catherd-cli 1.3.0 → 1.4.0

package/src/entry/lock-command.ts

@@ -1,10 +1,11 @@
+import { HOST_ARG } from "./host-arg.ts";
 import { defineCommand } from "citty";
 import { CatherdError } from "../domain/errors.ts";
 import { scrubSecrets } from "../infra/env.ts";
 import { gitToplevel } from "../infra/git.ts";
 import { heavySlots, withHeavySlot } from "../infra/heavy-lock.ts";
 import { killGroup } from "../infra/proc.ts";
-import { profileFor } from "../services/profile-store.ts";
+import { activeName, readProfileDoc } from "../services/profile-store.ts";
 import { printError } from "./cli-kit.ts";
 
 /**
@@ -71,6 +72,7 @@ export async function runForwarding(argv: string[]): Promise<number> {
   const watchdog = Bun.spawn(
     ["sh", "-c", 'read _ || kill -s KILL -- "-$1" 2>/dev/null', "sh", String(child.pid)],
     {
+      env: scrubSecrets(process.env),
       stdin: "pipe",
       stdout: "ignore",
       stderr: "ignore",
@@ -95,6 +97,7 @@ export const lockCommand = defineCommand({
       "Run a heavy command behind the machine-wide semaphore, in its own process group and session: it gets no /dev/tty and no job control",
   },
   args: {
+    ...HOST_ARG,
     slots: {
       type: "string",
       description: "Slots (default: CATHERD_LOCK_SLOTS, else the profile's lock.heavy, else half the cores)",
@@ -115,7 +118,9 @@ export const lockCommand = defineCommand({
     const repo = await gitToplevel(process.cwd());
     const slots = resolveSlots(
       args.slots,
-      () => profileFor(repo).lock.heavy,
+      // lock.heavy is host-independent: read it stored, so a worker (whose host identity is scrubbed) and an
+      // unknown terminal host still get the profile's value instead of the cpus/2 fallback
+      () => readProfileDoc(activeName(repo)).lock?.heavy ?? "cpus/2",
       (m) => console.error(m),
     );
     process.exitCode = await withHeavySlot(slots, () => runForwarding(argv));

package/src/entry/mcp/handshake.ts

@@ -15,7 +15,9 @@ const STDERR_TAIL = 4_000;
 /** The env the doctor's MCP server starts with: catherd's own secrets scrubbed, as for every process it starts. */
 export const handshakeEnv = (
   base: Record<string, string | undefined> = process.env,
-): Record<string, string> => scrubSecrets(base);
+): Record<string, string> => {
+  return scrubSecrets(base);
+};
 
 /**
  * Spec §10.3 and 1.1 §12: starts the MCP server the way the plugin does, `sh <launcher>` over stdio, and

package/src/entry/mcp/run-tools.ts

@@ -2,6 +2,7 @@ import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { ID_PATTERN } from "../../domain/ids.ts";
 import { ROLES } from "../../domain/roles.ts";
+import { knownQueueCapability } from "../../infra/codex-queue.ts";
 import { redact } from "../../infra/log.ts";
 import { registerSavedSecrets } from "../../services/jev-service.ts";
 import type { Deps } from "../../services/ports.ts";
@@ -59,9 +60,11 @@ export function registerRunTools(server: McpServer, deps: Deps): void {
       inputSchema: { run: z.string().optional() },
     },
     (a) =>
-      handle(() => {
+      handle(async () => {
         registerSavedSecrets();
-        return redact(status(deps, a.run));
+        const queue =
+          deps.host.host === "codex" && !deps.host.conflict ? knownQueueCapability(process.env) : null;
+        return redact(status(deps, a.run, queue));
       }),
   );
 

package/src/entry/mcp/server.ts

@@ -1,9 +1,13 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { sessionKey, type HostContext } from "../../domain/host.ts";
 import { errorMessage } from "../../domain/errors.ts";
+import { resolveHost } from "../../infra/host-context.ts";
 import { log } from "../../infra/log.ts";
+import { currentSession } from "../../services/sessions.ts";
 import { startNotifier } from "../../services/notifier.ts";
 import type { Deps } from "../../services/ports.ts";
 import { reconcileAll } from "../../services/reconcile.ts";
@@ -16,10 +20,18 @@ import { sdkToolError, toolOf } from "./result.ts";
 import { registerRunTools } from "./run-tools.ts";
 import { registerSetupTools } from "./setup-tools.ts";
 
+type ObserveSession = (context: Deps) => (() => void) | undefined;
+
 type Handler = (...args: unknown[]) => CallToolResult | Promise<CallToolResult>;
 
 /** Spec §10.2: every tool call is logged with its duration and outcome (the error code), never its input. */
-function logToolCalls(server: McpServer): void {
+function logToolCalls(
+  server: McpServer,
+  deps: Deps,
+  scope: AsyncLocalStorage<Deps>,
+  generation: () => number,
+  observe?: ObserveSession,
+): void {
   const register = server.registerTool.bind(server) as unknown as (
     n: string,
     c: unknown,
@@ -28,7 +40,28 @@ function logToolCalls(server: McpServer): void {
   (server as unknown as { registerTool: typeof register }).registerTool = (name, config, handler) =>
     register(name, config, async (...args: unknown[]) => {
       const started = Date.now();
-      const r = await handler(...args);
+      const epoch = generation();
+      const extra = args.at(-1) as { _meta?: Record<string, unknown> } | undefined;
+      let host = deps.host;
+      if (host.host === "codex" && !host.conflict && extra?._meta && "threadId" in extra._meta) {
+        const threadId = extra._meta.threadId;
+        host =
+          typeof threadId === "string"
+            ? resolveHost({
+                clientName: "codex-mcp-client",
+                env: { CODEX_THREAD_ID: threadId, CODEX_SESSION_ID: host.session?.sessionId },
+              })
+            : { host: "unknown", session: null, conflict: "Codex _meta.threadId must be a UUID string" };
+      }
+      const context: Deps = {
+        ...deps,
+        get host(): HostContext {
+          return epoch === generation() ? host : { host: "unknown", session: null, conflict: null };
+        },
+      };
+      const after = observe?.(context);
+      const r = await scope.run(context, () => handler(...args));
+      after?.();
       const code = r.isError ? (r.structuredContent as { code?: string } | undefined)?.code : undefined;
       log(r.isError ? "warn" : "info", "tool", {
         tool: name,
@@ -40,9 +73,25 @@ function logToolCalls(server: McpServer): void {
     });
 }
 
-export function buildServer(deps: Deps = defaultDeps()): McpServer {
+export function buildServer(deps: Deps = defaultDeps(), observe?: ObserveSession): McpServer {
   const server = new McpServer({ name: "catherd", version: deps.version });
-  logToolCalls(server);
+  const scope = new AsyncLocalStorage<Deps>();
+  const scoped: Deps = new Proxy(deps, {
+    get: (target, key) => (key === "profiles" ? profiles : Reflect.get(scope.getStore() ?? target, key)),
+  });
+  const profiles = deps.profiles.withHost?.(() => scoped.host) ?? deps.profiles;
+  let generation = 0;
+  const invalidate = () => {
+    generation++;
+    deps.host = { host: "unknown", session: null, conflict: null };
+  };
+  logToolCalls(server, deps, scope, () => generation, observe);
+  deps.host = { host: "unknown", session: null, conflict: null };
+  server.server.oninitialized = () => {
+    invalidate();
+    deps.host = resolveHost({ clientName: server.server.getClientVersion()?.name, env: process.env });
+  };
+  server.server.onclose = invalidate;
   // The SDK validates input before a tool's `handle` runs and reports a failure through this (private)
   // method as plain text; test/entry/mcp.test.ts fails loudly if an SDK upgrade renames it. The wrapper
   // above never sees such a call, so it is logged here (spec §10.2: every call), by the tool it names.
@@ -52,47 +101,87 @@ export function buildServer(deps: Deps = defaultDeps()): McpServer {
     log("warn", "tool", { tool: toolOf(message), ok: false, code });
     return r;
   };
-  registerRunTools(server, deps);
-  registerLaneTools(server, deps);
-  registerDispatchTools(server, deps);
-  registerSetupTools(server, deps);
-  registerProtocolTools(server, deps);
+  registerRunTools(server, scoped);
+  registerLaneTools(server, scoped);
+  registerDispatchTools(server, scoped);
+  registerSetupTools(server, scoped);
+  registerProtocolTools(server, scoped);
   return server;
 }
 
-/**
- * Spec §4.7: connect first, so the client never waits on a scan; then reconcile every run. Spec §3.4: the notifier
- * starts before reconcile, so what reconcile settles is announced, and scans for the rest once it is done. Spec
- * 1.2 §3.2: the source sync starts once connected and is never awaited, so neither the handshake nor a tool call
- * waits on the network. Tests pass their own transport and sync.
- */
+/** Connect immediately; initialized triggers recovery without delaying the handshake. */
 export async function startMcpServer(
-  o: { transport?: Transport; sync?: () => Promise<unknown> } = {},
+  o: { transport?: Transport; sync?: () => Promise<unknown>; deps?: Deps } = {},
 ): Promise<void> {
-  const deps = defaultDeps();
-  // which of the session's variables this server got (never their values): the live check of spec §3.9
-  log("info", "session", {
-    sessionId: Boolean(deps.session?.sessionId),
-    hostSessionId: Boolean(deps.session?.hostSessionId),
-    socket: Boolean(deps.session?.socketPath),
-    token: Boolean(deps.session?.token),
+  const deps = o.deps ?? defaultDeps();
+  const observed = new Map<string, ReturnType<typeof startNotifier>>();
+  const server = buildServer(deps, (context) => {
+    const target = currentSession(context);
+    if (!target) return;
+    const key = sessionKey(target);
+    let active = observed.get(key);
+    if (!active) {
+      active = startNotifier(context);
+      observed.set(key, active);
+    }
+    const n = active;
+    return () => {
+      if (observed.get(key) === n) void n.scan();
+    };
   });
-  const notifier = startNotifier(deps);
-  await buildServer(deps).connect(o.transport ?? new StdioServerTransport());
-  const sync = o.sync ?? (() => backgroundSync());
-  void Promise.resolve()
-    .then(sync)
-    .catch((e: unknown) => log("debug", "sources", { error: errorMessage(e) }));
-  try {
-    const r = await reconcileAll(deps);
-    const shown = r.warnings.length;
-    for (const w of r.warnings) console.error(`catherd: ${w}`);
-    void r.done.then(() => {
-      for (const w of r.warnings.slice(shown)) console.error(`catherd: ${w}`);
+  const initialized = server.server.oninitialized!;
+  const closed = server.server.onclose!;
+  let generation = 0;
+  let notifier: ReturnType<typeof startNotifier> | undefined;
+  let recovery: Deps | undefined;
+  const invalidate = () => {
+    generation++;
+    if (recovery) recovery.host = { host: "unknown", session: null, conflict: null };
+    notifier?.stop();
+    notifier = undefined;
+    for (const n of observed.values()) n.stop();
+    observed.clear();
+    closed();
+  };
+  server.server.onclose = invalidate;
+  server.server.oninitialized = () => {
+    invalidate();
+    initialized();
+    log("info", "session", {
+      host: deps.host.host,
+      conflict: deps.host.conflict,
+      sessionId: Boolean(deps.session?.sessionId),
+      hostSessionId: Boolean(deps.session?.hostSessionId),
+      socket: Boolean(deps.session?.socketPath),
+      token: Boolean(deps.session?.token),
     });
-  } catch (e) {
-    console.error(`catherd: reconcile failed: ${errorMessage(e)}`);
-  }
-  // whatever finished unread while no server ran, or finished under another server (spec §3.4)
-  void notifier.scan();
+    const epoch = generation;
+    recovery = { ...deps };
+    const context = recovery;
+    notifier = startNotifier(context);
+    const active = notifier;
+    const target = currentSession(context);
+    if (target) observed.set(sessionKey(target), active);
+    void Promise.resolve()
+      .then(() => {
+        if (epoch === generation) return (o.sync ?? (() => backgroundSync()))();
+      })
+      .catch((e: unknown) => log("debug", "sources", { error: errorMessage(e) }));
+    void (async () => {
+      try {
+        if (epoch !== generation) return;
+        const r = await reconcileAll(context);
+        if (epoch !== generation) return;
+        const shown = r.warnings.length;
+        for (const w of r.warnings) console.error(`catherd: ${w}`);
+        void r.done.then(() => {
+          if (epoch === generation) for (const w of r.warnings.slice(shown)) console.error(`catherd: ${w}`);
+        });
+        if (epoch === generation) void active.scan();
+      } catch (e) {
+        console.error(`catherd: reconcile failed: ${errorMessage(e)}`);
+      }
+    })();
+  };
+  await server.connect(o.transport ?? new StdioServerTransport());
 }

package/src/entry/mcp/setup-tools.ts

@@ -76,9 +76,14 @@ export function registerSetupTools(server: McpServer, deps: Deps): void {
     {
       description:
         "A profile (without a name: the profile this repo runs on, i.e. the one bound to `repo`, default this server's directory, else the active one) as the run engine reads it, with every default filled in: per role its access mode, rungs and default rung, and whether its backend enforces the access (enforcement); billing, jev, harness isolation, failover, budget, timeouts, preflight, lock and notify. Also `active` (the global active profile), `here` (the profile this repo runs on) and every name.",
-      inputSchema: { name: PROFILE, repo: REPO },
+      inputSchema: { name: PROFILE, repo: REPO, raw: z.boolean().optional() },
     },
-    (a) => handle(async () => deps.profiles.get(a.name, await toplevel(a.repo))),
+    (a) =>
+      handle(async () =>
+        a.raw && deps.profiles.raw
+          ? deps.profiles.raw(a.name, await toplevel(a.repo))
+          : deps.profiles.get(a.name, await toplevel(a.repo)),
+      ),
   );
 
   server.registerTool(

package/src/entry/profile-command.ts

@@ -1,9 +1,12 @@
+import { readFileSync } from "node:fs";
+import { HOST_ARG, terminalHost } from "./host-arg.ts";
 import { assertProfileName } from "../domain/profile.ts";
 import { defineCommand } from "citty";
 import type { Catalog } from "../domain/catalog.ts";
 import { rungInfo } from "../domain/catalog.ts";
 import { CatherdError } from "../domain/errors.ts";
-import { type Change, patchAt, type Profile } from "../domain/profile.ts";
+import type { OrchestrationHost } from "../domain/host.ts";
+import { ProfileDocSchema, type Change, patchAt, type Profile } from "../domain/profile.ts";
 import { inferredScores, type Issue } from "../domain/profile-rules.ts";
 import { ROLES, type Role } from "../domain/roles.ts";
 import { gitToplevel } from "../infra/git.ts";
@@ -15,6 +18,7 @@ import {
   deleteProfile,
   diffNamed,
   patchProfile,
+  resetHostDefaults,
   unbind,
 } from "../services/profile-service.ts";
 import {
@@ -24,6 +28,7 @@ import {
   listProfiles,
   profileExists,
   readProjects,
+  readProfileDoc,
   requireProfile,
   roleEnforcement,
   runnableBackends,
@@ -139,7 +144,10 @@ const list = defineCommand({
     name: "list",
     description: "Every profile, the one this repo runs on (*), and the repos bound to each",
   },
-  args: json,
+  args: {
+    ...HOST_ARG,
+    ...json,
+  },
   async run({ args }) {
     const active = await activeHere();
     const bindings = Object.entries(readProjects().bindings);
@@ -161,11 +169,20 @@ const show = defineCommand({
     name: "show",
     description: "A profile with every default filled in (without a name: the one this repo runs on)",
   },
-  args: { name: { type: "positional", required: false, description: "profile name" }, ...json },
+  args: {
+    ...HOST_ARG,
+    name: { type: "positional", required: false, description: "profile name" },
+    raw: { type: "boolean", description: "stored document without effective defaults" },
+    ...json,
+  },
   async run({ args }) {
     const here = await activeHere();
     const name = args.name === undefined ? here : requireProfile(args.name);
-    const p = getProfile(name);
+    if (args.raw)
+      return args.json
+        ? printJson(readProfileDoc(name))
+        : console.log(JSON.stringify(readProfileDoc(name), null, 2));
+    const p = getProfile(name, terminalHost(args.host).host);
     const o = {
       active: name === here,
       enforcement: roleEnforcement(p),
@@ -183,6 +200,7 @@ const use = defineCommand({
       "Make a profile active, bind it to this repo with --repo, or unbind this repo with --repo --clear",
   },
   args: {
+    ...HOST_ARG,
     name: { type: "positional", required: false, description: "profile name" },
     repo: { type: "boolean", description: "bind it to the git repo you are in, instead of making it active" },
     clear: { type: "boolean", description: "with --repo and no name: unbind the git repo you are in" },
@@ -193,7 +211,7 @@ const use = defineCommand({
         throw new CatherdError("E_INPUT_INVALID", "--clear goes with --repo and no profile name", {
           fix: "catherd profile use --repo --clear, inside the repo to unbind",
         });
-      const r = unbind(await repoHere());
+      const r = unbind(await repoHere(), terminalHost(args.host).host);
       console.log(`${mark("ok")} ${r.repo} is unbound`);
       printSynced(r);
       return;
@@ -202,7 +220,7 @@ const use = defineCommand({
       throw new CatherdError("E_INPUT_INVALID", "which profile? name one", {
         fix: "catherd profile use <name> [--repo], or catherd profile use --repo --clear",
       });
-    const r = activate(args.name, args.repo ? await repoHere() : null);
+    const r = activate(args.name, args.repo ? await repoHere() : null, terminalHost(args.host).host);
     console.log(`${mark("ok")} ${r.active} ${r.repo ? `is bound to ${r.repo}` : "is active"}`);
     printSynced(r);
   },
@@ -211,11 +229,12 @@ const use = defineCommand({
 const create = defineCommand({
   meta: { name: "new", description: "A new profile from the default one, or from --from <profile>" },
   args: {
+    ...HOST_ARG,
     name: { type: "positional", required: true, description: "new profile name" },
     from: { type: "string", description: "copy this profile instead of the default one" },
   },
   run({ args }) {
-    const r = createProfile(args.name, args.from);
+    const r = createProfile(args.name, args.from, terminalHost(args.host).host);
     if (!r.saved) throw refused(r.errors);
     console.log(`${mark("ok")} created ${args.name}${args.from ? ` from ${args.from}` : ""}`);
     printIssues([], r.warnings);
@@ -225,11 +244,12 @@ const create = defineCommand({
 const copy = defineCommand({
   meta: { name: "copy", description: "Copy a profile under a new name" },
   args: {
+    ...HOST_ARG,
     from: { type: "positional", required: true, description: "profile to copy" },
     to: { type: "positional", required: true, description: "new profile name" },
   },
   run({ args }) {
-    const r = createProfile(args.to, args.from);
+    const r = createProfile(args.to, args.from, terminalHost(args.host).host);
     if (!r.saved) throw refused(r.errors);
     console.log(`${mark("ok")} copied ${args.from} to ${args.to}`);
     printIssues([], r.warnings);
@@ -238,7 +258,10 @@ const copy = defineCommand({
 
 const rm = defineCommand({
   meta: { name: "rm", description: "Delete a profile and its agent files (never the active or a bound one)" },
-  args: { name: { type: "positional", required: true, description: "profile name" } },
+  args: {
+    ...HOST_ARG,
+    name: { type: "positional", required: true, description: "profile name" },
+  },
   run({ args }) {
     deleteProfile(args.name);
     console.log(`${mark("ok")} deleted ${args.name}`);
@@ -252,6 +275,7 @@ const set = defineCommand({
       "Set one field: e.g. roles.worker.access read-only, budget.usd 20, failover.<rung> <rung>, roles.worker.rungs a,b; null removes",
   },
   args: {
+    ...HOST_ARG,
     path: { type: "positional", required: true, description: "dotted path, e.g. roles.verifier.access" },
     value: { type: "positional", required: true, description: "JSON, or a plain word; null removes the key" },
     profile: { type: "string", description: "the profile to change (default: the one this repo runs on)" },
@@ -262,7 +286,9 @@ const set = defineCommand({
       throw new CatherdError("E_INPUT_INVALID", `no profile named "${args.profile}"`, {
         fix: `catherd profile new ${args.profile}`,
       });
-    const r = patchProfile(args.profile ?? (await activeHere()), patchAt(args.path, args.value));
+    const r = patchProfile(args.profile ?? (await activeHere()), patchAt(args.path, args.value), {
+      host: terminalHost(args.host).host,
+    });
     if (!r.saved) throw refused(r.errors);
     if (r.diff.length === 0) console.log("no change");
     for (const c of r.diff) console.log(`${mark("ok")} ${formatChange(c)}`);
@@ -282,6 +308,7 @@ const diff = defineCommand({
     description: "What differs between two profiles (the second defaults to the one this repo runs on)",
   },
   args: {
+    ...HOST_ARG,
     a: { type: "positional", required: true, description: "profile" },
     b: { type: "positional", required: false, description: "profile (default: the one this repo runs on)" },
     ...json,
@@ -290,6 +317,7 @@ const diff = defineCommand({
     const changes = diffNamed(
       args.b === undefined ? await activeHere() : requireProfile(args.b),
       requireProfile(args.a),
+      terminalHost(args.host).host,
     );
     if (args.json) return printJson(changes);
     if (changes.length === 0) console.log("no differences");
@@ -300,6 +328,7 @@ const diff = defineCommand({
 const validate = defineCommand({
   meta: { name: "validate", description: "Errors that block a save, and warnings that do not" },
   args: {
+    ...HOST_ARG,
     name: {
       type: "positional",
       required: false,
@@ -309,7 +338,11 @@ const validate = defineCommand({
   },
   async run({ args }) {
     const repo = await gitToplevel(process.cwd());
-    const v = validateNamed(args.name === undefined ? activeName(repo) : requireProfile(args.name), repo);
+    const v = validateNamed(
+      args.name === undefined ? activeName(repo) : requireProfile(args.name),
+      repo,
+      terminalHost(args.host).host,
+    );
     if (args.json) printJson({ valid: v.errors.length === 0, ...v });
     else if (v.errors.length === 0 && v.warnings.length === 0) console.log(`${mark("ok")} valid`);
     else printIssues(v.errors, v.warnings);
@@ -317,8 +350,71 @@ const validate = defineCommand({
   },
 });
 
+const HOSTS: readonly OrchestrationHost[] = ["claude-code", "codex", "unknown"];
+
+const resetDefaults = defineCommand({
+  meta: {
+    name: "reset-host-defaults",
+    description: "Review and explicitly reset only architect/verifier host defaults",
+  },
+  args: {
+    ...HOST_ARG,
+    ...JSON_ARG,
+    name: { type: "positional", required: false },
+    preview: { type: "boolean" },
+    expect: { type: "string", description: "reviewed preview JSON file" },
+  },
+  async run({ args }) {
+    const name = args.name === undefined ? await activeHere() : requireProfile(args.name);
+    const host = terminalHost(args.host).host;
+    let r;
+    if (args.preview) r = resetHostDefaults(name, host, { preview: true });
+    else {
+      if (!args.expect)
+        throw new CatherdError(
+          "E_INPUT_INVALID",
+          "saving host defaults requires --expect <reviewed-preview.json>",
+          { fix: "run reset-host-defaults --preview --json and review the output first" },
+        );
+      let expected, reviewed;
+      try {
+        const raw = JSON.parse(readFileSync(args.expect, "utf8")) as Record<string, unknown> | null;
+        expected = ProfileDocSchema.parse(raw?.expect);
+        const { profile, host: previewed } = raw ?? {};
+        if (typeof profile !== "string" || !HOSTS.includes(previewed as OrchestrationHost))
+          throw new Error("unbound preview");
+        reviewed = { profile, host: previewed as OrchestrationHost };
+      } catch {
+        throw new CatherdError("E_INPUT_INVALID", "invalid reviewed preview file", {
+          fix: "pass the JSON output of reset-host-defaults --preview --json",
+        });
+      }
+      r = resetHostDefaults(name, host, { preview: false, expect: expected, reviewed });
+    }
+    if (args.json) printJson(r);
+    else {
+      for (const c of r.diff) console.log(formatChange(c));
+      printIssues(r.errors, r.warnings);
+      printSynced(r);
+    }
+    if (r.errors.length) process.exitCode = EXIT.error;
+  },
+});
+
 /** Spec §8: `catherd profile list|show|use [--repo [--clear]]|new|copy|rm|set <path> <value>|diff|validate`. */
 export const profileCommand = defineCommand({
   meta: { name: "profile", description: "Profiles: which models each role runs, and how" },
-  subCommands: { list, show, use, new: create, copy, rm, set, diff, validate },
+  args: HOST_ARG,
+  subCommands: {
+    "reset-host-defaults": resetDefaults,
+    list,
+    show,
+    use,
+    new: create,
+    copy,
+    rm,
+    set,
+    diff,
+    validate,
+  },
 });