crewhaus 0.1.3

package/README.md

@@ -0,0 +1,84 @@
+# crewhaus
+
+The [factory](https://github.com/crewhaus/factory) command line: compile, run, eval, and deploy agent harness specs (`crewhaus.yaml`).
+
+CrewHaus compiles one spec into the shape each situation calls for — a CLI agent, channel bot, RAG pipeline, multi-agent crew, eval bundle, and more. Every factory workflow starts with a `crewhaus` subcommand.
+
+> This is the bare, unscoped `crewhaus` package. (The earlier `@crewhaus/cli` name is deprecated and points here; the supporting libraries remain scoped under `@crewhaus/*`.)
+
+## Install
+
+The fastest path is the self-contained binary — one file, no Bun/Node required:
+
+```bash
+brew install crewhaus/tap/crewhaus          # macOS / Linux (Homebrew)
+scoop install crewhaus                       # Windows (Scoop; see repo for the bucket)
+winget install CrewHaus.CLI                   # Windows (winget)
+# Debian / Ubuntu (apt): signed repo at https://crewhaus.github.io/apt
+```
+
+Or install from npm — this package runs on [Bun](https://bun.sh) ≥ 1.2:
+
+```bash
+npm install -g crewhaus        # global
+bun add -d crewhaus            # project-local dev dependency
+```
+
+Confirm it:
+
+```bash
+crewhaus --version
+```
+
+## Quickstart
+
+```bash
+# Scaffold a starter spec
+crewhaus init my-agent
+cd my-agent
+
+# Inspect the lowered IR — a quick sanity check of what the compiler sees
+crewhaus compile crewhaus.yaml --emit-ir
+
+# Set a provider credential (the starter spec uses an Anthropic model;
+# --model accepts other providers, e.g. openai/<m>, gemini/<m>, local/<m>@<url>)
+export ANTHROPIC_API_KEY=sk-ant-...
+
+# Compile in-memory and run the agent
+crewhaus run crewhaus.yaml
+```
+
+To emit a runnable bundle on disk instead, use `crewhaus compile crewhaus.yaml -o build`.
+
+## Subcommands
+
+Run `crewhaus` with no arguments for the full usage text, or any subcommand with `--help` for its flags.
+
+| Subcommand | What it does |
+|---|---|
+| `compile <spec.yaml> -o <out-dir>` | Compile a spec to a runnable bundle; `--emit-ir` prints the lowered IR as JSON instead |
+| `run <spec.yaml>` | Compile in-memory and execute the agent (`--model`, `--resume <id>` / `--continue`, `--prompt <text>`, …) |
+| `eval <spec.yaml> --dataset <data> --graders <graders.yaml>` | Run the agent against a dataset and grade (deterministic graders + LLM-as-judge) |
+| `eval-report diff <prev> <new>` | Compare two eval runs and emit a diff report |
+| `optimize <spec.yaml> --dataset <data> --graders <graders.yaml>` | Active eval-driven optimization; `--write-back` rewrites the spec in place |
+| `init [name]` | Scaffold a new `crewhaus.yaml` |
+| `doctor` | Check environment health |
+| `context --bundle` | Emit a single-markdown orientation manifest |
+| `cost-summary --session <id>` | Summarize cost-accrual events for a session |
+| `secrets doctor` / `secrets rotate <name>` | List or rotate secrets via the configured backend |
+| `spec put\|list\|get\|pin\|alias …` | Versioned spec storage |
+| `deploy promote\|rollback …` | Re-pin a spec for an environment |
+| `migrate-all --from N --to N` | Batch-migrate every spec in the registry |
+| `build-image <target> --tag <tag>` | Build the docker image for a target shape |
+| `cloud deploy` / `cloud teardown` | Deploy or tear down a managed CrewHaus cluster |
+| `federation discover <deployment>` | Resolve a federated peer's endpoint and cert fingerprint |
+| `sandbox doctor` | List registered sandbox images and healthcheck status |
+| `compliance evidence` | Collect SOC 2 / ISO 27001 / HIPAA evidence |
+| `version` | Print the CLI version (also `--version`, `-v`) |
+
+## Docs
+
+- [Documentation](https://crewhaus.ai/docs) — start with the [quickstart](https://crewhaus.ai/docs/quickstart) and the [CLI target guide](https://crewhaus.ai/docs/targets/cli)
+- [factory repository](https://github.com/crewhaus/factory) — architecture, contributing, and the full target-shape table
+
+Apache-2.0.

package/package.json

@@ -0,0 +1,117 @@
+{
+  "name": "crewhaus",
+  "version": "0.1.3",
+  "type": "module",
+  "description": "CrewHaus — the meta-harness compiler for AI agents. Compile one crewhaus.yaml spec into a CLI agent, channel bot, RAG pipeline, multi-agent crew, eval harness, voice or browser agent, and more.",
+  "keywords": [
+    "crewhaus",
+    "ai",
+    "agent",
+    "agents",
+    "llm",
+    "compiler",
+    "meta-harness",
+    "cli",
+    "claude",
+    "anthropic",
+    "rag",
+    "eval"
+  ],
+  "main": "src/index.ts",
+  "bin": {
+    "crewhaus": "src/index.ts"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "scripts": {
+    "test": "bun test src"
+  },
+  "dependencies": {
+    "@crewhaus/adapter-anthropic": "0.1.3",
+    "@crewhaus/agent-context-isolation": "0.1.3",
+    "@crewhaus/audit-log": "0.1.3",
+    "@crewhaus/eval-optimizer-orchestrator": "0.1.3",
+    "@crewhaus/prompt-optimizer": "0.1.3",
+    "@crewhaus/prompt-optimizer-claude": "0.1.3",
+    "@crewhaus/justification-judge-claude": "0.1.3",
+    "@crewhaus/spec-patch": "0.1.3",
+    "@crewhaus/canary-controller": "0.1.3",
+    "@crewhaus/compiler": "0.1.3",
+    "@crewhaus/computer-use-driver": "0.1.3",
+    "@crewhaus/context-bundle": "0.1.3",
+    "@crewhaus/deployment-controller": "0.1.3",
+    "@crewhaus/egress-classifier": "0.1.3",
+    "@crewhaus/egress-matcher-semantic": "0.1.3",
+    "@crewhaus/embedder": "0.1.3",
+    "@crewhaus/errors": "0.1.3",
+    "@crewhaus/eval-dataset": "0.1.3",
+    "@crewhaus/eval-grader": "0.1.3",
+    "@crewhaus/eval-report": "0.1.3",
+    "@crewhaus/eval-runner": "0.1.3",
+    "@crewhaus/hooks-engine": "0.1.3",
+    "@crewhaus/infra-utils": "0.1.3",
+    "@crewhaus/ir": "0.1.3",
+    "@crewhaus/logging": "0.1.3",
+    "@crewhaus/mcp-host": "0.1.3",
+    "@crewhaus/model-router": "0.1.3",
+    "@crewhaus/migration-engine": "0.1.3",
+    "@crewhaus/migration-runner": "0.1.3",
+    "@crewhaus/permission-engine": "0.1.3",
+    "@crewhaus/run-context": "0.1.3",
+    "@crewhaus/runtime-core": "0.1.3",
+    "@crewhaus/secrets-manager": "0.1.3",
+    "@crewhaus/session-store": "0.1.3",
+    "@crewhaus/spec-registry": "0.1.3",
+    "@crewhaus/skills-registry": "0.1.3",
+    "@crewhaus/slash-commands": "0.1.3",
+    "@crewhaus/spec": "0.1.3",
+    "@crewhaus/sub-agent-spawner": "0.1.3",
+    "@crewhaus/trace-event-bus": "0.1.3",
+    "@crewhaus/tool-bash": "0.1.3",
+    "@crewhaus/tool-builder": "0.1.3",
+    "@crewhaus/tool-catalog": "0.1.3",
+    "@crewhaus/tool-codegraph": "0.1.3",
+    "@crewhaus/tool-fetch": "0.1.3",
+    "@crewhaus/tool-fs": "0.1.3",
+    "@crewhaus/tool-image": "0.1.3",
+    "@crewhaus/tool-image-generation": "0.1.3",
+    "@crewhaus/tool-document-ingest": "0.1.3",
+    "@crewhaus/tool-mcp": "0.1.3",
+    "@crewhaus/tool-mouse-keyboard": "0.1.3",
+    "@crewhaus/tool-navigate": "0.1.3",
+    "@crewhaus/tool-screen-capture": "0.1.3",
+    "@crewhaus/tool-task": "0.1.3",
+    "@crewhaus/tool-todo": "0.1.3",
+    "@crewhaus/tool-vision-grounding": "0.1.3",
+    "@crewhaus/tool-web": "0.1.3",
+    "@crewhaus/docker-images": "0.1.3",
+    "@crewhaus/crewhaus-cloud": "0.1.3",
+    "@crewhaus/federation-discovery": "0.1.3",
+    "@crewhaus/sandbox": "0.1.3",
+    "@crewhaus/sandbox-image-registry": "0.1.3",
+    "@crewhaus/compliance-controls": "0.1.3"
+  },
+  "devDependencies": {
+    "zod": "^3.23.8"
+  },
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Max Meier",
+    "email": "max@crewhaus.ai",
+    "url": "https://crewhaus.ai"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crewhaus/factory.git",
+    "directory": "apps/cli"
+  },
+  "homepage": "https://github.com/crewhaus/factory/tree/main/apps/cli#readme",
+  "bugs": {
+    "url": "https://github.com/crewhaus/factory/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": ["src", "README.md", "LICENSE", "NOTICE"]
+}

package/src/doctor-checks.test.ts

@@ -0,0 +1,122 @@
+import { describe, expect, test } from "bun:test";
+import { buildCredentialChecks, extractSpecModel, selectedProvider } from "./doctor-checks";
+
+const yamlFor = (model: string): string =>
+  `name: t\ntarget: cli\nagent:\n  model: ${model}\n  instructions: hi\n`;
+
+describe("extractSpecModel", () => {
+  test("extracts agent.model from a valid spec", () => {
+    expect(extractSpecModel(yamlFor("openai/gpt-4o-mini"))).toBe("openai/gpt-4o-mini");
+  });
+
+  test("returns undefined for an unparseable spec (doctor must not crash)", () => {
+    expect(extractSpecModel("name: t\ntarget: cli\n")).toBeUndefined();
+    expect(extractSpecModel(":::not yaml at all")).toBeUndefined();
+  });
+});
+
+describe("selectedProvider", () => {
+  test("maps the full router grammar to doctor providers", () => {
+    expect(selectedProvider("claude-sonnet-4-5")).toBe("anthropic");
+    expect(selectedProvider("openai/gpt-4o-mini")).toBe("openai");
+    expect(selectedProvider("gemini/gemini-2.5-flash")).toBe("gemini");
+    expect(selectedProvider("bedrock/us.anthropic.claude-sonnet-4-5-20250929-v1:0")).toBe(
+      "bedrock",
+    );
+    // local/<m>@<url> parses to openai WITH a baseUrl → credential-free.
+    expect(selectedProvider("local/llama3.2@http://localhost:11434/v1")).toBe("local");
+  });
+
+  test("returns undefined for unrecognised model strings", () => {
+    expect(selectedProvider("gpt-4o-mini")).toBeUndefined();
+  });
+});
+
+describe("buildCredentialChecks — model-aware", () => {
+  test("openai spec + OPENAI_API_KEY passes; missing Anthropic creds do NOT fail", () => {
+    const checks = buildCredentialChecks("openai/gpt-4o-mini", { OPENAI_API_KEY: "sk-x" });
+    const selected = checks[0];
+    expect(selected?.label).toContain("OpenAI credentials");
+    expect(selected?.pass).toBe(true);
+    expect(checks.every((c) => c.pass)).toBe(true);
+    expect(checks.some((c) => c.label.includes("Anthropic") && !c.pass)).toBe(false);
+  });
+
+  test("openai spec accepts OPENAI_BASE_URL as the credential surface", () => {
+    const checks = buildCredentialChecks("openai/gpt-4o-mini", {
+      OPENAI_BASE_URL: "http://vllm:8000/v1",
+    });
+    expect(checks[0]?.pass).toBe(true);
+  });
+
+  test("openai spec without provider env FAILS the selected check", () => {
+    const checks = buildCredentialChecks("openai/gpt-4o-mini", {});
+    expect(checks[0]?.pass).toBe(false);
+    expect(checks[0]?.reason).toContain("OPENAI_API_KEY");
+  });
+
+  test("gemini spec: GEMINI_API_KEY, GOOGLE_API_KEY, or Vertex env all satisfy", () => {
+    expect(buildCredentialChecks("gemini/gemini-2.5-flash", { GEMINI_API_KEY: "g" })[0]?.pass).toBe(
+      true,
+    );
+    expect(buildCredentialChecks("gemini/gemini-2.5-flash", { GOOGLE_API_KEY: "g" })[0]?.pass).toBe(
+      true,
+    );
+    expect(
+      buildCredentialChecks("gemini/gemini-2.5-flash", {
+        GOOGLE_GENAI_USE_VERTEXAI: "1",
+        GOOGLE_CLOUD_PROJECT: "p",
+      })[0]?.pass,
+    ).toBe(true);
+    const missing = buildCredentialChecks("gemini/gemini-2.5-flash", {});
+    expect(missing[0]?.pass).toBe(false);
+  });
+
+  test("bedrock spec is INFORMATIONAL — never fails even with no AWS env (SDK chain is authoritative)", () => {
+    const none = buildCredentialChecks("bedrock/us.anthropic.claude-sonnet-4-5-20250929-v1:0", {});
+    expect(none[0]?.pass).toBe(true);
+    expect(none[0]?.warn).toBe(true);
+    expect(none[0]?.reason).toContain("SDK default credential chain");
+    const some = buildCredentialChecks("bedrock/anthropic.claude-sonnet-4-5-20250929-v1:0", {
+      AWS_PROFILE: "dev",
+    });
+    expect(some[0]?.pass).toBe(true);
+  });
+
+  test("local spec needs no credentials", () => {
+    const checks = buildCredentialChecks("local/llama3.2@http://localhost:11434/v1", {});
+    expect(checks[0]?.pass).toBe(true);
+    expect(checks[0]?.label).toContain("Local endpoint");
+  });
+
+  test("non-selected providers with env set surface as informational warn lines, not failures", () => {
+    const checks = buildCredentialChecks("openai/gpt-4o-mini", {
+      OPENAI_API_KEY: "sk-x",
+      ANTHROPIC_API_KEY: "sk-ant",
+    });
+    const anthropicLine = checks.find((c) => c.label.includes("Anthropic"));
+    expect(anthropicLine?.pass).toBe(true);
+    expect(anthropicLine?.warn).toBe(true);
+    expect(anthropicLine?.label).toContain("not required");
+  });
+});
+
+describe("buildCredentialChecks — no spec model (legacy fallback)", () => {
+  test("Anthropic creds present → plain pass (unchanged behaviour)", () => {
+    const checks = buildCredentialChecks(undefined, { ANTHROPIC_API_KEY: "sk-ant" });
+    expect(checks).toEqual([{ label: "Anthropic credentials", pass: true }]);
+  });
+
+  test("no creds at all → hard fail (unchanged behaviour)", () => {
+    const checks = buildCredentialChecks(undefined, {});
+    expect(checks[0]?.pass).toBe(false);
+    expect(checks[0]?.reason).toContain("ANTHROPIC_AUTH_TOKEN");
+  });
+
+  test("missing Anthropic creds downgrade to informational when another provider env is clearly set", () => {
+    const checks = buildCredentialChecks(undefined, { OPENAI_API_KEY: "sk-x" });
+    expect(checks[0]?.pass).toBe(true);
+    expect(checks[0]?.warn).toBe(true);
+    expect(checks[0]?.reason).toContain("OpenAI");
+  });
+});

package/src/doctor-checks.ts

@@ -0,0 +1,220 @@
+import { resolveAuth } from "@crewhaus/adapter-anthropic";
+import { parseModelString } from "@crewhaus/model-router";
+import { parseSpec } from "@crewhaus/spec";
+
+/**
+ * Model-aware credential checks for `crewhaus doctor`, factored out of the
+ * entry file `index.ts` (which runs a top-level argv switch and so cannot be
+ * imported by a test without executing the CLI). Side-effect-free and
+ * directly unit-testable, mirroring `scope-audit.ts` / `justification-gate.ts`.
+ *
+ * The old doctor checked ONLY Anthropic credentials and exited 1 when they
+ * were absent — for every spec, including openai/gemini/bedrock/local ones
+ * that never touch Anthropic. The fix: parse the cwd spec's `agent.model`
+ * with the model-router grammar and check the matching provider's env,
+ * reporting the others informationally instead of failing on them.
+ */
+
+/** Doctor-level provider id: the router's four providers plus "local"
+ *  (`local/<m>@<url>` parses to openai WITH a baseUrl — credential-free). */
+export type DoctorProviderId = "anthropic" | "openai" | "gemini" | "bedrock" | "local";
+
+export type DoctorCredentialCheck = {
+  readonly label: string;
+  readonly pass: boolean;
+  /** warn+pass renders as "~" — informational, never fails doctor. */
+  readonly warn?: boolean;
+  readonly reason?: string;
+};
+
+function isSet(env: NodeJS.ProcessEnv, name: string): boolean {
+  const v = env[name];
+  return typeof v === "string" && v !== "";
+}
+
+/**
+ * Tolerantly extract `agent.model` from a crewhaus.yaml text. Returns
+ * undefined when the spec doesn't parse or carries no agent.model (e.g.
+ * workflow shapes with per-step models) — the caller then falls back to
+ * the legacy Anthropic-first behaviour.
+ */
+export function extractSpecModel(yamlText: string): string | undefined {
+  try {
+    const spec = parseSpec(yamlText) as unknown as { agent?: { model?: unknown } };
+    const m = spec.agent?.model;
+    return typeof m === "string" && m.length > 0 ? m : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Map a model string to the doctor-level provider whose credentials the
+ * run will need. Returns undefined for unparseable strings.
+ */
+export function selectedProvider(model: string): DoctorProviderId | undefined {
+  try {
+    const parsed = parseModelString(model);
+    if (parsed.providerId === "openai" && parsed.baseUrl !== undefined) return "local";
+    return parsed.providerId;
+  } catch {
+    return undefined;
+  }
+}
+
+type EnvStatus = { readonly satisfied: boolean; readonly detail: string };
+
+function anthropicStatus(env: NodeJS.ProcessEnv): EnvStatus {
+  const auth = resolveAuth(env);
+  return auth.mode !== "none"
+    ? { satisfied: true, detail: `${auth.mode} credentials found` }
+    : {
+        satisfied: false,
+        detail: "set ANTHROPIC_AUTH_TOKEN (Claude subscription) or ANTHROPIC_API_KEY",
+      };
+}
+
+function openaiStatus(env: NodeJS.ProcessEnv): EnvStatus {
+  if (isSet(env, "OPENAI_API_KEY")) return { satisfied: true, detail: "OPENAI_API_KEY set" };
+  if (isSet(env, "OPENAI_BASE_URL")) {
+    return { satisfied: true, detail: "OPENAI_BASE_URL set (OpenAI-compatible endpoint)" };
+  }
+  return {
+    satisfied: false,
+    detail: "set OPENAI_API_KEY (or OPENAI_BASE_URL for an OpenAI-compatible endpoint)",
+  };
+}
+
+function geminiStatus(env: NodeJS.ProcessEnv): EnvStatus {
+  if (isSet(env, "GEMINI_API_KEY")) return { satisfied: true, detail: "GEMINI_API_KEY set" };
+  if (isSet(env, "GOOGLE_API_KEY")) return { satisfied: true, detail: "GOOGLE_API_KEY set" };
+  if (isSet(env, "GOOGLE_GENAI_USE_VERTEXAI") || isSet(env, "GOOGLE_CLOUD_PROJECT")) {
+    return {
+      satisfied: true,
+      detail: "Vertex AI env set (GOOGLE_GENAI_USE_VERTEXAI/GOOGLE_CLOUD_PROJECT)",
+    };
+  }
+  return {
+    satisfied: false,
+    detail:
+      "set GEMINI_API_KEY (or GOOGLE_API_KEY; Vertex users set GOOGLE_GENAI_USE_VERTEXAI + GOOGLE_CLOUD_PROJECT)",
+  };
+}
+
+const BEDROCK_ENV_NAMES = [
+  "AWS_BEARER_TOKEN_BEDROCK",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_PROFILE",
+  "AWS_REGION",
+] as const;
+
+function bedrockStatus(env: NodeJS.ProcessEnv): EnvStatus {
+  const found = BEDROCK_ENV_NAMES.filter((n) => isSet(env, n));
+  return found.length > 0
+    ? { satisfied: true, detail: `${found.join(", ")} set` }
+    : {
+        satisfied: false,
+        detail:
+          "no AWS env vars visible (AWS_BEARER_TOKEN_BEDROCK/AWS_ACCESS_KEY_ID/AWS_PROFILE/AWS_REGION) — the SDK default credential chain (IRSA, instance profile, ~/.aws) may still apply",
+      };
+}
+
+function statusFor(provider: DoctorProviderId, env: NodeJS.ProcessEnv): EnvStatus {
+  switch (provider) {
+    case "anthropic":
+      return anthropicStatus(env);
+    case "openai":
+      return openaiStatus(env);
+    case "gemini":
+      return geminiStatus(env);
+    case "bedrock":
+      return bedrockStatus(env);
+    case "local":
+      return {
+        satisfied: true,
+        detail: "local endpoint baked into the model string — no credentials needed",
+      };
+  }
+}
+
+const PROVIDER_LABEL: Record<DoctorProviderId, string> = {
+  anthropic: "Anthropic credentials",
+  openai: "OpenAI credentials",
+  gemini: "Gemini credentials",
+  bedrock: "Bedrock (AWS) credentials",
+  local: "Local endpoint",
+};
+
+/** Providers whose env check is INFORMATIONAL even when selected: the AWS
+ *  SDK's default credential chain is authoritative for bedrock (env vars are
+ *  only one of its sources), and local/ endpoints need no credentials. */
+const INFORMATIONAL_WHEN_SELECTED: ReadonlySet<DoctorProviderId> = new Set(["bedrock", "local"]);
+
+/** Non-selected providers whose env is set get an informational line so the
+ *  operator sees what else is configured. */
+const ALL_PROVIDERS: readonly DoctorProviderId[] = ["anthropic", "openai", "gemini", "bedrock"];
+
+/**
+ * Build the credential section of `crewhaus doctor`.
+ *
+ * With a parseable spec model: the matching provider gets a real pass/fail
+ * check (informational for bedrock/local), and any OTHER provider with env
+ * visibly set gets a "~" informational line. Without one (no spec file, or
+ * no agent.model): legacy Anthropic-first behaviour, EXCEPT that a missing
+ * Anthropic credential downgrades to informational when another provider's
+ * env is clearly set (the operator is plainly not on Anthropic).
+ */
+export function buildCredentialChecks(
+  specModel: string | undefined,
+  env: NodeJS.ProcessEnv,
+): DoctorCredentialCheck[] {
+  const provider = specModel !== undefined ? selectedProvider(specModel) : undefined;
+  const checks: DoctorCredentialCheck[] = [];
+
+  if (provider !== undefined && specModel !== undefined) {
+    const status = statusFor(provider, env);
+    const informational = INFORMATIONAL_WHEN_SELECTED.has(provider);
+    checks.push({
+      label: `${PROVIDER_LABEL[provider]} (model ${specModel})`,
+      pass: informational ? true : status.satisfied,
+      ...(informational && !status.satisfied ? { warn: true } : {}),
+      ...(status.satisfied && !informational ? {} : { reason: status.detail }),
+    });
+    for (const other of ALL_PROVIDERS) {
+      if (other === provider) continue;
+      const otherStatus = statusFor(other, env);
+      if (otherStatus.satisfied) {
+        checks.push({
+          label: `${PROVIDER_LABEL[other]} (not required for this spec)`,
+          pass: true,
+          warn: true,
+          reason: otherStatus.detail,
+        });
+      }
+    }
+    return checks;
+  }
+
+  // No spec model — legacy Anthropic-first behaviour with one softening:
+  // when Anthropic creds are absent but another provider's env is clearly
+  // set, report informationally instead of hard-failing.
+  const anthropic = anthropicStatus(env);
+  if (anthropic.satisfied) {
+    checks.push({ label: "Anthropic credentials", pass: true });
+    return checks;
+  }
+  const others = ALL_PROVIDERS.filter((p) => p !== "anthropic").filter(
+    (p) => statusFor(p, env).satisfied,
+  );
+  if (others.length > 0) {
+    checks.push({
+      label: "Anthropic credentials",
+      pass: true,
+      warn: true,
+      reason: `not set, but ${others.map((p) => PROVIDER_LABEL[p]).join(" + ")} detected — claude-* models will not run until ANTHROPIC_AUTH_TOKEN/ANTHROPIC_API_KEY is set`,
+    });
+    return checks;
+  }
+  checks.push({ label: "Anthropic credentials", pass: false, reason: anthropic.detail });
+  return checks;
+}