typeclaw 0.1.1 → 0.1.2

package/src/cli/doctor.ts

@@ -0,0 +1,100 @@
+import { defineCommand } from 'citty'
+
+import { formatJson, formatReport, runDoctor, type DoctorRunResult } from '@/doctor'
+import { findAgentDir } from '@/init'
+
+export const doctorCommand = defineCommand({
+  meta: {
+    name: 'doctor',
+    description: 'diagnose the host, agent folder, and plugins; surface remediation steps',
+  },
+  args: {
+    verbose: {
+      type: 'boolean',
+      alias: 'v',
+      description: 'show check details and per-entry hints',
+      default: false,
+    },
+    json: {
+      type: 'boolean',
+      description: 'emit the doctor report as JSON',
+      default: false,
+    },
+    fix: {
+      type: 'boolean',
+      description: 'attempt to auto-fix issues and commit changes in the agent folder',
+      default: false,
+    },
+    only: {
+      type: 'string',
+      description: 'comma-separated list of categories to include (e.g. docker,config)',
+    },
+  },
+  async run({ args }) {
+    const cwd = findAgentDir(process.cwd()) ?? process.cwd()
+    const only = parseOnly(args.only)
+    const result = await runDoctor({
+      cwd,
+      fix: args.fix,
+      ...(only !== undefined ? { only } : {}),
+    })
+    emit(result, { verbose: args.verbose, json: args.json })
+    process.exit(exitCodeFor(result))
+  },
+})
+
+export function exitCodeFor(result: DoctorRunResult): number {
+  const last = result.final ?? result.initial
+  if (last.ok) return 0
+  return 1
+}
+
+function parseOnly(value: string | undefined): string[] | undefined {
+  if (value === undefined) return undefined
+  const parts = value
+    .split(',')
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0)
+  return parts.length > 0 ? parts : undefined
+}
+
+function emit(result: DoctorRunResult, opts: { verbose: boolean; json: boolean }): void {
+  if (opts.json) {
+    process.stdout.write(`${formatJson(result.final ?? result.initial)}\n`)
+    return
+  }
+  const useColor = Boolean(process.stdout.isTTY) && process.env.NO_COLOR === undefined
+  process.stdout.write(`${formatReport(result.initial, { useColor, verbose: opts.verbose })}\n`)
+
+  if (result.fixAttempts) {
+    process.stdout.write('\n')
+    process.stdout.write(`${formatFixAttempts(result, useColor)}\n`)
+  }
+  if (result.final) {
+    process.stdout.write('\n')
+    process.stdout.write(`${formatReport(result.final, { useColor, verbose: opts.verbose })}\n`)
+  }
+}
+
+function formatFixAttempts(result: DoctorRunResult, useColor: boolean): string {
+  const lines: string[] = []
+  lines.push(useColor ? '\u001b[1m--fix\u001b[0m' : '--fix')
+  for (const attempt of result.fixAttempts ?? []) {
+    const tag = attempt.source === 'static' ? '[static]' : `[plugin]`
+    if (attempt.ok) {
+      lines.push(`  ${tag} ${attempt.name}: ${attempt.summary}`)
+    } else {
+      lines.push(`  ${tag} ${attempt.name}: failed: ${attempt.reason}`)
+    }
+  }
+  if (result.commit) {
+    if (result.commit.kind === 'committed') {
+      lines.push(`  commit: ${result.commit.commitSha.slice(0, 12)} (${result.commit.pathsStaged.length} path(s))`)
+    } else if (result.commit.kind === 'skipped') {
+      lines.push(`  commit: skipped — ${result.commit.reason}`)
+    } else {
+      lines.push(`  commit: failed — ${result.commit.reason}`)
+    }
+  }
+  return lines.join('\n')
+}

package/src/cli/index.ts

@@ -20,6 +20,7 @@ const main = defineCommand({
     shell: () => import('./shell').then((m) => m.shellCommand),
     compose: () => import('./compose').then((m) => m.composeCommand),
     channel: () => import('./channel').then((m) => m.channelCommand),
+    doctor: () => import('./doctor').then((m) => m.doctorCommand),
     _hostd: () => import('./hostd').then((m) => m.hostdCommand),
   },
 })

package/src/compose/doctor.ts

@@ -0,0 +1,141 @@
+import { loadConfigSync } from '@/config'
+import { runDoctor, type DoctorRunResult, type RunDoctorOptions } from '@/doctor'
+
+import { discoverAgents, type AgentEntry } from './discover'
+
+export type ComposeDoctorAgent = {
+  entry: AgentEntry
+  result: DoctorRunResult
+}
+
+export type ComposeDoctorCrossCheck = {
+  name: string
+  status: 'ok' | 'warning' | 'error' | 'info'
+  message: string
+  details?: string[]
+}
+
+export type ComposeDoctorReport = {
+  rootCwd: string
+  agents: ComposeDoctorAgent[]
+  crossChecks: ComposeDoctorCrossCheck[]
+  ok: boolean
+}
+
+export type ComposeDoctorOptions = {
+  rootCwd: string
+  fix?: boolean
+  only?: string[]
+  shallow?: boolean
+  runDoctorFn?: (opts: RunDoctorOptions) => Promise<DoctorRunResult>
+}
+
+export async function composeDoctor(opts: ComposeDoctorOptions): Promise<ComposeDoctorReport> {
+  const runDoctorFn = opts.runDoctorFn ?? runDoctor
+  const agents = discoverAgents(opts.rootCwd)
+
+  const crossChecks: ComposeDoctorCrossCheck[] = []
+  if (agents.length === 0) {
+    crossChecks.push({
+      name: 'compose.root-has-agents',
+      status: 'info',
+      message: 'no typeclaw agents found in immediate subdirectories',
+    })
+  } else {
+    crossChecks.push(...runCrossChecks(agents))
+  }
+
+  let agentResults: ComposeDoctorAgent[] = []
+  if (!opts.shallow) {
+    agentResults = await Promise.all(
+      agents.map(async (entry) => ({
+        entry,
+        result: await runDoctorFn({
+          cwd: entry.cwd,
+          ...(opts.fix === true ? { fix: true } : {}),
+          ...(opts.only !== undefined ? { only: opts.only } : {}),
+        }),
+      })),
+    )
+  }
+
+  const ok =
+    crossChecks.every((c) => c.status === 'ok' || c.status === 'info') &&
+    agentResults.every((a) => (a.result.final ?? a.result.initial).ok)
+
+  return { rootCwd: opts.rootCwd, agents: agentResults, crossChecks, ok }
+}
+
+export function runCrossChecks(agents: AgentEntry[]): ComposeDoctorCrossCheck[] {
+  const checks: ComposeDoctorCrossCheck[] = []
+
+  const portConfigs = collectPreferredPorts(agents)
+  const portDuplicates = findDuplicates(portConfigs.map(({ port }) => port))
+  if (portDuplicates.size === 0) {
+    checks.push({
+      name: 'compose.no-port-collisions',
+      status: 'ok',
+      message: `${portConfigs.length} agent(s) declare unique preferred ports`,
+    })
+  } else {
+    const details = [...portDuplicates].map((port) => {
+      const names = portConfigs.filter((p) => p.port === port).map((p) => p.name)
+      return `port ${port}: ${names.join(', ')}`
+    })
+    checks.push({
+      name: 'compose.no-port-collisions',
+      status: 'warning',
+      message: `${portDuplicates.size} preferred port(s) shared across agents`,
+      details,
+    })
+  }
+
+  const nameDuplicates = findDuplicates(agents.map((a) => a.containerName))
+  if (nameDuplicates.size === 0) {
+    checks.push({
+      name: 'compose.no-container-name-collisions',
+      status: 'ok',
+      message: 'all agent folders map to unique Docker names',
+    })
+  } else {
+    const details = [...nameDuplicates].map((name) => {
+      const collisions = agents.filter((a) => a.containerName === name).map((a) => a.name)
+      return `${name}: ${collisions.join(', ')}`
+    })
+    checks.push({
+      name: 'compose.no-container-name-collisions',
+      status: 'error',
+      message: `${nameDuplicates.size} container name(s) shared across agents`,
+      details,
+    })
+  }
+
+  return checks
+}
+
+function collectPreferredPorts(agents: AgentEntry[]): Array<{ name: string; port: number }> {
+  const out: Array<{ name: string; port: number }> = []
+  for (const agent of agents) {
+    const port = readPreferredPort(agent.cwd)
+    if (port !== null) out.push({ name: agent.name, port })
+  }
+  return out
+}
+
+function readPreferredPort(cwd: string): number | null {
+  try {
+    return loadConfigSync(cwd).port
+  } catch {
+    return null
+  }
+}
+
+function findDuplicates<T>(items: T[]): Set<T> {
+  const seen = new Set<T>()
+  const dupes = new Set<T>()
+  for (const item of items) {
+    if (seen.has(item)) dupes.add(item)
+    else seen.add(item)
+  }
+  return dupes
+}

package/src/compose/index.ts

@@ -1,4 +1,12 @@
 export { discoverAgents, type AgentEntry } from './discover'
+export {
+  composeDoctor,
+  runCrossChecks,
+  type ComposeDoctorAgent,
+  type ComposeDoctorCrossCheck,
+  type ComposeDoctorOptions,
+  type ComposeDoctorReport,
+} from './doctor'
 export { colorFor, composeLogs, makeLinePrefixer, type ComposeLogsOptions, type ComposeLogsResult } from './logs'
 export { composeStatus, type AgentRuntimeState, type AgentStatusEntry, type ComposeStatusResult } from './status'
 export {

package/src/compose/logs.ts

@@ -1,4 +1,6 @@
 import { containerExists } from '@/container'
+import { supportsColor } from '@/container/log-colors'
+import { makeLogTimestampReformatter, type TimestampReformatter } from '@/container/log-timestamps'
 import { getBun } from '@/container/shared'
 
 import { discoverAgents, type AgentEntry } from './discover'
@@ -91,7 +93,9 @@ export async function composeLogs({
   const useColor = supportsColor(out)
 
   const procs = attached.map((agent) => {
-    const cmd = follow ? ['docker', 'logs', '-f', agent.containerName] : ['docker', 'logs', agent.containerName]
+    const cmd = follow
+      ? ['docker', 'logs', '--timestamps', '-f', agent.containerName]
+      : ['docker', 'logs', '--timestamps', agent.containerName]
     const proc = bun.spawn({ cmd, stdout: 'pipe', stderr: 'pipe' })
     return { agent, proc }
   })
@@ -110,8 +114,18 @@ export async function composeLogs({
   const pumps = procs.flatMap(({ agent, proc }) => {
     const color = colorFor(agent.name)
     return [
-      pumpStream(proc.stdout, makeLinePrefixer(agent.name, width, color, useColor), out),
-      pumpStream(proc.stderr, makeLinePrefixer(agent.name, width, color, useColor), err),
+      pumpStream(
+        proc.stdout,
+        makeLogTimestampReformatter(undefined, { color: useColor }),
+        makeLinePrefixer(agent.name, width, color, useColor),
+        out,
+      ),
+      pumpStream(
+        proc.stderr,
+        makeLogTimestampReformatter(undefined, { color: useColor }),
+        makeLinePrefixer(agent.name, width, color, useColor),
+        err,
+      ),
     ]
   })
 
@@ -128,35 +142,34 @@ export async function composeLogs({
 
 async function pumpStream(
   stream: ReadableStream<Uint8Array>,
+  reformatter: TimestampReformatter,
   prefixer: { write: (s: string) => string; flush: () => string },
   sink: NodeJS.WritableStream,
 ): Promise<void> {
   const decoder = new TextDecoder()
   const reader = stream.getReader()
+  const writeChunk = (chunk: string): void => {
+    const reformatted = reformatter.write(chunk)
+    if (reformatted.length === 0) return
+    const prefixed = prefixer.write(reformatted)
+    if (prefixed.length > 0) sink.write(prefixed)
+  }
   try {
     while (true) {
       const { done, value } = await reader.read()
       if (done) break
-      if (value && value.byteLength > 0) {
-        const out = prefixer.write(decoder.decode(value, { stream: true }))
-        if (out.length > 0) sink.write(out)
-      }
+      if (value && value.byteLength > 0) writeChunk(decoder.decode(value, { stream: true }))
     }
     const tail = decoder.decode()
-    if (tail.length > 0) {
-      const out = prefixer.write(tail)
-      if (out.length > 0) sink.write(out)
+    if (tail.length > 0) writeChunk(tail)
+    const flushedTs = reformatter.flush()
+    if (flushedTs.length > 0) {
+      const prefixed = prefixer.write(flushedTs)
+      if (prefixed.length > 0) sink.write(prefixed)
     }
-    const flushed = prefixer.flush()
-    if (flushed.length > 0) sink.write(flushed)
+    const flushedPrefix = prefixer.flush()
+    if (flushedPrefix.length > 0) sink.write(flushedPrefix)
   } finally {
     reader.releaseLock()
   }
 }
-
-function supportsColor(stream: NodeJS.WritableStream): boolean {
-  const tty = (stream as unknown as { isTTY?: boolean }).isTTY === true
-  if (!tty) return false
-  if (process.env.NO_COLOR !== undefined && process.env.NO_COLOR !== '') return false
-  return true
-}

package/src/config/config.ts

@@ -104,6 +104,23 @@ export const gitignoreSchema = z
 
 export type GitignoreConfig = z.infer<typeof gitignoreSchema>
 
+// `blockInternal` is the kill-switch for the container-stage egress filter
+// installed by Dockerfile entrypoint shim: when true, the container is granted
+// CAP_NET_ADMIN at boot just long enough to install iptables OUTPUT rules
+// that DROP traffic to RFC1918, link-local (incl. cloud metadata), CGNAT,
+// multicast/reserved, IPv6 ULA/link-local/multicast. The capability is then
+// dropped from the bounding set via setpriv before the agent process exec's,
+// so no child (python, curl, bun-spawned anything) can mutate or recover it.
+// Default is `false` so existing agent folders are unaffected by an upgrade;
+// `typeclaw init` writes `true` for new agents (handled separately in init).
+export const networkSchema = z
+  .object({
+    blockInternal: z.boolean().default(false),
+  })
+  .default({ blockInternal: false })
+
+export type NetworkConfig = z.infer<typeof networkSchema>
+
 export const configSchema = z
   .object({
     $schema: z.string().optional(),
@@ -123,6 +140,7 @@ export const configSchema = z
     alias: z.array(z.string().trim().min(1)).default([]),
     channels: channelsSchema,
     portForward: portForwardSchema,
+    network: networkSchema,
     dockerfile: dockerfileSchema,
     gitignore: gitignoreSchema,
   })
@@ -213,6 +231,7 @@ export const FIELD_EFFECTS: Record<string, FieldEffect> = {
   alias: 'applied',
   channels: 'applied',
   portForward: 'restart-required',
+  network: 'restart-required',
   dockerfile: 'restart-required',
   gitignore: 'restart-required',
 }
@@ -276,6 +295,7 @@ export function extractPluginConfigs(raw: unknown): Record<string, unknown> {
     'plugins',
     'channels',
     'portForward',
+    'network',
     'dockerfile',
     'gitignore',
   ])

package/src/container/log-colors.ts

@@ -0,0 +1,75 @@
+// Per-source line tinting for `typeclaw logs` and `typeclaw compose logs`.
+// PR #146's wall-clock timestamp prefix made every line start identically,
+// dropping readability when many sources interleave. We restore visual
+// grouping by tinting each line based on its first `[tag]` (`[plugin:memory]`,
+// `[memory-logger]`, etc.). Same trick `compose/logs.ts#colorFor` uses for
+// agent names — stable hash → palette index → ANSI escape that wraps the
+// whole line body.
+//
+// Lines without a `[tag]` get no tint (only the leading timestamp is dimmed),
+// so untagged docker output, raw stack traces, and channel adapter logs
+// stay readable without inheriting a misleading color.
+
+import type { WritableStream as NodeWritable } from 'node:stream/web'
+
+const ANSI_RESET = '\x1b[0m'
+const ANSI_DIM = '\x1b[2m'
+const ANSI_CYAN = '\x1b[36m'
+const ANSI_YELLOW = '\x1b[33m'
+const ANSI_GREEN = '\x1b[32m'
+const ANSI_MAGENTA = '\x1b[35m'
+const ANSI_BLUE = '\x1b[34m'
+const ANSI_BRIGHT_CYAN = '\x1b[96m'
+const ANSI_BRIGHT_YELLOW = '\x1b[93m'
+const ANSI_BRIGHT_GREEN = '\x1b[92m'
+const ANSI_BRIGHT_MAGENTA = '\x1b[95m'
+const ANSI_BRIGHT_BLUE = '\x1b[94m'
+
+const TAG_PALETTE = [
+  ANSI_CYAN,
+  ANSI_YELLOW,
+  ANSI_GREEN,
+  ANSI_MAGENTA,
+  ANSI_BLUE,
+  ANSI_BRIGHT_CYAN,
+  ANSI_BRIGHT_YELLOW,
+  ANSI_BRIGHT_GREEN,
+  ANSI_BRIGHT_MAGENTA,
+  ANSI_BRIGHT_BLUE,
+] as const
+
+// Anchored to line start with a trailing space so a date that happens to
+// appear mid-line doesn't get dimmed.
+const TIMESTAMP_RE = /^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})(?= )/
+
+const TAG_RE = /\[([^\]\n]+)\]/
+
+// `useColor=false` returns the input verbatim; the contract that protects
+// pipes, file redirects, NO_COLOR, and tests from ANSI leakage.
+export function colorize(line: string, useColor: boolean): string {
+  if (!useColor || line.length === 0) return line
+
+  const ts = TIMESTAMP_RE.exec(line)
+  const timestampLen = ts ? ts[0].length : 0
+  const dimmedTimestamp = ts ? `${ANSI_DIM}${ts[0]}${ANSI_RESET}` : ''
+  const rest = line.slice(timestampLen)
+
+  const tag = TAG_RE.exec(rest)
+  if (!tag) return `${dimmedTimestamp}${rest}`
+
+  const tint = paletteColor(tag[1] ?? '')
+  return `${dimmedTimestamp}${tint}${rest}${ANSI_RESET}`
+}
+
+function paletteColor(seed: string): string {
+  let h = 0
+  for (let i = 0; i < seed.length; i++) h = (h * 31 + seed.charCodeAt(i)) >>> 0
+  return TAG_PALETTE[h % TAG_PALETTE.length] ?? TAG_PALETTE[0]
+}
+
+export function supportsColor(stream: NodeJS.WritableStream | NodeWritable): boolean {
+  const tty = (stream as unknown as { isTTY?: boolean }).isTTY === true
+  if (!tty) return false
+  if (process.env.NO_COLOR !== undefined && process.env.NO_COLOR !== '') return false
+  return true
+}

package/src/container/log-timestamps.ts

@@ -0,0 +1,84 @@
+// Docker emits each `--timestamps` line as `<RFC3339Nano> <body>\n`, e.g.
+// `2026-05-13T14:23:01.123456789Z hello world\n`. RFC3339Nano is precise but
+// painful to read live; humans want a wall-clock prefix. This module parses
+// the leading token, reformats it to `YYYY-MM-DD HH:MM:SS` in the host's
+// local timezone, and passes everything after the first space through.
+//
+// Stateful chunker mirroring src/compose/logs.ts#makeLinePrefixer: only emits
+// newline-terminated lines and flushes the un-terminated tail on EOF, so
+// interleaved reads from `docker logs` can never shred a line mid-character.
+
+import { colorize } from './log-colors'
+
+// `2026-05-13T14:23:01.123456789Z` or `...+09:00` etc. We accept anything
+// from Docker that Date can parse, but anchor on the ISO date+time prefix to
+// avoid eating non-timestamped log content.
+const TIMESTAMP_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})) (.*)$/
+
+export type TimestampReformatter = {
+  write: (chunk: string) => string
+  flush: () => string
+}
+
+export type ReformatterOptions = {
+  // Color is opt-in and applied per emitted line *after* timestamp rewriting.
+  // Defaults to `false` so tests stay deterministic and pipes/files stay
+  // ANSI-free unless callers explicitly opt in via supportsColor(out).
+  color?: boolean
+}
+
+export function makeLogTimestampReformatter(
+  now: () => Date = () => new Date(),
+  options: ReformatterOptions = {},
+): TimestampReformatter {
+  const useColor = options.color ?? false
+  let buffer = ''
+  return {
+    write(chunk: string): string {
+      buffer += chunk
+      const nl = buffer.lastIndexOf('\n')
+      if (nl < 0) return ''
+      const complete = buffer.slice(0, nl + 1)
+      buffer = buffer.slice(nl + 1)
+      return complete
+        .split('\n')
+        .slice(0, -1)
+        .map((line) => `${colorize(reformatLine(line, now), useColor)}\n`)
+        .join('')
+    },
+    flush(): string {
+      if (buffer.length === 0) return ''
+      const out = `${colorize(reformatLine(buffer, now), useColor)}\n`
+      buffer = ''
+      return out
+    },
+  }
+}
+
+// Exported for tests. Format: `YYYY-MM-DD HH:MM:SS <rest>`. Falls back to the
+// raw line if it doesn't look like a Docker `--timestamps` line, and falls
+// back to `now()` if Docker's timestamp doesn't parse (defensive — shouldn't
+// happen, but losing one timestamp shouldn't hide the log body).
+export function reformatLine(line: string, now: () => Date = () => new Date()): string {
+  const match = TIMESTAMP_RE.exec(line)
+  if (!match) return line
+  const [, raw, body] = match
+  if (raw === undefined || body === undefined) return line
+  const parsed = new Date(raw)
+  const stamp = formatLocal(Number.isNaN(parsed.getTime()) ? now() : parsed)
+  return `${stamp} ${body}`
+}
+
+function formatLocal(d: Date): string {
+  const year = d.getFullYear()
+  const month = pad2(d.getMonth() + 1)
+  const day = pad2(d.getDate())
+  const hour = pad2(d.getHours())
+  const minute = pad2(d.getMinutes())
+  const second = pad2(d.getSeconds())
+  return `${year}-${month}-${day} ${hour}:${minute}:${second}`
+}
+
+function pad2(n: number): string {
+  return n < 10 ? `0${n}` : String(n)
+}

package/src/container/logs.ts

@@ -1,3 +1,5 @@
+import { supportsColor } from './log-colors'
+import { makeLogTimestampReformatter, type TimestampReformatter } from './log-timestamps'
 import { containerExists, containerNameFromCwd, getBun } from './shared'
 
 export type LogsPlan = {
@@ -7,7 +9,25 @@ export type LogsPlan = {
 
 export type LogsResult = { ok: true; containerName: string; exitCode: number } | { ok: false; reason: string }
 
-export async function logs({ cwd, follow }: { cwd: string; follow: boolean }): Promise<LogsResult> {
+export type LogsOptions = {
+  cwd: string
+  follow: boolean
+  out?: NodeJS.WritableStream
+  err?: NodeJS.WritableStream
+  signal?: AbortSignal
+  // When undefined, defaults to TTY+NO_COLOR detection on `out`/`err`.
+  // Tests pass `false` for deterministic plain output.
+  useColor?: boolean
+}
+
+export async function logs({
+  cwd,
+  follow,
+  out = process.stdout,
+  err = process.stderr,
+  signal,
+  useColor,
+}: LogsOptions): Promise<LogsResult> {
   const bun = getBun()
   if (!bun) return { ok: false, reason: 'bun runtime not available' }
 
@@ -18,14 +38,30 @@ export async function logs({ cwd, follow }: { cwd: string; follow: boolean }): P
       return { ok: false, reason: `Container ${containerName} not found. Run \`typeclaw start\` first.` }
     }
 
-    const cmd = ['docker', 'logs']
+    const cmd = ['docker', 'logs', '--timestamps']
     if (follow) cmd.push('-f')
     cmd.push(containerName)
 
-    // Inherit stdio so logs stream live and Ctrl+C reaches `docker logs`,
-    // which exits cleanly on SIGINT in follow mode.
-    const proc = bun.spawn({ cmd, cwd, stdout: 'inherit', stderr: 'inherit' })
+    const proc = bun.spawn({ cmd, cwd, stdout: 'pipe', stderr: 'pipe' })
+
+    const onAbort = (): void => {
+      try {
+        proc.kill('SIGTERM')
+      } catch {
+        // already exited
+      }
+    }
+    signal?.addEventListener('abort', onAbort, { once: true })
+
+    const colorOut = useColor ?? supportsColor(out)
+    const colorErr = useColor ?? supportsColor(err)
+    await Promise.all([
+      pumpWithTimestamps(proc.stdout, out, makeLogTimestampReformatter(undefined, { color: colorOut })),
+      pumpWithTimestamps(proc.stderr, err, makeLogTimestampReformatter(undefined, { color: colorErr })),
+    ])
     const exitCode = await proc.exited
+    signal?.removeEventListener('abort', onAbort)
+
     return { ok: true, containerName, exitCode }
   } catch (error) {
     return { ok: false, reason: error instanceof Error ? error.message : String(error) }
@@ -35,3 +71,33 @@ export async function logs({ cwd, follow }: { cwd: string; follow: boolean }): P
 export function planLogs(cwd: string, { follow }: { follow: boolean }): LogsPlan {
   return { containerName: containerNameFromCwd(cwd), follow }
 }
+
+// Exported for `compose/logs.ts` so the multi-agent path reuses the same
+// reformatter and stays consistent with single-agent output.
+export async function pumpWithTimestamps(
+  stream: ReadableStream<Uint8Array>,
+  sink: NodeJS.WritableStream,
+  reformatter: TimestampReformatter = makeLogTimestampReformatter(),
+): Promise<void> {
+  const decoder = new TextDecoder()
+  const reader = stream.getReader()
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      if (value && value.byteLength > 0) {
+        const out = reformatter.write(decoder.decode(value, { stream: true }))
+        if (out.length > 0) sink.write(out)
+      }
+    }
+    const tail = decoder.decode()
+    if (tail.length > 0) {
+      const out = reformatter.write(tail)
+      if (out.length > 0) sink.write(out)
+    }
+    const flushed = reformatter.flush()
+    if (flushed.length > 0) sink.write(flushed)
+  } finally {
+    reader.releaseLock()
+  }
+}