catherd-cli 1.3.0 → 1.4.0

package/src/entry/runs-command.ts

@@ -1,5 +1,11 @@
 import { resolve } from "node:path";
 import { defineCommand } from "citty";
+import { assertId } from "../domain/ids.ts";
+import { knownQueueCapability, UNCHECKED_QUEUE } from "../infra/codex-queue.ts";
+import { listDispatches } from "../services/dispatches.ts";
+import { retryDelivery } from "../services/notifier.ts";
+import { inspectDelivery } from "../services/run-debug.ts";
+import { terminalHost } from "./host-arg.ts";
 import { formatBudget } from "../domain/budget.ts";
 import { CatherdError } from "../domain/errors.ts";
 import { gitToplevel } from "../infra/git.ts";
@@ -52,15 +58,30 @@ export function formatRun(s: RunSummary, now: number = Date.now()): string[] {
     lines.push(
       `  verifier step ${s.verifier.item}${s.verifier.carried ? " (carried over)" : ""} at ${s.verifier.at.slice(11, 16)}`,
     );
+  for (const d of s.delivery)
+    lines.push(
+      `  ${JSON.parse(d.eventId)[2] === "stalled" ? "stalled notice" : d.delivery === "collected" ? "collected" : "unread"} ${d.name} · delivery ${d.delivery}${d.receipt ? ` · queue receipt ${d.receipt.msgId}` : ""}`,
+    );
   for (const l of s.stateTail) lines.push(`  | ${l}`);
   for (const w of s.warnings) lines.push(`  ${mark("warn")} ${w}`);
   return lines;
 }
 
-function printStatus(runId: string | undefined, asJson: boolean): void {
+/**
+ * `live`: a long-lived watch, which reads the queue capability a background probe keeps fresh. A one-shot
+ * status never probes it: a slow Codex CLI must not delay the stored run state, nor hold the process open.
+ */
+async function printStatus(runId: string | undefined, asJson: boolean, live = false): Promise<void> {
   // redacted as `runs show` is: the state.md tail can quote a secret, and status goes to shared terminals
   registerSavedSecrets();
-  const r = redact(status(defaultDeps(), runId));
+  const host = terminalHost(undefined);
+  const queue =
+    host.host === "codex" && !host.conflict
+      ? live
+        ? knownQueueCapability(process.env)
+        : UNCHECKED_QUEUE
+      : null;
+  const r = redact(status(defaultDeps(host), runId, queue));
   if (asJson) return printJson(r);
   if (r.runs.length === 0) console.log("no runs yet");
   // grouped by session, as the runs page is (spec §4); a run shows once, under the session that started it
@@ -84,6 +105,13 @@ function printStatus(runId: string | undefined, asJson: boolean): void {
       for (const l of rest) console.log(l);
     }
   }
+  console.log(`host ${r.host.host}${r.host.conflict ? ` · conflict: ${r.host.conflict}` : ""}`);
+  if (r.queue)
+    console.log(
+      r.queue.checked === false
+        ? `queue unchecked · ${r.queue.reason}`
+        : `queue CLI ${r.queue.cli ? "supported" : "unavailable"} · server ${r.queue.server}${r.queue.reason ? ` · ${r.queue.reason}` : ""}`,
+    );
   for (const w of r.warnings) console.log(`${mark("warn")} ${w}`);
 }
 
@@ -95,7 +123,7 @@ export const statusCommand = defineCommand({
   },
   args: { run: { type: "positional", required: false, description: "run id" }, ...json },
   run({ args }) {
-    printStatus(args.run, args.json === true);
+    return printStatus(args.run, args.json === true);
   },
 });
 
@@ -142,7 +170,7 @@ export const watchCommand = defineCommand({
     }
     for (;;) {
       if (process.stdout.isTTY) process.stdout.write("\x1b[2J\x1b[H");
-      printStatus(undefined, false);
+      await printStatus(undefined, false, true);
       console.log(`updated ${new Date().toLocaleTimeString()} · Ctrl-C to stop`);
       await Bun.sleep(every);
     }
@@ -223,6 +251,10 @@ const show = defineCommand({
     for (const d of debug ?? []) {
       console.log(`\n--- ${d.name} ${d.dispatchId} (${d.rung}, admitted ${d.admittedAt})`);
       console.log(`record: ${d.record ? JSON.stringify(d.record) : "none yet"}`);
+      for (const e of d.deliveries.length ? d.deliveries : [d])
+        console.log(
+          `delivery: ${e.delivery}; event ${e.eventId}; receipt ${e.receipt ? JSON.stringify(e.receipt) : "none"}`,
+        );
       console.log(`exit.json: ${d.exit ? JSON.stringify(d.exit) : "none yet"}`);
       for (const [label, lines] of [
         ["stderr", d.stderrTail],
@@ -252,9 +284,53 @@ const cancelCmd = defineCommand({
   },
 });
 
+const retryPush = defineCommand({
+  meta: {
+    name: "retry-push",
+    description: "Retry a stored event for its current owner, acknowledging possible duplicate input",
+  },
+  args: {
+    run: { type: "positional", required: true, description: "stored run id" },
+    name: { type: "positional", required: true, description: "stored role name" },
+    event: { type: "string", required: true, description: "exact event ID shown by peek/status" },
+    "acknowledge-possible-duplicate": {
+      type: "boolean",
+      description: "explicitly acknowledge possible duplicate native input",
+    },
+    ...json,
+  },
+  async run({ args }) {
+    if (args["acknowledge-possible-duplicate"] !== true)
+      throw new CatherdError("E_INPUT_INVALID", "Retry requires --acknowledge-possible-duplicate");
+    assertId("role name", args.name);
+    const run = findRun(args.run);
+    const d = listDispatches(run).find(
+      (d) =>
+        d.admit.name === args.name &&
+        ["finished", "stalled"].some(
+          (kind) => args.event === JSON.stringify([run.id, d.admit.dispatchId, kind]),
+        ),
+    );
+    if (!d) throw new CatherdError("E_INPUT_INVALID", "Event does not belong to this stored run and role");
+    const deps = defaultDeps(terminalHost(undefined));
+    await retryDelivery(deps, d.dir, args.event, { allowPossibleDuplicate: true });
+    const inspection = inspectDelivery(
+      run,
+      d,
+      readRecords(run).records.some((r) => r.dispatchId === d.admit.dispatchId),
+      args.event,
+    );
+    if (args.json) printJson({ ...inspection, processing: "unconfirmed" });
+    else
+      console.log(
+        `retry inspected: ${inspection.delivery}; event ${args.event}${inspection.receipt ? `; queue receipt ${inspection.receipt.msgId}` : ""}; processing unconfirmed; use peek/result`,
+      );
+  },
+});
+
 /** Spec §8 `catherd runs list|show [--debug]|cancel`; a bare `catherd runs` lists them, as `status` needs no run. */
 export const runsCommand = defineCommand({
   meta: { name: "runs", description: "Runs: list them (the default), show one, cancel a live role" },
-  subCommands: { list, show, cancel: cancelCmd },
+  subCommands: { list, show, cancel: cancelCmd, "retry-push": retryPush },
   default: "list",
 });

package/src/entry/tui/effects.ts

@@ -1,3 +1,5 @@
+import type { HostContext } from "../../domain/host.ts";
+import { sessionKey } from "../../domain/host.ts";
 import { realpathSync, statSync, watch } from "node:fs";
 import { adapterFor } from "../../adapters/registry.ts";
 import "../../adapters/all.ts";
@@ -88,6 +90,7 @@ export interface RunRow {
  * The live set calls the services; tests and the storybook pass fakes.
  */
 export interface Effects {
+  host: HostContext;
   version: string;
   doctor(): Promise<DoctorReport>;
   runs(): { rows: RunRow[]; warnings: string[] };
@@ -247,7 +250,7 @@ export function rowOf(s: RunSummary): RunRow {
     roleRuns: s.totals.runs,
     landed: s.milestones.length,
     budget: s.budget?.fraction ?? null,
-    session: s.session?.sessionId ?? null,
+    session: s.session ? sessionKey(s.session) : null,
   };
 }
 
@@ -314,14 +317,19 @@ export function watchDirs(
  * The live effects. `repo` is the git toplevel the TUI was opened in (null outside one): inside a repo
  * bound to a profile, `here` is that profile and activating binds the repo instead of the global profile.
  */
-export function liveEffects(repo: string | null = null): Effects {
-  const deps = defaultDeps();
+export function liveEffects(
+  repo: string | null = null,
+  host: HostContext = { host: "unknown", session: null, conflict: null },
+): Effects {
+  const deps = defaultDeps(host);
   const rows = memoRuns((r) => rowOf(summarizeRun(deps, r)));
   const harnesses = HARNESS_KEYS.filter((h) => adapterFor(h));
   const bound = () => (repo !== null && readProjects().bindings[repo] !== undefined ? repo : null);
   return {
+    host,
     version: VERSION,
-    doctor: () => doctor({ bunVersion: Bun.version, version: VERSION, handshake: () => mcpHandshake() }),
+    doctor: () =>
+      doctor({ host, repo, bunVersion: Bun.version, version: VERSION, handshake: () => mcpHandshake() }),
     runs() {
       const { runs, corrupt } = listRuns();
       return { rows: rows(runs), warnings: corrupt.map((c) => `skipped run ${c.id}: ${c.reason}`) };
@@ -343,7 +351,7 @@ export function liveEffects(repo: string | null = null): Effects {
         models: catalogQuery({ scoredOnly: false, limit: Number.MAX_SAFE_INTEGER }, billing).models,
       };
     },
-    validate: (p, c) => validateHere(p, c),
+    validate: (p, c) => validateHere(p, c, undefined, host.host),
     enforcement: enforcementOf,
     harnesses,
     isolation(h) {
@@ -356,10 +364,13 @@ export function liveEffects(repo: string | null = null): Effects {
     agents: (p) => agentFiles(p, VERSION).map((f) => f.name),
     async save(name, patch, treatLikes, shown) {
       for (const [rung, like] of Object.entries(treatLikes)) await saveTreatLike(rung, like);
-      return patchProfile(name, patch, shown === undefined ? {} : { expect: shown });
+      return patchProfile(name, patch, {
+        host: host.host,
+        ...(shown === undefined ? {} : { expect: shown }),
+      });
     },
-    activate: (name, scope) => activate(name, scope),
-    create: createProfile,
+    activate: (name, scope) => activate(name, scope, host.host),
+    create: (name, from) => createProfile(name, from, host.host),
     remove: deleteProfile,
     refreshCatalog: () => refreshDiscovery(),
     syncSources: () => syncSources(),

package/src/entry/tui/fixtures.ts

@@ -1,3 +1,5 @@
+import type { OrchestrationHost } from "../../domain/host.ts";
+import { sessionKey } from "../../domain/host.ts";
 import { isDeepStrictEqual } from "node:util";
 import {
   applyPatch,
@@ -30,6 +32,9 @@ import { withStaged } from "./profile-tree.ts";
  * the catalog is the shipped one, read through the catalog service.
  */
 export const FIXTURE_REPORT: DoctorReport = {
+  host: { host: "unknown", session: null, conflict: null },
+  queue: null,
+  push: null,
   ready: false,
   version: "1.0.0",
   checks: [
@@ -79,6 +84,7 @@ export const FIXTURE_REPORT: DoctorReport = {
 };
 
 const summary = (o: Partial<RunSummary> & Pick<RunSummary, "id" | "title">): RunSummary => ({
+  delivery: [],
   repo: "/home/me/app",
   createdAt: "2026-09-26T11:48:00.000Z",
   session: null,
@@ -112,7 +118,13 @@ const FIXTURE_RUNS: RunSummary[] = [
   summary({
     id: JOBS,
     title: "Jobs screen",
-    session: { sessionId: "s-jobs", hostSessionId: null, name: "jobs screen", live: true },
+    session: {
+      host: "claude-code",
+      sessionId: "s-jobs",
+      hostSessionId: null,
+      name: "jobs screen",
+      live: true,
+    },
     stateTail: ["M1 in review", "Next: fix round for M1.L2"],
     live: [
       {
@@ -141,7 +153,13 @@ const FIXTURE_RUNS: RunSummary[] = [
     title: "Auth refactor",
     repo: "/home/me/api",
     createdAt: "2026-09-25T09:00:00.000Z",
-    session: { sessionId: "s-auth", hostSessionId: null, name: "auth build", live: false },
+    session: {
+      host: "claude-code",
+      sessionId: "s-auth",
+      hostSessionId: null,
+      name: "auth build",
+      live: false,
+    },
     continuedIn: "kit follow-up",
     stateTail: ["Next: done"],
     totals: {
@@ -200,7 +218,7 @@ const auth = (continued: SessionRun["continued"]): SessionRun => ({
 export const FIXTURE_SESSIONS: { row: SessionRow; runs: SessionRun[] }[] = [
   {
     row: {
-      key: "s-jobs",
+      key: sessionKey({ host: "claude-code", sessionId: "s-jobs" }),
       name: "jobs screen",
       live: true,
       runs: 1,
@@ -267,7 +285,7 @@ export const FIXTURE_SESSIONS: { row: SessionRow; runs: SessionRun[] }[] = [
   },
   {
     row: {
-      key: "s-kit",
+      key: sessionKey({ host: "claude-code", sessionId: "s-kit" }),
       name: "kit follow-up",
       live: false,
       runs: 1,
@@ -279,7 +297,7 @@ export const FIXTURE_SESSIONS: { row: SessionRow; runs: SessionRun[] }[] = [
   },
   {
     row: {
-      key: "s-auth",
+      key: sessionKey({ host: "claude-code", sessionId: "s-auth" }),
       name: "auth build",
       live: false,
       runs: 2,
@@ -394,6 +412,7 @@ const BACKENDS = ["claude", "codex", "claude-code", "opencode"];
  * directory the TUI stands in and `bindings` the repo bindings, as `liveEffects(repo)` reads them.
  */
 export interface FixtureOptions {
+  host?: OrchestrationHost;
   runs?: RunSummary[];
   sessions?: { row: SessionRow; runs: SessionRun[] }[];
   report?: DoctorReport;
@@ -418,6 +437,7 @@ export function fixtureEffects(o: FixtureOptions = {}): Effects & {
   /** the run folders watched now */
   watched: string[][];
 } {
+  const host = o.host ?? "claude-code";
   const runs = o.runs ?? FIXTURE_RUNS;
   const sessions = o.sessions ?? FIXTURE_SESSIONS;
   const listeners = new Set<() => void>();
@@ -434,15 +454,17 @@ export function fixtureEffects(o: FixtureOptions = {}): Effects & {
     after: ProfileDoc,
     staged: Record<string, string> = {},
   ) => {
-    const p = resolveProfile(after, name);
+    const p = resolveProfile(after, name, host);
     const c = withStaged(loadCatalog({ timings: false }), staged);
-    const v = validateProfile(p, c, BACKENDS);
+    const v = validateProfile(p, c, BACKENDS, undefined, host);
     // spec 1.2 §6.2, as the ProfileService rules: a save that repairs part of an invalid profile goes through
-    const was = docs.has(name) ? validateProfile(resolveProfile(before, name), c, BACKENDS) : null;
+    const was = docs.has(name)
+      ? validateProfile(resolveProfile(before, name, host), c, BACKENDS, undefined, host)
+      : null;
     return {
       saved: repairs(was, v),
       ...v,
-      diff: diffProfiles(resolveProfile(before, name), p),
+      diff: diffProfiles(resolveProfile(before, name, host), p),
       linked: [],
       pruned: [],
       newSessionNeededFor: [],
@@ -454,6 +476,7 @@ export function fixtureEffects(o: FixtureOptions = {}): Effects & {
     touch: () => {
       for (const l of listeners) l();
     },
+    host: { host, session: null, conflict: null },
     version: "1.0.0",
     doctor: async () => o.report ?? FIXTURE_REPORT,
     runs: () => ({ rows: runs.map(rowOf), warnings: [] }),
@@ -520,7 +543,7 @@ export function fixtureEffects(o: FixtureOptions = {}): Effects & {
       catalog: loadCatalog({ timings: false }),
       models: catalogQuery({ scoredOnly: false, limit: Number.MAX_SAFE_INTEGER }, billing).models,
     }),
-    validate: (p, c) => validateProfile(p, c, BACKENDS),
+    validate: (p, c) => validateProfile(p, c, BACKENDS, undefined, host),
     enforcement: (rung) => (rung.startsWith("codex:") ? "enforced" : "advisory"),
     harnesses: ["codex", "claude-code", "opencode"],
     isolation: () => ({}),

package/src/entry/tui/run.tsx

@@ -1,3 +1,4 @@
+import { terminalHost } from "../host-arg.ts";
 import { type CliRenderer, createCliRenderer, SystemClock } from "@opentui/core";
 import { createRoot } from "@opentui/react";
 import { gitToplevel } from "../../infra/git.ts";
@@ -26,6 +27,7 @@ import { App } from "./views/app.tsx";
 
 export interface TuiOptions {
   rawArgs: string[];
+  host?: string;
   tab?: Tab;
   env?: Record<string, string | undefined>;
   /** Whether stdin and stdout are a terminal; tests pass it so none reads the real one. */
@@ -59,8 +61,9 @@ export async function openTui(o: TuiOptions): Promise<number> {
   }
   const keybinds = keybindsFromConfig();
   const story = Boolean(env.CATHERD_STORY);
+  const host = terminalHost(o.host, env);
   // the repo this directory is in, resolved once at start (the repo ruling)
-  const effects: Effects = story ? fixtureEffects() : liveEffects(await gitToplevel(process.cwd()));
+  const effects: Effects = story ? fixtureEffects() : liveEffects(await gitToplevel(process.cwd()), host);
   const renderer = await createCliRenderer({
     exitOnCtrlC: false,
     useMouse: false,
@@ -83,7 +86,7 @@ export async function openTui(o: TuiOptions): Promise<number> {
         keymap={createAppKeymap(renderer)}
         effects={effects}
         clock={new WallClock()}
-        initial={initialState(o.tab ?? "status")}
+        initial={initialState(o.tab ?? "status", effects.host.host)}
         copy={(text) => renderer.copyToClipboardOSC52(text)}
         onExit={(code, kept) => {
           result = { code, kept };
@@ -103,6 +106,9 @@ export async function openTui(o: TuiOptions): Promise<number> {
 }
 
 /** Bare `catherd`: `cli.ts` imports this only when no subcommand was named, so no subcommand loads OpenTUI. */
-export async function tuiRun(ctx: { rawArgs: string[] }): Promise<void> {
-  process.exitCode = await openTui({ rawArgs: ctx.rawArgs });
+export async function tuiRun(ctx: { rawArgs: string[]; args?: Record<string, unknown> }): Promise<void> {
+  process.exitCode = await openTui({
+    rawArgs: ctx.rawArgs,
+    host: typeof ctx.args?.host === "string" ? ctx.args.host : undefined,
+  });
 }

package/src/entry/tui/state.ts

@@ -1,3 +1,4 @@
+import type { OrchestrationHost } from "../../domain/host.ts";
 import {
   applyPatch,
   diffProfiles,
@@ -21,6 +22,7 @@ interface Snapshot {
 
 /** Spec §9.2: edits are staged per profile and touch nothing on disk until a save. */
 export interface Draft extends Snapshot {
+  host: OrchestrationHost;
   name: string;
   /** the document as it was read, which a save diffs against */
   base: ProfileDoc;
@@ -118,6 +120,7 @@ export const ARM_MS: Record<Armed["what"], number> = { interrupt: 1_500, delete:
 export const HISTORY_LIMIT = 100;
 
 export interface AppState {
+  host: OrchestrationHost;
   tab: Tab;
   /** the profile the Profiles tab shows; null until one is read */
   profile: string | null;
@@ -165,7 +168,8 @@ export type Action =
   | { type: "arm"; what: Armed["what"]; target: string; at: number }
   | { type: "disarm" };
 
-export const initialState = (tab: Tab = "status"): AppState => ({
+export const initialState = (tab: Tab = "status", host: OrchestrationHost = "unknown"): AppState => ({
+  host,
   tab,
   profile: null,
   drafts: {},
@@ -177,7 +181,8 @@ export const initialState = (tab: Tab = "status"): AppState => ({
   armed: null,
 });
 
-const fresh = (name: string, doc: ProfileDoc): Draft => ({
+const fresh = (name: string, doc: ProfileDoc, host: OrchestrationHost): Draft => ({
+  host,
   name,
   base: doc,
   doc,
@@ -195,7 +200,10 @@ export const currentDraft = (s: AppState): Draft | null => (s.profile ? (s.draft
 const isStaged = (d: Draft | undefined): boolean => d !== undefined && dirtyCount(d) > 0;
 
 export function dirtyCount(d: Draft): number {
-  const fields = diffProfiles(resolveProfile(d.base, d.name), resolveProfile(d.doc, d.name)).length;
+  const fields = diffProfiles(
+    resolveProfile(d.base, d.name, d.host),
+    resolveProfile(d.doc, d.name, d.host),
+  ).length;
   return fields + Object.keys(d.treatLikes).length;
 }
 
@@ -239,7 +247,9 @@ export function reduce(s: AppState, a: Action): AppState {
         tab: "profiles",
         profile: a.name,
         // Keep only a draft with staged changes; a clean one restarts from the file just read.
-        drafts: isStaged(s.drafts[a.name]) ? s.drafts : { ...s.drafts, [a.name]: fresh(a.name, a.doc) },
+        drafts: isStaged(s.drafts[a.name])
+          ? s.drafts
+          : { ...s.drafts, [a.name]: fresh(a.name, a.doc, s.host) },
       };
     case "edit":
       return withDraft(s, s.profile, (d) =>
@@ -302,13 +312,16 @@ export function reduce(s: AppState, a: Action): AppState {
       const d = s.drafts[a.name];
       const from = a.from;
       if (!from || !d || (same(d.doc, from.doc) && same(d.treatLikes, from.treatLikes)))
-        return { ...s, drafts: { ...s.drafts, [a.name]: fresh(a.name, a.doc) } };
+        return { ...s, drafts: { ...s.drafts, [a.name]: fresh(a.name, a.doc, s.host) } };
       // edited while the save wrote: the saved file is the new base, and the newer edits stay staged over it
       const treatLikes = Object.fromEntries(
         Object.entries(d.treatLikes).filter(([rung, like]) => from.treatLikes[rung] !== like),
       );
       const doc = applyPatch(a.doc, patchBetween(from.doc, d.doc));
-      return { ...s, drafts: { ...s.drafts, [a.name]: { ...fresh(a.name, a.doc), doc, treatLikes } } };
+      return {
+        ...s,
+        drafts: { ...s.drafts, [a.name]: { ...fresh(a.name, a.doc, s.host), doc, treatLikes } },
+      };
     }
     case "forget": {
       const { [a.name]: _gone, ...drafts } = s.drafts;

package/src/entry/tui/stories.ts

@@ -1,3 +1,4 @@
+import { sessionKey } from "../../domain/host.ts";
 import type { ProfilePatch } from "../../domain/profile.ts";
 import type { CommandId } from "./commands.ts";
 import type { FixtureOptions } from "./fixtures.ts";
@@ -58,19 +59,25 @@ export const STORIES: Story[] = [
   {
     name: "session",
     title: "Runs: one session with two runs, one continued elsewhere",
-    steps: [{ command: "tab.runs" }, { action: { type: "session", key: "s-auth" } }],
+    steps: [
+      { command: "tab.runs" },
+      { action: { type: "session", key: sessionKey({ host: "claude-code", sessionId: "s-auth" }) } },
+    ],
   },
   {
     name: "session-live",
     title: "Runs: a live session with three live roles",
-    steps: [{ command: "tab.runs" }, { action: { type: "session", key: "s-jobs" } }],
+    steps: [
+      { command: "tab.runs" },
+      { action: { type: "session", key: sessionKey({ host: "claude-code", sessionId: "s-jobs" }) } },
+    ],
   },
   {
     name: "role",
     title: "Runs: a role opened",
     steps: [
       { command: "tab.runs" },
-      { action: { type: "session", key: "s-jobs" } },
+      { action: { type: "session", key: sessionKey({ host: "claude-code", sessionId: "s-jobs" }) } },
       { action: { type: "role", run: "20260926-114800-jobs-screen", dispatchId: "d1" } },
     ],
   },
@@ -79,7 +86,7 @@ export const STORIES: Story[] = [
     title: "Runs: a milestone opened on its digest",
     steps: [
       { command: "tab.runs" },
-      { action: { type: "session", key: "s-jobs" } },
+      { action: { type: "session", key: sessionKey({ host: "claude-code", sessionId: "s-jobs" }) } },
       { action: { type: "milestone", run: "20260926-114800-jobs-screen", name: "M0" } },
     ],
   },

package/src/entry/tui/views/profile-actions.ts

@@ -1,6 +1,6 @@
 import { isDeepStrictEqual } from "node:util";
 import { errorMessage, isCatherdError } from "../../../domain/errors.ts";
-import { PROFILE_NAME, patchBetween, type ProfileDoc } from "../../../domain/profile.ts";
+import { PROFILE_NAME, patchBetween, resolveProfile, type ProfileDoc } from "../../../domain/profile.ts";
 import { CHANGED_ON_DISK } from "../effects.ts";
 import { type AppApi, useApp, useDialogHandler } from "../providers/app.tsx";
 import { type Data, useData } from "../providers/data.tsx";
@@ -16,7 +16,9 @@ const fail = (app: AppApi, e: unknown) => app.toast(errorToast(e));
  */
 export function showProfile(app: AppApi, name: string, o: { quiet?: boolean } = {}): unknown {
   try {
-    app.dispatch({ type: "show", name, doc: app.effects.readProfile(name) });
+    const doc = app.effects.readProfile(name);
+    resolveProfile(doc, name, app.getState().host);
+    app.dispatch({ type: "show", name, doc });
     return null;
   } catch (e) {
     if (!o.quiet) fail(app, e);

package/src/entry/tui/views/profiles.tsx

@@ -100,7 +100,7 @@ export function ProfilesView(props: { width: number; height: number }) {
           },
     );
   }, [app.state.profile, here, app, polledAt, openTries]);
-  const profile = useMemo(() => (draft ? resolveProfile(draft.doc, draft.name) : null), [draft]);
+  const profile = useMemo(() => (draft ? resolveProfile(draft.doc, draft.name, draft.host) : null), [draft]);
   const billingKey = JSON.stringify(profile?.billing ?? {});
   // read again after every save too, by the identity of the base it reads back (the same bytes when only
   // treat-likes changed): a save writes the staged treat-likes to the catalog override and clears them
@@ -185,7 +185,7 @@ export function ProfilesView(props: { width: number; height: number }) {
   /** the draft as it is now: two keys in one tick must not both edit the profile this render drew */
   const current = () => {
     const d = currentDraft(app.getState());
-    return d ? resolveProfile(d.doc, d.name) : null;
+    return d ? resolveProfile(d.doc, d.name, d.host) : null;
   };
   const edit = (patch: ReturnType<typeof patchFor>) => patch && app.dispatch({ type: "edit", patch });
   const toggleOpen = (r: Row, open?: boolean) =>

package/src/entry/tui/views/save-dialog.tsx

@@ -51,8 +51,8 @@ function previewSave(
   fx: Pick<Effects, "catalog" | "validate" | "agents" | "readProfile">,
   now: ProfileDoc = fx.readProfile(d.name),
 ): SavePreview {
-  const before = resolveProfile(now, d.name);
-  const after = resolveProfile(applyPatch(now, patchBetween(d.base, d.doc)), d.name);
+  const before = resolveProfile(now, d.name, d.host);
+  const after = resolveProfile(applyPatch(now, patchBetween(d.base, d.doc)), d.name, d.host);
   const { catalog } = fx.catalog(after.billing);
   const a = new Set(fx.agents(before));
   const b = new Set(fx.agents(after));

package/src/infra/cli.ts

@@ -0,0 +1,65 @@
+import { scrubSecrets } from "./env.ts";
+import { log } from "./log.ts";
+import { killGroup } from "./proc.ts";
+
+export interface CliResult {
+  ok: boolean;
+  out: string;
+  err: string;
+}
+
+/** Process groups of CLI calls still running: an exiting catherd (Ctrl-C is exit 130) kills them. */
+const live = new Set<number>();
+let hooked = false;
+function track(pid: number): void {
+  live.add(pid);
+  if (hooked) return;
+  hooked = true;
+  // a detached group gets no terminal SIGINT, and process.exit skips the timeout, so kill it on the way out
+  process.on("exit", () => {
+    for (const g of live) killGroup(g, "SIGKILL");
+  });
+}
+
+/**
+ * Runs `bin <args>` without catherd's secrets and with no stdin; null when `bin` is not on PATH. A call
+ * past `timeoutMs` is killed with every process it started (it runs in its own process group) and is
+ * reported as failed, so neither a wedged CLI nor a child holding its pipes stalls the caller.
+ */
+export async function runCli(
+  bin: string,
+  args: string[],
+  o: { timeoutMs: number; env?: Record<string, string>; cwd?: string; logArgs?: string[] },
+): Promise<CliResult | null> {
+  if (!Bun.which(bin, { PATH: process.env.PATH ?? "" })) return null;
+  const logArgs = o.logArgs ?? args;
+  log("debug", "spawn", { argv: [bin, ...logArgs], env: scrubSecrets(o.env ?? {}) });
+  const p = Bun.spawn([bin, ...args], {
+    cwd: o.cwd,
+    env: scrubSecrets({ ...process.env, ...o.env }),
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    detached: true,
+  });
+  track(p.pid);
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const late = new Promise<null>((resolve) => {
+    timer = setTimeout(() => resolve(null), o.timeoutMs);
+  });
+  try {
+    const done = await Promise.race([
+      Promise.all([p.exited, new Response(p.stdout).text(), new Response(p.stderr).text()]),
+      late,
+    ]);
+    if (!done) {
+      killGroup(p.pid, "SIGKILL");
+      return { ok: false, out: "", err: `${bin} ${logArgs.join(" ")} timed out after ${o.timeoutMs} ms` };
+    }
+    const [code, out, err] = done;
+    return { ok: code === 0, out, err };
+  } finally {
+    clearTimeout(timer);
+    live.delete(p.pid);
+  }
+}