@cordfuse/crosstalk 7.0.0-alpha.5 → 7.0.0-alpha.7

package/README.md

@@ -19,16 +19,14 @@ Requires: Node.js ≥ 20 + Docker on PATH + git on PATH. Works on Linux, macOS,
 ## Quickstart
 
 ```sh
-# 1. Scaffold a transport.
-crosstalk init mytransport
-cd mytransport
+# 1. Scaffold a transport. Runtime-owned at <base>/crosstalk/transport/.
+crosstalk init
 
-# 2. Bring up the engine container for this transport.
+# 2. Bring up the engine container.
 crosstalk up
-#    Generates docker-compose.yml in the transport root and runs
-#    `docker compose up -d` for ghcr.io/cordfuse/crosstalk-server:<latest>.
-#    Bind-mounts $PWD as the transport — any `git remote add` from the
-#    host is immediately visible to the engine.
+#    Generates <base>/crosstalk/docker-compose.yml and runs `docker
+#    compose up -d` for ghcr.io/cordfuse/crosstalk-server:<latest>.
+#    No cwd magic — works from any directory.
 
 # 3. Install an agent CLI inside the container, then authenticate.
 crosstalk chat --shell
@@ -36,8 +34,8 @@ crosstalk chat --shell
   exit
 crosstalk chat --agent claude --login
 #    Auth URL opens in your default browser via xdg-open / open / start.
-#    Operator never has to copy-paste it. Token saved in the /crosstalk-root
-#    volume so subsequent dispatched workers reuse it.
+#    Token saved in the /crosstalk-root volume so subsequent dispatched
+#    workers reuse it.
 
 # 4. Send your first message.
 crosstalk channel general
@@ -49,16 +47,19 @@ crosstalk replies <relPath printed by step above>
 
 ## Subcommand surface
 
+Every name-resolved verb takes an optional `--containername <name>` (or `-c <name>`) flag. Bare verb = default container (literally named `crosstalk`).
+
 | Group | Subcommand | What it does |
 |---|---|---|
 | Meta | `crosstalk version` | Print client + engine versions (warns on skew) |
-| Protocol | `crosstalk init <dir>` | Scaffold a transport + `git init` |
+| Protocol | `crosstalk init [-c <name>] [--remote <url>]` | Scaffold a transport at `<base>/<name>/transport/` |
 | Protocol | `crosstalk run --type primitive\|workflow ...` | Dispatch a primitive or workflow |
 | Protocol | `crosstalk replies <relPath>...` | Poll reply status |
-| Protocol | `crosstalk status` | Engine heartbeat, claimed models, channels |
+| Protocol | `crosstalk status` | Container name, transport host path, engine state, channels |
 | Protocol | `crosstalk channel <name> [--rename\|--delete]` | Channel operations |
-| Lifecycle | `crosstalk up` | Generate docker-compose, start engine container |
-| Lifecycle | `crosstalk down [--volumes]` | Stop the engine container |
+| Lifecycle | `crosstalk up` | Generate docker-compose, start the engine container |
+| Lifecycle | `crosstalk down` | Stop the engine container (keep storage) |
+| Lifecycle | `crosstalk rm [--force]` | Remove container AND wipe storage (cannot undo) |
 | Lifecycle | `crosstalk restart` | Down + up |
 | Lifecycle | `crosstalk pull` | Refresh the engine image |
 | Lifecycle | `crosstalk logs [-f]` | Stream the engine container's logs |
@@ -72,10 +73,14 @@ crosstalk replies <relPath printed by step above>
 
 ## What lives where
 
-- **Host** — `crosstalk` binary on PATH, `~/path/to/mytransport/` (the operator's transport directory, bind-mounted).
-- **Container** (`crosstalk-server`, image `ghcr.io/cordfuse/crosstalk-server`) — `crosstalkd` daemon, dispatch state bind-mounted at `<base>/<transport>/crosstalk-state:/var/lib/crosstalk-state`, operator-installed agent CLIs + auth tokens bind-mounted at `<base>/<transport>/crosstalk-root:/crosstalk-root`. `<base>` is per-OS (`$XDG_DATA_HOME/crosstalk` on Linux, `~/Library/Application Support/crosstalk` on macOS, `%LOCALAPPDATA%\crosstalk` on Windows); `CROSSTALK_STORAGE_MODE=system` switches to `/var/lib`-style paths instead.
-- **Engine HTTP API** — `127.0.0.1:7000` (compose `127.0.0.1:HOST:CONTAINER` port mapping is the actual security boundary; engine binds 0.0.0.0 inside the container).
-- **Transport bind-mount** — `$PWD:/var/lib/crosstalk-transport`. Operator git commands on the host are seen by the engine immediately.
+- **Host** — `crosstalk` binary on PATH. Per-transport storage at `<base>/<name>/` (one tree per container).
+- **Container** (literally named whatever the operator picked at `init`, default `crosstalk`; image `ghcr.io/cordfuse/crosstalk-server`) — `crosstalkd` daemon, bind-mounted from:
+  - `<base>/<name>/transport/` → `/var/lib/crosstalk-transport` (runtime-owned git repo)
+  - `<base>/<name>/crosstalk-root/` → `/crosstalk-root` (operator CLIs + auth)
+  - `<base>/<name>/crosstalk-state/` → `/var/lib/crosstalk-state` (cursor + heartbeat)
+- **`<base>`** is per-OS user-mode: `$XDG_DATA_HOME/crosstalk` on Linux, `~/Library/Application Support/crosstalk` on macOS, `%LOCALAPPDATA%\crosstalk` on Windows. `CROSSTALK_STORAGE_MODE=system` switches to `/var/lib`-style paths.
+- **Engine HTTP API** — `127.0.0.1:<port>`. Default container = port 7000; named containers allocate at init from 7001 upward, recorded in `<base>/<name>/api-port`.
+- **Container identification** — every crosstalkd container gets the Docker label `crosstalk.transport=true`. The client uses the label for inventory queries, not name-pattern matching.
 
 ---
 

package/bin/crosstalk.js

@@ -30,6 +30,8 @@ const SUBCOMMANDS = {
   init:    'init.js',
   up:      'up.js',
   down:    'down.js',
+  rm:      'rm.js',
+  auth:    'auth.js',
   restart: 'restart.js',
   pull:    'pull.js',
   logs:    'logs.js',

package/commands/auth.js

@@ -0,0 +1,218 @@
+// crosstalk auth — manage agent auth tokens/keys.
+//
+// One subverb: `paste`. Operator runs the agent's headless-token
+// generator on their host (`claude setup-token`, etc.), pastes the
+// resulting token at our prompt, and we persist it in the container's
+// env so subsequent dispatch + chat invocations are authenticated.
+//
+// Storage: <base>/<name>/auth.env (0600, operator-UID owned). Docker
+// Compose's `env_file:` references it; each line is `KEY=value`.
+// Existing keys are replaced in-place; new keys append. Empty lines
+// and `#` comments preserved.
+//
+// Why this exists: 5 of the 6 supported agents work cleanly with env-
+// var auth (the headless path), but none of them have a uniform "set
+// the token" UX inside the container. This verb is the operator's
+// one-stop shop — same UX for any agent.
+//
+// Per-agent env var (the audit on 2026-06-14 confirmed each):
+//   claude → CLAUDE_CODE_OAUTH_TOKEN   (preferred: `claude setup-token`)
+//            ANTHROPIC_API_KEY         (alternate: Console API key)
+//   codex  → OPENAI_API_KEY            (preferred)
+//            CODEX_ACCESS_TOKEN        (alternate: device-auth output)
+//   gemini → GEMINI_API_KEY
+//   qwen   → OPENAI_API_KEY            (qwen --auth-type openai)
+//   agy    → none (interactive OAuth only; errors with hint)
+
+import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { createInterface } from 'readline';
+import { has, flag } from '../lib/argv.js';
+import { requireInitialized, DEFAULT_CONTAINER_NAME } from '../lib/resolve.js';
+
+const AGENT_ENV = {
+  claude:   { default: 'CLAUDE_CODE_OAUTH_TOKEN', label: 'OAuth token' },
+  codex:    { default: 'OPENAI_API_KEY',          label: 'API key' },
+  gemini:   { default: 'GEMINI_API_KEY',          label: 'API key' },
+  qwen:     { default: 'OPENAI_API_KEY',          label: 'API key' },
+  opencode: { default: 'OPENAI_API_KEY',          label: 'provider API key' },
+};
+
+const AGENT_GEN_CMD = {
+  claude:   'claude setup-token        # on a host with a browser',
+  codex:    'echo $OPENAI_API_KEY      # or platform.openai.com/api-keys',
+  gemini:   'echo $GEMINI_API_KEY      # or aistudio.google.com/apikey',
+  qwen:     'echo $OPENAI_API_KEY      # OpenAI-compatible',
+  opencode: 'echo $OPENAI_API_KEY      # or provider-specific',
+};
+
+// Control byte values used by the TTY prompt — avoid embedding raw
+// bytes inline so the file is editor/linter clean.
+const CTRL_C = String.fromCharCode(3);   // 0x03 — interrupt
+const CTRL_D = String.fromCharCode(4);   // 0x04 — EOF
+const BS     = String.fromCharCode(8);   // 0x08 — backspace
+const DEL    = String.fromCharCode(127); // 0x7F — terminal backspace
+
+function usage(exit = 0) {
+  const w = exit === 0 ? process.stdout : process.stderr;
+  w.write(
+`Usage: crosstalk auth paste --agent <name> [--containername <name>]
+
+Persists an auth token/key for an agent CLI into the container's
+environment. Operator generates the value on the host (which has a
+browser) and pastes at the prompt; crosstalk writes it to
+<base>/<name>/auth.env. Subsequent dispatch + chat invocations pick
+it up via the engine container's env.
+
+Options:
+  --agent <name>           One of: claude, codex, gemini, qwen, opencode.
+                           agy is interactive-only; use 'crosstalk chat
+                           --agent agy --login' for OAuth instead.
+  --containername <name>   Which crosstalk container to set the env on
+                           (default: 'crosstalk').
+  -c <name>                Shorthand for --containername.
+
+Reads from stdin (hidden) — if the input isn't a TTY, the entire stdin
+is read as the token (e.g. piped from a setup script).
+
+After paste, run 'crosstalk restart' to pick up the new env.
+`,
+  );
+  process.exit(exit);
+}
+
+function promptHidden(promptText) {
+  return new Promise((resolve) => {
+    process.stderr.write(promptText);
+    if (!process.stdin.isTTY) {
+      let buf = '';
+      process.stdin.on('data', (chunk) => { buf += chunk.toString(); });
+      process.stdin.on('end', () => resolve(buf.trim()));
+      return;
+    }
+    if (typeof process.stdin.setRawMode !== 'function') {
+      const rl = createInterface({ input: process.stdin, output: process.stderr });
+      rl.question('', (ans) => { rl.close(); resolve(ans.trim()); });
+      return;
+    }
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding('utf-8');
+    let buf = '';
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === '\r' || ch === '\n') {
+          process.stderr.write('\n');
+          process.stdin.setRawMode(false);
+          process.stdin.pause();
+          process.stdin.removeListener('data', onData);
+          resolve(buf.trim());
+          return;
+        }
+        if (ch === CTRL_C || ch === CTRL_D) {
+          process.stderr.write('\n');
+          process.stdin.setRawMode(false);
+          process.exit(130);
+        }
+        if (ch === BS || ch === DEL) {
+          buf = buf.slice(0, -1);
+          continue;
+        }
+        buf += ch;
+      }
+    };
+    process.stdin.on('data', onData);
+  });
+}
+
+// Upsert a KEY=value line in env-file content. Preserves other lines +
+// comments. Returns the new content.
+function upsertEnv(existing, key, value) {
+  const lines = existing.split('\n');
+  let replaced = false;
+  const out = lines.map((line) => {
+    if (line.startsWith(`${key}=`)) {
+      replaced = true;
+      return `${key}=${value}`;
+    }
+    return line;
+  });
+  if (!replaced) {
+    while (out.length > 0 && out[out.length - 1] === '') out.pop();
+    out.push(`${key}=${value}`);
+    out.push('');
+  }
+  return out.join('\n');
+}
+
+export async function run(argv) {
+  if (has(argv, '--help') || has(argv, '-h')) usage(0);
+
+  const pos = argv.filter((a) => !a.startsWith('-'));
+  const subverb = pos[0];
+  if (subverb !== 'paste') {
+    if (subverb) {
+      process.stderr.write(`crosstalk auth: unknown subverb '${subverb}'. Try 'paste'.\n`);
+    } else {
+      usage(1);
+    }
+    return 1;
+  }
+
+  const agent = flag(argv, '--agent');
+  if (!agent) {
+    process.stderr.write(`crosstalk auth paste: --agent <name> is required.\n`);
+    return 1;
+  }
+
+  if (agent === 'agy') {
+    process.stderr.write(
+      `crosstalk auth paste: agy has no headless env-var path — its only auth is interactive OAuth.\n` +
+      `  Use 'crosstalk chat --agent agy --login' to set up auth.\n`,
+    );
+    return 1;
+  }
+
+  const cfg = AGENT_ENV[agent];
+  if (!cfg) {
+    process.stderr.write(
+      `crosstalk auth paste: unknown agent '${agent}'.\n` +
+      `  Supported: ${Object.keys(AGENT_ENV).join(', ')}.\n`,
+    );
+    return 1;
+  }
+
+  const { name, paths } = requireInitialized(argv);
+
+  if (process.stdin.isTTY) {
+    process.stderr.write(
+      `\nPasting ${cfg.label} for ${agent} into '${name}' container.\n` +
+      `  Env var: ${cfg.default}\n` +
+      `  Storage: ${paths.authEnvFile}\n` +
+      `\nGenerate on host:\n  ${AGENT_GEN_CMD[agent] ?? '(see agent docs)'}\n` +
+      `\nPaste the value below (input hidden, press Enter):\n`,
+    );
+  }
+  const value = await promptHidden('> ');
+  if (!value) {
+    process.stderr.write(`crosstalk auth paste: empty input — aborted.\n`);
+    return 1;
+  }
+  if (value.includes('\n')) {
+    process.stderr.write(
+      `crosstalk auth paste: input contains a newline. Tokens are single-line; check copy/paste.\n`,
+    );
+    return 1;
+  }
+
+  const existing = existsSync(paths.authEnvFile)
+    ? readFileSync(paths.authEnvFile, 'utf-8')
+    : '';
+  const updated = upsertEnv(existing, cfg.default, value);
+  writeFileSync(paths.authEnvFile, updated, { mode: 0o600 });
+
+  process.stdout.write(
+    `\nSaved ${cfg.default} to ${paths.authEnvFile}.\n` +
+    `Run 'crosstalk restart${name === DEFAULT_CONTAINER_NAME ? '' : ` --containername ${name}`}' to pick up the new env.\n`,
+  );
+  return 0;
+}

package/commands/channel.js

@@ -4,7 +4,7 @@
 // endpoints that haven't been added to the engine yet; they land
 // when the engine gains them.
 
-import { api } from '../lib/api-client.js';
+import { apiFor } from '../lib/api-client.js';
 import { reportAndExit } from '../lib/errors.js';
 import { positionals, has, flag } from '../lib/argv.js';
 
@@ -25,7 +25,8 @@ function usage(exit = 0) {
 export async function run(argv) {
   if (has(argv, '--help') || has(argv, '-h')) usage(0);
 
-  const pos = positionals(argv, ['--rename']);
+  const api = apiFor(argv);
+  const pos = positionals(argv, ['--rename', '--containername', '-c']);
   if (pos.length === 0) usage(1);
 
   // `crosstalk channel list` → list channels

package/commands/chat.js

@@ -23,8 +23,8 @@
 //   fallback, not the primary mechanism.
 
 import { spawn, spawnSync } from 'child_process';
-import { requireTransportRoot, containerName } from '../lib/transport.js';
-import { api, ConnectError } from '../lib/api-client.js';
+import { requireInitialized } from '../lib/resolve.js';
+import { apiFor, ConnectError } from '../lib/api-client.js';
 import { flag, has } from '../lib/argv.js';
 
 const KNOWN_AGENTS = ['claude', 'codex', 'gemini', 'qwen', 'opencode', 'agy'];
@@ -132,6 +132,17 @@ Examples:
   process.exit(exit);
 }
 
+// Detect host terminal dims with sane fallbacks. Pass into the
+// container via -e COLUMNS/LINES so the agent CLI renders at the
+// operator's real terminal size instead of docker's 80×24 fallback.
+// (When stdout is piped — like in --login — docker can't auto-detect
+// the host's stdout terminal, which is mac's alpha.6 bug D.)
+function hostTermDims() {
+  const cols = process.stdout.columns || process.stderr.columns || 120;
+  const rows = process.stdout.rows    || process.stderr.rows    || 40;
+  return { cols, rows };
+}
+
 function runInteractive(container, command, env = {}) {
   // Full TTY passthrough — docker exec -it gives the container a real
   // PTY, and stdio: 'inherit' forwards stdin/stdout/stderr from the
@@ -147,30 +158,79 @@ function runInteractive(container, command, env = {}) {
   return r.status ?? 1;
 }
 
+// Per-agent login command. Returns null for agents without an OAuth
+// path (gemini, qwen, opencode) — these need env-var auth, not browser
+// OAuth. The full audit (cachy 2026-06-14) confirmed each agent's
+// surface:
+//   claude  → `claude auth login` (clean single-line URL output)
+//   codex   → `codex login`       (clean single-line URL output)
+//   agy     → `agy --print init`  (triggers OAuth, clean URL)
+// We use the explicit auth subcommand instead of bare invocation —
+// that's mac's bug D fix root cause. Bare `claude` drops into a TUI
+// with line wraps + winsize sensitivity that broke URL extraction
+// across alpha.3 → alpha.6. The official auth subcommand prints a
+// plain single-line URL on stdout, no TUI involved.
+function loginCommand(agent) {
+  if (agent === 'claude') return ['claude', 'auth', 'login'];
+  if (agent === 'codex')  return ['codex', 'login'];
+  if (agent === 'agy')    return ['agy', '--print', 'init'];
+  return null;  // gemini, qwen, opencode — env-based
+}
+
+// Per-agent env-var hint for the no-OAuth agents.
+function envHint(agent) {
+  if (agent === 'gemini')   return 'GEMINI_API_KEY';
+  if (agent === 'qwen')     return 'OPENAI_API_KEY (qwen --auth-type openai)';
+  if (agent === 'opencode') return 'per-provider keys in opencode config';
+  return null;
+}
+
 function runLogin(container, agent) {
-  // Login mode: tee the agent's stdout so we can spot the auth URL and
-  // open it in the operator's browser. The container still has a real
-  // PTY (docker exec -it allocates one inside the container regardless
-  // of host stdio configuration), so the agent CLI renders into a TTY;
-  // we just pipe the bytes on the host side to inspect them.
-  //
-  // No agent-specific "login" subcommand — we just run the agent's
-  // default interactive entry point. First-run auth flow happens
-  // automatically for every agent we support.
-  //
-  // No COLUMNS=1000 env: making the agent render the URL "unwrapped" via
-  // a wide terminal claim doesn't reliably propagate to the in-container
-  // PTY, and even when it does Claude's TUI hard-wraps anyway. The
-  // extractCompleteUrl() function joins wrapped URL fragments on the
-  // host side, so the agent's rendering width is irrelevant. As bonus,
-  // dropping COLUMNS=1000 fixes daily-chat soft-wrap weirdness in
-  // long-form prose (agents see the real host terminal width).
+  const cmd = loginCommand(agent);
+  if (!cmd) {
+    const env = envHint(agent);
+    process.stderr.write(
+      `crosstalk chat --login --agent ${agent}: this agent has no browser OAuth flow.\n` +
+      (env ? `  Use environment-based auth instead:\n    crosstalk auth paste --agent ${agent}\n  (or set ${env} directly in docker-compose.yml)\n` : '') +
+      `  Documented in GUIDE-CLI.md § Agent auth.\n`,
+    );
+    return Promise.resolve(1);
+  }
+
+  // Pass host terminal dims explicitly. Docker exec -t normally sizes
+  // the container PTY off its stdout terminal, but we PIPE stdout (to
+  // scrape the OAuth URL), so docker has no TTY to size from and falls
+  // back to 80×24 — that's mac's bug D root cause. Setting COLUMNS/LINES
+  // env vars gets the agent CLI to render at the right size from the
+  // start. (Live SIGWINCH updates aren't propagated — docker env is
+  // set-at-spawn — but OAuth flows are short; operators don't typically
+  // resize the terminal mid-auth.)
+  const { cols, rows } = hostTermDims();
+
   return new Promise((resolve) => {
     const child = spawn(
       'docker',
-      ['exec', '-it', container, agent],
+      ['exec', '-it',
+       '-e', `COLUMNS=${cols}`,
+       '-e', `LINES=${rows}`,
+       '-e', 'TERM=xterm-256color',
+       container, ...cmd],
       { stdio: ['inherit', 'pipe', 'inherit'] },
     );
+
+    // SIGWINCH handler: docker env is set-at-spawn so we can't dynamically
+    // resize the in-container PTY without a control channel (would need
+    // node-pty or a sidecar process). Best-effort: surface that a resize
+    // happened so the operator knows why the TUI may not have responded.
+    const onWinch = () => {
+      const { cols: c, rows: r } = hostTermDims();
+      process.stderr.write(
+        `\n[crosstalk chat] Terminal resized to ${c}×${r} — in-container PTY won't update mid-session. ` +
+        `Exit (Ctrl-C) and retry if rendering is off.\n`,
+      );
+    };
+    process.on('SIGWINCH', onWinch);
+
     let opened = false;
     let buffer = '';
     child.stdout.on('data', (chunk) => {
@@ -187,16 +247,22 @@ function runLogin(container, agent) {
           : `\n[crosstalk chat] Could not auto-open browser. Open this URL manually:\n  ${url}\n`,
       );
     });
-    child.on('exit', (code) => resolve(code ?? 0));
-    child.on('error', () => resolve(1));
+    child.on('exit', (code) => {
+      process.removeListener('SIGWINCH', onWinch);
+      resolve(code ?? 0);
+    });
+    child.on('error', () => {
+      process.removeListener('SIGWINCH', onWinch);
+      resolve(1);
+    });
   });
 }
 
 export async function run(argv) {
   if (has(argv, '--help') || has(argv, '-h')) usage(0);
 
-  const root = requireTransportRoot();
-  const name = containerName(root);
+  const { name } = requireInitialized(argv);
+  const api = apiFor(argv);
 
   if (has(argv, '--shell')) {
     return runInteractive(name, 'bash');

package/commands/down.js

@@ -1,18 +1,22 @@
-// crosstalk down — stop the engine container for this transport.
+// crosstalk down — stop a transport's container, keep storage.
+//
+// alpha.6: name-resolved. --volumes flag retires (no named volumes in
+// the bind-mount model). Reversible — next `up` resumes against the
+// preserved <base>/<name>/ storage.
 
 import { existsSync } from 'fs';
 import { spawnSync } from 'child_process';
-import { requireTransportRoot, composeFile } from '../lib/transport.js';
 import { has } from '../lib/argv.js';
+import { requireInitialized, DEFAULT_CONTAINER_NAME } from '../lib/resolve.js';
 
 function usage(exit = 0) {
   const w = exit === 0 ? process.stdout : process.stderr;
   w.write(
-`Usage: crosstalk down [--volumes]
+`Usage: crosstalk down [--containername <name>]
 
-Stops the engine container for the transport in the current directory.
-With --volumes, also removes the persistent volumes (clears operator-
-installed CLIs + auth state; you'll have to re-install + re-auth).
+Stops the engine container for a transport. Storage at <base>/<name>/
+is preserved — next 'crosstalk up' resumes against it. Use
+'crosstalk rm' if you want to wipe storage as well.
 `,
   );
   process.exit(exit);
@@ -21,17 +25,16 @@ installed CLIs + auth state; you'll have to re-install + re-auth).
 export async function run(argv) {
   if (has(argv, '--help') || has(argv, '-h')) usage(0);
 
-  const root = requireTransportRoot();
-  const composeYml = composeFile(root);
-  if (!existsSync(composeYml)) {
-    process.stderr.write(`crosstalk down: no docker-compose.yml at ${composeYml}\n`);
-    process.stderr.write(`  (this transport was probably never brought up — nothing to do)\n`);
+  const { name, paths } = requireInitialized(argv);
+  if (!existsSync(paths.composeFile)) {
+    process.stderr.write(
+      `crosstalk down: '${name}' has no compose file (never brought up). Nothing to do.\n`,
+    );
     return 0;
   }
 
-  const args = ['compose', '-f', composeYml, 'down'];
-  if (has(argv, '--volumes')) args.push('--volumes');
-
-  const r = spawnSync('docker', args, { cwd: root, stdio: 'inherit' });
+  const r = spawnSync('docker', ['compose', '-f', paths.composeFile, 'down'], {
+    stdio: 'inherit',
+  });
   return r.status ?? 1;
 }