typeclaw 0.1.1 → 0.1.3

package/src/cli/doctor.ts

@@ -0,0 +1,100 @@
+import { defineCommand } from 'citty'
+
+import { formatJson, formatReport, runDoctor, type DoctorRunResult } from '@/doctor'
+import { findAgentDir } from '@/init'
+
+export const doctorCommand = defineCommand({
+  meta: {
+    name: 'doctor',
+    description: 'diagnose the host, agent folder, and plugins; surface remediation steps',
+  },
+  args: {
+    verbose: {
+      type: 'boolean',
+      alias: 'v',
+      description: 'show check details and per-entry hints',
+      default: false,
+    },
+    json: {
+      type: 'boolean',
+      description: 'emit the doctor report as JSON',
+      default: false,
+    },
+    fix: {
+      type: 'boolean',
+      description: 'attempt to auto-fix issues and commit changes in the agent folder',
+      default: false,
+    },
+    only: {
+      type: 'string',
+      description: 'comma-separated list of categories to include (e.g. docker,config)',
+    },
+  },
+  async run({ args }) {
+    const cwd = findAgentDir(process.cwd()) ?? process.cwd()
+    const only = parseOnly(args.only)
+    const result = await runDoctor({
+      cwd,
+      fix: args.fix,
+      ...(only !== undefined ? { only } : {}),
+    })
+    emit(result, { verbose: args.verbose, json: args.json })
+    process.exit(exitCodeFor(result))
+  },
+})
+
+export function exitCodeFor(result: DoctorRunResult): number {
+  const last = result.final ?? result.initial
+  if (last.ok) return 0
+  return 1
+}
+
+function parseOnly(value: string | undefined): string[] | undefined {
+  if (value === undefined) return undefined
+  const parts = value
+    .split(',')
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0)
+  return parts.length > 0 ? parts : undefined
+}
+
+function emit(result: DoctorRunResult, opts: { verbose: boolean; json: boolean }): void {
+  if (opts.json) {
+    process.stdout.write(`${formatJson(result.final ?? result.initial)}\n`)
+    return
+  }
+  const useColor = Boolean(process.stdout.isTTY) && process.env.NO_COLOR === undefined
+  process.stdout.write(`${formatReport(result.initial, { useColor, verbose: opts.verbose })}\n`)
+
+  if (result.fixAttempts) {
+    process.stdout.write('\n')
+    process.stdout.write(`${formatFixAttempts(result, useColor)}\n`)
+  }
+  if (result.final) {
+    process.stdout.write('\n')
+    process.stdout.write(`${formatReport(result.final, { useColor, verbose: opts.verbose })}\n`)
+  }
+}
+
+function formatFixAttempts(result: DoctorRunResult, useColor: boolean): string {
+  const lines: string[] = []
+  lines.push(useColor ? '\u001b[1m--fix\u001b[0m' : '--fix')
+  for (const attempt of result.fixAttempts ?? []) {
+    const tag = attempt.source === 'static' ? '[static]' : `[plugin]`
+    if (attempt.ok) {
+      lines.push(`  ${tag} ${attempt.name}: ${attempt.summary}`)
+    } else {
+      lines.push(`  ${tag} ${attempt.name}: failed: ${attempt.reason}`)
+    }
+  }
+  if (result.commit) {
+    if (result.commit.kind === 'committed') {
+      lines.push(`  commit: ${result.commit.commitSha.slice(0, 12)} (${result.commit.pathsStaged.length} path(s))`)
+    } else if (result.commit.kind === 'skipped') {
+      lines.push(`  commit: skipped — ${result.commit.reason}`)
+    } else {
+      lines.push(`  commit: failed — ${result.commit.reason}`)
+    }
+  }
+  return lines.join('\n')
+}

package/src/cli/index.ts

@@ -2,9 +2,12 @@
 
 import { defineCommand, runMain } from 'citty'
 
+import { CLI_VERSION } from '../init/cli-version'
+
 const main = defineCommand({
   meta: {
     name: 'typeclaw',
+    version: CLI_VERSION,
     description: 'TypeClaw agent runtime',
   },
   subCommands: {
@@ -20,6 +23,7 @@ const main = defineCommand({
     shell: () => import('./shell').then((m) => m.shellCommand),
     compose: () => import('./compose').then((m) => m.composeCommand),
     channel: () => import('./channel').then((m) => m.channelCommand),
+    doctor: () => import('./doctor').then((m) => m.doctorCommand),
     _hostd: () => import('./hostd').then((m) => m.hostdCommand),
   },
 })

package/src/cli/init.ts

@@ -275,6 +275,7 @@ export const init = defineCommand({
         cwd,
         llmAuth,
         model: selectedModel.ref,
+        cliEntry: process.argv[1],
         ...(discordBotToken !== undefined ? { discordBotToken } : {}),
         ...(slackBotToken !== undefined ? { slackBotToken, slackAppToken } : {}),
         ...(telegramBotToken !== undefined ? { telegramBotToken } : {}),
@@ -414,7 +415,7 @@ function preflightFailureGuidance(result: Extract<DockerAvailability, { ok: fals
 }
 
 function reportKakaotalkAuth(result: KakaotalkAuthResult): string {
-  if (result.ok) return 'KakaoTalk credentials saved to workspace/.agent-messenger/.'
+  if (result.ok) return 'KakaoTalk credentials saved to secrets.json.'
   return `KakaoTalk login failed: ${result.reason}`
 }
 

package/src/cli/ui.ts

@@ -2,6 +2,8 @@ import { styleText } from 'node:util'
 
 import { cancel, intro, isCancel, log, note, outro, spinner as clackSpinner } from '@clack/prompts'
 
+import { type AutoUpgradeOutcome, describeAutoUpgrade } from '@/init/auto-upgrade'
+
 export { cancel, intro, isCancel, log, note, outro }
 
 function colorize(modifier: Parameters<typeof styleText>[0], s: string): string {
@@ -62,6 +64,7 @@ export type StartLikeResult = {
   hostPort: number
   containerId: string
   hostd: { state: 'registered' } | { state: 'unavailable'; reason: string } | { state: 'disabled' }
+  autoUpgrade?: AutoUpgradeOutcome
 }
 
 export function renderStartSuccess(result: StartLikeResult): string {
@@ -69,6 +72,14 @@ export function renderStartSuccess(result: StartLikeResult): string {
   const name = c.cyan(result.plan.containerName)
   const port = c.green(String(result.hostPort))
 
+  if (result.autoUpgrade) {
+    const message = describeAutoUpgrade(result.autoUpgrade)
+    if (message.length > 0) {
+      const tint = result.autoUpgrade.kind === 'exact-pin-respected' ? c.yellow : c.cyan
+      lines.push(tint(message))
+    }
+  }
+
   if (result.alreadyRunning) {
     lines.push(`${c.green('●')} ${name} is already running on host port ${port}.`)
   } else {

package/src/compose/doctor.ts

@@ -0,0 +1,141 @@
+import { loadConfigSync } from '@/config'
+import { runDoctor, type DoctorRunResult, type RunDoctorOptions } from '@/doctor'
+
+import { discoverAgents, type AgentEntry } from './discover'
+
+export type ComposeDoctorAgent = {
+  entry: AgentEntry
+  result: DoctorRunResult
+}
+
+export type ComposeDoctorCrossCheck = {
+  name: string
+  status: 'ok' | 'warning' | 'error' | 'info'
+  message: string
+  details?: string[]
+}
+
+export type ComposeDoctorReport = {
+  rootCwd: string
+  agents: ComposeDoctorAgent[]
+  crossChecks: ComposeDoctorCrossCheck[]
+  ok: boolean
+}
+
+export type ComposeDoctorOptions = {
+  rootCwd: string
+  fix?: boolean
+  only?: string[]
+  shallow?: boolean
+  runDoctorFn?: (opts: RunDoctorOptions) => Promise<DoctorRunResult>
+}
+
+export async function composeDoctor(opts: ComposeDoctorOptions): Promise<ComposeDoctorReport> {
+  const runDoctorFn = opts.runDoctorFn ?? runDoctor
+  const agents = discoverAgents(opts.rootCwd)
+
+  const crossChecks: ComposeDoctorCrossCheck[] = []
+  if (agents.length === 0) {
+    crossChecks.push({
+      name: 'compose.root-has-agents',
+      status: 'info',
+      message: 'no typeclaw agents found in immediate subdirectories',
+    })
+  } else {
+    crossChecks.push(...runCrossChecks(agents))
+  }
+
+  let agentResults: ComposeDoctorAgent[] = []
+  if (!opts.shallow) {
+    agentResults = await Promise.all(
+      agents.map(async (entry) => ({
+        entry,
+        result: await runDoctorFn({
+          cwd: entry.cwd,
+          ...(opts.fix === true ? { fix: true } : {}),
+          ...(opts.only !== undefined ? { only: opts.only } : {}),
+        }),
+      })),
+    )
+  }
+
+  const ok =
+    crossChecks.every((c) => c.status === 'ok' || c.status === 'info') &&
+    agentResults.every((a) => (a.result.final ?? a.result.initial).ok)
+
+  return { rootCwd: opts.rootCwd, agents: agentResults, crossChecks, ok }
+}
+
+export function runCrossChecks(agents: AgentEntry[]): ComposeDoctorCrossCheck[] {
+  const checks: ComposeDoctorCrossCheck[] = []
+
+  const portConfigs = collectPreferredPorts(agents)
+  const portDuplicates = findDuplicates(portConfigs.map(({ port }) => port))
+  if (portDuplicates.size === 0) {
+    checks.push({
+      name: 'compose.no-port-collisions',
+      status: 'ok',
+      message: `${portConfigs.length} agent(s) declare unique preferred ports`,
+    })
+  } else {
+    const details = [...portDuplicates].map((port) => {
+      const names = portConfigs.filter((p) => p.port === port).map((p) => p.name)
+      return `port ${port}: ${names.join(', ')}`
+    })
+    checks.push({
+      name: 'compose.no-port-collisions',
+      status: 'warning',
+      message: `${portDuplicates.size} preferred port(s) shared across agents`,
+      details,
+    })
+  }
+
+  const nameDuplicates = findDuplicates(agents.map((a) => a.containerName))
+  if (nameDuplicates.size === 0) {
+    checks.push({
+      name: 'compose.no-container-name-collisions',
+      status: 'ok',
+      message: 'all agent folders map to unique Docker names',
+    })
+  } else {
+    const details = [...nameDuplicates].map((name) => {
+      const collisions = agents.filter((a) => a.containerName === name).map((a) => a.name)
+      return `${name}: ${collisions.join(', ')}`
+    })
+    checks.push({
+      name: 'compose.no-container-name-collisions',
+      status: 'error',
+      message: `${nameDuplicates.size} container name(s) shared across agents`,
+      details,
+    })
+  }
+
+  return checks
+}
+
+function collectPreferredPorts(agents: AgentEntry[]): Array<{ name: string; port: number }> {
+  const out: Array<{ name: string; port: number }> = []
+  for (const agent of agents) {
+    const port = readPreferredPort(agent.cwd)
+    if (port !== null) out.push({ name: agent.name, port })
+  }
+  return out
+}
+
+function readPreferredPort(cwd: string): number | null {
+  try {
+    return loadConfigSync(cwd).port
+  } catch {
+    return null
+  }
+}
+
+function findDuplicates<T>(items: T[]): Set<T> {
+  const seen = new Set<T>()
+  const dupes = new Set<T>()
+  for (const item of items) {
+    if (seen.has(item)) dupes.add(item)
+    else seen.add(item)
+  }
+  return dupes
+}

package/src/compose/index.ts

@@ -1,4 +1,12 @@
 export { discoverAgents, type AgentEntry } from './discover'
+export {
+  composeDoctor,
+  runCrossChecks,
+  type ComposeDoctorAgent,
+  type ComposeDoctorCrossCheck,
+  type ComposeDoctorOptions,
+  type ComposeDoctorReport,
+} from './doctor'
 export { colorFor, composeLogs, makeLinePrefixer, type ComposeLogsOptions, type ComposeLogsResult } from './logs'
 export { composeStatus, type AgentRuntimeState, type AgentStatusEntry, type ComposeStatusResult } from './status'
 export {

package/src/compose/logs.ts

@@ -1,4 +1,6 @@
 import { containerExists } from '@/container'
+import { supportsColor } from '@/container/log-colors'
+import { makeLogTimestampReformatter, type TimestampReformatter } from '@/container/log-timestamps'
 import { getBun } from '@/container/shared'
 
 import { discoverAgents, type AgentEntry } from './discover'
@@ -91,7 +93,9 @@ export async function composeLogs({
   const useColor = supportsColor(out)
 
   const procs = attached.map((agent) => {
-    const cmd = follow ? ['docker', 'logs', '-f', agent.containerName] : ['docker', 'logs', agent.containerName]
+    const cmd = follow
+      ? ['docker', 'logs', '--timestamps', '-f', agent.containerName]
+      : ['docker', 'logs', '--timestamps', agent.containerName]
     const proc = bun.spawn({ cmd, stdout: 'pipe', stderr: 'pipe' })
     return { agent, proc }
   })
@@ -110,8 +114,18 @@ export async function composeLogs({
   const pumps = procs.flatMap(({ agent, proc }) => {
     const color = colorFor(agent.name)
     return [
-      pumpStream(proc.stdout, makeLinePrefixer(agent.name, width, color, useColor), out),
-      pumpStream(proc.stderr, makeLinePrefixer(agent.name, width, color, useColor), err),
+      pumpStream(
+        proc.stdout,
+        makeLogTimestampReformatter(undefined, { color: useColor }),
+        makeLinePrefixer(agent.name, width, color, useColor),
+        out,
+      ),
+      pumpStream(
+        proc.stderr,
+        makeLogTimestampReformatter(undefined, { color: useColor }),
+        makeLinePrefixer(agent.name, width, color, useColor),
+        err,
+      ),
     ]
   })
 
@@ -128,35 +142,34 @@ export async function composeLogs({
 
 async function pumpStream(
   stream: ReadableStream<Uint8Array>,
+  reformatter: TimestampReformatter,
   prefixer: { write: (s: string) => string; flush: () => string },
   sink: NodeJS.WritableStream,
 ): Promise<void> {
   const decoder = new TextDecoder()
   const reader = stream.getReader()
+  const writeChunk = (chunk: string): void => {
+    const reformatted = reformatter.write(chunk)
+    if (reformatted.length === 0) return
+    const prefixed = prefixer.write(reformatted)
+    if (prefixed.length > 0) sink.write(prefixed)
+  }
   try {
     while (true) {
       const { done, value } = await reader.read()
       if (done) break
-      if (value && value.byteLength > 0) {
-        const out = prefixer.write(decoder.decode(value, { stream: true }))
-        if (out.length > 0) sink.write(out)
-      }
+      if (value && value.byteLength > 0) writeChunk(decoder.decode(value, { stream: true }))
     }
     const tail = decoder.decode()
-    if (tail.length > 0) {
-      const out = prefixer.write(tail)
-      if (out.length > 0) sink.write(out)
+    if (tail.length > 0) writeChunk(tail)
+    const flushedTs = reformatter.flush()
+    if (flushedTs.length > 0) {
+      const prefixed = prefixer.write(flushedTs)
+      if (prefixed.length > 0) sink.write(prefixed)
     }
-    const flushed = prefixer.flush()
-    if (flushed.length > 0) sink.write(flushed)
+    const flushedPrefix = prefixer.flush()
+    if (flushedPrefix.length > 0) sink.write(flushedPrefix)
   } finally {
     reader.releaseLock()
   }
 }
-
-function supportsColor(stream: NodeJS.WritableStream): boolean {
-  const tty = (stream as unknown as { isTTY?: boolean }).isTTY === true
-  if (!tty) return false
-  if (process.env.NO_COLOR !== undefined && process.env.NO_COLOR !== '') return false
-  return true
-}

package/src/config/config.ts

@@ -104,6 +104,34 @@ export const gitignoreSchema = z
 
 export type GitignoreConfig = z.infer<typeof gitignoreSchema>
 
+// `blockInternal` is the kill-switch for the container-stage egress filter
+// installed by Dockerfile entrypoint shim: when true, the container is granted
+// CAP_NET_ADMIN at boot just long enough to install iptables OUTPUT rules
+// that DROP traffic to RFC1918, link-local (incl. cloud metadata), CGNAT,
+// multicast/reserved, IPv6 ULA/link-local/multicast. The capability is then
+// dropped from the bounding set via setpriv before the agent process exec's,
+// so no child (python, curl, bun-spawned anything) can mutate or recover it.
+//
+// Default is `true`: the threat model that motivated this feature — prompt
+// injection asking the agent to fetch RFC1918 hosts (e.g. a LAN router admin
+// page) or the cloud-IMDS endpoint — applies to every agent equally, so the
+// safe default is "on" and
+// the explicit opt-out is for users who need their agent to reach LAN hosts
+// (NAS, internal services, sibling dev machines). PR #145 shipped this with
+// default `false` to preserve existing-folder behavior on upgrade; this
+// follow-up (the one PR #145 promised in its description) makes the default
+// match the intent. `typeclaw init` also writes `true` explicitly so the
+// field is discoverable in fresh `typeclaw.json` files. Loopback traffic
+// (`-o lo`) is always allowed by the shim, so `bun run dev` and local APIs
+// on `localhost` / `127.0.0.1` are unaffected.
+export const networkSchema = z
+  .object({
+    blockInternal: z.boolean().default(true),
+  })
+  .default({ blockInternal: true })
+
+export type NetworkConfig = z.infer<typeof networkSchema>
+
 export const configSchema = z
   .object({
     $schema: z.string().optional(),
@@ -123,6 +151,7 @@ export const configSchema = z
     alias: z.array(z.string().trim().min(1)).default([]),
     channels: channelsSchema,
     portForward: portForwardSchema,
+    network: networkSchema,
     dockerfile: dockerfileSchema,
     gitignore: gitignoreSchema,
   })
@@ -213,6 +242,7 @@ export const FIELD_EFFECTS: Record<string, FieldEffect> = {
   alias: 'applied',
   channels: 'applied',
   portForward: 'restart-required',
+  network: 'restart-required',
   dockerfile: 'restart-required',
   gitignore: 'restart-required',
 }
@@ -276,6 +306,7 @@ export function extractPluginConfigs(raw: unknown): Record<string, unknown> {
     'plugins',
     'channels',
     'portForward',
+    'network',
     'dockerfile',
     'gitignore',
   ])

package/src/container/log-colors.ts

@@ -0,0 +1,75 @@
+// Per-source line tinting for `typeclaw logs` and `typeclaw compose logs`.
+// PR #146's wall-clock timestamp prefix made every line start identically,
+// dropping readability when many sources interleave. We restore visual
+// grouping by tinting each line based on its first `[tag]` (`[plugin:memory]`,
+// `[memory-logger]`, etc.). Same trick `compose/logs.ts#colorFor` uses for
+// agent names — stable hash → palette index → ANSI escape that wraps the
+// whole line body.
+//
+// Lines without a `[tag]` get no tint (only the leading timestamp is dimmed),
+// so untagged docker output, raw stack traces, and channel adapter logs
+// stay readable without inheriting a misleading color.
+
+import type { WritableStream as NodeWritable } from 'node:stream/web'
+
+const ANSI_RESET = '\x1b[0m'
+const ANSI_DIM = '\x1b[2m'
+const ANSI_CYAN = '\x1b[36m'
+const ANSI_YELLOW = '\x1b[33m'
+const ANSI_GREEN = '\x1b[32m'
+const ANSI_MAGENTA = '\x1b[35m'
+const ANSI_BLUE = '\x1b[34m'
+const ANSI_BRIGHT_CYAN = '\x1b[96m'
+const ANSI_BRIGHT_YELLOW = '\x1b[93m'
+const ANSI_BRIGHT_GREEN = '\x1b[92m'
+const ANSI_BRIGHT_MAGENTA = '\x1b[95m'
+const ANSI_BRIGHT_BLUE = '\x1b[94m'
+
+const TAG_PALETTE = [
+  ANSI_CYAN,
+  ANSI_YELLOW,
+  ANSI_GREEN,
+  ANSI_MAGENTA,
+  ANSI_BLUE,
+  ANSI_BRIGHT_CYAN,
+  ANSI_BRIGHT_YELLOW,
+  ANSI_BRIGHT_GREEN,
+  ANSI_BRIGHT_MAGENTA,
+  ANSI_BRIGHT_BLUE,
+] as const
+
+// Anchored to line start with a trailing space so a date that happens to
+// appear mid-line doesn't get dimmed.
+const TIMESTAMP_RE = /^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})(?= )/
+
+const TAG_RE = /\[([^\]\n]+)\]/
+
+// `useColor=false` returns the input verbatim; the contract that protects
+// pipes, file redirects, NO_COLOR, and tests from ANSI leakage.
+export function colorize(line: string, useColor: boolean): string {
+  if (!useColor || line.length === 0) return line
+
+  const ts = TIMESTAMP_RE.exec(line)
+  const timestampLen = ts ? ts[0].length : 0
+  const dimmedTimestamp = ts ? `${ANSI_DIM}${ts[0]}${ANSI_RESET}` : ''
+  const rest = line.slice(timestampLen)
+
+  const tag = TAG_RE.exec(rest)
+  if (!tag) return `${dimmedTimestamp}${rest}`
+
+  const tint = paletteColor(tag[1] ?? '')
+  return `${dimmedTimestamp}${tint}${rest}${ANSI_RESET}`
+}
+
+function paletteColor(seed: string): string {
+  let h = 0
+  for (let i = 0; i < seed.length; i++) h = (h * 31 + seed.charCodeAt(i)) >>> 0
+  return TAG_PALETTE[h % TAG_PALETTE.length] ?? TAG_PALETTE[0]
+}
+
+export function supportsColor(stream: NodeJS.WritableStream | NodeWritable): boolean {
+  const tty = (stream as unknown as { isTTY?: boolean }).isTTY === true
+  if (!tty) return false
+  if (process.env.NO_COLOR !== undefined && process.env.NO_COLOR !== '') return false
+  return true
+}

package/src/container/log-timestamps.ts

@@ -0,0 +1,84 @@
+// Docker emits each `--timestamps` line as `<RFC3339Nano> <body>\n`, e.g.
+// `2026-05-13T14:23:01.123456789Z hello world\n`. RFC3339Nano is precise but
+// painful to read live; humans want a wall-clock prefix. This module parses
+// the leading token, reformats it to `YYYY-MM-DD HH:MM:SS` in the host's
+// local timezone, and passes everything after the first space through.
+//
+// Stateful chunker mirroring src/compose/logs.ts#makeLinePrefixer: only emits
+// newline-terminated lines and flushes the un-terminated tail on EOF, so
+// interleaved reads from `docker logs` can never shred a line mid-character.
+
+import { colorize } from './log-colors'
+
+// `2026-05-13T14:23:01.123456789Z` or `...+09:00` etc. We accept anything
+// from Docker that Date can parse, but anchor on the ISO date+time prefix to
+// avoid eating non-timestamped log content.
+const TIMESTAMP_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})) (.*)$/
+
+export type TimestampReformatter = {
+  write: (chunk: string) => string
+  flush: () => string
+}
+
+export type ReformatterOptions = {
+  // Color is opt-in and applied per emitted line *after* timestamp rewriting.
+  // Defaults to `false` so tests stay deterministic and pipes/files stay
+  // ANSI-free unless callers explicitly opt in via supportsColor(out).
+  color?: boolean
+}
+
+export function makeLogTimestampReformatter(
+  now: () => Date = () => new Date(),
+  options: ReformatterOptions = {},
+): TimestampReformatter {
+  const useColor = options.color ?? false
+  let buffer = ''
+  return {
+    write(chunk: string): string {
+      buffer += chunk
+      const nl = buffer.lastIndexOf('\n')
+      if (nl < 0) return ''
+      const complete = buffer.slice(0, nl + 1)
+      buffer = buffer.slice(nl + 1)
+      return complete
+        .split('\n')
+        .slice(0, -1)
+        .map((line) => `${colorize(reformatLine(line, now), useColor)}\n`)
+        .join('')
+    },
+    flush(): string {
+      if (buffer.length === 0) return ''
+      const out = `${colorize(reformatLine(buffer, now), useColor)}\n`
+      buffer = ''
+      return out
+    },
+  }
+}
+
+// Exported for tests. Format: `YYYY-MM-DD HH:MM:SS <rest>`. Falls back to the
+// raw line if it doesn't look like a Docker `--timestamps` line, and falls
+// back to `now()` if Docker's timestamp doesn't parse (defensive — shouldn't
+// happen, but losing one timestamp shouldn't hide the log body).
+export function reformatLine(line: string, now: () => Date = () => new Date()): string {
+  const match = TIMESTAMP_RE.exec(line)
+  if (!match) return line
+  const [, raw, body] = match
+  if (raw === undefined || body === undefined) return line
+  const parsed = new Date(raw)
+  const stamp = formatLocal(Number.isNaN(parsed.getTime()) ? now() : parsed)
+  return `${stamp} ${body}`
+}
+
+function formatLocal(d: Date): string {
+  const year = d.getFullYear()
+  const month = pad2(d.getMonth() + 1)
+  const day = pad2(d.getDate())
+  const hour = pad2(d.getHours())
+  const minute = pad2(d.getMinutes())
+  const second = pad2(d.getSeconds())
+  return `${year}-${month}-${day} ${hour}:${minute}:${second}`
+}
+
+function pad2(n: number): string {
+  return n < 10 ? `0${n}` : String(n)
+}