CLI: move action validation to #run