -10788,8 +10876,8 @@ var dropWorkspaceCommand = defineDeepspaceCommand({
     const { view } = await api4.dropWorkspace(id);
     spinner2?.message(`Cleaning up ${id} locally\u2026`);
     const cleanup = keepWorktree ? null : cleanupWorkspaceLocal(appDir, id, null);
-    const inOwnWorktree = !cleanup && inOwnLinkedWorktree(appDir, id);
-    const retainedWorktree = keepWorktree || inOwnWorktree ? appDir : null;
+    const inOwnWorktree = !cleanup && ownLinkedWorktree;
+    const retainedWorktree = cleanup?.worktreeRetained ?? (keepWorktree || inOwnWorktree ? appDir : null);
     const data = {
       workspaceId: id,
       status: view.workspace.status,
@@ -11077,9 +11165,9 @@ var git_credential_default = defineCommand13({
 });
 
 // src/cli/cli.ts
-var __dirname = dirname9(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync24(join25(__dirname, "..", "package.json"), "utf-8"));
-if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync25("/etc/ssl/certs/ca-certificates.crt")) {
+var __dirname = dirname10(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync25(join23(__dirname, "..", "package.json"), "utf-8"));
+if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync24("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand14({