crewhaus 0.1.3 → 0.1.5

package/README.md

@@ -11,7 +11,7 @@ CrewHaus compiles one spec into the shape each situation calls for — a CLI age
 The fastest path is the self-contained binary — one file, no Bun/Node required:
 
 ```bash
-brew install crewhaus/tap/crewhaus          # macOS / Linux (Homebrew)
+brew tap crewhaus/tap && brew install crewhaus          # macOS / Linux (Homebrew)
 scoop install crewhaus                       # Windows (Scoop; see repo for the bucket)
 winget install CrewHaus.CLI                   # Windows (winget)
 # Debian / Ubuntu (apt): signed repo at https://crewhaus.github.io/apt

package/dist/doctor-checks.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Model-aware credential checks for `crewhaus doctor`, factored out of the
+ * entry file `index.ts` (which runs a top-level argv switch and so cannot be
+ * imported by a test without executing the CLI). Side-effect-free and
+ * directly unit-testable, mirroring `scope-audit.ts` / `justification-gate.ts`.
+ *
+ * The old doctor checked ONLY Anthropic credentials and exited 1 when they
+ * were absent — for every spec, including openai/gemini/bedrock/local ones
+ * that never touch Anthropic. The fix: parse the cwd spec's `agent.model`
+ * with the model-router grammar and check the matching provider's env,
+ * reporting the others informationally instead of failing on them.
+ */
+/** Doctor-level provider id: the router's four providers plus "local"
+ *  (`local/<m>@<url>` parses to openai WITH a baseUrl — credential-free). */
+export type DoctorProviderId = "anthropic" | "openai" | "gemini" | "bedrock" | "local";
+export type DoctorCredentialCheck = {
+    readonly label: string;
+    readonly pass: boolean;
+    /** warn+pass renders as "~" — informational, never fails doctor. */
+    readonly warn?: boolean;
+    readonly reason?: string;
+};
+/**
+ * Tolerantly extract `agent.model` from a crewhaus.yaml text. Returns
+ * undefined when the spec doesn't parse or carries no agent.model (e.g.
+ * workflow shapes with per-step models) — the caller then falls back to
+ * the legacy Anthropic-first behaviour.
+ */
+export declare function extractSpecModel(yamlText: string): string | undefined;
+/**
+ * Map a model string to the doctor-level provider whose credentials the
+ * run will need. Returns undefined for unparseable strings.
+ */
+export declare function selectedProvider(model: string): DoctorProviderId | undefined;
+/**
+ * Build the credential section of `crewhaus doctor`.
+ *
+ * With a parseable spec model: the matching provider gets a real pass/fail
+ * check (informational for bedrock/local), and any OTHER provider with env
+ * visibly set gets a "~" informational line. Without one (no spec file, or
+ * no agent.model): legacy Anthropic-first behaviour, EXCEPT that a missing
+ * Anthropic credential downgrades to informational when another provider's
+ * env is clearly set (the operator is plainly not on Anthropic).
+ */
+export declare function buildCredentialChecks(specModel: string | undefined, env: NodeJS.ProcessEnv): DoctorCredentialCheck[];

package/dist/doctor-checks.js

@@ -0,0 +1,178 @@
+import { resolveAuth } from "@crewhaus/adapter-anthropic";
+import { parseModelString } from "@crewhaus/model-router";
+import { parseSpec } from "@crewhaus/spec";
+function isSet(env, name) {
+    const v = env[name];
+    return typeof v === "string" && v !== "";
+}
+/**
+ * Tolerantly extract `agent.model` from a crewhaus.yaml text. Returns
+ * undefined when the spec doesn't parse or carries no agent.model (e.g.
+ * workflow shapes with per-step models) — the caller then falls back to
+ * the legacy Anthropic-first behaviour.
+ */
+export function extractSpecModel(yamlText) {
+    try {
+        const spec = parseSpec(yamlText);
+        const m = spec.agent?.model;
+        return typeof m === "string" && m.length > 0 ? m : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Map a model string to the doctor-level provider whose credentials the
+ * run will need. Returns undefined for unparseable strings.
+ */
+export function selectedProvider(model) {
+    try {
+        const parsed = parseModelString(model);
+        if (parsed.providerId === "openai" && parsed.baseUrl !== undefined)
+            return "local";
+        return parsed.providerId;
+    }
+    catch {
+        return undefined;
+    }
+}
+function anthropicStatus(env) {
+    const auth = resolveAuth(env);
+    return auth.mode !== "none"
+        ? { satisfied: true, detail: `${auth.mode} credentials found` }
+        : {
+            satisfied: false,
+            detail: "set ANTHROPIC_AUTH_TOKEN (Claude subscription) or ANTHROPIC_API_KEY",
+        };
+}
+function openaiStatus(env) {
+    if (isSet(env, "OPENAI_API_KEY"))
+        return { satisfied: true, detail: "OPENAI_API_KEY set" };
+    if (isSet(env, "OPENAI_BASE_URL")) {
+        return { satisfied: true, detail: "OPENAI_BASE_URL set (OpenAI-compatible endpoint)" };
+    }
+    return {
+        satisfied: false,
+        detail: "set OPENAI_API_KEY (or OPENAI_BASE_URL for an OpenAI-compatible endpoint)",
+    };
+}
+function geminiStatus(env) {
+    if (isSet(env, "GEMINI_API_KEY"))
+        return { satisfied: true, detail: "GEMINI_API_KEY set" };
+    if (isSet(env, "GOOGLE_API_KEY"))
+        return { satisfied: true, detail: "GOOGLE_API_KEY set" };
+    if (isSet(env, "GOOGLE_GENAI_USE_VERTEXAI") || isSet(env, "GOOGLE_CLOUD_PROJECT")) {
+        return {
+            satisfied: true,
+            detail: "Vertex AI env set (GOOGLE_GENAI_USE_VERTEXAI/GOOGLE_CLOUD_PROJECT)",
+        };
+    }
+    return {
+        satisfied: false,
+        detail: "set GEMINI_API_KEY (or GOOGLE_API_KEY; Vertex users set GOOGLE_GENAI_USE_VERTEXAI + GOOGLE_CLOUD_PROJECT)",
+    };
+}
+const BEDROCK_ENV_NAMES = [
+    "AWS_BEARER_TOKEN_BEDROCK",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_PROFILE",
+    "AWS_REGION",
+];
+function bedrockStatus(env) {
+    const found = BEDROCK_ENV_NAMES.filter((n) => isSet(env, n));
+    return found.length > 0
+        ? { satisfied: true, detail: `${found.join(", ")} set` }
+        : {
+            satisfied: false,
+            detail: "no AWS env vars visible (AWS_BEARER_TOKEN_BEDROCK/AWS_ACCESS_KEY_ID/AWS_PROFILE/AWS_REGION) — the SDK default credential chain (IRSA, instance profile, ~/.aws) may still apply",
+        };
+}
+function statusFor(provider, env) {
+    switch (provider) {
+        case "anthropic":
+            return anthropicStatus(env);
+        case "openai":
+            return openaiStatus(env);
+        case "gemini":
+            return geminiStatus(env);
+        case "bedrock":
+            return bedrockStatus(env);
+        case "local":
+            return {
+                satisfied: true,
+                detail: "local endpoint baked into the model string — no credentials needed",
+            };
+    }
+}
+const PROVIDER_LABEL = {
+    anthropic: "Anthropic credentials",
+    openai: "OpenAI credentials",
+    gemini: "Gemini credentials",
+    bedrock: "Bedrock (AWS) credentials",
+    local: "Local endpoint",
+};
+/** Providers whose env check is INFORMATIONAL even when selected: the AWS
+ *  SDK's default credential chain is authoritative for bedrock (env vars are
+ *  only one of its sources), and local/ endpoints need no credentials. */
+const INFORMATIONAL_WHEN_SELECTED = new Set(["bedrock", "local"]);
+/** Non-selected providers whose env is set get an informational line so the
+ *  operator sees what else is configured. */
+const ALL_PROVIDERS = ["anthropic", "openai", "gemini", "bedrock"];
+/**
+ * Build the credential section of `crewhaus doctor`.
+ *
+ * With a parseable spec model: the matching provider gets a real pass/fail
+ * check (informational for bedrock/local), and any OTHER provider with env
+ * visibly set gets a "~" informational line. Without one (no spec file, or
+ * no agent.model): legacy Anthropic-first behaviour, EXCEPT that a missing
+ * Anthropic credential downgrades to informational when another provider's
+ * env is clearly set (the operator is plainly not on Anthropic).
+ */
+export function buildCredentialChecks(specModel, env) {
+    const provider = specModel !== undefined ? selectedProvider(specModel) : undefined;
+    const checks = [];
+    if (provider !== undefined && specModel !== undefined) {
+        const status = statusFor(provider, env);
+        const informational = INFORMATIONAL_WHEN_SELECTED.has(provider);
+        checks.push({
+            label: `${PROVIDER_LABEL[provider]} (model ${specModel})`,
+            pass: informational ? true : status.satisfied,
+            ...(informational && !status.satisfied ? { warn: true } : {}),
+            ...(status.satisfied && !informational ? {} : { reason: status.detail }),
+        });
+        for (const other of ALL_PROVIDERS) {
+            if (other === provider)
+                continue;
+            const otherStatus = statusFor(other, env);
+            if (otherStatus.satisfied) {
+                checks.push({
+                    label: `${PROVIDER_LABEL[other]} (not required for this spec)`,
+                    pass: true,
+                    warn: true,
+                    reason: otherStatus.detail,
+                });
+            }
+        }
+        return checks;
+    }
+    // No spec model — legacy Anthropic-first behaviour with one softening:
+    // when Anthropic creds are absent but another provider's env is clearly
+    // set, report informationally instead of hard-failing.
+    const anthropic = anthropicStatus(env);
+    if (anthropic.satisfied) {
+        checks.push({ label: "Anthropic credentials", pass: true });
+        return checks;
+    }
+    const others = ALL_PROVIDERS.filter((p) => p !== "anthropic").filter((p) => statusFor(p, env).satisfied);
+    if (others.length > 0) {
+        checks.push({
+            label: "Anthropic credentials",
+            pass: true,
+            warn: true,
+            reason: `not set, but ${others.map((p) => PROVIDER_LABEL[p]).join(" + ")} detected — claude-* models will not run until ANTHROPIC_AUTH_TOKEN/ANTHROPIC_API_KEY is set`,
+        });
+        return checks;
+    }
+    checks.push({ label: "Anthropic credentials", pass: false, reason: anthropic.detail });
+    return checks;
+}

package/{src/egress-matcher.ts → dist/egress-matcher.d.ts}

@@ -1,5 +1,4 @@
 import type { EgressMatcher } from "@crewhaus/egress-classifier";
-
 /**
  * FR-006 — Pillar 3 sink-side egress-matcher selection for `crewhaus run`,
  * factored out of the entry file `index.ts` (which runs a top-level argv
@@ -28,11 +27,7 @@ import type { EgressMatcher } from "@crewhaus/egress-classifier";
  * claude judge. The default path (`"substring"` / unset) returns `undefined`
  * and never touches the semantic package, so it pulls in no embedding code.
  */
-
 export type EgressMatcherChoice = "substring" | "semantic";
-
-const VALID_EGRESS_MATCHER_CHOICES: ReadonlyArray<EgressMatcherChoice> = ["substring", "semantic"];
-
 /**
  * Default embedder model for the semantic matcher when neither
  * `--egress-embedder` nor `CREWHAUS_EGRESS_EMBEDDER` is supplied. A real
@@ -40,24 +35,15 @@ const VALID_EGRESS_MATCHER_CHOICES: ReadonlyArray<EgressMatcherChoice> = ["subst
  * throws and `SemanticEgressMatcher` degrades to the substring tripwire
  * (its built-in safe fallback) rather than dropping the egress check.
  */
-export const DEFAULT_EGRESS_EMBEDDER_MODEL = "openai/text-embedding-3-small";
-
+export declare const DEFAULT_EGRESS_EMBEDDER_MODEL = "openai/text-embedding-3-small";
 /** Thrown by `resolveEgressMatcherChoice` on an unrecognised choice. The CLI
  *  entry file catches it and routes the message through `die()`; tests assert
  *  on `.choice` / `.message` without the process exiting. */
-export class InvalidEgressMatcherChoiceError extends Error {
-  override readonly name = "InvalidEgressMatcherChoiceError";
-  constructor(readonly choice: string) {
-    super(
-      `invalid --egress-matcher "${choice}" — allowed: ${VALID_EGRESS_MATCHER_CHOICES.join(", ")}`,
-    );
-  }
+export declare class InvalidEgressMatcherChoiceError extends Error {
+    readonly choice: string;
+    readonly name = "InvalidEgressMatcherChoiceError";
+    constructor(choice: string);
 }
-
-function isEgressMatcherChoice(s: string): s is EgressMatcherChoice {
-  return (VALID_EGRESS_MATCHER_CHOICES as ReadonlyArray<string>).includes(s);
-}
-
 /**
  * Pure resolution of the matcher choice from the flag value + the lowered IR
  * selector. `flagValue` is the raw `--egress-matcher` value (or undefined when
@@ -65,28 +51,19 @@ function isEgressMatcherChoice(s: string): s is EgressMatcherChoice {
  * Throws `InvalidEgressMatcherChoiceError` for any value outside the allowed
  * set so the caller can `die()` with a friendly message.
  */
-export function resolveEgressMatcherChoice(
-  flagValue: string | undefined,
-  irEgressMatcher: EgressMatcherChoice | undefined,
-): EgressMatcherChoice {
-  const raw = flagValue ?? irEgressMatcher ?? "substring";
-  if (!isEgressMatcherChoice(raw)) throw new InvalidEgressMatcherChoiceError(raw);
-  return raw;
-}
-
+export declare function resolveEgressMatcherChoice(flagValue: string | undefined, irEgressMatcher: EgressMatcherChoice | undefined): EgressMatcherChoice;
 export type CreateEgressMatcherOptions = {
-  /**
-   * Embedder model string for the `"semantic"` choice — the
-   * `@crewhaus/embedder` prefix grammar (`openai/…`, `voyage/…`, `mock/…`).
-   * Resolution precedence at the call site: `--egress-embedder` flag >
-   * `CREWHAUS_EGRESS_EMBEDDER` env > `DEFAULT_EGRESS_EMBEDDER_MODEL`. Tests
-   * pass `mock/…` for a deterministic, network-free embedder.
-   */
-  readonly embedderModel: string;
-  /** Optional cosine threshold passed through to `SemanticEgressMatcher`. */
-  readonly threshold?: number;
+    /**
+     * Embedder model string for the `"semantic"` choice — the
+     * `@crewhaus/embedder` prefix grammar (`openai/…`, `voyage/…`, `mock/…`).
+     * Resolution precedence at the call site: `--egress-embedder` flag >
+     * `CREWHAUS_EGRESS_EMBEDDER` env > `DEFAULT_EGRESS_EMBEDDER_MODEL`. Tests
+     * pass `mock/…` for a deterministic, network-free embedder.
+     */
+    readonly embedderModel: string;
+    /** Optional cosine threshold passed through to `SemanticEgressMatcher`. */
+    readonly threshold?: number;
 };
-
 /**
  * Build the `EgressMatcher` for a resolved choice. Returns `undefined` for
  * `"substring"` so the caller omits `egressMatcher` from `runChatLoop`
@@ -97,16 +74,4 @@ export type CreateEgressMatcherOptions = {
  * with the injected embedder, so the model-backed code only loads when
  * actually selected.
  */
-export async function createEgressMatcher(
-  choice: EgressMatcherChoice,
-  opts: CreateEgressMatcherOptions,
-): Promise<EgressMatcher | undefined> {
-  if (choice === "substring") return undefined;
-  const { createEmbedder } = await import("@crewhaus/embedder");
-  const { createSemanticEgressMatcher } = await import("@crewhaus/egress-matcher-semantic");
-  const embedder = createEmbedder({ model: opts.embedderModel });
-  return createSemanticEgressMatcher({
-    embedder,
-    ...(opts.threshold !== undefined ? { threshold: opts.threshold } : {}),
-  });
-}
+export declare function createEgressMatcher(choice: EgressMatcherChoice, opts: CreateEgressMatcherOptions): Promise<EgressMatcher | undefined>;

package/dist/egress-matcher.js

@@ -0,0 +1,57 @@
+const VALID_EGRESS_MATCHER_CHOICES = ["substring", "semantic"];
+/**
+ * Default embedder model for the semantic matcher when neither
+ * `--egress-embedder` nor `CREWHAUS_EGRESS_EMBEDDER` is supplied. A real
+ * provider is the production intent; if its API key is unset the embedder
+ * throws and `SemanticEgressMatcher` degrades to the substring tripwire
+ * (its built-in safe fallback) rather than dropping the egress check.
+ */
+export const DEFAULT_EGRESS_EMBEDDER_MODEL = "openai/text-embedding-3-small";
+/** Thrown by `resolveEgressMatcherChoice` on an unrecognised choice. The CLI
+ *  entry file catches it and routes the message through `die()`; tests assert
+ *  on `.choice` / `.message` without the process exiting. */
+export class InvalidEgressMatcherChoiceError extends Error {
+    choice;
+    name = "InvalidEgressMatcherChoiceError";
+    constructor(choice) {
+        super(`invalid --egress-matcher "${choice}" — allowed: ${VALID_EGRESS_MATCHER_CHOICES.join(", ")}`);
+        this.choice = choice;
+    }
+}
+function isEgressMatcherChoice(s) {
+    return VALID_EGRESS_MATCHER_CHOICES.includes(s);
+}
+/**
+ * Pure resolution of the matcher choice from the flag value + the lowered IR
+ * selector. `flagValue` is the raw `--egress-matcher` value (or undefined when
+ * the flag is absent); `irEgressMatcher` is `ir.security?.egressMatcher`.
+ * Throws `InvalidEgressMatcherChoiceError` for any value outside the allowed
+ * set so the caller can `die()` with a friendly message.
+ */
+export function resolveEgressMatcherChoice(flagValue, irEgressMatcher) {
+    const raw = flagValue ?? irEgressMatcher ?? "substring";
+    if (!isEgressMatcherChoice(raw))
+        throw new InvalidEgressMatcherChoiceError(raw);
+    return raw;
+}
+/**
+ * Build the `EgressMatcher` for a resolved choice. Returns `undefined` for
+ * `"substring"` so the caller omits `egressMatcher` from `runChatLoop`
+ * (runtime-core then uses the built-in `substringMatcher`, the
+ * behavior-preserving default — the default egress path pulls in no embedding
+ * dependency). For `"semantic"` it lazily imports `@crewhaus/embedder` and
+ * `@crewhaus/egress-matcher-semantic` and constructs a `SemanticEgressMatcher`
+ * with the injected embedder, so the model-backed code only loads when
+ * actually selected.
+ */
+export async function createEgressMatcher(choice, opts) {
+    if (choice === "substring")
+        return undefined;
+    const { createEmbedder } = await import("@crewhaus/embedder");
+    const { createSemanticEgressMatcher } = await import("@crewhaus/egress-matcher-semantic");
+    const embedder = createEmbedder({ model: opts.embedderModel });
+    return createSemanticEgressMatcher({
+        embedder,
+        ...(opts.threshold !== undefined ? { threshold: opts.threshold } : {}),
+    });
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+export {};