@kindgi/cli 0.1.4 → 0.1.5

package/dist/commands/doctor.js

@@ -26,13 +26,17 @@ import { readFile, readdir, stat } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
 import { findKindgiConfig } from '@kindgi/handler-runtime';
 import { LOCAL_ENV_NAME, displayEnvPath, readPackEnv } from '@kindgi/secrets-dotenv';
+import { DEV_GOOGLE_CREDENTIALS_VAR, VERTEX_PROVIDER_ID, resolveDevGoogleCredentials, vertexCredentialsHint, } from '../dev/google-credentials.js';
+import { javaMajor } from '../dev/pack-code.js';
 import { docker } from '../dev/runtime-container.js';
 import { DEFAULT_RUNTIME_IMAGE, registryOf } from '../dev/runtime-image.js';
 import { checkDocker, checkImageAccess, credentialHelperHint } from '../dev/runtime-registry.js';
+import { extractKindgiError } from '../errors.js';
 import { renderJson } from '../output.js';
 import { binCommand, cliInstall, defaultDetectIo, publishedCliSpec, pythonBinRunner, usablePackageManager, } from '../package-manager.js';
 import { loadProviderPresets } from '../providers/preset-loader.js';
 import { CLI_VERSION } from '../version-info.js';
+import { probeConsole } from './console.js';
 /**
  * The provider `kindgi dev` falls back to, with canned replies
  * (`DEV_ECHO_PROVIDER_ID` in `@kindgi/dev-echo-provider`): not a model.
@@ -42,11 +46,16 @@ const DEV_ECHO_PROVIDER_ID = 'dev-echo';
 export const MIN_NODE = '22.12.0';
 /** The Python a Python project needs (`requires-python` in its pyproject.toml). */
 export const MIN_PYTHON = '3.11.0';
+/** The JDK a Java or Scala project needs (kindgi-pack's baseline). */
+export const MIN_JAVA = 17;
 const TITLES = {
     node: 'Node.js',
     npm: 'npm',
     python: 'Python',
     uv: 'uv',
+    java: 'Java',
+    maven: 'Maven',
+    sbt: 'sbt',
     docker: 'Docker',
     registry: 'Runtime image',
     project: 'Project',
@@ -54,6 +63,8 @@ const TITLES = {
     'model-key': 'Model key',
     runtime: 'Runtime',
     provider: 'Provider',
+    'console-sign-in': 'Console sign-in',
+    erasures: 'Erasures',
 };
 export const doctorCommand = {
     kind: 'leaf',
@@ -83,24 +94,32 @@ export async function runDoctor(ctx, dir) {
     const run = seam.docker ?? docker;
     const checks = [];
     const config = await findKindgiConfig(dir);
-    const language = config === undefined ? undefined : config.format === 'pyproject' ? 'python' : 'node';
+    const language = config === undefined
+        ? undefined
+        : config.format === 'pyproject'
+            ? 'python'
+            : config.format === 'json'
+                ? await jvmLanguageOf(config.path)
+                : 'node';
     const pypi = cliInstall(ctx.env) === 'pypi';
     const kindgi = await kindgiCommand(dir, language, pypi, tool);
     checks.push(...(await nodeChecks(seam.nodeVersion ?? process.versions.node, tool, pypi)));
     checks.push(...(await pythonChecks(tool, language)));
+    checks.push(...(await jvmChecks(tool, language, dir, ctx.env)));
     const dockerCheck = await checkDockerRunning(run);
     checks.push(dockerCheck);
     checks.push(dockerCheck.status === 'pass'
         ? await registryCheck(run, seam.image ?? DEFAULT_RUNTIME_IMAGE, kindgi)
         : skip('registry', 'Not checked: it needs Docker running.'));
+    checks.push(await consoleSignInCheck(ctx));
     if (config === undefined || language === undefined) {
         checks.push({
             id: 'project',
             status: 'skip',
-            message: `No Kindgi project in ${dir}: no kindgi.config.ts, and no pyproject.toml with [tool.kindgi].`,
+            message: `No Kindgi project in ${dir}: no kindgi.config.ts, no pyproject.toml with [tool.kindgi], and no kindgi.config.json.`,
             fix: createProjectFix(kindgi, pypi),
         });
-        for (const id of ['dependencies', 'model-key', 'runtime', 'provider']) {
+        for (const id of ['dependencies', 'model-key', 'runtime', 'provider', 'erasures']) {
             checks.push(skip(id, 'Not checked: it needs a project.'));
         }
         return report(checks, null);
@@ -112,9 +131,12 @@ export async function runDoctor(ctx, dir) {
     const runtime = await runtimeCheck(ctx, rc, kindgi);
     checks.push(runtime.check);
     checks.push(runtime.check.status === 'pass' && runtime.url !== undefined && rc.token !== undefined
-        ? await providerCheck(ctx, runtime.url, rc.token, kindgi, seam)
+        ? await providerCheck(ctx, runtime.url, rc.token, kindgi, seam, dir)
         : skip('provider', `Not checked: it needs the runtime running (${kindgi('dev')}).`));
-    return report(checks, { dir, language });
+    checks.push(runtime.check.status === 'pass' && runtime.url !== undefined
+        ? await erasuresCheck(ctx, runtime.url)
+        : skip('erasures', `Not checked: it needs the runtime running (${kindgi('dev')}).`));
+    return report(checks, { dir, language }, runtime.consoleUrl);
 }
 /** The report as ✓/✗ lines, each failure with its fix. */
 export function doctorText(report) {
@@ -122,6 +144,8 @@ export function doctorText(report) {
     for (const check of report.checks) {
         const mark = MARKS[check.status];
         lines.push(`  ${mark} ${TITLES[check.id]}: ${check.message}`);
+        for (const detail of check.details ?? [])
+            lines.push(`      ✗ ${detail}`);
         if (check.fix !== undefined && check.status !== 'pass')
             lines.push(`      Fix: ${check.fix}`);
     }
@@ -141,11 +165,12 @@ const MARKS = {
     fail: '✗',
     skip: '–',
 };
-function report(checks, project) {
+function report(checks, project, consoleUrl) {
     return {
         ok: checks.every((c) => c.status !== 'fail'),
         cliVersion: CLI_VERSION,
         project,
+        ...(consoleUrl !== undefined && { consoleUrl }),
         checks,
     };
 }
@@ -182,7 +207,7 @@ async function nodeChecks(version, tool, pypi) {
 function createProjectFix(kindgi, pypi) {
     return pypi
         ? `Create one: ${kindgi('init', '<name>', '--template=python')}, then run doctor in its folder.`
-        : `Create one: ${kindgi('init', '<name>')} (TypeScript; add --template=python for Python), then run doctor in its folder.`;
+        : `Create one: ${kindgi('init', '<name>')} (TypeScript; add --template=python for Python, --template=java for Java), then run doctor in its folder.`;
 }
 function nodeCheck(version, pypi) {
     return atLeast(version, MIN_NODE)
@@ -208,7 +233,7 @@ async function pythonChecks(tool, language) {
     const pythonFix = `Install Python ${MIN_PYTHON.replace(/\.0$/, '')} or later (https://www.python.org/downloads, or: uv python install 3.12).`;
     const uvFix = 'Install uv: curl -LsSf https://astral.sh/uv/install.sh | sh (or: brew install uv).';
     if (language !== 'python') {
-        const why = language === 'node' ? 'a TypeScript project' : 'no project yet';
+        const why = projectKind(language);
         return [
             skip('python', `Not needed (${why}); ${python !== undefined ? `Python ${python} is installed` : "Python isn't installed"}, for a Python project (kindgi init --template=python).`),
             skip('uv', `Not needed (${why}); ${uvVersion !== undefined ? `uv ${uvVersion} is installed` : "uv isn't installed"}, for a Python project.`),
@@ -225,6 +250,95 @@ async function pythonChecks(tool, language) {
             : fail('uv', "uv isn't installed: a Kindgi Python project installs and runs with it.", uvFix),
     ];
 }
+/** Why a language's tools aren't needed: the project's kind, or no project. */
+function projectKind(language) {
+    return language === 'node'
+        ? 'a TypeScript project'
+        : language === 'python'
+            ? 'a Python project'
+            : language === 'java'
+                ? 'a Java project'
+                : language === 'scala'
+                    ? 'a Scala project'
+                    : 'no project yet';
+}
+/** A `kindgi.config.json`'s language: `scala` when it says so, else `java`. */
+async function jvmLanguageOf(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf8')).language === 'scala'
+            ? 'scala'
+            : 'java';
+    }
+    catch {
+        return 'java';
+    }
+}
+/**
+ * A JDK 17+, and Maven or sbt: needed by a Java project (the JDK, Maven) or a
+ * Scala one (the JDK, sbt); elsewhere, what's installed (for choosing a
+ * template). The JDK is `JAVA_HOME`'s, else the `java` on PATH, as `kindgi
+ * dev` finds it; Maven is the project's wrapper (`mvnw`), else `mvn`; sbt is
+ * the `sbt` on PATH.
+ */
+async function jvmChecks(tool, language, dir, env) {
+    return [
+        await jdkCheck(tool, language, env),
+        await mavenCheck(tool, language, dir),
+        await sbtCheck(tool, language),
+    ];
+}
+async function jdkCheck(tool, language, env) {
+    const home = env.JAVA_HOME !== undefined && env.JAVA_HOME !== '' ? env.JAVA_HOME : undefined;
+    const got = await tool(home === undefined ? 'java' : join(home, 'bin', 'java'), ['-version']);
+    const version = got.code === null ? undefined : /version "([^"]+)"/.exec(`${got.stderr}\n${got.stdout}`)?.[1];
+    if (language !== 'java' && language !== 'scala')
+        return jdkNotNeeded(language, version);
+    const javaFix = `Install a JDK ${MIN_JAVA} or later (e.g. Eclipse Temurin, https://adoptium.net) and set JAVA_HOME to it.`;
+    const where = home === undefined ? 'the java on your PATH' : `JAVA_HOME, ${home}`;
+    if (version === undefined)
+        return fail('java', `No JDK: ${where} doesn't run.`, javaFix);
+    const name = language === 'java' ? 'Java' : 'Scala';
+    return (javaMajor(version) ?? 0) >= MIN_JAVA
+        ? pass('java', `Java ${version} (${where}).`)
+        : fail('java', `Java ${version} (${where}); a Kindgi ${name} project needs ${MIN_JAVA} or later.`, javaFix);
+}
+/** The JDK outside a JVM project: what's installed, for choosing a template. */
+function jdkNotNeeded(language, version) {
+    const installed = version !== undefined ? `Java ${version} is installed` : "Java isn't installed";
+    return skip('java', `Not needed (${projectKind(language)}); ${installed}, for a Java or Scala project (kindgi init --template=java or scala).`);
+}
+async function mavenCheck(tool, language, dir) {
+    const wrapper = await isFile(join(dir, 'mvnw'));
+    const mvn = wrapper ? undefined : await tool('mvn', ['--version']);
+    const mvnVersion = mvn?.code === 0 ? /Apache Maven (\S+)/.exec(mvn.stdout)?.[1] : undefined;
+    if (language !== 'java') {
+        return skip('maven', `Not needed (${projectKind(language)}); ${mvnVersion !== undefined ? `Maven ${mvnVersion} is installed` : "Maven isn't installed"}, for a Java project.`);
+    }
+    if (wrapper)
+        return pass('maven', 'The project has the Maven wrapper (mvnw).');
+    return mvnVersion !== undefined
+        ? pass('maven', `Maven ${mvnVersion}.`)
+        : fail('maven', "Maven isn't installed, and the project has no Maven wrapper (mvnw).", 'Add the Maven wrapper to the project (mvn wrapper:wrapper), or install Maven 3.9 or later (https://maven.apache.org/install.html).');
+}
+async function sbtCheck(tool, language) {
+    // `--script-version` answers from the launcher script, without starting a JVM.
+    const got = await tool('sbt', ['--script-version']);
+    const version = got.code === 0 ? /(\d+\.\d+\.\d+\S*)/.exec(got.stdout)?.[1] : undefined;
+    if (language !== 'scala') {
+        return skip('sbt', `Not needed (${projectKind(language)}); ${version !== undefined ? `sbt ${version} is installed` : "sbt isn't installed"}, for a Scala project.`);
+    }
+    return version !== undefined
+        ? pass('sbt', `sbt ${version} (the launcher; the project's own sbt is project/build.properties').`)
+        : fail('sbt', "sbt isn't installed: a Kindgi Scala project builds with it.", 'Install sbt 1.10 or later (https://www.scala-sbt.org/download).');
+}
+async function isFile(path) {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
 async function pythonVersion(tool) {
     for (const command of ['python3', 'python']) {
         const got = await tool(command, ['--version']);
@@ -245,7 +359,7 @@ async function checkDockerRunning(run) {
 async function registryCheck(run, image, kindgi) {
     const access = await checkImageAccess(run, image);
     const host = registryOf(image);
-    const login = `${kindgi('auth', 'registry', '--username', '<robot name>', '--password-stdin')} (the robot name and token come from access.kindgi.com; pipe the token in, never paste it into a chat)`;
+    const login = `${kindgi('auth', 'registry', '--username', '<robot name>', '--password-stdin')} (request the robot name and token at contact@kindgi.com; pipe the token in, never paste it into a chat)`;
     switch (access.kind) {
         case 'ok':
             return pass('registry', `Docker can pull the runtime image (${image}).`);
@@ -285,13 +399,53 @@ async function readKindgirc(dir) {
 function projectCheck(dir, language, rc) {
     const kind = language === 'python'
         ? 'A Python project (pyproject.toml)'
-        : 'A TypeScript project (kindgi.config.ts)';
+        : language === 'java'
+            ? 'A Java project (kindgi.config.json)'
+            : language === 'scala'
+                ? 'A Scala project (kindgi.config.json)'
+                : 'A TypeScript project (kindgi.config.ts)';
     if (rc.malformed !== undefined) {
         return fail('project', `${kind} in ${dir}, but its .kindgirc.json isn't valid JSON (${rc.malformed}).`, 'Delete .kindgirc.json: kindgi dev writes a new one on its next start.');
     }
     return pass('project', `${kind} in ${dir}; ${rc.exists ? 'kindgi dev has run here (.kindgirc.json)' : "kindgi dev hasn't run here yet"}.`);
 }
+/**
+ * A Scala project's build declares kindgi-pack-scala: in `build.sbt`, or a
+ * `project/*.scala` file it reads its dependencies from.
+ */
+async function scalaDependenciesCheck(dir) {
+    let build;
+    try {
+        build = await readFile(join(dir, 'build.sbt'), 'utf8');
+    }
+    catch {
+        return fail('dependencies', 'No build.sbt: a Kindgi Scala project builds with sbt.', 'Create one with the kindgi-pack-scala dependency (kindgi init --template=scala writes one).');
+    }
+    const projectDir = join(dir, 'project');
+    const projectFiles = await readdir(projectDir).catch(() => []);
+    const sources = [build];
+    for (const name of projectFiles.filter((f) => f.endsWith('.scala'))) {
+        sources.push(await readFile(join(projectDir, name), 'utf8').catch(() => ''));
+    }
+    return sources.some((text) => /"com\.kindgi"\s*%%\s*"kindgi-pack-scala"/.test(text))
+        ? pass('dependencies', 'The build has "com.kindgi" %% "kindgi-pack-scala" (sbt downloads it on the first build).')
+        : fail('dependencies', 'The build doesn\'t have "com.kindgi" %% "kindgi-pack-scala".', 'Add "com.kindgi" %% "kindgi-pack-scala" % "<version>" to libraryDependencies in build.sbt.');
+}
 async function dependenciesCheck(dir, language, tool) {
+    if (language === 'java') {
+        let pom;
+        try {
+            pom = await readFile(join(dir, 'pom.xml'), 'utf8');
+        }
+        catch {
+            return fail('dependencies', 'No pom.xml: a Kindgi Java project builds with Maven.', 'Create one with the com.kindgi:kindgi-pack dependency (kindgi init --template=java writes one).');
+        }
+        return /<groupId>\s*com\.kindgi\s*<\/groupId>\s*<artifactId>\s*kindgi-pack\s*<\/artifactId>/.test(pom)
+            ? pass('dependencies', 'pom.xml has com.kindgi:kindgi-pack (Maven downloads it on the first build).')
+            : fail('dependencies', "pom.xml doesn't have com.kindgi:kindgi-pack.", 'Add the com.kindgi:kindgi-pack dependency to pom.xml.');
+    }
+    if (language === 'scala')
+        return scalaDependenciesCheck(dir);
     if (language === 'python') {
         return (await pythonPackageInstalled(dir))
             ? pass('dependencies', 'The kindgi package is installed in .venv.')
@@ -359,6 +513,32 @@ async function modelKeyCheck(dir, seam, hostEnv, kindgi) {
     const others = names.slice(1);
     return fail('model-key', `No model key in ${files} (looked for ${names.join(', ')})${inShell !== undefined ? `; ${inShell} is set in your shell, but kindgi dev reads keys from the project's env files` : ''}.`, `With kindgi dev running, set one LLM provider's key: ${kindgi('secrets', 'set', want, '--env=local', '--scope=tenant')}${others.length > 0 ? `, or the same with ${orList(others)}` : ''} (it prompts without echoing; or pipe it in with --from-stdin). Never paste a key into a chat.`);
 }
+// ---------- erasures ----------
+/**
+ * Whether the runtime can replay erasures after a backup restore: it
+ * needs the erasure ledger key, which `kindgi dev` doesn't set (fine for
+ * development), so this check never fails: it passes, or says why not.
+ */
+async function erasuresCheck(ctx, url) {
+    let said;
+    try {
+        const res = await ctx.fetch(`${url.replace(/\/+$/, '')}/ready`, {
+            method: 'GET',
+            signal: AbortSignal.timeout(5000),
+        });
+        said = (await res.json()).erasures;
+    }
+    catch {
+        said = undefined;
+    }
+    if (said === 'replayable') {
+        return pass('erasures', 'Erasures can be replayed after a backup restore: the runtime has the erasure ledger key.');
+    }
+    if (said === 'unreplayable') {
+        return skip('erasures', "Erasures run, but a replay after a backup restore can't find whom they erased: the runtime has no KINDGI_ERASURE_LEDGER_KEY. Fine for development; set it where you run in production.");
+    }
+    return skip('erasures', "Not checked: this runtime doesn't say (it's from before 0.1.5).");
+}
 // ---------- the runtime ----------
 async function runtimeCheck(ctx, rc, kindgi) {
     const start = `Start it: ${kindgi('dev')} (it keeps running; stop it with Ctrl+C).`;
@@ -371,8 +551,20 @@ async function runtimeCheck(ctx, rc, kindgi) {
     const url = `${rc.apiUrl.replace(/\/+$/, '')}/health`;
     try {
         const res = await ctx.fetch(url, { method: 'GET', signal: AbortSignal.timeout(5000) });
-        if (res.ok)
-            return { check: pass('runtime', `The runtime answers at ${rc.apiUrl}.`), url: rc.apiUrl };
+        if (res.ok) {
+            // Where to open it: the console, when the runtime serves one (T374).
+            const consoleProbe = await probeConsole(ctx.fetch, rc.apiUrl);
+            return consoleProbe.kind === 'served'
+                ? {
+                    check: pass('runtime', `The runtime answers at ${rc.apiUrl}; its console is at ${consoleProbe.url}.`),
+                    url: rc.apiUrl,
+                    consoleUrl: consoleProbe.url,
+                }
+                : {
+                    check: pass('runtime', `The runtime answers at ${rc.apiUrl}${consoleProbe.kind === 'not-served' ? ' (it serves no console)' : ''}.`),
+                    url: rc.apiUrl,
+                };
+        }
         return {
             check: fail('runtime', `Something answers at ${rc.apiUrl}, but not as a healthy Kindgi runtime (HTTP ${res.status}).`, `${restart}; if another program holds that port, kindgi dev picks a free one.`),
         };
@@ -388,7 +580,66 @@ async function runtimeCheck(ctx, rc, kindgi) {
         };
     }
 }
-async function providerCheck(ctx, apiUrl, token, kindgi, seam) {
+/**
+ * Whether anyone can sign in to the console of the runtime the CLI points
+ * at (`--url`, `KINDGI_API_URL`, `kindgi auth login`). Since 0.1.5,
+ * signing in with an API token is off by default outside `kindgi dev`: a
+ * deployment that relied on it, with no identity provider, has no way in.
+ */
+async function consoleSignInCheck(ctx) {
+    const apiUrl = ctx.config.apiUrl?.replace(/\/+$/, '');
+    if (apiUrl === undefined) {
+        return skip('console-sign-in', 'Not checked: no runtime to ask (set KINDGI_API_URL, or run kindgi auth login).');
+    }
+    const TOKEN_ON = 'Set KINDGI_CONSOLE_TOKEN_SIGN_IN=on on the runtime and restart it, to keep signing in to the console with an API token';
+    let methods;
+    try {
+        const res = await ctx.fetch(`${apiUrl}/v1/auth/sign-in-options`, {
+            method: 'GET',
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!res.ok) {
+            return skip('console-sign-in', `Not checked: the runtime at ${apiUrl} doesn't say how people sign in (older than 0.1.5).`);
+        }
+        methods = (await res.json()).methods;
+    }
+    catch {
+        return skip('console-sign-in', `Not checked: nothing answers at ${apiUrl}.`);
+    }
+    if (methods === undefined) {
+        return skip('console-sign-in', `Not checked: the runtime at ${apiUrl} doesn't say how people sign in (older than 0.1.5).`);
+    }
+    if (methods.apiToken === true) {
+        return pass('console-sign-in', methods.identityProviders === true
+            ? 'People can sign in to the console with an API token or an identity provider.'
+            : 'People can sign in to the console with an API token.');
+    }
+    if (methods.identityProviders !== true) {
+        return warn('console-sign-in', `Nobody can sign in to the console at ${apiUrl}: signing in with an API token is off (the default outside kindgi dev since 0.1.5), and no identity provider is set up.`, `${TOKEN_ON}; or set up sign-in with your identity provider (KINDGI_AUTH_SECRET_PATH, then kindgi sso providers start).`);
+    }
+    const token = ctx.config.token;
+    if (token === undefined) {
+        return pass('console-sign-in', 'People sign in to the console with an identity provider.');
+    }
+    try {
+        const res = await ctx.fetch(`${apiUrl}/v1/auth/providers`, {
+            method: 'GET',
+            headers: { authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (res.ok) {
+            const providers = (await res.json()).data ?? [];
+            if (providers.length === 0) {
+                return warn('console-sign-in', `Sign-in with an identity provider is on at ${apiUrl}, but none is registered, and signing in with an API token is off: nobody can sign in to the console.`, `Register one (kindgi sso providers start <id> --idp=google|entra|okta|keycloak); or ${TOKEN_ON.charAt(0).toLowerCase()}${TOKEN_ON.slice(1)}.`);
+            }
+        }
+    }
+    catch {
+        // The providers couldn't be listed: the sign-in options already said it's on.
+    }
+    return pass('console-sign-in', 'People sign in to the console with an identity provider.');
+}
+async function providerCheck(ctx, apiUrl, token, kindgi, seam, dir) {
     try {
         const page = await ctx.clientFor(apiUrl, token).providers.list();
         const listed = page.data;
@@ -400,10 +651,34 @@ async function providerCheck(ctx, apiUrl, token, kindgi, seam) {
             : `Register one: ${kindgi('providers', 'register', `--preset=${presets[0] ?? 'anthropic'}`)} (its key must be set first; see Model key).`;
         if (models.length > 0) {
             const registered = `${models.length === 1 ? 'A provider is' : `${models.length} providers are`} registered: ${models.join(', ')}.`;
-            const stale = staleDefaults(listed, await (seam.presets ?? (() => loadProviderPresets()))(), kindgi);
-            return stale.length === 0
+            const allPresets = await (seam.presets ?? (() => loadProviderPresets()))();
+            const stale = staleDefaults(listed, allPresets, kindgi);
+            const google = await vertexCredentials(ids, dir, ctx.env);
+            const notes = [...stale, ...(google === undefined ? [] : [google])];
+            const broken = await configIssues(ctx.clientFor(apiUrl, token), models);
+            if (broken !== undefined && broken.size > 0) {
+                const details = [...broken].flatMap(([id, issues]) => issues.map((i) => `${id}: ${i.path}: ${i.message}`));
+                const fix = [...broken.keys()]
+                    .map((id) => reRegister(id, presetFor(id, allPresets), kindgi))
+                    .join(' ');
+                const names = [...broken.keys()].join(', ');
+                if (broken.size === models.length) {
+                    return {
+                        ...fail('provider', `No usable provider: the runtime can't build ${broken.size === 1 ? names : `any of ${names}`} from ${broken.size === 1 ? 'its' : 'their'} registration, so an agent has no model to call.`, fix),
+                        details,
+                    };
+                }
+                return {
+                    ...warn('provider', [
+                        `${registered} The runtime can't build ${names} from ${broken.size === 1 ? 'its' : 'their'} registration, so agents only get the others.`,
+                        ...notes.map((s) => s.message),
+                    ].join(' '), [fix, ...notes.map((s) => s.fix)].join(' ')),
+                    details,
+                };
+            }
+            return notes.length === 0
                 ? pass('provider', registered)
-                : warn('provider', [registered, ...stale.map((s) => s.message)].join(' '), stale.map((s) => s.fix).join(' '));
+                : warn('provider', [registered, ...notes.map((s) => s.message)].join(' '), notes.map((s) => s.fix).join(' '));
         }
         return ids.length > 0
             ? fail('provider', `Only ${DEV_ECHO_PROVIDER_ID} is registered: agents get its canned replies, not a model's.`, register)
@@ -413,6 +688,28 @@ async function providerCheck(ctx, apiUrl, token, kindgi, seam) {
         return fail('provider', `Couldn't list the providers: ${err.message}`, 'Run doctor again once kindgi dev has finished starting; if it persists, restart kindgi dev.');
     }
 }
+/** A registered provider as `providers.list` answers it; a runtime before 0.1.4 sends no `defaultModel`. */
+/**
+ * A Vertex provider (the `gemini` preset) with no Google credentials in
+ * `kindgi dev`: `KINDGI_DEV_GOOGLE_CREDENTIALS` unset, `off`, or not
+ * usable. `undefined` when there's no Vertex provider, or it has them.
+ */
+async function vertexCredentials(ids, dir, hostEnv) {
+    const vertex = ids.filter((id) => id === VERTEX_PROVIDER_ID);
+    if (vertex.length === 0)
+        return undefined;
+    const env = await readPackEnv({ packDir: dir, envName: LOCAL_ENV_NAME });
+    const setting = hostEnv[DEV_GOOGLE_CREDENTIALS_VAR] ?? env.values[DEV_GOOGLE_CREDENTIALS_VAR];
+    const resolved = resolveDevGoogleCredentials(setting, hostEnv);
+    if (resolved.kind === 'ok' && resolved.credentials !== undefined)
+        return undefined;
+    return resolved.kind === 'error'
+        ? { message: resolved.message, fix: vertexCredentialsHint(vertex, hostEnv) }
+        : {
+            message: `${vertex.join(', ')} is Vertex AI, and kindgi dev gives the runtime no Google credentials (${DEV_GOOGLE_CREDENTIALS_VAR} is ${setting === undefined || setting.trim() === '' ? 'unset' : 'off'}).`,
+            fix: vertexCredentialsHint(vertex, hostEnv),
+        };
+}
 /**
  * Registrations made from a preset (the preset's provider id) whose
  * agents that name no model land where the preset no longer would send
@@ -435,7 +732,7 @@ function staleDefaults(listed, presets, kindgi) {
             return [
                 {
                     message: `On ${p.id}, an agent that names no model gets ${lands}, which the ${preset.name} preset no longer lists.`,
-                    fix: `Re-register ${p.id} for the preset's current models: ${register}. Or name a model on your agents (preferredModel).`,
+                    fix: `${reRegisterSteps(p.id, register, kindgi)} Or name a model on your agents (preferredModel).`,
                 },
             ];
         }
@@ -447,13 +744,51 @@ function staleDefaults(listed, presets, kindgi) {
             return [
                 {
                     message: `On ${p.id}, an agent that names no model gets ${lands}, the first by name: ${p.id} has no default model, and the ${preset.name} preset's is ${wanted}.`,
-                    fix: `Re-register ${p.id}: ${register}. A runtime older than 0.1.4 doesn't keep a default model: there, name a model on your agents (preferredModel).`,
+                    fix: `${reRegisterSteps(p.id, register, kindgi)} A runtime older than 0.1.4 doesn't keep a default model: there, name a model on your agents (preferredModel).`,
                 },
             ];
         }
         return [];
     });
 }
+/**
+ * Each provider's configuration problems by its adapter's own static check
+ * (`GET /v1/providers/{id}/check`, T362): only the providers with any.
+ * `undefined` when the runtime has no such route (older than 0.1.5): the
+ * check is skipped. A provider the check can't read (gone meanwhile) is
+ * left out.
+ */
+async function configIssues(client, ids) {
+    const out = new Map();
+    for (const id of ids) {
+        try {
+            const result = await client.providers.check(id);
+            if (result.issues.length > 0)
+                out.set(id, result.issues);
+        }
+        catch (err) {
+            const wire = extractKindgiError(err);
+            if (wire?.code === 'not-found' && wire.serverCode === 'route-not-found')
+                return undefined;
+        }
+    }
+    return out;
+}
+/** The preset a provider id was registered from, if one has that id. */
+function presetFor(id, presets) {
+    return Object.values(presets).find((p) => p.metadata.id === id);
+}
+/** How to fix a registration: unregister it, then register it again with the setting fixed. */
+function reRegister(id, preset, kindgi) {
+    const register = preset !== undefined
+        ? kindgi('providers', 'register', `--preset=${preset.name}`, ...(preset.adapterConfig ?? []).map((s) => `--${s.key}=<${s.key}>`))
+        : kindgi('providers', 'register', '--spec=@<file>');
+    return `${reRegisterSteps(id, register, kindgi)}${preset === undefined ? ' (its spec with the setting fixed)' : ''}`;
+}
+/** A provider's id is taken while it's registered: unregister it first. */
+function reRegisterSteps(id, register, kindgi) {
+    return `Unregister ${id} (${kindgi('providers', 'unregister', id)}), then register it again: ${register}.`;
+}
 /**
  * In a TypeScript project, its own CLI (`pnpm exec kindgi …`,
  * `npx --no kindgi …`); in a Python project or outside one, the
@@ -461,8 +796,9 @@ function staleDefaults(listed, presets, kindgi) {
  */
 async function kindgiCommand(dir, language, pypi, tool) {
     if (pypi) {
-        // The PyPI build runs from the project's own environment; outside one, uvx.
-        if (language === undefined) {
+        // The PyPI build runs from the project's own environment; outside one (or in a
+        // Java or Scala project, which has none), uvx.
+        if (language === undefined || language === 'java' || language === 'scala') {
             return (...args) => ['uvx', '--from', 'kindgi-cli', 'kindgi', ...args].join(' ');
         }
         const runner = await pythonBinRunner(dir, { KINDGI_CLI_INSTALL: 'pypi' });