catherd-cli 0.2.1 → 1.1.0

package/src/services/dispatches.ts

@@ -0,0 +1,174 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { z } from "zod";
+import { dispatchHints } from "../domain/hints.ts";
+import { ACCESS, type RunRecord } from "../domain/record.ts";
+import { ROLES } from "../domain/roles.ts";
+import { dispatchPaths, readExit, supervisorAlive } from "../infra/dispatch-dir.ts";
+import { isAlive } from "../infra/proc.ts";
+import { readVersioned, writeTextAtomic } from "../infra/store.ts";
+import { readRecords, type Run, runPaths } from "./run-store.ts";
+
+/** admit.json: what admission decided. Written last, so a dispatch exists once it does. */
+const AdmitSchema = z.looseObject({
+  schema: z.literal(1),
+  runId: z.string(),
+  dispatchId: z.string(),
+  name: z.string(),
+  role: z.enum(ROLES),
+  lane: z.string().nullable(),
+  owns: z.array(z.string()),
+  rung: z.string(),
+  backend: z.string(),
+  thread: z.string().nullable(),
+  attempt: z.number().int().min(1),
+  failoverFrom: z.string().nullable(),
+  /** the limited dispatch a failover stand-in replaces (plan 9); absent on any other dispatch */
+  failoverOf: z.string().optional(),
+  access: z.enum(ACCESS),
+  isolated: z.boolean(),
+  cliVersion: z.string().nullable(),
+  admittedAt: z.string(),
+  repo: z.string(),
+  /** `git status` fingerprints when admitted, for changedOwned and violations */
+  before: z.record(z.string(), z.string()),
+  /** the Claude Code session that dispatched it (spec §3.3); absent on 1.0 dispatches and outside Claude Code */
+  sessionId: z.string().optional(),
+});
+export type Admit = z.infer<typeof AdmitSchema>;
+
+export interface Dispatch {
+  dir: string;
+  admit: Admit;
+}
+export type DispatchState = "starting" | "running" | "finished";
+
+/** How long an admitted dispatch may go without a launch.json before it counts as never started. */
+export const STARTING_GRACE_MS = 30_000;
+/** The start grace in force; tests shorten it. */
+export const startLimits = { graceMs: STARTING_GRACE_MS };
+
+export const admitPath = (dir: string): string => join(dir, "admit.json");
+export const launchPath = (dir: string): string => join(dir, "launch.json");
+export const roleDir = (run: Run, name: string): string => join(runPaths(run.dir).roles, name);
+
+/** Every admitted dispatch of the run, oldest first; a folder whose admit.json cannot be read is skipped. */
+export function listDispatches(run: Run): Dispatch[] {
+  const roles = runPaths(run.dir).roles;
+  const out: Dispatch[] = [];
+  if (!existsSync(roles)) return out;
+  for (const name of readdirSync(roles, { withFileTypes: true })) {
+    if (!name.isDirectory()) continue;
+    for (const id of readdirSync(join(roles, name.name), { withFileTypes: true })) {
+      if (!id.isDirectory()) continue;
+      const dir = join(roles, name.name, id.name);
+      try {
+        out.push({ dir, admit: readVersioned(admitPath(dir), AdmitSchema, 1) });
+      } catch {
+        // admission never finished writing this folder
+      }
+    }
+  }
+  return out.sort((a, b) => a.admit.dispatchId.localeCompare(b.admit.dispatchId));
+}
+
+interface ProcFile {
+  pid: number;
+  /** the worker's process group; the detached worker leads it */
+  pgid?: number;
+  startTime: string | null;
+  supervisorPid: number;
+  supervisorStartTime: string | null;
+  startedAt: string;
+}
+interface LaunchFile {
+  supervisorPid: number;
+  supervisorStartTime: string | null;
+}
+
+function readJson<T>(file: string): T | null {
+  try {
+    return JSON.parse(readFileSync(file, "utf8")) as T;
+  } catch {
+    return null;
+  }
+}
+
+export const readProc = (dir: string): ProcFile | null => readJson<ProcFile>(dispatchPaths(dir).proc);
+
+/**
+ * Spec §3.3: finished once exit.json exists, or once neither the supervisor nor its worker is alive,
+ * each identified by pid and start time, so a reused pid never keeps a dispatch alive (audit C3).
+ */
+export function dispatchState(d: Dispatch, now = Date.now()): DispatchState {
+  if (readExit(d.dir)) return "finished";
+  // a live supervisor holds its dispatch's lock from its first moment, before launch.json or proc.json
+  if (!readProc(d.dir) && supervisorAlive(d.dir)) return "starting";
+  const proc = readProc(d.dir);
+  if (proc)
+    return isAlive(proc.supervisorPid, proc.supervisorStartTime) || isAlive(proc.pid, proc.startTime)
+      ? "running"
+      : "finished";
+  const launch = readJson<LaunchFile>(launchPath(d.dir));
+  if (launch) return isAlive(launch.supervisorPid, launch.supervisorStartTime) ? "starting" : "finished";
+  return now - Date.parse(d.admit.admittedAt) < startLimits.graceMs ? "starting" : "finished";
+}
+
+export type LiveDispatch = Dispatch & { state: DispatchState };
+
+/** Dispatches that have no record yet, with their state; `live` keeps only the unfinished ones. */
+export function pendingDispatches(
+  run: Run,
+  now = Date.now(),
+  records: RunRecord[] = readRecords(run).records,
+): LiveDispatch[] {
+  const recorded = new Set(records.map((r) => r.dispatchId));
+  return listDispatches(run)
+    .filter((d) => !recorded.has(d.admit.dispatchId))
+    .map((d) => ({ ...d, state: dispatchState(d, now) }));
+}
+
+export const liveDispatches = (run: Run, now = Date.now()): LiveDispatch[] =>
+  pendingDispatches(run, now).filter((d) => d.state !== "finished");
+
+/** Spec §4.1: `roles/<name>/latest` names the newest dispatch of a role. */
+export function setLatest(run: Run, name: string, dispatchId: string): void {
+  writeTextAtomic(join(roleDir(run, name), "latest"), dispatchId);
+}
+
+export function latestDispatch(run: Run, name: string): Dispatch | null {
+  const all = listDispatches(run).filter((d) => d.admit.name === name);
+  let id: string | null = null;
+  try {
+    id = readFileSync(join(roleDir(run, name), "latest"), "utf8").trim();
+  } catch {
+    // no pointer yet
+  }
+  return all.find((d) => d.admit.dispatchId === id) ?? all.at(-1) ?? null;
+}
+
+/** failover.json: what failover did for a limited dispatch (plan 10), written once, under its lock. */
+const FailoverSchema = z.looseObject({
+  schema: z.literal(1),
+  at: z.string(),
+  /** the stand-in it launched, if any */
+  standIn: z.object({ dispatchId: z.string(), rung: z.string() }).nullable(),
+  /** the limited record's hints, as failover left them ("limit: … failed over to …", "failover: …") */
+  hints: z.array(z.string()),
+  /** the pause it wrote to state.md, if any */
+  pause: z.string().nullable(),
+});
+export type FailoverFile = z.infer<typeof FailoverSchema>;
+
+export function readFailover(dir: string): FailoverFile | null {
+  try {
+    return readVersioned(dispatchPaths(dir).failover, FailoverSchema, 1);
+  } catch {
+    return null;
+  }
+}
+
+/** Spec §4.4: what to do next about one finished record; for a usage limit, the failover's own hints. */
+export function recordHints(run: Run, d: Dispatch, r: RunRecord): string[] {
+  return readFailover(d.dir)?.hints ?? dispatchHints(r, d.admit.owns, relative(run.dir, d.dir));
+}

package/src/services/doctor-access.ts

@@ -0,0 +1,231 @@
+import { realTmpdir } from "../adapters/access.ts";
+import type { AccessShell } from "../adapters/backend.ts";
+import { adapterFor } from "../adapters/registry.ts";
+import "../adapters/all.ts";
+import { tryParseRung } from "../domain/ids.ts";
+import type { Profile } from "../domain/profile.ts";
+import { ROLES } from "../domain/roles.ts";
+import { locksDir } from "../infra/paths.ts";
+import { ensurePrivateDir } from "../infra/store.ts";
+import type { Check } from "./doctor-checks.ts";
+
+// Spec §5 and §12: the five access probes doctor runs per backend that serves a workspace-write role, each
+// in that backend's worker shell with the grants a worker gets, and the rows that report them.
+
+export type ProbeId = "lock" | "temp" | "loopback" | "https" | "docker";
+
+/**
+ * What the probes reach: npm's ping, through HTTPS_PROXY when it is set (Bun's fetch honours it), and
+ * `docker`. CATHERD_PROBE_URL and CATHERD_PROBE_DOCKER replace them (tests: a local server, no docker).
+ */
+export const probeTargets = {
+  get url(): string {
+    return process.env.CATHERD_PROBE_URL || "https://registry.npmjs.org/-/ping";
+  },
+  get docker(): string {
+    return process.env.CATHERD_PROBE_DOCKER || "docker";
+  },
+};
+
+interface ProbeDef {
+  id: ProbeId;
+  label: string;
+  /** off when the role's network is off (Docker access goes with the network) */
+  network: boolean;
+  script: string;
+  args: () => string[];
+}
+
+// every path and URL goes in as an argument, never into the script text
+const WRITE = 'f="$1/.catherd-doctor-$$" && touch "$f" && rm -f "$f"';
+const BUN_EVAL = '"$1" -e "$2"';
+const BIND = 'Bun.listen({ hostname: "127.0.0.1", port: 0, socket: { data() {} } }).stop(true)';
+// npm's ping answers 200; any 4xx or 5xx fails, so a proxy's 407 or 403 for a denied host is not a false green
+// a fetch that throws (no route, DNS, refused) prints its error code, not Bun's stack and version trailer
+const FETCH =
+  "let r; try { r = await fetch(process.argv[1], { method: 'HEAD' }) } catch (e) { console.error([e?.code, e?.message].filter(Boolean).join(': ') || String(e)); process.exit(1) } if (r.status >= 400) { console.error(`HTTP ${r.status}${r.status === 407 ? ' (proxy authentication required)' : r.status === 403 ? ' (refused: a proxy denying the host?)' : ''}`); process.exit(1) }";
+
+/** Why a probe failed: its last non-empty stderr line (Bun's version trailer skipped), else stdout's. */
+export function lastErrorLine(err: string, out: string): string | undefined {
+  const lines = (t: string) =>
+    t
+      .split("\n")
+      .map((l) => l.trim())
+      .filter((l) => l && !/^Bun v\d/.test(l));
+  return lines(err).at(-1) ?? lines(out).at(-1);
+}
+
+const PROBES: ProbeDef[] = [
+  { id: "lock", label: "lock-dir write", network: false, script: WRITE, args: () => [locksDir()] },
+  { id: "temp", label: "temp write", network: false, script: WRITE, args: () => [realTmpdir()] },
+  {
+    id: "loopback",
+    label: "loopback bind",
+    network: true,
+    script: BUN_EVAL,
+    args: () => [process.execPath, BIND],
+  },
+  {
+    id: "https",
+    label: "outbound HTTPS",
+    network: true,
+    script: `${BUN_EVAL} "$3"`,
+    args: () => [process.execPath, FETCH, probeTargets.url],
+  },
+  {
+    id: "docker",
+    label: "docker version",
+    network: true,
+    script: '"$1" version',
+    args: () => [probeTargets.docker],
+  },
+];
+
+export interface ProbeResult {
+  id: ProbeId;
+  label: string;
+  /** "off": the role's network is off; "skip": docker is not installed */
+  state: "ok" | "failed" | "off" | "skip";
+  /** the last line the probe printed on failure */
+  why?: string;
+}
+
+/** Runs the five probes in `shell`; the network three (docker among them) only when granted, docker only when installed. */
+export async function runProbes(shell: AccessShell, network: boolean): Promise<ProbeResult[]> {
+  const out: ProbeResult[] = [];
+  let noLocks: string | null = null;
+  try {
+    ensurePrivateDir(locksDir());
+  } catch (e) {
+    noLocks = `cannot create ${locksDir()}: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  for (const p of PROBES) {
+    if (p.id === "lock" && noLocks) {
+      out.push({ id: p.id, label: p.label, state: "failed", why: noLocks });
+      continue;
+    }
+    if (p.network && !network) {
+      out.push({ id: p.id, label: p.label, state: "off" });
+      continue;
+    }
+    if (p.id === "docker" && !Bun.which(probeTargets.docker, { PATH: process.env.PATH ?? "" })) {
+      out.push({ id: p.id, label: p.label, state: "skip" });
+      continue;
+    }
+    const r = await shell.run(p.script, p.args());
+    const last = lastErrorLine(r?.err ?? "", r?.out ?? "");
+    const late = last && / timed out after (\d+) ms$/.exec(last);
+    const why =
+      r === null
+        ? "the probe shell did not start"
+        : late
+          ? `timed out after ${Number(late[1]) / 1000} s`
+          : last;
+    out.push({
+      id: p.id,
+      label: p.label,
+      state: r?.ok ? "ok" : "failed",
+      ...(r?.ok ? {} : { why: why || "no output" }),
+    });
+  }
+  return out;
+}
+
+/** The fix for a failed probe, per backend: Codex's sandbox holds catherd's grants; the others run unsandboxed. */
+function fixFor(backend: string, id: ProbeId): string {
+  if (backend === "codex") {
+    const override =
+      "catherd passes this grant to Codex itself (with your top-level [sandbox_workspace_write] writable_roots added): check that no --profile or managed requirements.toml overrides it";
+    if (id === "docker")
+      return "the Codex sandbox cannot reach the Docker socket here: run the Docker checks in the verifier (full access), or give the role full access";
+    return override;
+  }
+  const FIX: Record<ProbeId, string> = {
+    lock: `chmod -R u+w ${locksDir()}`,
+    temp: `check that ${realTmpdir()} is writable`,
+    loopback: "something on this machine refuses a bind to 127.0.0.1: check the firewall",
+    https: "check the network, or set HTTPS_PROXY for this shell",
+    docker: `start Docker: ${probeTargets.docker} version fails`,
+  };
+  return FIX[id];
+}
+
+/** Every backend an enabled workspace-write role runs on or fails over to, with whether any of those roles has network. */
+export function workspaceWriteNetwork(profiles: Profile[]): Map<string, boolean> {
+  const out = new Map<string, boolean>();
+  for (const p of profiles)
+    for (const role of ROLES) {
+      const rc = p.roles[role];
+      if (!rc.enabled || rc.access !== "workspace-write") continue;
+      for (const r of [...rc.rungs, ...rc.rungs.flatMap((x) => p.failover[x] ?? [])]) {
+        const b = tryParseRung(r)?.backend;
+        if (b && b !== "claude") out.set(b, (out.get(b) ?? false) || rc.network !== false);
+      }
+    }
+  return out;
+}
+
+/**
+ * The `sandbox:codex` row (which `codex sandbox` form runs) and one `access:<backend>` row per backend; a
+ * backend not in `installed` (its CLI is not on PATH) is skipped without running a probe.
+ */
+export async function accessChecks(profiles: Profile[], installed: ReadonlySet<string>): Promise<Check[]> {
+  const checks: Check[] = [];
+  for (const [id, network] of workspaceWriteNetwork(profiles)) {
+    const a = adapterFor(id);
+    if (!a?.accessShell) continue;
+    if (!installed.has(id)) {
+      checks.push({
+        id: `access:${id}`,
+        label: `${id} worker access`,
+        state: "skip",
+        word: "not installed",
+        detail: `${id} is not installed: no worker runs on it here`,
+      });
+      continue;
+    }
+    const shell = await a.accessShell({ network }).catch((e: unknown) => String(e));
+    if (id === "codex")
+      checks.push(
+        typeof shell === "string"
+          ? { id: "sandbox:codex", label: "codex sandbox", state: "skip", word: "not tested", detail: shell }
+          : { id: "sandbox:codex", label: "codex sandbox", state: "ok", word: "ready", detail: shell.how },
+      );
+    const base = { id: `access:${id}`, label: `${id} worker access` };
+    if (typeof shell === "string") {
+      checks.push({ ...base, state: "skip", word: "not tested", detail: shell });
+      continue;
+    }
+    let results: ProbeResult[];
+    try {
+      results = await runProbes(shell, network);
+    } finally {
+      shell.close();
+    }
+    const failed = results.filter((r) => r.state === "failed");
+    const passed = results.filter((r) => r.state === "ok").map((r) => r.label);
+    const notes = [
+      ...(results.some((r) => r.state === "off") ? ["network off by profile"] : []),
+      ...(results.some((r) => r.state === "skip") ? ["no docker"] : []),
+      // only Codex's sandbox can take the network away; the others' shells keep it
+      ...(id !== "codex" && !network ? [`network: false is not enforced by ${id}'s shell`] : []),
+    ];
+    checks.push(
+      failed.length
+        ? {
+            ...base,
+            state: "warn",
+            word: "blocked",
+            detail: `in ${shell.how}, a worker cannot: ${failed.map((r) => `${r.label} (${r.why})`).join("; ")}`,
+            fix: failed.map((r) => `${r.label}: ${fixFor(id, r.id)}`).join("\n"),
+          }
+        : {
+            ...base,
+            state: "ok",
+            word: "ready",
+            detail: [`${passed.join(", ")} in ${shell.how}`, ...notes].join(" · "),
+          },
+    );
+  }
+  return checks;
+}

package/src/services/doctor-backends.ts

@@ -0,0 +1,170 @@
+import type { Probe } from "../adapters/backend.ts";
+import { adapterFor } from "../adapters/registry.ts";
+import "../adapters/all.ts";
+import { ADAPTER_IDS, tryParseRung } from "../domain/ids.ts";
+import type { Profile } from "../domain/profile.ts";
+import { ROLES, type Role } from "../domain/roles.ts";
+import { refreshDiscovery } from "./catalog-service.ts";
+import { type Check, errText, fixOf } from "./doctor-checks.ts";
+
+// The backend rows of `catherd doctor` (spec §10.3) and the backends the linked profiles use.
+
+/** A rung's backend; null for a malformed rung, which validate reports. */
+const backendOf = (rung: string): string | null => tryParseRung(rung)?.backend ?? null;
+
+/** Every backend a linked profile runs a role on ("role"), or only fails over to ("failover"). */
+export function usedBackends(profiles: Profile[]): Map<string, "role" | "failover"> {
+  const used = new Map<string, "role" | "failover">();
+  const note = (rung: string, how: "role" | "failover") => {
+    const b = backendOf(rung);
+    if (b && used.get(b) !== "role") used.set(b, how);
+  };
+  for (const p of profiles) {
+    for (const role of ROLES) if (p.roles[role].enabled) for (const r of p.roles[role].rungs) note(r, "role");
+    for (const to of Object.values(p.failover)) note(to, "failover");
+  }
+  return used;
+}
+
+const PROBLEM_WORD: Record<string, string> = {
+  E_BACKEND_MISSING: "missing",
+  E_BACKEND_TOO_OLD: "too old",
+  E_BACKEND_NOT_LOGGED_IN: "not logged in",
+};
+
+/**
+ * Spec §7.2 keeps the default profile Codex-first. When a backend a role runs on is missing and another is
+ * ready, its fix also offers to move those roles there, onto a rung the shipped catalog scores.
+ */
+const MOVE_TO: Record<string, string> = {
+  "claude-code": "claude-code:claude-opus-5-5#medium",
+  opencode: "opencode:opencode-go/gpt-6-luna#high",
+  codex: "codex:gpt-6-sol#medium",
+};
+
+/** `w` as one shell word: bare when plainly safe, else single-quoted (zsh can glob a bare `#`). */
+const shellWord = (w: string): string => (/^[\w./:=@,+-]+$/.test(w) ? w : `'${w.replaceAll("'", `'\\''`)}'`);
+
+/**
+ * Install `id`, or move the roles that run on it to `to`: one runnable `catherd profile set` per line, for
+ * each linked profile, any default rung the new ladder would not hold reset first. The artist draws, which only Codex does, so
+ * off Codex it is turned off instead.
+ */
+export function moveRolesFix(install: string, id: string, to: string, profiles: Profile[]): string {
+  const onIt = (r: string | undefined) => r !== undefined && backendOf(r) === id;
+  const set = (p: Profile, path: string, v: string) =>
+    `catherd profile set ${path} ${shellWord(v)} --profile ${shellWord(p.name)}`;
+  const stuck = new Set<Role>();
+  const commands: string[] = [];
+  for (const p of profiles)
+    for (const role of ROLES) {
+      const rc = p.roles[role];
+      if (!rc.enabled || !rc.rungs.some(onIt)) continue;
+      if (role === "artist" && to !== "codex") {
+        stuck.add(role);
+        commands.push(set(p, `roles.${role}.enabled`, "false"));
+        continue;
+      }
+      const target = MOVE_TO[to] as string;
+      // the new ladder holds only `target`, so any other default would fail validation: reset it first
+      if (rc.defaultRung !== undefined && rc.defaultRung !== null && rc.defaultRung !== target)
+        commands.push(set(p, `roles.${role}.defaultRung`, "null"));
+      commands.push(set(p, `roles.${role}.rungs`, target));
+    }
+  if (!commands.length) return install;
+  const off = stuck.size ? ` (${[...stuck].join(", ")} needs ${id}, so it is turned off)` : "";
+  return [
+    install,
+    `or move its roles to ${to}: /catherd-setup in Claude Code, or run${off}`,
+    ...commands,
+  ].join("\n");
+}
+
+/** One row per backend; `installed`, when given, collects the backends whose CLI is on PATH. */
+export async function backendChecks(
+  used: Map<string, "role" | "failover">,
+  profiles: Profile[],
+  installed?: Set<string>,
+): Promise<Check[]> {
+  const checks: Check[] = [];
+  const ready: string[] = [];
+  for (const id of ADAPTER_IDS) {
+    const a = adapterFor(id);
+    if (!a) continue;
+    const probe: Probe = await a.probe().catch((e: unknown) => ({
+      installed: false,
+      version: null,
+      versionOk: false,
+      loggedIn: null,
+      problems: [
+        { code: "E_IO_UNEXPECTED" as const, message: errText(e), fix: `run ${id} --version to see why` },
+      ],
+    }));
+    if (probe.installed) installed?.add(id);
+    const problem = probe.problems[0];
+    const use = used.get(id);
+    if (!problem) {
+      ready.push(id);
+      const detail = [probe.version, probe.login && `${probe.login} login`].filter(Boolean).join(" · ");
+      // a login billed apart from what a profile says (a plan, or per token) ranks that backend's cost wrongly;
+      // only a profile that routes something to this backend is ranked by it
+      const billed =
+        probe.billing &&
+        profiles.find((p) => p.billing[id] && p.billing[id] !== probe.billing && usedBackends([p]).has(id));
+      checks.push(
+        billed
+          ? {
+              id: `backend:${id}`,
+              label: id,
+              state: "warn",
+              word: "billing",
+              detail: `${detail} · profile ${billed.name} bills ${id} as ${billed.billing[id]}, but this login is ${probe.billing}`,
+              fix: `catherd profile set billing.${id} ${probe.billing} --profile ${billed.name}`,
+            }
+          : { id: `backend:${id}`, label: id, state: "ok", word: "ready", detail },
+      );
+      continue;
+    }
+    checks.push({
+      id: `backend:${id}`,
+      label: id,
+      state: use === "role" ? "fail" : use === "failover" ? "warn" : "skip",
+      word: PROBLEM_WORD[problem.code] ?? "not ready",
+      detail: `${problem.message}${use === "failover" ? " (a failover stand-in uses it)" : use ? "" : " (no profile uses it)"}`,
+      fix: problem.fix,
+    });
+  }
+  const to = Object.keys(MOVE_TO).find((b) => ready.includes(b));
+  for (const c of checks) {
+    const id = c.id.slice("backend:".length);
+    if (to && c.state === "fail" && c.word === PROBLEM_WORD.E_BACKEND_MISSING && c.fix && id !== to)
+      c.fix = moveRolesFix(c.fix, id, to, profiles);
+  }
+  // spec §5.2: doctor refreshes discovery; a listing that fails keeps the last one
+  let refreshed: Awaited<ReturnType<typeof refreshDiscovery>> = [];
+  try {
+    refreshed = await refreshDiscovery({ backends: ready });
+  } catch (e) {
+    checks.push({
+      id: "discovery",
+      label: "model discovery",
+      state: "fail",
+      word: "unreadable",
+      detail: errText(e),
+      fix: fixOf(e) ?? "catherd catalog refresh --verbose",
+    });
+  }
+  for (const r of refreshed) {
+    const c = checks.find((x) => x.id === `backend:${r.backend}`);
+    if (!c) continue;
+    if (r.error)
+      Object.assign(c, {
+        state: "warn",
+        word: "no listing",
+        detail: `${c.detail} · ${r.error}`,
+        fix: "catherd catalog refresh",
+      });
+    else c.detail = `${c.detail} · ${r.models} models`;
+  }
+  return checks;
+}