fix: use -tt for forced PTY and -o cat for journalctl color passthrough

Two fixes discovered during live sandbox testing:

1. SSH PTY: Changed --ssh-flag=-t to --ssh-flag=-tt. The single -t
   requires stdin to be a terminal, but subprocess.Popen doesn't have
   one. Double -tt forces PTY allocation regardless.

2. journalctl output format: The default --short format strips ANSI
   escape codes from stored messages. When colors are enabled, use
   -o cat which outputs raw message content preserving ANSI codes
   written by the --pretty devserver.

Author: dashed

devservices/commands/sandbox.py

@@ -928,10 +928,14 @@ def sandbox_logs(args: Namespace) -> None:
     # Build the remote command
     if service in SANDBOX_SYSTEMD_SERVICES:
         unit = SANDBOX_SYSTEMD_SERVICES[service]
+        # Use -o cat when colors are enabled: journalctl's default --short format
+        # strips ANSI escape codes from stored messages, but -o cat outputs raw
+        # message content preserving any ANSI codes written by --pretty devserver.
+        output_fmt = " -o cat" if use_color else ""
         if follow:
-            remote_cmd = f"sudo journalctl -u {unit} -n {lines} -f"
+            remote_cmd = f"sudo journalctl -u {unit} -n {lines}{output_fmt} -f"
         else:
-            remote_cmd = f"sudo journalctl -u {unit} -n {lines} --no-pager"
+            remote_cmd = f"sudo journalctl -u {unit} -n {lines}{output_fmt} --no-pager"
     else:
         # Docker container — find by partial name match
         follow_flag = "-f " if follow else ""

devservices/utils/sandbox.py

@@ -297,8 +297,9 @@ def ssh_stream(
     Unlike ssh_command() which captures output, this passes stdout/stderr
     directly through to the caller's terminal, suitable for follow/tail mode.
 
-    When tty=True, allocates a PTY on the remote side (--ssh-flag=-t) so that
-    programs which detect a terminal (e.g. journalctl) emit colored output.
+    When tty=True, forces PTY allocation on the remote side (--ssh-flag=-tt)
+    so that programs which detect a terminal (e.g. journalctl) emit colored
+    output. Uses -tt (double) to force allocation even without a local tty.
     """
     cmd = [
         "gcloud",
@@ -310,7 +311,7 @@ def ssh_stream(
         "--tunnel-through-iap",
     ]
     if tty:
-        cmd.append("--ssh-flag=-t")
+        cmd.append("--ssh-flag=-tt")
     cmd.append(f"--command={command}")
     try:
         return subprocess.Popen(cmd)

tests/commands/test_sandbox.py

@@ -3128,6 +3128,7 @@ def test_sandbox_logs_follow_color(
         assert call_kwargs["tty"] is True
         remote_cmd = mock_ssh_stream.call_args[0][3]
         assert ANSI_STRIP_PIPE not in remote_cmd
+        assert "-o cat" in remote_cmd
         mock_proc.wait.assert_called()
 
 
@@ -3170,6 +3171,7 @@ def test_sandbox_logs_follow_no_color(
         assert call_kwargs["tty"] is False
         remote_cmd = mock_ssh_stream.call_args[0][3]
         assert ANSI_STRIP_PIPE in remote_cmd
+        assert "-o cat" not in remote_cmd
         mock_proc.wait.assert_called()
 
 
@@ -3212,6 +3214,7 @@ def test_sandbox_logs_no_follow_color(
         assert call_kwargs["tty"] is True
         remote_cmd = mock_ssh_stream.call_args[0][3]
         assert ANSI_STRIP_PIPE not in remote_cmd
+        assert "-o cat" in remote_cmd
         mock_proc.wait.assert_called()
 
 
@@ -3254,6 +3257,7 @@ def test_sandbox_logs_no_follow_no_color(
         assert call_kwargs["tty"] is False
         remote_cmd = mock_ssh_stream.call_args[0][3]
         assert ANSI_STRIP_PIPE in remote_cmd
+        assert "-o cat" not in remote_cmd
         mock_proc.wait.assert_called()
 
 
@@ -3299,6 +3303,7 @@ def test_sandbox_logs_auto_color_tty(
         assert call_kwargs["tty"] is True
         remote_cmd = mock_ssh_stream.call_args[0][3]
         assert ANSI_STRIP_PIPE not in remote_cmd
+        assert "-o cat" in remote_cmd
 
 
 @mock.patch("devservices.commands.sandbox.validate_sandbox_prerequisites")
@@ -3343,6 +3348,7 @@ def test_sandbox_logs_auto_color_pipe(
         assert call_kwargs["tty"] is False
         remote_cmd = mock_ssh_stream.call_args[0][3]
         assert ANSI_STRIP_PIPE in remote_cmd
+        assert "-o cat" not in remote_cmd
 
 
 @mock.patch("devservices.commands.sandbox.validate_sandbox_prerequisites")

tests/utils/test_sandbox.py

@@ -736,26 +736,26 @@ def test_ssh_command_gcloud_not_found(mock_run_gcloud: mock.Mock) -> None:
 
 @mock.patch("subprocess.Popen")
 def test_ssh_stream_with_tty(mock_popen: mock.Mock) -> None:
-    """ssh_stream with tty=True adds --ssh-flag=-t to the command."""
+    """ssh_stream with tty=True adds --ssh-flag=-tt to the command."""
     mock_proc = mock.Mock()
     mock_popen.return_value = mock_proc
     result = ssh_stream(
         "sandbox-test", "my-project", "us-central1-a", "echo hello", tty=True
     )
     assert result is mock_proc
     call_args = mock_popen.call_args[0][0]
-    assert "--ssh-flag=-t" in call_args
+    assert "--ssh-flag=-tt" in call_args
 
 
 @mock.patch("subprocess.Popen")
 def test_ssh_stream_without_tty(mock_popen: mock.Mock) -> None:
-    """ssh_stream with tty=False (default) does NOT add --ssh-flag=-t."""
+    """ssh_stream with tty=False (default) does NOT add --ssh-flag=-tt."""
     mock_proc = mock.Mock()
     mock_popen.return_value = mock_proc
     result = ssh_stream("sandbox-test", "my-project", "us-central1-a", "echo hello")
     assert result is mock_proc
     call_args = mock_popen.call_args[0][0]
-    assert "--ssh-flag=-t" not in call_args
+    assert "--ssh-flag=-tt" not in call_args
 
 
 # --- check_api_enabled ---