devsurface 0.3.0 → 0.5.0

package/dist/cli/index.js

@@ -7,8 +7,8 @@ import { Command } from "commander";
 import pc from "picocolors";
 
 // src/core/doctor/index.ts
-import { promises as fs9 } from "fs";
-import path9 from "path";
+import { promises as fs11 } from "fs";
+import path11 from "path";
 
 // src/core/documentation.ts
 function extractScriptReferences(content) {
@@ -32,8 +32,8 @@ function extractScriptReferences(content) {
 }
 
 // src/core/scanner/index.ts
-import { promises as fs8 } from "fs";
-import path8 from "path";
+import { promises as fs10 } from "fs";
+import path10 from "path";
 
 // src/core/config/load.ts
 import { promises as fs } from "fs";
@@ -836,9 +836,64 @@ async function detectGit(root) {
   }
 }
 
-// src/core/scanner/packageManager.ts
+// src/core/scanner/language.ts
 import { promises as fs6 } from "fs";
 import path6 from "path";
+var languageFiles = [
+  { language: "python", candidates: ["requirements.txt", "pyproject.toml", "Pipfile"] },
+  { language: "go", candidates: ["go.mod"] },
+  { language: "java", candidates: ["pom.xml", "build.gradle", "build.gradle.kts"] }
+];
+function isWithinRoot5(root, target) {
+  const relative = path6.relative(path6.resolve(root), path6.resolve(target));
+  return relative === "" || !relative.startsWith("..") && !path6.isAbsolute(relative);
+}
+async function safeFile(root, candidate) {
+  const filePath = path6.join(root, candidate);
+  try {
+    const [realRoot, stat, realPath] = await Promise.all([
+      fs6.realpath(root),
+      fs6.stat(filePath),
+      fs6.realpath(filePath)
+    ]);
+    if (stat.isFile() && isWithinRoot5(realRoot, realPath)) {
+      return realPath;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function detectProjectLanguage(root, packageJson) {
+  const detected = [];
+  const files = [];
+  if (packageJson !== null) {
+    detected.push("node");
+    files.push(packageJson.path);
+  }
+  for (const definition of languageFiles) {
+    let found = false;
+    for (const candidate of definition.candidates) {
+      const file = await safeFile(root, candidate);
+      if (file !== null) {
+        found = true;
+        files.push(file);
+      }
+    }
+    if (found) {
+      detected.push(definition.language);
+    }
+  }
+  return {
+    primary: detected[0] ?? null,
+    detected,
+    files
+  };
+}
+
+// src/core/scanner/packageManager.ts
+import { promises as fs7 } from "fs";
+import path7 from "path";
 var lockFiles = [
   { file: "pnpm-lock.yaml", manager: "pnpm" },
   { file: "yarn.lock", manager: "yarn" },
@@ -848,7 +903,7 @@ var lockFiles = [
 ];
 async function exists(filePath) {
   try {
-    await fs6.access(filePath);
+    await fs7.access(filePath);
     return true;
   } catch {
     return false;
@@ -856,7 +911,7 @@ async function exists(filePath) {
 }
 async function detectPackageManager(root) {
   for (const lockFile of lockFiles) {
-    if (await exists(path6.join(root, lockFile.file))) {
+    if (await exists(path7.join(root, lockFile.file))) {
       return lockFile.manager;
     }
   }
@@ -864,23 +919,23 @@ async function detectPackageManager(root) {
 }
 
 // src/core/scanner/packageJson.ts
-import { promises as fs7 } from "fs";
-import path7 from "path";
-function isWithinRoot5(root, target) {
-  const relative = path7.relative(root, target);
-  return relative === "" || !relative.startsWith("..") && !path7.isAbsolute(relative);
+import { promises as fs8 } from "fs";
+import path8 from "path";
+function isWithinRoot6(root, target) {
+  const relative = path8.relative(root, target);
+  return relative === "" || !relative.startsWith("..") && !path8.isAbsolute(relative);
 }
 async function readPackageJson(root) {
-  const packageJsonPath = path7.join(root, "package.json");
+  const packageJsonPath = path8.join(root, "package.json");
   try {
     const [realRoot, realPackageJsonPath] = await Promise.all([
-      fs7.realpath(root),
-      fs7.realpath(packageJsonPath)
+      fs8.realpath(root),
+      fs8.realpath(packageJsonPath)
     ]);
-    if (!isWithinRoot5(realRoot, realPackageJsonPath)) {
+    if (!isWithinRoot6(realRoot, realPackageJsonPath)) {
       return null;
     }
-    const content = await fs7.readFile(realPackageJsonPath, "utf8");
+    const content = await fs8.readFile(realPackageJsonPath, "utf8");
     const data = JSON.parse(content);
     return { path: realPackageJsonPath, data };
   } catch {
@@ -966,6 +1021,235 @@ async function detectPorts(ports) {
   );
 }
 
+// src/core/scanner/presets.ts
+import { promises as fs9 } from "fs";
+import path9 from "path";
+function dependencyNames(packageJson) {
+  const data = packageJson?.data;
+  return new Set(
+    Object.keys({
+      ...data?.dependencies,
+      ...data?.devDependencies,
+      ...data?.optionalDependencies,
+      ...data?.peerDependencies
+    })
+  );
+}
+function hasAnyDependency(dependencies, names) {
+  return names.some((name) => dependencies.has(name));
+}
+async function readIfPresent2(root, candidate) {
+  const filePath = path9.join(root, candidate);
+  try {
+    const [realRoot, realPath] = await Promise.all([fs9.realpath(root), fs9.realpath(filePath)]);
+    const relative = path9.relative(realRoot, realPath);
+    if (relative.startsWith("..") || path9.isAbsolute(relative)) {
+      return null;
+    }
+    return await fs9.readFile(realPath, "utf8");
+  } catch {
+    return null;
+  }
+}
+function completePreset(draft) {
+  return {
+    name: draft.name,
+    label: draft.label,
+    commands: draft.commands ?? {},
+    groups: draft.groups ?? {},
+    ports: draft.ports ?? []
+  };
+}
+function nodePresets(framework, packageJson) {
+  const detected = new Set(framework?.detected ?? []);
+  const dependencies = dependencyNames(packageJson);
+  const presets = [];
+  if (detected.has("Next.js")) {
+    presets.push({
+      name: "next",
+      label: "Next.js",
+      commands: {
+        "next:dev": "next dev",
+        "next:build": "next build",
+        "next:start": "next start"
+      },
+      groups: {
+        "Next.js": ["next:dev", "next:build", "next:start"]
+      },
+      ports: [3e3]
+    });
+  }
+  if (detected.has("Vite")) {
+    presets.push({
+      name: "vite",
+      label: "Vite",
+      commands: {
+        "vite:dev": "vite --host 127.0.0.1",
+        "vite:build": "vite build",
+        "vite:preview": "vite preview --host 127.0.0.1"
+      },
+      groups: {
+        Vite: ["vite:dev", "vite:build", "vite:preview"]
+      },
+      ports: [5173, 4173]
+    });
+  }
+  if (detected.has("NestJS")) {
+    presets.push({
+      name: "nestjs",
+      label: "NestJS",
+      commands: {
+        "nest:start": "nest start --watch",
+        "nest:build": "nest build"
+      },
+      groups: {
+        NestJS: ["nest:start", "nest:build"]
+      },
+      ports: [3e3]
+    });
+  }
+  if (detected.has("Remix")) {
+    presets.push({
+      name: "remix",
+      label: "Remix",
+      commands: {
+        "remix:dev": "remix vite:dev",
+        "remix:build": "remix vite:build"
+      },
+      groups: {
+        Remix: ["remix:dev", "remix:build"]
+      },
+      ports: [5173]
+    });
+  }
+  if (detected.has("Express") || detected.has("Fastify")) {
+    presets.push({
+      name: detected.has("Fastify") ? "fastify" : "express",
+      label: detected.has("Fastify") ? "Fastify" : "Express",
+      ports: [3e3]
+    });
+  }
+  if (detected.has("Prisma") || hasAnyDependency(dependencies, ["prisma", "@prisma/client"])) {
+    presets.push({
+      name: "prisma",
+      label: "Prisma",
+      commands: {
+        "prisma:migrate": "prisma migrate dev",
+        "prisma:studio": "prisma studio"
+      },
+      groups: {
+        Database: ["prisma:migrate", "prisma:studio"]
+      },
+      ports: [5555]
+    });
+  }
+  return presets.map(completePreset);
+}
+async function pythonPresets(root, language) {
+  if (!language.detected.includes("python")) {
+    return [];
+  }
+  const [requirements, pyproject, pipfile] = await Promise.all([
+    readIfPresent2(root, "requirements.txt"),
+    readIfPresent2(root, "pyproject.toml"),
+    readIfPresent2(root, "Pipfile")
+  ]);
+  const manifest = [requirements, pyproject, pipfile].filter(Boolean).join("\n").toLowerCase();
+  const commands = {};
+  const groups = {};
+  const ports = [];
+  if (requirements !== null) {
+    commands["python:install"] = "python -m pip install -r requirements.txt";
+    groups.Setup = ["python:install"];
+  }
+  if (manifest.includes("uvicorn") || manifest.includes("fastapi")) {
+    commands["python:dev"] = "uvicorn main:app --reload --host 127.0.0.1";
+    groups.Python = [...groups.Python ?? [], "python:dev"];
+    ports.push(8e3);
+  }
+  if (manifest.includes("flask")) {
+    commands["flask:dev"] = "flask --app app run --host 127.0.0.1";
+    groups.Python = [...groups.Python ?? [], "flask:dev"];
+    ports.push(5e3);
+  }
+  if (manifest.includes("django") || await readIfPresent2(root, "manage.py") !== null) {
+    commands["django:dev"] = "python manage.py runserver 127.0.0.1:8000";
+    commands["django:migrate"] = "python manage.py migrate";
+    groups.Python = [...groups.Python ?? [], "django:dev", "django:migrate"];
+    ports.push(8e3);
+  }
+  return [
+    completePreset({
+      name: "python",
+      label: "Python",
+      commands,
+      groups,
+      ports
+    })
+  ];
+}
+function goPresets(language) {
+  if (!language.detected.includes("go")) {
+    return [];
+  }
+  return [
+    completePreset({
+      name: "go",
+      label: "Go",
+      commands: {
+        "go:run": "go run .",
+        "go:build": "go build ./...",
+        "go:test": "go test ./..."
+      },
+      groups: {
+        Go: ["go:run", "go:build", "go:test"]
+      }
+    })
+  ];
+}
+async function javaPresets(language) {
+  if (!language.detected.includes("java")) {
+    return [];
+  }
+  const hasMaven = language.files.some((file) => path9.basename(file) === "pom.xml");
+  const hasGradle = language.files.some((file) => path9.basename(file).startsWith("build.gradle"));
+  const commands = {};
+  const groups = {};
+  if (hasMaven) {
+    commands["maven:test"] = "mvn test";
+    commands["maven:package"] = "mvn package";
+    groups.Maven = ["maven:test", "maven:package"];
+  }
+  if (hasGradle) {
+    commands["gradle:test"] = "gradle test";
+    commands["gradle:build"] = "gradle build";
+    groups.Gradle = ["gradle:test", "gradle:build"];
+  }
+  return [completePreset({ name: "java", label: "Java", commands, groups })];
+}
+async function detectPresets(options) {
+  return [
+    ...nodePresets(options.framework, options.packageJson),
+    ...await pythonPresets(options.root, options.language),
+    ...goPresets(options.language),
+    ...await javaPresets(options.language)
+  ].filter(
+    (preset) => Object.keys(preset.commands).length > 0 || Object.keys(preset.groups).length > 0 || preset.ports.length > 0
+  );
+}
+function mergePresetCommands(presets) {
+  return Object.assign({}, ...presets.map((preset) => preset.commands));
+}
+function mergePresetGroups(presets) {
+  const groups = {};
+  for (const preset of presets) {
+    for (const [group, commands] of Object.entries(preset.groups)) {
+      groups[group] = [...groups[group] ?? [], ...commands];
+    }
+  }
+  return groups;
+}
+
 // src/core/scanner/scripts.ts
 function extractScripts(packageJson) {
   if (!packageJson?.data.scripts || typeof packageJson.data.scripts !== "object" || Array.isArray(packageJson.data.scripts)) {
@@ -980,17 +1264,17 @@ function extractScripts(packageJson) {
 }
 
 // src/core/scanner/index.ts
-function isWithinRoot6(root, target) {
-  const relative = path8.relative(path8.resolve(root), path8.resolve(target));
-  return relative === "" || !relative.startsWith("..") && !path8.isAbsolute(relative);
+function isWithinRoot7(root, target) {
+  const relative = path10.relative(path10.resolve(root), path10.resolve(target));
+  return relative === "" || !relative.startsWith("..") && !path10.isAbsolute(relative);
 }
 async function findFirstFile(root, candidates) {
-  const resolvedRoot = await fs8.realpath(root).catch(() => path8.resolve(root));
+  const resolvedRoot = await fs10.realpath(root).catch(() => path10.resolve(root));
   for (const candidate of candidates) {
-    const filePath = path8.join(root, candidate);
+    const filePath = path10.join(root, candidate);
     try {
-      const [stat, realPath] = await Promise.all([fs8.stat(filePath), fs8.realpath(filePath)]);
-      if (stat.isFile() && isWithinRoot6(resolvedRoot, realPath)) {
+      const [stat, realPath] = await Promise.all([fs10.stat(filePath), fs10.realpath(filePath)]);
+      if (stat.isFile() && isWithinRoot7(resolvedRoot, realPath)) {
         return { path: realPath, exists: true };
       }
     } catch {
@@ -1002,15 +1286,25 @@ function configuredPorts(configPorts) {
   return Array.isArray(configPorts) ? configPorts : [];
 }
 async function scanProject(root = process.cwd()) {
-  const resolvedRoot = await fs8.realpath(root).catch(() => path8.resolve(root));
+  const resolvedRoot = await fs10.realpath(root).catch(() => path10.resolve(root));
   const config = await loadConfig(resolvedRoot);
   const packageJson = await readPackageJson(resolvedRoot);
   const scripts = extractScripts(packageJson) ?? {};
   const framework = detectFramework(packageJson);
+  const language = await detectProjectLanguage(resolvedRoot, packageJson);
+  const presets = await detectPresets({
+    root: resolvedRoot,
+    packageJson,
+    framework,
+    language
+  });
+  const presetCommands = mergePresetCommands(presets);
+  const presetGroups = mergePresetGroups(presets);
   const portsToProbe = [
     ...configuredPorts(config?.config.ports),
     ...inferPortsFromScripts(scripts),
-    ...defaultPortsForFramework(framework)
+    ...defaultPortsForFramework(framework),
+    ...presets.flatMap((preset) => preset.ports)
   ];
   const [packageManager, env, docker, git, ports, readme, license] = await Promise.all([
     detectPackageManager(resolvedRoot),
@@ -1023,14 +1317,18 @@ async function scanProject(root = process.cwd()) {
   ]);
   return {
     root: resolvedRoot,
-    projectName: config?.config.name ?? packageJson?.data.name ?? path8.basename(resolvedRoot),
+    projectName: config?.config.name ?? packageJson?.data.name ?? path10.basename(resolvedRoot),
     packageJson,
     packageManager: packageManager ?? (packageJson ? "npm" : null),
+    language,
     scripts,
     env,
     docker,
     git,
     framework,
+    presets,
+    presetCommands,
+    presetGroups,
     ports: ports ?? [],
     readme,
     license,
@@ -1041,18 +1339,18 @@ async function scanProject(root = process.cwd()) {
 // src/core/doctor/index.ts
 async function pathExists(filePath) {
   try {
-    await fs9.access(filePath);
+    await fs11.access(filePath);
     return true;
   } catch {
     return false;
   }
 }
-async function readIfPresent2(filePath) {
+async function readIfPresent3(filePath) {
   if (filePath === null) {
     return null;
   }
   try {
-    return await fs9.readFile(filePath, "utf8");
+    return await fs11.readFile(filePath, "utf8");
   } catch {
     return null;
   }
@@ -1068,7 +1366,9 @@ async function runDoctor(root = process.cwd(), scan) {
       warning("config-warning", "warning", "Config warning", configWarning, result.config?.path)
     );
   }
-  if (result.packageJson === null) {
+  const isNodeProject = result.language.detected.includes("node");
+  const hasKnownProjectLanguage = result.language.detected.length > 0;
+  if (result.packageJson === null && !hasKnownProjectLanguage) {
     warnings.push(
       warning(
         "missing-package-json",
@@ -1079,7 +1379,7 @@ async function runDoctor(root = process.cwd(), scan) {
     );
     return warnings;
   }
-  if (!await pathExists(path9.join(root, "node_modules", ".bin"))) {
+  if (isNodeProject && !await pathExists(path11.join(root, "node_modules", ".bin"))) {
     warnings.push(
       warning(
         "missing-node-modules",
@@ -1126,7 +1426,7 @@ async function runDoctor(root = process.cwd(), scan) {
       warning("missing-readme", "warning", "No README", "No README.md or README file was found.")
     );
   } else {
-    const readme = await readIfPresent2(result.readme.path);
+    const readme = await readIfPresent3(result.readme.path);
     if (readme !== null) {
       const references = extractScriptReferences(readme);
       const missingScripts = references.filter((script) => result.scripts[script] === void 0);
@@ -1162,7 +1462,7 @@ async function runDoctor(root = process.cwd(), scan) {
       )
     );
   }
-  if (result.scripts.test === void 0) {
+  if (isNodeProject && result.scripts.test === void 0) {
     warnings.push(
       warning(
         "missing-test-script",
@@ -1172,7 +1472,7 @@ async function runDoctor(root = process.cwd(), scan) {
       )
     );
   }
-  if (result.scripts.build === void 0) {
+  if (isNodeProject && result.scripts.build === void 0) {
     warnings.push(
       warning(
         "missing-build-script",
@@ -1233,17 +1533,17 @@ async function doctorCommand(cwd = process.cwd()) {
 }
 
 // src/cli/commands/init.ts
-import { promises as fs10 } from "fs";
-import path10 from "path";
+import { promises as fs12 } from "fs";
+import path12 from "path";
 import pc2 from "picocolors";
 async function initCommand(cwd = process.cwd()) {
-  const configPath = path10.join(cwd, CONFIG_FILE_NAME);
+  const configPath = path12.join(cwd, CONFIG_FILE_NAME);
   try {
-    await fs10.access(configPath);
+    await fs12.access(configPath);
     console.log(pc2.yellow(`${CONFIG_FILE_NAME} already exists.`));
     return;
   } catch {
-    await fs10.writeFile(configPath, `${JSON.stringify(defaultConfig, null, 2)}
+    await fs12.writeFile(configPath, `${JSON.stringify(defaultConfig, null, 2)}
 `, "utf8");
     console.log(pc2.green(`Created ${CONFIG_FILE_NAME}.`));
   }
@@ -1430,26 +1730,60 @@ async function runPackageScriptToTerminal(options) {
     });
   });
 }
+async function runConfiguredCommandToTerminal(options) {
+  const resolvedCommand = await resolveConfiguredCommand(options.cwd, options.command);
+  if (resolvedCommand === null) {
+    return 1;
+  }
+  return await new Promise((resolve) => {
+    const child = spawn2(resolvedCommand.command, resolvedCommand.args, {
+      cwd: options.cwd,
+      stdio: "inherit",
+      windowsHide: true
+    });
+    child.on("error", () => {
+      resolve(1);
+    });
+    child.on("close", (code) => {
+      resolve(code ?? 1);
+    });
+  });
+}
 
 // src/cli/commands/run.ts
 async function runCommand(script, cwd = process.cwd()) {
   const scan = await scanProject(cwd);
-  if (scan.packageJson === null) {
-    console.error(pc3.red("No package.json was found in this directory."));
-    process.exitCode = 1;
+  if (scan.scripts[script] !== void 0) {
+    const exitCode = await runPackageScriptToTerminal({
+      cwd,
+      packageManager: scan.packageManager,
+      script
+    });
+    process.exitCode = exitCode;
     return;
   }
-  if (scan.scripts[script] === void 0) {
-    console.error(pc3.red(`Script "${script}" was not found in package.json.`));
-    process.exitCode = 1;
+  const configuredCommand = scan.config?.config.commands?.[script] ?? scan.presetCommands[script];
+  if (configuredCommand !== void 0) {
+    if (isDangerousCommand(configuredCommand)) {
+      console.error(pc3.red(`Refusing to run dangerous command "${safeDisplayText(script)}".`));
+      process.exitCode = 1;
+      return;
+    }
+    const exitCode = await runConfiguredCommandToTerminal({
+      cwd,
+      command: configuredCommand
+    });
+    process.exitCode = exitCode;
     return;
   }
-  const exitCode = await runPackageScriptToTerminal({
-    cwd,
-    packageManager: scan.packageManager,
-    script
-  });
-  process.exitCode = exitCode;
+  const available = [
+    ...Object.keys(scan.scripts),
+    ...Object.keys(scan.config?.config.commands ?? {}),
+    ...Object.keys(scan.presetCommands)
+  ];
+  const hint = available.length > 0 ? ` Available commands: ${safeDisplayList(available)}.` : "";
+  console.error(pc3.red(`Command "${safeDisplayText(script)}" was not found.${hint}`));
+  process.exitCode = 1;
 }
 
 // src/cli/commands/scan.ts
@@ -1459,9 +1793,11 @@ function formatList(values) {
 }
 function printScanResult(scan) {
   console.log(pc4.bold(`Project:   ${safeDisplayText(scan.projectName)}`));
+  console.log(`Language:  ${formatList(scan.language.detected) || "unknown"}`);
   console.log(`Type:      ${safeDisplayText(scan.framework?.type ?? "Unknown")}`);
   console.log(`Manager:   ${safeDisplayText(scan.packageManager ?? "unknown")}`);
   console.log(`Scripts:   ${formatList(Object.keys(scan.scripts))}`);
+  console.log(`Presets:   ${formatList(scan.presets.map((preset) => preset.label)) || "none"}`);
   console.log(`Git:       ${safeDisplayText(scan.git?.branch ?? "not detected")}`);
   console.log(`README:    ${scan.readme.exists ? "found" : "missing"}`);
   console.log(`LICENSE:   ${scan.license.exists ? "found" : "missing"}`);
@@ -1485,41 +1821,33 @@ async function scanCommand(cwd = process.cwd()) {
 // src/cli/commands/start.ts
 import pc5 from "picocolors";
 
-// src/server/index.ts
-import { promises as fs17 } from "fs";
-import path13 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { createAdaptorServer } from "@hono/node-server";
-import { serveStatic } from "@hono/node-server/serve-static";
-import { Hono } from "hono";
-
 // node_modules/open/index.js
 import process7 from "process";
 import { Buffer as Buffer2 } from "buffer";
-import path11 from "path";
+import path13 from "path";
 import { fileURLToPath } from "url";
 import { promisify as promisify5 } from "util";
 import childProcess from "child_process";
-import fs15, { constants as fsConstants2 } from "fs/promises";
+import fs17, { constants as fsConstants2 } from "fs/promises";
 
 // node_modules/wsl-utils/index.js
 import process3 from "process";
-import fs14, { constants as fsConstants } from "fs/promises";
+import fs16, { constants as fsConstants } from "fs/promises";
 
 // node_modules/is-wsl/index.js
 import process2 from "process";
 import os2 from "os";
-import fs13 from "fs";
+import fs15 from "fs";
 
 // node_modules/is-inside-container/index.js
-import fs12 from "fs";
+import fs14 from "fs";
 
 // node_modules/is-docker/index.js
-import fs11 from "fs";
+import fs13 from "fs";
 var isDockerCached;
 function hasDockerEnv() {
   try {
-    fs11.statSync("/.dockerenv");
+    fs13.statSync("/.dockerenv");
     return true;
   } catch {
     return false;
@@ -1527,7 +1855,7 @@ function hasDockerEnv() {
 }
 function hasDockerCGroup() {
   try {
-    return fs11.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+    return fs13.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
   } catch {
     return false;
   }
@@ -1543,7 +1871,7 @@ function isDocker() {
 var cachedResult;
 var hasContainerEnv = () => {
   try {
-    fs12.statSync("/run/.containerenv");
+    fs14.statSync("/run/.containerenv");
     return true;
   } catch {
     return false;
@@ -1568,12 +1896,12 @@ var isWsl = () => {
     return true;
   }
   try {
-    if (fs13.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {
+    if (fs15.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft")) {
       return !isInsideContainer();
     }
   } catch {
   }
-  if (fs13.existsSync("/proc/sys/fs/binfmt_misc/WSLInterop") || fs13.existsSync("/run/WSL")) {
+  if (fs15.existsSync("/proc/sys/fs/binfmt_misc/WSLInterop") || fs15.existsSync("/run/WSL")) {
     return !isInsideContainer();
   }
   return false;
@@ -1591,14 +1919,14 @@ var wslDrivesMountPoint = /* @__PURE__ */ (() => {
     const configFilePath = "/etc/wsl.conf";
     let isConfigFileExists = false;
     try {
-      await fs14.access(configFilePath, fsConstants.F_OK);
+      await fs16.access(configFilePath, fsConstants.F_OK);
       isConfigFileExists = true;
     } catch {
     }
     if (!isConfigFileExists) {
       return defaultMountPoint;
     }
-    const configContent = await fs14.readFile(configFilePath, { encoding: "utf8" });
+    const configContent = await fs16.readFile(configFilePath, { encoding: "utf8" });
     const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);
     if (!configMountPoint) {
       return defaultMountPoint;
@@ -1752,8 +2080,8 @@ async function defaultBrowser2() {
 
 // node_modules/open/index.js
 var execFile5 = promisify5(childProcess.execFile);
-var __dirname = path11.dirname(fileURLToPath(import.meta.url));
-var localXdgOpenPath = path11.join(__dirname, "xdg-open");
+var __dirname = path13.dirname(fileURLToPath(import.meta.url));
+var localXdgOpenPath = path13.join(__dirname, "xdg-open");
 var { platform, arch } = process7;
 async function getWindowsDefaultBrowserFromWsl() {
   const powershellPath = await powerShellPath();
@@ -1903,7 +2231,7 @@ var baseOpen = async (options) => {
       const isBundled = !__dirname || __dirname === "/";
       let exeLocalXdgOpen = false;
       try {
-        await fs15.access(localXdgOpenPath, fsConstants2.X_OK);
+        await fs17.access(localXdgOpenPath, fsConstants2.X_OK);
         exeLocalXdgOpen = true;
       } catch {
       }
@@ -2007,6 +2335,14 @@ defineLazyProperty(apps, "browser", () => "browser");
 defineLazyProperty(apps, "browserPrivate", () => "browserPrivate");
 var open_default = open;
 
+// src/server/index.ts
+import { promises as fs21 } from "fs";
+import path17 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { createAdaptorServer } from "@hono/node-server";
+import { serveStatic } from "@hono/node-server/serve-static";
+import { Hono } from "hono";
+
 // src/core/process/manager.ts
 import { EventEmitter } from "events";
 import spawn3 from "cross-spawn";
@@ -2149,12 +2485,244 @@ var ProcessManager = class extends EventEmitter {
   }
 };
 
+// src/core/hub/registry.ts
+import { createHash } from "crypto";
+import { promises as fs19 } from "fs";
+import os3 from "os";
+import path15 from "path";
+
+// src/core/hub/workspaceRoots.ts
+import { promises as fs18 } from "fs";
+import path14 from "path";
+function isWithinRoot8(root, target) {
+  const relative = path14.relative(root, target);
+  return relative === "" || !relative.startsWith("..") && !path14.isAbsolute(relative);
+}
+async function configuredWorkspaceRoots() {
+  const raw = process.env.DEVSURFACE_WORKSPACE_ROOTS;
+  if (!raw) {
+    return [];
+  }
+  const roots = [];
+  for (const entry of raw.split(",")) {
+    const trimmed = entry.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      roots.push(await fs18.realpath(path14.resolve(trimmed)));
+    } catch {
+    }
+  }
+  return roots;
+}
+async function assertWithinWorkspaceRoots(targetPath) {
+  const roots = await configuredWorkspaceRoots();
+  if (roots.length === 0) {
+    return;
+  }
+  for (const root of roots) {
+    if (isWithinRoot8(root, targetPath)) {
+      return;
+    }
+  }
+  throw new Error("Path must be inside a configured workspace root.");
+}
+
+// src/core/hub/registry.ts
+function workspaceId(realPath) {
+  const base = path15.basename(realPath).replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 32) || "workspace";
+  const hash = createHash("sha256").update(realPath).digest("hex").slice(0, 6);
+  return `${base}-${hash}`;
+}
+function defaultDataDir() {
+  return process.env.DEVSURFACE_DATA_DIR ?? path15.join(os3.homedir(), ".devsurface");
+}
+async function readPackageName(dirPath) {
+  try {
+    const raw = JSON.parse(await fs19.readFile(path15.join(dirPath, "package.json"), "utf8"));
+    return typeof raw?.name === "string" && raw.name.length > 0 ? raw.name : null;
+  } catch {
+    return null;
+  }
+}
+var WorkspaceRegistry = class {
+  filePath;
+  seeded = false;
+  constructor(dataDir) {
+    const dir = dataDir ?? defaultDataDir();
+    this.filePath = path15.join(dir, "workspaces.json");
+  }
+  async list() {
+    await this.seedFromEnv();
+    return await this.read();
+  }
+  async add(dirPath) {
+    const realDir = await this.resolveDir(dirPath);
+    await assertWithinWorkspaceRoots(realDir);
+    const entries = await this.read();
+    const existing = entries.find((entry2) => entry2.path === realDir);
+    if (existing) {
+      return existing;
+    }
+    const name = await readPackageName(realDir) ?? path15.basename(realDir);
+    const entry = {
+      id: workspaceId(realDir),
+      name,
+      path: realDir,
+      addedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    entries.push(entry);
+    await this.write(entries);
+    return entry;
+  }
+  async remove(id) {
+    const entries = await this.read();
+    const filtered = entries.filter((entry) => entry.id !== id);
+    if (filtered.length === entries.length) {
+      return false;
+    }
+    await this.write(filtered);
+    return true;
+  }
+  async findByPath(dirPath) {
+    try {
+      const realDir = await fs19.realpath(path15.resolve(dirPath));
+      const entries = await this.read();
+      return entries.find((entry) => entry.path === realDir) ?? null;
+    } catch {
+      return null;
+    }
+  }
+  async resolve(id) {
+    const entries = await this.read();
+    const entry = entries.find((item) => item.id === id);
+    if (!entry) {
+      return null;
+    }
+    try {
+      const realDir = await this.resolveDir(entry.path);
+      await assertWithinWorkspaceRoots(realDir);
+      if (realDir !== entry.path) {
+        const updated = { ...entry, path: realDir };
+        await this.write(entries.map((item) => item.id === id ? updated : item));
+        return updated;
+      }
+      return entry;
+    } catch {
+      await this.remove(id);
+      return null;
+    }
+  }
+  async resolveDir(dirPath) {
+    const resolved = path15.resolve(dirPath);
+    const realDir = await fs19.realpath(resolved);
+    const stat = await fs19.stat(realDir);
+    if (!stat.isDirectory()) {
+      throw new Error(`${dirPath} is not a directory.`);
+    }
+    return realDir;
+  }
+  async read() {
+    try {
+      const content = await fs19.readFile(this.filePath, "utf8");
+      const parsed = JSON.parse(content);
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
+    }
+  }
+  async write(entries) {
+    await fs19.mkdir(path15.dirname(this.filePath), { recursive: true });
+    await fs19.writeFile(this.filePath, JSON.stringify(entries, null, 2) + "\n", "utf8");
+  }
+  async seedFromEnv() {
+    if (this.seeded) {
+      return;
+    }
+    this.seeded = true;
+    const seedValue = process.env.DEVSURFACE_WORKSPACES;
+    if (!seedValue) {
+      return;
+    }
+    const paths = seedValue.split(",").map((p) => p.trim()).filter(Boolean);
+    for (const p of paths) {
+      try {
+        await this.add(p);
+      } catch {
+      }
+    }
+  }
+};
+
+// src/core/hub/runtime.ts
+var Hub = class {
+  registry;
+  runtimes = /* @__PURE__ */ new Map();
+  cleanupInstalled = false;
+  constructor(options) {
+    this.registry = new WorkspaceRegistry(options?.dataDir);
+  }
+  get(id) {
+    return this.runtimes.get(id) ?? null;
+  }
+  ensure(entry) {
+    const existing = this.runtimes.get(entry.id);
+    if (existing) {
+      return existing;
+    }
+    const runtime = {
+      id: entry.id,
+      root: entry.path,
+      processManager: new ProcessManager(),
+      dockerController: new DockerComposeController(entry.path)
+    };
+    this.runtimes.set(entry.id, runtime);
+    return runtime;
+  }
+  async listSummaries() {
+    const entries = await this.registry.list();
+    return entries.map((entry) => {
+      const runtime = this.runtimes.get(entry.id);
+      const running = runtime ? runtime.processManager.list().filter((p) => p.status === "running").length : 0;
+      return {
+        id: entry.id,
+        name: entry.name,
+        path: entry.path,
+        addedAt: entry.addedAt,
+        runningProcesses: running
+      };
+    });
+  }
+  killAll() {
+    for (const runtime of this.runtimes.values()) {
+      runtime.processManager.killAll();
+    }
+  }
+  attachCleanupHandlers() {
+    if (this.cleanupInstalled) {
+      return;
+    }
+    this.cleanupInstalled = true;
+    process.once("exit", () => {
+      this.killAll();
+    });
+    process.once("SIGINT", () => {
+      this.killAll();
+      process.exit(130);
+    });
+  }
+};
+
 // src/server/routes/api.ts
 import { constants as constants2, existsSync } from "fs";
-import { promises as fs16 } from "fs";
-import path12 from "path";
+import { promises as fs20 } from "fs";
+import path16 from "path";
 import spawn4 from "cross-spawn";
 
+// src/version.ts
+var DEV_SURFACE_VERSION = "0.5.0";
+
 // src/server/localAccess.ts
 var LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
 function hostnameFromHostHeader(host) {
@@ -2194,6 +2762,130 @@ function isSameOrigin(requestUrl, origin) {
   }
 }
 
+// src/server/listenConfig.ts
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_PORT = 4567;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
+var CONTAINER_HOSTS = /* @__PURE__ */ new Set(["0.0.0.0", "::"]);
+function resolveHost() {
+  const envHost = process.env.DEVSURFACE_HOST;
+  if (!envHost) {
+    return DEFAULT_HOST;
+  }
+  if (LOOPBACK_HOSTS.has(envHost)) {
+    return envHost;
+  }
+  if (CONTAINER_HOSTS.has(envHost) && process.env.DEVSURFACE_CONTAINER === "true") {
+    return envHost;
+  }
+  if (CONTAINER_HOSTS.has(envHost)) {
+    throw new Error(
+      "All-interface DevSurface binding is only allowed when DEVSURFACE_CONTAINER=true. DevSurface binds to 127.0.0.1 on bare metal."
+    );
+  }
+  throw new Error("DEVSURFACE_HOST must be a loopback host, or 0.0.0.0 inside a container.");
+}
+var listenHost = DEFAULT_HOST;
+function setListenHost(host) {
+  listenHost = host;
+}
+function getListenHost() {
+  return listenHost;
+}
+function normalizeRemoteAddress(raw) {
+  if (typeof raw !== "string" || raw.length === 0) {
+    return null;
+  }
+  if (raw.startsWith("::ffff:")) {
+    return raw.slice("::ffff:".length);
+  }
+  return raw;
+}
+function isLoopbackRemoteAddress(raw) {
+  const address = normalizeRemoteAddress(raw);
+  if (!address) {
+    return false;
+  }
+  if (address === "::1" || address === "127.0.0.1") {
+    return true;
+  }
+  return address.startsWith("127.");
+}
+function parseIpv4(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4) {
+    return null;
+  }
+  const octets = parts.map((part) => Number(part));
+  if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+    return null;
+  }
+  return octets;
+}
+function isPrivateRemoteAddress(raw) {
+  const address = normalizeRemoteAddress(raw);
+  if (!address) {
+    return false;
+  }
+  if (isLoopbackRemoteAddress(address)) {
+    return true;
+  }
+  if (address.startsWith("fe80:")) {
+    return true;
+  }
+  const ipv4 = parseIpv4(address);
+  if (!ipv4) {
+    return false;
+  }
+  const [a, b] = ipv4;
+  if (a === 10) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  return false;
+}
+function isAllowedRemoteAddress(raw, host) {
+  if (host === "0.0.0.0" || host === "::") {
+    return isPrivateRemoteAddress(raw);
+  }
+  return isLoopbackRemoteAddress(raw);
+}
+function isAllowedClientConnection(raw, host = getListenHost()) {
+  if (raw === void 0) {
+    return true;
+  }
+  return isAllowedRemoteAddress(raw, host);
+}
+function initializeListenHost() {
+  const host = resolveHost();
+  setListenHost(host);
+  return host;
+}
+
+// src/server/accessControl.ts
+function remoteAddressFromRequest(request) {
+  return request?.socket?.remoteAddress;
+}
+function createApiAccessMiddleware() {
+  return async (context, next) => {
+    const host = context.req.header("host") ?? new URL(context.req.url).host;
+    if (!isAllowedLocalHostHeader(host)) {
+      return context.json({ error: "Non-local host rejected." }, 403);
+    }
+    const env = context.env;
+    const remoteAddress = remoteAddressFromRequest(env?.incoming);
+    if (!isAllowedClientConnection(remoteAddress, getListenHost())) {
+      return context.json({ error: "Remote client rejected." }, 403);
+    }
+    await next();
+  };
+}
+
 // src/server/mutationToken.ts
 import { randomBytes, timingSafeEqual } from "crypto";
 function createMutationToken() {
@@ -2215,9 +2907,9 @@ function isAllowedTerminalCommand(command) {
 }
 
 // src/server/routes/api.ts
-function isWithinRoot7(root, target) {
-  const relative = path12.relative(path12.resolve(root), path12.resolve(target));
-  return relative === "" || !relative.startsWith("..") && !path12.isAbsolute(relative);
+function isWithinRoot9(root, target) {
+  const relative = path16.relative(path16.resolve(root), path16.resolve(target));
+  return relative === "" || !relative.startsWith("..") && !path16.isAbsolute(relative);
 }
 function isAllowedMutationOrigin(requestUrl, origin) {
   if (origin === null) {
@@ -2225,6 +2917,23 @@ function isAllowedMutationOrigin(requestUrl, origin) {
   }
   return isAllowedLocalOrigin(origin) && isSameOrigin(requestUrl, origin);
 }
+function registerMutationGuard(app, mutationToken) {
+  app.use("/api/*", createApiAccessMiddleware());
+  app.use("/api/*", async (context, next) => {
+    if (context.req.method === "GET" || context.req.method === "HEAD") {
+      await next();
+      return;
+    }
+    const origin = context.req.header("origin") ?? null;
+    const secFetchSite = context.req.header("sec-fetch-site") ?? null;
+    const intent = context.req.header("x-devsurface-intent") ?? null;
+    const token = context.req.header("x-devsurface-token") ?? null;
+    if (!hasMutationIntent(intent) || !hasValidMutationToken(token, mutationToken) || isCrossSiteFetch(secFetchSite) || !isAllowedMutationOrigin(context.req.url, origin)) {
+      return context.json({ error: "Cross-origin mutation rejected." }, 403);
+    }
+    await next();
+  });
+}
 function isCrossSiteFetch(secFetchSite) {
   return secFetchSite === "cross-site";
 }
@@ -2232,35 +2941,35 @@ function hasMutationIntent(intent) {
   return intent === "dashboard";
 }
 async function realPathWithinRoot(root, target) {
-  if (!isWithinRoot7(root, target)) {
+  if (!isWithinRoot9(root, target)) {
     return false;
   }
   try {
-    const [realRoot, realTarget] = await Promise.all([fs16.realpath(root), fs16.realpath(target)]);
-    return isWithinRoot7(realRoot, realTarget);
+    const [realRoot, realTarget] = await Promise.all([fs20.realpath(root), fs20.realpath(target)]);
+    return isWithinRoot9(realRoot, realTarget);
   } catch {
     return false;
   }
 }
 async function writableDestinationWithinRoot(root, destination) {
-  if (!isWithinRoot7(root, destination)) {
+  if (!isWithinRoot9(root, destination)) {
     return false;
   }
   try {
     const [realRoot, realParent] = await Promise.all([
-      fs16.realpath(root),
-      fs16.realpath(path12.dirname(destination))
+      fs20.realpath(root),
+      fs20.realpath(path16.dirname(destination))
     ]);
-    return isWithinRoot7(realRoot, realParent);
+    return isWithinRoot9(realRoot, realParent);
   } catch {
     return false;
   }
 }
 async function copyFileExclusive(source, destination) {
-  const content = await fs16.readFile(source);
+  const content = await fs20.readFile(source);
   let handle2 = null;
   try {
-    handle2 = await fs16.open(
+    handle2 = await fs20.open(
       destination,
       constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY,
       384
@@ -2287,15 +2996,15 @@ function resolveCommandPromptExecutable() {
   return process.env.ComSpec ?? "cmd.exe";
 }
 function findExecutable(command) {
-  if (path12.isAbsolute(command)) {
+  if (path16.isAbsolute(command)) {
     return existsSync(command) ? command : null;
   }
   const pathValue = process.env.PATH ?? "";
-  for (const directory of pathValue.split(path12.delimiter)) {
+  for (const directory of pathValue.split(path16.delimiter)) {
     if (directory.length === 0) {
       continue;
     }
-    const candidate = path12.join(directory, command);
+    const candidate = path16.join(directory, command);
     if (existsSync(candidate)) {
       return candidate;
     }
@@ -2361,93 +3070,74 @@ function openTerminalAt(root) {
   }
   return launchDetached(terminal.command, terminal.args, root);
 }
-function registerApiRoutes(app, options) {
-  const dockerController = options.dockerController ?? new DockerComposeController(options.projectRoot);
-  app.get("/api/session", (context) => {
-    return context.json({ token: options.mutationToken });
-  });
-  app.use("/api/*", async (context, next) => {
-    const host = context.req.header("host") ?? new URL(context.req.url).host;
-    if (!isAllowedLocalHostHeader(host)) {
-      return context.json({ error: "Non-local host rejected." }, 403);
+function handleDockerError(error, context) {
+  if (error instanceof DockerOperationError) {
+    if (error.code === "compose-not-found" || error.code === "service-not-found") {
+      return context.json({ error: error.message, code: error.code }, 404);
     }
-    if (context.req.method !== "GET" && context.req.method !== "HEAD") {
-      const origin = context.req.header("origin") ?? null;
-      const secFetchSite = context.req.header("sec-fetch-site") ?? null;
-      const intent = context.req.header("x-devsurface-intent") ?? null;
-      const token = context.req.header("x-devsurface-token") ?? null;
-      if (!hasMutationIntent(intent) || !hasValidMutationToken(token, options.mutationToken) || isCrossSiteFetch(secFetchSite) || !isAllowedMutationOrigin(context.req.url, origin)) {
-        return context.json({ error: "Cross-origin mutation rejected." }, 403);
-      }
+    if (error.code === "docker-not-installed" || error.code === "docker-not-running") {
+      return context.json({ error: error.message, code: error.code }, 503);
     }
-    await next();
-  });
-  app.get("/api/project", async (context) => {
-    return context.json(await scanProject(options.projectRoot));
+    return context.json({ error: error.message, code: error.code }, 502);
+  }
+  throw error;
+}
+function registerWorkspaceRoutes(app, resolveWorkspace) {
+  app.get("/api/workspaces/:id/project", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
+    return context.json(await scanProject(ws.root));
   });
-  app.get("/api/health", async (context) => {
-    return context.json(await runDoctor(options.projectRoot));
+  app.get("/api/workspaces/:id/health", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
+    return context.json(await runDoctor(ws.root));
   });
-  app.get("/api/processes", (context) => {
-    return context.json(options.processManager.list());
+  app.get("/api/workspaces/:id/processes", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
+    return context.json(ws.processManager.list());
   });
-  app.get("/api/logs", (context) => {
-    return context.json(options.processManager.listLogs());
+  app.get("/api/workspaces/:id/logs", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
+    return context.json(ws.processManager.listLogs());
   });
-  app.get("/api/docker/:service/logs", async (context) => {
+  app.get("/api/workspaces/:id/docker/:service/logs", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
     const service = decodeURIComponent(context.req.param("service"));
     try {
-      return context.json(await dockerController.logs(service));
+      return context.json(await ws.dockerController.logs(service));
     } catch (error) {
-      if (error instanceof DockerOperationError) {
-        if (error.code === "compose-not-found" || error.code === "service-not-found") {
-          return context.json({ error: error.message, code: error.code }, 404);
-        }
-        if (error.code === "docker-not-installed" || error.code === "docker-not-running") {
-          return context.json({ error: error.message, code: error.code }, 503);
-        }
-        return context.json({ error: error.message, code: error.code }, 502);
-      }
-      throw error;
+      return handleDockerError(error, context);
     }
   });
-  app.post("/api/docker/:service/start", async (context) => {
+  app.post("/api/workspaces/:id/docker/:service/start", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
     const service = decodeURIComponent(context.req.param("service"));
     try {
-      return context.json(await dockerController.start(service));
+      return context.json(await ws.dockerController.start(service));
     } catch (error) {
-      if (error instanceof DockerOperationError) {
-        if (error.code === "compose-not-found" || error.code === "service-not-found") {
-          return context.json({ error: error.message, code: error.code }, 404);
-        }
-        if (error.code === "docker-not-installed" || error.code === "docker-not-running") {
-          return context.json({ error: error.message, code: error.code }, 503);
-        }
-        return context.json({ error: error.message, code: error.code }, 502);
-      }
-      throw error;
+      return handleDockerError(error, context);
     }
   });
-  app.post("/api/docker/:service/stop", async (context) => {
+  app.post("/api/workspaces/:id/docker/:service/stop", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
     const service = decodeURIComponent(context.req.param("service"));
     try {
-      return context.json(await dockerController.stop(service));
+      return context.json(await ws.dockerController.stop(service));
     } catch (error) {
-      if (error instanceof DockerOperationError) {
-        if (error.code === "compose-not-found" || error.code === "service-not-found") {
-          return context.json({ error: error.message, code: error.code }, 404);
-        }
-        if (error.code === "docker-not-installed" || error.code === "docker-not-running") {
-          return context.json({ error: error.message, code: error.code }, 503);
-        }
-        return context.json({ error: error.message, code: error.code }, 502);
-      }
-      throw error;
+      return handleDockerError(error, context);
     }
   });
-  app.post("/api/run/:script", async (context) => {
+  app.post("/api/workspaces/:id/run/:script", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
     const script = decodeURIComponent(context.req.param("script"));
-    const scan = await scanProject(options.projectRoot);
+    const scan = await scanProject(ws.root);
     const packageScript = scan.scripts[script];
     if (packageScript === void 0) {
       return context.json({ error: `Script "${script}" was not found.` }, 404);
@@ -2456,36 +3146,35 @@ function registerApiRoutes(app, options) {
       return context.json({ error: "Refusing to run dangerous script." }, 403);
     }
     const command = await resolvePackageRunCommand({
-      cwd: options.projectRoot,
+      cwd: ws.root,
       packageManager: scan.packageManager,
       script
     });
     if (command === null) {
       return context.json({ error: "Package manager executable was not found." }, 503);
     }
-    const processInfo = options.processManager.start({
-      cwd: options.projectRoot,
+    const processInfo = ws.processManager.start({
+      cwd: ws.root,
       script,
       command: command.command,
       args: command.args,
       displayCommand: command.displayCommand
     });
-    return context.json({
-      ...processInfo,
-      packageScript
-    });
+    return context.json({ ...processInfo, packageScript });
   });
-  app.post("/api/install", async (context) => {
-    const scan = await scanProject(options.projectRoot);
+  app.post("/api/workspaces/:id/install", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
+    const scan = await scanProject(ws.root);
     const command = await resolvePackageInstallCommand({
-      cwd: options.projectRoot,
+      cwd: ws.root,
       packageManager: scan.packageManager
     });
     if (command === null) {
       return context.json({ error: "Package manager executable was not found." }, 503);
     }
-    const processInfo = options.processManager.start({
-      cwd: options.projectRoot,
+    const processInfo = ws.processManager.start({
+      cwd: ws.root,
       script: "install",
       command: command.command,
       args: command.args,
@@ -2493,17 +3182,19 @@ function registerApiRoutes(app, options) {
     });
     return context.json(processInfo);
   });
-  app.post("/api/commands/:name", async (context) => {
+  app.post("/api/workspaces/:id/commands/:name", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
     const name = decodeURIComponent(context.req.param("name"));
-    const scan = await scanProject(options.projectRoot);
-    const configuredCommand = scan.config?.config.commands?.[name] ?? null;
+    const scan = await scanProject(ws.root);
+    const configuredCommand = scan.config?.config.commands?.[name] ?? scan.presetCommands[name] ?? null;
     if (configuredCommand === null) {
       return context.json({ error: `Configured command "${name}" was not found.` }, 404);
     }
     if (isDangerousCommand(configuredCommand)) {
       return context.json({ error: "Refusing to run dangerous command." }, 403);
     }
-    const resolvedCommand = await resolveConfiguredCommand(options.projectRoot, configuredCommand);
+    const resolvedCommand = await resolveConfiguredCommand(ws.root, configuredCommand);
     if (resolvedCommand === null) {
       return context.json(
         {
@@ -2512,43 +3203,48 @@ function registerApiRoutes(app, options) {
         400
       );
     }
-    const processInfo = options.processManager.start({
-      cwd: options.projectRoot,
+    const processInfo = ws.processManager.start({
+      cwd: ws.root,
       script: name,
       command: resolvedCommand.command,
       args: resolvedCommand.args,
       displayCommand: resolvedCommand.displayCommand
     });
-    return context.json({
-      ...processInfo,
-      configuredCommand
-    });
+    return context.json({ ...processInfo, configuredCommand });
   });
-  app.post("/api/open/folder", async (context) => {
-    await open_default(options.projectRoot);
+  app.post("/api/workspaces/:id/open/folder", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
+    await open_default(ws.root);
     return context.json({ opened: true, target: "folder" });
   });
-  app.post("/api/open/package", async (context) => {
-    const packagePath = path12.join(options.projectRoot, "package.json");
-    if (!await realPathWithinRoot(options.projectRoot, packagePath)) {
+  app.post("/api/workspaces/:id/open/package", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
+    const packagePath = path16.join(ws.root, "package.json");
+    if (!await realPathWithinRoot(ws.root, packagePath)) {
       return context.json({ error: "package.json was not found inside the project root." }, 404);
     }
     await open_default(packagePath);
     return context.json({ opened: true, target: "package" });
   });
-  app.post("/api/open/terminal", (context) => {
-    const opened = openTerminalAt(options.projectRoot);
+  app.post("/api/workspaces/:id/open/terminal", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
+    const opened = openTerminalAt(ws.root);
     return context.json({ opened, target: "terminal" }, opened ? 200 : 501);
   });
-  app.post("/api/env/copy", async (context) => {
-    const scan = await scanProject(options.projectRoot);
+  app.post("/api/workspaces/:id/env/copy", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
+    const scan = await scanProject(ws.root);
     const examplePath = scan.env?.examplePath ?? null;
     const localPath = scan.env?.localPath ?? null;
     if (examplePath === null) {
       return context.json({ error: ".env.example was not found." }, 404);
     }
-    const destination = localPath ?? path12.join(options.projectRoot, scan.config?.config.env?.local ?? ".env");
-    if (!await realPathWithinRoot(options.projectRoot, examplePath) || !await writableDestinationWithinRoot(options.projectRoot, destination)) {
+    const destination = localPath ?? path16.join(ws.root, scan.config?.config.env?.local ?? ".env");
+    if (!await realPathWithinRoot(ws.root, examplePath) || !await writableDestinationWithinRoot(ws.root, destination)) {
       return context.json({ error: "Refusing to copy env files outside the project root." }, 400);
     }
     const copyResult = await copyFileExclusive(examplePath, destination);
@@ -2557,12 +3253,79 @@ function registerApiRoutes(app, options) {
     }
     return context.json({ copied: true });
   });
-  app.delete("/api/run/:pid", (context) => {
+  app.delete("/api/workspaces/:id/run/:pid", async (context) => {
+    const ws = await resolveWorkspace(context.req.param("id"));
+    if (!ws) return context.json({ error: "Workspace not found." }, 404);
     const pid = decodeURIComponent(context.req.param("pid"));
-    const stopped = options.processManager.stop(pid);
+    const stopped = ws.processManager.stop(pid);
     return context.json({ stopped });
   });
 }
+function registerHubApiRoutes(app, options) {
+  const { hub } = options;
+  registerMutationGuard(app, options.mutationToken);
+  async function resolveWorkspace(id) {
+    const entry = await hub.registry.resolve(id);
+    if (!entry) return null;
+    const runtime = hub.ensure(entry);
+    return {
+      root: runtime.root,
+      processManager: runtime.processManager,
+      dockerController: runtime.dockerController
+    };
+  }
+  app.get("/api/session", (context) => {
+    return context.json({ token: options.mutationToken });
+  });
+  app.get("/api/hub/status", (context) => {
+    return context.json({ status: "running", version: DEV_SURFACE_VERSION });
+  });
+  app.get("/api/workspaces", async (context) => {
+    return context.json(await hub.listSummaries());
+  });
+  app.post("/api/workspaces", async (context) => {
+    const body = await context.req.json().catch(() => null);
+    if (!body?.path) {
+      return context.json({ error: "path is required." }, 400);
+    }
+    try {
+      const entry = await hub.registry.add(body.path);
+      return context.json(entry, 201);
+    } catch (error) {
+      return context.json({ error: error instanceof Error ? error.message : "Invalid path." }, 400);
+    }
+  });
+  app.delete("/api/workspaces/:id", async (context) => {
+    const id = context.req.param("id");
+    const runtime = hub.get(id);
+    if (runtime) {
+      runtime.processManager.killAll();
+    }
+    const removed = await hub.registry.remove(id);
+    return context.json({ removed }, removed ? 200 : 404);
+  });
+  registerWorkspaceRoutes(app, resolveWorkspace);
+  app.get("/api/project", async (context) => {
+    const entries = await hub.registry.list();
+    if (entries.length === 0) return context.json({ error: "No workspaces registered." }, 404);
+    return context.json(await scanProject(hub.ensure(entries[0]).root));
+  });
+  app.get("/api/health", async (context) => {
+    const entries = await hub.registry.list();
+    if (entries.length === 0) return context.json({ error: "No workspaces registered." }, 404);
+    return context.json(await runDoctor(hub.ensure(entries[0]).root));
+  });
+  app.get("/api/processes", async (context) => {
+    const entries = await hub.registry.list();
+    if (entries.length === 0) return context.json([]);
+    return context.json(hub.ensure(entries[0]).processManager.list());
+  });
+  app.get("/api/logs", async (context) => {
+    const entries = await hub.registry.list();
+    if (entries.length === 0) return context.json([]);
+    return context.json(hub.ensure(entries[0]).processManager.listLogs());
+  });
+}
 
 // src/server/routes/ws.ts
 import { WebSocket, WebSocketServer } from "ws";
@@ -2570,6 +3333,9 @@ function isAllowedWebSocketRequest(request) {
   const origin = request.headers.origin;
   const host = request.headers.host;
   const secFetchSite = request.headers["sec-fetch-site"];
+  if (!isAllowedClientConnection(remoteAddressFromRequest(request), getListenHost())) {
+    return false;
+  }
   if (typeof host !== "string" || !isAllowedLocalHostHeader(host)) {
     return false;
   }
@@ -2588,32 +3354,63 @@ function isAllowedWebSocketRequest(request) {
     return false;
   }
 }
-function setupWebSocket(server, processManager) {
+function workspaceIdFromUrl(url) {
+  if (!url) return null;
+  try {
+    const parsed = new URL(url, "http://localhost");
+    return parsed.searchParams.get("workspace");
+  } catch {
+    return null;
+  }
+}
+function setupHubWebSocket(server, hub) {
   const wss = new WebSocketServer({
     server,
     path: "/ws",
     verifyClient: (info) => isAllowedWebSocketRequest(info.req)
   });
-  function broadcast(payload) {
+  const clientWorkspaces = /* @__PURE__ */ new WeakMap();
+  const attachedManagers = /* @__PURE__ */ new Set();
+  function attachManager(workspaceId2, processManager) {
+    if (attachedManagers.has(workspaceId2)) {
+      return;
+    }
+    attachedManagers.add(workspaceId2);
+    processManager.on("log", (event) => {
+      broadcastToWorkspace(workspaceId2, { type: "log", event });
+    });
+    processManager.on("process", (processInfo) => {
+      broadcastToWorkspace(workspaceId2, { type: "process", process: processInfo });
+    });
+  }
+  function broadcastToWorkspace(workspaceId2, payload) {
     const serialized = JSON.stringify(payload);
     for (const client of wss.clients) {
-      if (client.readyState === WebSocket.OPEN) {
+      if (client.readyState === WebSocket.OPEN && clientWorkspaces.get(client) === workspaceId2) {
         client.send(serialized);
       }
     }
   }
-  processManager.on("log", (event) => {
-    broadcast({ type: "log", event });
-  });
-  processManager.on("process", (processInfo) => {
-    broadcast({ type: "process", process: processInfo });
-  });
-  wss.on("connection", (socket) => {
+  wss.on("connection", async (socket, request) => {
+    const workspaceId2 = workspaceIdFromUrl(request.url);
+    if (!workspaceId2) {
+      socket.close(4e3, "Missing workspace query parameter.");
+      return;
+    }
+    const entry = await hub.registry.resolve(workspaceId2);
+    if (!entry) {
+      socket.close(4004, "Workspace not found.");
+      return;
+    }
+    const runtime = hub.ensure(entry);
+    clientWorkspaces.set(socket, workspaceId2);
+    attachManager(workspaceId2, runtime.processManager);
     socket.send(
       JSON.stringify({
         type: "hello",
-        processes: processManager.list(),
-        logs: processManager.listLogs()
+        workspace: workspaceId2,
+        processes: runtime.processManager.list(),
+        logs: runtime.processManager.listLogs()
       })
     );
   });
@@ -2621,51 +3418,44 @@ function setupWebSocket(server, processManager) {
 }
 
 // src/server/index.ts
-var HOST = "127.0.0.1";
-var DEFAULT_PORT = 4567;
-function assertLocalHost(host) {
-  if (host !== HOST) {
-    throw new Error("DevSurface must bind only to 127.0.0.1.");
-  }
-}
 async function fileExists(filePath) {
   try {
-    await fs17.access(filePath);
+    await fs21.access(filePath);
     return true;
   } catch {
     return false;
   }
 }
 async function findWebDistDir() {
-  const moduleDir = path13.dirname(fileURLToPath2(import.meta.url));
+  const moduleDir = path17.dirname(fileURLToPath2(import.meta.url));
   const candidates = [
-    path13.join(moduleDir, "..", "web", "dist"),
-    path13.join(moduleDir, "..", "..", "src", "web", "dist"),
-    path13.join(moduleDir, "web", "dist")
+    path17.join(moduleDir, "..", "web", "dist"),
+    path17.join(moduleDir, "..", "..", "src", "web", "dist"),
+    path17.join(moduleDir, "web", "dist")
   ];
   for (const candidate of candidates) {
-    if (await fileExists(path13.join(candidate, "index.html"))) {
+    if (await fileExists(path17.join(candidate, "index.html"))) {
       return candidate;
     }
   }
   return null;
 }
-function toListenError(error, port) {
+function toListenError(error, host, port) {
   const code = error instanceof Error ? error.code : void 0;
   if (code === "EADDRINUSE") {
     return new Error(
-      `Port ${port} is already in use on ${HOST}. Stop the other process or run DevSurface with --port ${port + 1}.`,
+      `Port ${port} is already in use on ${host}. Stop the other process or run DevSurface with --port ${port + 1}.`,
       { cause: error }
     );
   }
   if (code === "EACCES") {
-    return new Error(`DevSurface does not have permission to bind to ${HOST}:${port}.`, {
+    return new Error(`DevSurface does not have permission to bind to ${host}:${port}.`, {
       cause: error
     });
   }
   return error instanceof Error ? error : new Error(String(error));
 }
-async function listenOnLocalHost(server, wss, port) {
+async function listenOnHost(server, wss, host, port) {
   await new Promise((resolve, reject) => {
     let settled = false;
     const cleanup = () => {
@@ -2674,17 +3464,13 @@ async function listenOnLocalHost(server, wss, port) {
       wss.off("error", onError);
     };
     const onError = (error) => {
-      if (settled) {
-        return;
-      }
+      if (settled) return;
       settled = true;
       cleanup();
-      reject(toListenError(error, port));
+      reject(toListenError(error, host, port));
     };
     const onListening = () => {
-      if (settled) {
-        return;
-      }
+      if (settled) return;
       settled = true;
       cleanup();
       resolve();
@@ -2692,7 +3478,7 @@ async function listenOnLocalHost(server, wss, port) {
     wss.once("error", onError);
     server.once("error", onError);
     server.once("listening", onListening);
-    server.listen(port, HOST);
+    server.listen(port, host);
   });
 }
 async function closeWebSocketServer(wss) {
@@ -2714,18 +3500,13 @@ async function closeHttpServer(server) {
     });
   });
 }
-async function createApp(options) {
-  const app = new Hono();
-  registerApiRoutes(app, {
-    ...options,
-    mutationToken: options.mutationToken ?? createMutationToken()
-  });
+async function mountWebUi(app) {
   const webDistDir = await findWebDistDir();
   if (webDistDir !== null) {
     app.use("/assets/*", serveStatic({ root: webDistDir }));
     app.get("/favicon.svg", serveStatic({ root: webDistDir }));
     app.get("*", async (context) => {
-      const html = await fs17.readFile(path13.join(webDistDir, "index.html"), "utf8");
+      const html = await fs21.readFile(path17.join(webDistDir, "index.html"), "utf8");
       return context.html(html);
     });
   } else {
@@ -2737,46 +3518,96 @@ async function createApp(options) {
       )
     );
   }
+}
+async function createHubApp(options) {
+  const app = new Hono();
+  registerHubApiRoutes(app, {
+    hub: options.hub,
+    mutationToken: options.mutationToken ?? createMutationToken()
+  });
+  await mountWebUi(app);
   return app;
 }
-async function startDevSurfaceServer(options) {
-  assertLocalHost(HOST);
+async function startHubServer(options) {
+  const host = initializeListenHost();
   const port = options.port ?? DEFAULT_PORT;
-  const processManager = new ProcessManager();
-  processManager.attachCleanupHandlers();
-  const app = await createApp({
-    projectRoot: options.projectRoot,
-    processManager
-  });
+  const hub = new Hub({ dataDir: options.dataDir });
+  hub.attachCleanupHandlers();
+  if (options.initialWorkspace) {
+    await hub.registry.add(options.initialWorkspace);
+  }
+  const mutationToken = createMutationToken();
+  const app = await createHubApp({ hub, mutationToken });
   const server = createAdaptorServer({
     fetch: app.fetch,
-    hostname: HOST
+    hostname: host
   });
-  const wss = setupWebSocket(server, processManager);
-  await listenOnLocalHost(server, wss, port);
-  processManager.attachCleanupHandlers();
-  const url = `http://${HOST}:${port}`;
+  const wss = setupHubWebSocket(server, hub);
+  await listenOnHost(server, wss, host, port);
+  const url = `http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${port}`;
   if (options.openBrowser !== false) {
-    await open_default(url);
+    const entries = await hub.registry.list();
+    const deepLink = entries.length > 0 ? `${url}/?workspace=${entries[0].id}` : url;
+    await open_default(deepLink);
   }
+  const dummyProcessManager = new ProcessManager();
   return {
     url,
     port,
-    processManager,
+    host,
+    hub,
+    processManager: dummyProcessManager,
     close: async () => {
-      processManager.killAll();
+      hub.killAll();
       await closeWebSocketServer(wss);
       await closeHttpServer(server);
     }
   };
 }
 
-// src/version.ts
-var DEV_SURFACE_VERSION = "0.3.0";
+// src/cli/hub/client.ts
+async function isHubRunning(port = DEFAULT_PORT) {
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/api/hub/status`, {
+      signal: AbortSignal.timeout(2e3)
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+async function registerWorkspaceRemotely(dirPath, port = DEFAULT_PORT) {
+  try {
+    const sessionResponse = await fetch(`http://127.0.0.1:${port}/api/session`, {
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (!sessionResponse.ok) return null;
+    const session = await sessionResponse.json();
+    const response = await fetch(`http://127.0.0.1:${port}/api/workspaces`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-DevSurface-Intent": "dashboard",
+        "X-DevSurface-Token": session.token
+      },
+      body: JSON.stringify({ path: dirPath }),
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!response.ok) return null;
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+function dashboardUrl(workspaceId2, port = DEFAULT_PORT, host = DEFAULT_HOST) {
+  const displayHost = host === "0.0.0.0" ? "127.0.0.1" : host;
+  return `http://${displayHost}:${port}/?workspace=${workspaceId2}`;
+}
 
 // src/cli/commands/start.ts
 async function startCommand(options) {
   const cwd = options.cwd ?? process.cwd();
+  const port = options.port ?? 4567;
   console.log(pc5.bold(`DevSurface v${DEV_SURFACE_VERSION}`));
   console.log("Scanning project...\n");
   const scan = await scanProject(cwd);
@@ -2789,13 +3620,159 @@ async function startCommand(options) {
       console.log(`  ${marker} ${item.title}`);
     }
   }
-  const server = await startDevSurfaceServer({
-    projectRoot: cwd,
+  if (await isHubRunning(port)) {
+    console.log("\nHub already running. Registering workspace...");
+    const registered = await registerWorkspaceRemotely(cwd, port);
+    if (registered) {
+      const url = dashboardUrl(registered.id, port);
+      console.log(`Workspace ${pc5.cyan(registered.name)} attached.`);
+      console.log(`Dashboard -> ${pc5.cyan(url)}`);
+      if (options.openBrowser !== false) {
+        await open_default(url);
+      }
+      return;
+    }
+    console.log("Could not register with running hub. Starting a new instance...");
+  }
+  const server = await startHubServer({
+    port,
+    openBrowser: options.openBrowser,
+    initialWorkspace: cwd
+  });
+  console.log(`
+Dashboard running at -> ${pc5.cyan(server.url)}`);
+}
+
+// src/cli/commands/serve.ts
+import pc6 from "picocolors";
+async function serveCommand(options) {
+  console.log(pc6.bold(`DevSurface Hub v${DEV_SURFACE_VERSION}`));
+  console.log("Starting hub server...\n");
+  const server = await startHubServer({
     port: options.port,
     openBrowser: options.openBrowser
   });
+  const summaries = await server.hub.listSummaries();
+  if (summaries.length > 0) {
+    console.log(`Registered workspaces: ${summaries.length}`);
+    for (const ws of summaries) {
+      console.log(`  ${pc6.cyan(ws.name)} -> ${ws.path}`);
+    }
+  } else {
+    console.log(
+      "No workspaces registered yet. Use `devsurface workspace add` or `npx devsurface` inside a project."
+    );
+  }
   console.log(`
-Dashboard running at -> ${pc5.cyan(server.url)}`);
+Hub running at -> ${pc6.cyan(server.url)}`);
+}
+
+// src/cli/commands/workspace.ts
+import path18 from "path";
+import pc7 from "picocolors";
+async function workspaceAddCommand(dirPath) {
+  const registry = new WorkspaceRegistry();
+  const target = path18.resolve(dirPath ?? process.cwd());
+  const entry = await registry.add(target);
+  console.log(`Added workspace ${pc7.cyan(entry.name)} (${entry.id}) -> ${entry.path}`);
+}
+async function workspaceListCommand() {
+  const registry = new WorkspaceRegistry();
+  const entries = await registry.list();
+  if (entries.length === 0) {
+    console.log(
+      "No workspaces registered. Run `devsurface workspace add` or `npx devsurface` inside a project."
+    );
+    return;
+  }
+  console.log(`${entries.length} workspace${entries.length === 1 ? "" : "s"}:
+`);
+  for (const entry of entries) {
+    console.log(`  ${pc7.cyan(entry.name)} (${entry.id})`);
+    console.log(`    ${entry.path}`);
+  }
+}
+async function workspaceRemoveCommand(id) {
+  const registry = new WorkspaceRegistry();
+  const removed = await registry.remove(id);
+  if (removed) {
+    console.log(`Removed workspace ${pc7.cyan(id)}.`);
+  } else {
+    console.error(`Workspace "${id}" not found.`);
+    process.exitCode = 1;
+  }
+}
+
+// src/cli/updateCheck.ts
+var REGISTRY_LATEST_URL = "https://registry.npmjs.org/devsurface/latest";
+var UPDATE_CHECK_TIMEOUT_MS = 900;
+function parseVersion(version) {
+  const match = version.match(/^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/);
+  if (!match) {
+    return null;
+  }
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function isNewerVersion(latestVersion, currentVersion) {
+  const latest = parseVersion(latestVersion);
+  const current = parseVersion(currentVersion);
+  if (latest === null || current === null) {
+    return false;
+  }
+  for (let index = 0; index < latest.length; index += 1) {
+    if (latest[index] > current[index]) {
+      return true;
+    }
+    if (latest[index] < current[index]) {
+      return false;
+    }
+  }
+  return false;
+}
+function formatUpdateNotice(info) {
+  return `Update available: v${info.latestVersion}
+Run: npx devsurface@latest`;
+}
+function shouldCheckForUpdates() {
+  return process.env.DEVSURFACE_UPDATE_CHECK !== "0" && process.env.CI !== "true";
+}
+async function checkForUpdate(currentVersion, fetchImpl = fetch) {
+  if (!shouldCheckForUpdates()) {
+    return null;
+  }
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), UPDATE_CHECK_TIMEOUT_MS);
+  try {
+    const response = await fetchImpl(REGISTRY_LATEST_URL, {
+      headers: {
+        accept: "application/json"
+      },
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const body = await response.json();
+    const latestVersion = typeof body.version === "string" ? body.version : null;
+    if (latestVersion === null || !isNewerVersion(latestVersion, currentVersion)) {
+      return null;
+    }
+    return {
+      currentVersion,
+      latestVersion
+    };
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function printUpdateNotice(currentVersion) {
+  const update = await checkForUpdate(currentVersion);
+  if (update !== null) {
+    console.log(`
+${formatUpdateNotice(update)}`);
+  }
 }
 
 // src/cli/index.ts
@@ -2808,7 +3785,9 @@ function toPort(value) {
   return port;
 }
 function handle(command) {
-  command.catch((error) => {
+  command.then(async () => {
+    await printUpdateNotice(DEV_SURFACE_VERSION);
+  }).catch((error) => {
     const message = error instanceof Error ? error.message : String(error);
     console.error(message);
     process.exitCode = 1;
@@ -2823,6 +3802,24 @@ program.name("devsurface").description("Turn any Node.js repository into a local
     })
   );
 });
+program.command("serve").description("Start the DevSurface hub server (multi-workspace mode).").option("-p, --port <port>", "hub port", toPort, 4567).option("--no-open", "do not open the browser automatically").action((options) => {
+  handle(
+    serveCommand({
+      port: options.port,
+      openBrowser: options.open
+    })
+  );
+});
+var workspace = program.command("workspace").description("Manage registered workspaces.");
+workspace.command("add [path]").description("Register a project directory with the hub.").action((dirPath) => {
+  handle(workspaceAddCommand(dirPath));
+});
+workspace.command("list").description("List all registered workspaces.").action(() => {
+  handle(workspaceListCommand());
+});
+workspace.command("remove <id>").description("Remove a workspace from the hub registry.").action((id) => {
+  handle(workspaceRemoveCommand(id));
+});
 program.command("scan").description("Print detected project info.").action(() => {
   handle(scanCommand(process.cwd()));
 });