catherd-cli 1.4.0 → 1.5.0

package/src/services/peek.ts

@@ -49,6 +49,45 @@ export interface PeekRun extends Reentry {
   native: { name: string; role: string; rung: string; status: string; at: string } | null;
   /** the run's next step (state.md's last line) */
   next: string;
+  /** plan 22, goal mode: whether anything in this run is the coordinator's to do now, and why (not) */
+  actionable: boolean;
+  reason: string;
+}
+
+/**
+ * Plan 22, goal mode: whether the run holds anything for the coordinator. An unread record is its to read; with
+ * roles live, a protocol step one of them is doing (lanes running, the reviewer or verifier step with that role
+ * live, the plan while an architect or researcher runs) or the owner's question is nobody's to act on, so the
+ * coordinator ends its turn with no tool call and the next catherd message wakes it.
+ */
+export function actionability(
+  live: { name: string; role: string }[],
+  unread: { name: string }[],
+  protocolNext: string,
+): { actionable: boolean; reason: string } {
+  if (unread.length)
+    return {
+      actionable: true,
+      reason: `unread: ${unread.map((u) => `result(run, "${u.name}")`).join(", ")}`,
+    };
+  if (protocolNext.endsWith(" parked: wait for the owner"))
+    return {
+      actionable: false,
+      reason: `${protocolNext.replace(/: wait for the owner$/, "")}: the owner's answer comes first; end the turn with no tool call`,
+    };
+  const running = (role: string) => live.some((l) => l.role === role);
+  const covered =
+    /: lanes running \(/.test(protocolNext) ||
+    (protocolNext.endsWith(": reviewer") && running("reviewer")) ||
+    (protocolNext.endsWith(": verifier") && running("verifier")) ||
+    (protocolNext.startsWith("plan:") && (running("architect") || running("researcher"))) ||
+    (protocolNext.startsWith("finish:") && (running("verifier") || running("writer")));
+  if (live.length && covered)
+    return {
+      actionable: false,
+      reason: `only roles are live (${live.map((l) => l.name).join(", ")}): their results arrive as catherd messages; end the turn with no tool call`,
+    };
+  return { actionable: true, reason: protocolNext };
 }
 
 function peekRun(deps: Deps, run: Run, name: string | undefined): PeekRun {
@@ -57,23 +96,31 @@ function peekRun(deps: Deps, run: Run, name: string | undefined): PeekRun {
   const records = new Map(readRecords(run).records.map((r) => [r.dispatchId, r]));
   const agents = readAgentRuns(run).filter((a) => name === undefined || a.name === name);
   const native = agents.at(-1);
-  const r = reentry(run, now);
+  const notes = readNotes(run);
+  const re = reentry(run, now, notes);
+  const live = liveDispatches(run, now);
+  // the whole run decides it, whatever `name` narrows the view to
+  const act = actionability(
+    live.map((d) => ({ name: d.admit.name, role: d.admit.role })),
+    listDispatches(run).flatMap((d) =>
+      records.has(d.admit.dispatchId) && awaitsCollect(d.dir) ? [{ name: d.admit.name }] : [],
+    ),
+    re.protocol.next,
+  );
   return {
-    questions: r.questions,
+    questions: re.questions,
     run: run.id,
     title: run.meta.title,
     owner: runOwner(run)?.sessionId ?? null,
     ownerHost: runOwner(run)?.host ?? null,
-    live: liveDispatches(run, now)
-      .filter(mine)
-      .map((d) => ({
-        name: d.admit.name,
-        role: d.admit.role,
-        rung: d.admit.rung,
-        state: d.state,
-        secs: Math.max(0, Math.round((now - Date.parse(d.admit.admittedAt)) / 1000)),
-        lastEvent: lastActivity(d),
-      })),
+    live: live.filter(mine).map((d) => ({
+      name: d.admit.name,
+      role: d.admit.role,
+      rung: d.admit.rung,
+      state: d.state,
+      secs: Math.max(0, Math.round((now - Date.parse(d.admit.admittedAt)) / 1000)),
+      lastEvent: lastActivity(d),
+    })),
     delivery: listDispatches(run)
       .filter(mine)
       .flatMap((d) =>
@@ -103,9 +150,10 @@ function peekRun(deps: Deps, run: Run, name: string | undefined): PeekRun {
     native: native
       ? { name: native.name, role: native.role, rung: native.rung, status: native.status, at: native.at }
       : null,
-    next: readNotes(run).next,
-    protocol: r.protocol,
-    verifier: r.verifier,
+    next: notes.next,
+    protocol: re.protocol,
+    verifier: re.verifier,
+    ...act,
   };
 }
 
@@ -117,7 +165,15 @@ function peekRun(deps: Deps, run: Run, name: string | undefined): PeekRun {
 export async function peek(
   deps: Deps,
   i: { run?: string; name?: string },
-): Promise<{ runs: PeekRun[]; hints: string[]; host: HostContext; queue: QueueCapability | null }> {
+): Promise<{
+  /** plan 22, goal mode: false when no run holds anything for the coordinator; `reason` says why either way */
+  actionable: boolean;
+  reason: string;
+  runs: PeekRun[];
+  hints: string[];
+  host: HostContext;
+  queue: QueueCapability | null;
+}> {
   if (i.name !== undefined) assertId("role name", i.name);
   let runs: Run[];
   if (i.run) {
@@ -131,8 +187,14 @@ export async function peek(
     runs = owned.length ? owned : all.slice(0, 1);
   }
   const hints = runs.length === 0 ? ["no runs yet: run_start(repo, title, a_lines) starts one"] : [];
+  const views = runs.map((r) => peekRun(deps, r, i.name));
+  const doing = views.filter((v) => v.actionable);
+  const shown = (vs: PeekRun[]) =>
+    vs.map((v) => (views.length > 1 ? `${v.title}: ${v.reason}` : v.reason)).join("; ");
   return {
-    runs: runs.map((r) => peekRun(deps, r, i.name)),
+    actionable: views.length === 0 || doing.length > 0,
+    reason: views.length === 0 ? "no runs yet" : shown(doing.length ? doing : views),
+    runs: views,
     hints,
     host: inspectionHost(deps.host),
     queue: deps.host.host === "codex" && !deps.host.conflict ? knownQueueCapability(process.env) : null,

package/src/services/ports.ts

@@ -7,6 +7,7 @@ import type { Verdict } from "../domain/jev.ts";
 import type { Difficulty, Kind } from "../domain/lane.ts";
 import type { Access } from "../domain/record.ts";
 import type { Role } from "../domain/roles.ts";
+import type { RoleScope } from "../domain/role-scope.ts";
 import type { Change, ProfileDoc, ProfilePatch } from "../domain/profile.ts";
 import type { Issue } from "../domain/profile-rules.ts";
 import type { RouteJev, RouteSource } from "../domain/route.ts";
@@ -18,7 +19,18 @@ export interface ProfileView {
   objective: "cost" | "speed";
   /** `defaultRung`, when set, is where a lane starts without a kind and difficulty (spec §5.4) */
   roles: Partial<
-    Record<Role, { enabled: boolean; access: Access; rungs: string[]; defaultRung?: string; network?: false }>
+    Record<
+      Role,
+      {
+        enabled: boolean;
+        access: Access;
+        rungs: string[];
+        defaultRung?: string;
+        network?: false;
+        /** plan 23: the role's own timeouts over the profile's */
+        timeouts?: { idleMin?: number; wallMin?: number };
+      }
+    >
   >;
   /** per billing key (spec §7.1); a missing key bills as DEFAULT_BILLING */
   billing: Partial<Record<string, BillingMode>>;
@@ -82,6 +94,8 @@ export interface RouteRequest {
   lane: string | null;
   laneText: string | null;
   spentFraction: number;
+  /** spec 1.5 plan 24: the run's dispatches so far per quota, for a tie between rungs of equal scores */
+  usage?: Record<string, number>;
 }
 
 export interface RouteAnswer {
@@ -93,6 +107,14 @@ export interface RouteAnswer {
   /** the Jev question set asked, and its summed probabilities, for outcomes.jsonl (spec §5.6) */
   questionSet: string | null;
   jev: RouteJev | null;
+  /** spec 1.5 plan 24: where Jev disagreed with a declared lane header (`Jev said logic/hard`), else null */
+  jevSaid: string | null;
+  /** spec 1.5 plan 24: no rung clears the lane's bar, and the closest one */
+  noClear?: string;
+  /** spec 1.5 plan 24: rungs of equal scores on other quotas competed for the start, and what decided */
+  tie?: string;
+  /** spec 1.5 plan 24: the decision in one line, for the coordinator */
+  why: string;
   /** spec 1.2 §5.3, §8: the chosen rung's thresholds, values, sources, facts and run evidence */
   provenance?: Provenance;
 }
@@ -111,6 +133,8 @@ export interface CatalogFilter {
 
 export interface RoutingPort {
   route(req: RouteRequest): Promise<RouteAnswer>;
+  /** spec 1.5 plan 24: the lanes of one role in one call; Jev is asked about all of them at once */
+  routeMany(reqs: RouteRequest[]): Promise<RouteAnswer[]>;
   /** `use` is the repo profile's `jev.use`: "off" answers with the rule's default and never asks Jev */
   finding(
     runDir: string,
@@ -143,5 +167,10 @@ export interface Deps {
   session: SessionEnv | null;
   now: () => number;
   /** spec 1.2 §3.2 `catalog_sync`; default: the real sync (tests inject one that never reaches the network) */
-  sync?: (o: { force: boolean }) => Promise<SyncReport>;
+  sync?: (o: { force: boolean; wait?: boolean }) => Promise<SyncReport>;
+  /**
+   * Spec 1.5 plan 21: the role this process works for (CATHERD_ROLE, or a role's scratch TMPDIR); null or
+   * absent for the orchestrator's own server. A role never claims a run and never reaches a coordinator tool.
+   */
+  role?: RoleScope | null;
 }

package/src/services/preflight.ts

@@ -1,16 +1,19 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { CatherdError, errorMessage } from "../domain/errors.ts";
-import { assertLaneHeader, LANE_HEADER_FIX, parseLaneHeader } from "../domain/lane.ts";
+import { assertLaneHeader, LANE_HEADER_FIX, onlyAllowedHits, parseLaneHeader } from "../domain/lane.ts";
 import { checkEnv } from "../infra/env.ts";
-import { heavySlots, withHeavySlot } from "../infra/heavy-lock.ts";
+import { heavySlots, withHeavySlotWithin } from "../infra/heavy-lock.ts";
+import { loginEnv } from "../infra/login-env.ts";
 import { killGroup } from "../infra/proc.ts";
+import { readGateEnv, resolveGateEnv } from "./gate-env.ts";
+import { landedMilestones } from "./milestones.ts";
 import type { Deps } from "./ports.ts";
 import { TAIL_LINES } from "./run-debug.ts";
 import { findRun, type Run, runPaths } from "./run-store.ts";
 
-/** Spec §4.7. Only `cannot-start` blocks the run. */
-export type PreflightOutcome = "pass" | "fails-as-expected" | "skipped" | "cannot-start";
+/** Spec §4.7. Only `cannot-start` blocks the run; `lock-busy` (plan 23) means: run preflight again. */
+export type PreflightOutcome = "pass" | "fails-as-expected" | "skipped" | "cannot-start" | "lock-busy";
 
 interface PreflightResult {
   lane: string;
@@ -28,6 +31,8 @@ export type PreflightReport =
       commands: { lane: string; check: string | null }[];
       results: PreflightResult[];
       blocked: boolean;
+      /** plan 23: lanes whose fast check runs no linter while the repo has one */
+      warnings: string[];
     };
 
 const CHECK_TIMEOUT_MS = 120_000;
@@ -47,6 +52,8 @@ interface LaneCheck {
   lane: string;
   check: string | null;
   owns: string[];
+  /** spec 1.5: the Allow: exceptions of the lane's absence check */
+  allow: string[];
   problem: string | null;
   /** spec 1.1 §6: why its Kind: or Difficulty: line is refused */
   invalid: string | null;
@@ -73,15 +80,19 @@ function laneChecks(run: Run): LaneCheck[] {
           lane,
           check: h.fastCheck,
           owns: h.owns,
+          allow: h.allow,
           problem: h.fastCheck ? null : `lanes/${f} has no Fast check: line`,
           invalid,
         };
       } catch (e) {
-        return { lane, check: null, owns: [], problem: (e as Error).message, invalid };
+        return { lane, check: null, owns: [], allow: [], problem: (e as Error).message, invalid };
       }
     });
 }
 
+/** How many output lines a check's Allow: exceptions are matched against; past it, the check fails as before. */
+const ALLOW_LINES = 1_000;
+
 /** How long the pipes may stay open after the check's own process exits. */
 export const DRAIN_MS = 500;
 
@@ -116,10 +127,11 @@ export async function runCheck(
   repo: string,
   check: string,
   timeoutMs: number,
-): Promise<{ code: number | null; timedOut: boolean; tail: string[] }> {
+  env: Record<string, string> = checkEnv(process.env, repo),
+): Promise<{ code: number | null; timedOut: boolean; tail: string[]; lines: string[] }> {
   const p = Bun.spawn(["sh", "-c", check], {
     cwd: repo,
-    env: checkEnv(process.env, repo),
+    env,
     stdin: "ignore",
     stdout: "pipe",
     stderr: "pipe",
@@ -141,11 +153,10 @@ export async function runCheck(
       Bun.sleep(DRAIN_MS).then(() => false),
     ]);
     if (!drained) killGroup(p.pid, "SIGKILL"); // leftovers still in the check's group
-    const tail = `${out.text()}${err.text()}`
-      .split("\n")
-      .filter((l) => l.trim())
-      .slice(-TAIL_LINES);
-    return { code: timedOut ? null : code, timedOut, tail };
+    // every line, up to a bound, for a lane's Allow: exceptions; the tail is what the report shows
+    const all = `${out.text()}${err.text()}`.split("\n").filter((l) => l.trim());
+    const lines = all.length <= ALLOW_LINES ? all : [];
+    return { code: timedOut ? null : code, timedOut, tail: all.slice(-TAIL_LINES), lines };
   } finally {
     clearTimeout(timer);
     out.stop();
@@ -153,10 +164,100 @@ export async function runCheck(
   }
 }
 
-export function classify(r: { code: number | null; timedOut: boolean; tail: string[] }): PreflightOutcome {
+/**
+ * Plan 23: a check that failed on the machine, not on the code: no Docker (or none at DOCKER_HOST), no DNS, a
+ * permission the sandbox or the OS denied. Such a check cannot start; it never fails as expected.
+ */
+const ENVIRONMENT = [
+  /command not found/i,
+  /Cannot connect to the Docker daemon/i,
+  /rootless Docker not found/i,
+  /Could not find a valid Docker environment/i,
+  /docker\.sock: connect: no such file or directory/i,
+  /Temporary failure in name resolution|Could not resolve host|no such host|Name or service not known|nodename nor servname|getaddrinfo (ENOTFOUND|EAI_AGAIN)/i,
+  /permission denied|operation not permitted|\bEACCES\b|\bEPERM\b/i,
+];
+
+/** pnpm exits 0 on a `--filter` that matches no package: the lane creates it, so there is nothing to run yet. */
+const EMPTY_FILTER = /No projects matched the filters/i;
+
+/** The first tail line an ENVIRONMENT pattern matches, or null. */
+export const environmentLine = (tail: string[]): string | null =>
+  tail.find((l) => ENVIRONMENT.some((re) => re.test(l))) ?? null;
+
+/** One `pnpm … --filter …` command, nothing chained, piped or backgrounded beside it. */
+const SINGLE_PNPM_FILTER = /^\s*pnpm\s(?:[^;&|\n`$()<>]*\s)?(?:--filter|-F)(?:[\s=])[^;&|\n`$()<>]*$/;
+
+/**
+ * An unmatched pnpm filter is "skipped" only when it is provably the check's sole failure: the whole check
+ * exited 0, or the check is a single pnpm --filter command. In a compound check (`pnpm --filter new test;
+ * docker compose up`) a later command's failure decides.
+ */
+export function classify(
+  r: { code: number | null; timedOut: boolean; tail: string[] },
+  command?: string,
+): PreflightOutcome {
   if (r.timedOut || r.code === 126 || r.code === 127) return "cannot-start";
+  const soleFailure = r.code === 0 || (command !== undefined && SINGLE_PNPM_FILTER.test(command));
+  if (soleFailure && r.tail.some((l) => EMPTY_FILTER.test(l))) return "skipped";
   if (r.code === 0) return "pass";
-  return r.tail.some((l) => /command not found/i.test(l)) ? "cannot-start" : "fails-as-expected";
+  return environmentLine(r.tail) !== null ? "cannot-start" : "fails-as-expected";
+}
+
+/** Why a classified result says what it says, for its note. */
+function noteOf(
+  r: { code: number | null; timedOut: boolean; tail: string[] },
+  outcome: PreflightOutcome,
+  timeoutMs: number,
+): string | null {
+  if (r.timedOut) return `timed out after ${timeoutMs / 1000} s`;
+  if (outcome === "skipped") return "the pnpm filter matches no package yet; the lane creates it";
+  const env = outcome === "cannot-start" ? environmentLine(r.tail) : null;
+  return env ? `environment: ${env.trim()}` : null;
+}
+
+/** How long one check waits for a heavy slot before it reports lock-busy; tests shorten it. */
+export const preflightLimits = { lockWaitMs: 60_000 };
+
+/**
+ * Plan 23: a check runs in the user's login environment (DOCKER_HOST and the rest a login shell sets), through
+ * the allowlist, plus the repo's gate environment. A login PATH comes first, with the server's own after it.
+ */
+export async function checkEnvFor(repo: string): Promise<Record<string, string>> {
+  const login = loginEnv();
+  const base: Record<string, string | undefined> = { ...process.env, ...login };
+  const path = [
+    ...new Set([...(login.PATH ?? "").split(":"), ...(process.env.PATH ?? "").split(":")].filter(Boolean)),
+  ];
+  if (path.length) base.PATH = path.join(":");
+  return { ...checkEnv(base, repo), ...resolveGateEnv(await readGateEnv(repo), base).env };
+}
+
+/** What a fast check names when it lints: a lint script, or a linter by name. */
+const LINT_STEP = /\b(lint|eslint|biome|oxlint|golangci-lint|ruff|clippy|vet|check)\b/i;
+
+/** Root files that say the repo has a linter, by the linter they configure. */
+const LINT_CONFIGS: [RegExp, string][] = [
+  [/^\.golangci\.(ya?ml|toml|json)$/, "golangci-lint"],
+  [/^(biome\.jsonc?)$/, "biome"],
+  [/^(eslint\.config\.[cm]?[jt]s|\.eslintrc(\.[a-z]+)?)$/, "eslint"],
+  [/^\.?oxlintrc\.json$/, "oxlint"],
+  [/^\.?ruff\.toml$/, "ruff"],
+];
+
+/** The linter the repo has, by name, or null: a root lint config, or a `lint` script in package.json. */
+export function repoLinter(repo: string): string | null {
+  for (const name of existsSync(repo) ? readdirSync(repo) : [])
+    for (const [re, linter] of LINT_CONFIGS) if (re.test(name)) return linter;
+  try {
+    const pkg = JSON.parse(readFileSync(join(repo, "package.json"), "utf8")) as {
+      scripts?: Record<string, unknown>;
+    };
+    if (typeof pkg.scripts?.lint === "string") return "the lint script";
+  } catch {
+    // no package.json, or one that does not parse: no lint script
+  }
+  return null;
 }
 
 /**
@@ -165,11 +266,16 @@ export function classify(r: { code: number | null; timedOut: boolean; tail: stri
  */
 export async function preflight(
   deps: Deps,
-  i: { run: string; confirmed?: boolean; timeoutMs?: number },
+  i: { run: string; confirmed?: boolean; timeoutMs?: number; milestone?: string },
 ): Promise<PreflightReport> {
   const run = findRun(i.run);
   const profile = deps.profiles.forRepo(run.meta.repo);
-  const lanes = laneChecks(run);
+  // plan 23: one milestone's lanes, or by default every lane whose milestone has not landed
+  const landed = new Set(landedMilestones(run));
+  const milestoneOf = (lane: string) => lane.split(".")[0] as string;
+  const lanes = laneChecks(run).filter((l) =>
+    i.milestone ? milestoneOf(l.lane) === i.milestone : !landed.has(milestoneOf(l.lane)),
+  );
   // spec 1.1 §6: refuse before running anything, naming every lane whose header the catalog cannot route
   const invalid = lanes.flatMap((l) => (l.invalid ? [l.invalid] : []));
   if (invalid.length) throw new CatherdError("E_LANE_INVALID", invalid.join("; "), { fix: LANE_HEADER_FIX });
@@ -177,6 +283,8 @@ export async function preflight(
   if (profile.preflight.confirm && !i.confirmed) return { needsConfirmation: true, commands };
   const timeoutMs = i.timeoutMs ?? CHECK_TIMEOUT_MS;
   const results: PreflightResult[] = [];
+  // the login env is captured once per server; the gate env is read once per preflight
+  let env: Record<string, string> | undefined;
   for (const l of lanes) {
     const check = l.check;
     if (!check) {
@@ -202,20 +310,46 @@ export async function preflight(
       results.push({ lane: l.lane, check, outcome: "skipped", exitCode: null, tail: [], note });
       continue;
     }
-    const r = await withHeavySlot(heavySlots(profile.heavy), () => runCheck(run.meta.repo, check, timeoutMs));
+    env ??= await checkEnvFor(run.meta.repo);
+    const checkEnvironment = env;
+    // plan 23: each check waits for its slot within its own budget, and says lock-busy past it
+    const slot = await withHeavySlotWithin(heavySlots(profile.heavy), preflightLimits.lockWaitMs, () =>
+      runCheck(run.meta.repo, check, timeoutMs, checkEnvironment),
+    );
+    if (slot.busy) {
+      const note = `every heavy slot stayed busy for ${preflightLimits.lockWaitMs / 1000} s (other lanes' checks); run preflight again when they finish`;
+      results.push({ lane: l.lane, check, outcome: "lock-busy", exitCode: null, tail: [], note });
+      continue;
+    }
+    const r = slot.value;
+    // spec 1.5: an absence check whose every hit is one of the lane's Allow: exceptions has passed
+    const classified = classify(r, check);
+    const allowed = classified === "fails-as-expected" && onlyAllowedHits(r.lines, l.allow);
+    const outcome = allowed ? "pass" : classified;
     results.push({
       lane: l.lane,
       check,
-      outcome: classify(r),
+      outcome,
       exitCode: r.code,
       tail: r.tail,
-      note: r.timedOut ? `timed out after ${timeoutMs / 1000} s` : null,
+      note: allowed ? `every hit is an Allow: exception (${r.lines.length})` : noteOf(r, outcome, timeoutMs),
     });
   }
+  // plan 23: lint reaches the worker only through its fast check
+  const linter = repoLinter(run.meta.repo);
+  const warnings = linter
+    ? lanes
+        .filter((l) => l.check && !LINT_STEP.test(l.check))
+        .map(
+          (l) =>
+            `${l.lane}: its fast check runs no linter, and the repo has one (${linter}): add the linter of every package the lane touches to its Fast check: line`,
+        )
+    : [];
   return {
     needsConfirmation: false,
     commands,
     results,
     blocked: results.some((r) => r.outcome === "cannot-start"),
+    warnings,
   };
 }

package/src/services/profile-service.ts

@@ -333,6 +333,7 @@ export function profileService(host: () => HostContext): ProfilePort {
         name === undefined ? activeName(repo) : requireProfile(name),
         repo,
         host().host,
+        { reach: true },
       );
       return { valid: v.errors.length === 0, ...v };
     },

package/src/services/profile-store.ts

@@ -15,7 +15,12 @@ import {
   ProfileDocSchema,
   resolveProfile,
 } from "../domain/profile.ts";
-import { type Issue, type Validation, validateProfile } from "../domain/profile-rules.ts";
+import {
+  type Issue,
+  type ValidateOptions,
+  type Validation,
+  validateProfile,
+} from "../domain/profile-rules.ts";
 import type { Catalog } from "../domain/catalog.ts";
 import type { Access } from "../domain/record.ts";
 import { ROLES, type Role } from "../domain/roles.ts";
@@ -220,8 +225,9 @@ export function validateHere(
   c: Catalog,
   doc?: ProfileDoc,
   host: OrchestrationHost = "unknown",
+  o: ValidateOptions = {},
 ): Validation {
-  const v = validateProfile(p, c, runnableBackends(), doc, host);
+  const v = validateProfile(p, c, runnableBackends(), doc, host, o);
   return {
     errors: [...v.errors, ...isolationKeyErrors(p), ...isolatedOnlyErrors(p)],
     warnings: [...v.warnings, ...budgetUsdWarnings(p)],
@@ -233,12 +239,13 @@ export function validateNamed(
   name: string | undefined,
   repo: string | null,
   host: OrchestrationHost,
+  o: ValidateOptions = {},
 ): Validation {
   const n = name ?? activeName(repo);
   const doc = readProfileDoc(n);
   const catalog = loadCatalog({ timings: false, ...(repo === null ? {} : { repo }) });
   try {
-    return validateHere(resolveProfile(doc, n, host), catalog, doc, host);
+    return validateHere(resolveProfile(doc, n, host), catalog, doc, host, o);
   } catch (e) {
     if (!(e instanceof CatherdError)) throw e;
     return { errors: [{ path: "roles", message: e.message, fix: e.fix }], warnings: [] };