jawere 1.6.0 → 1.7.0

package/README.md

@@ -4,12 +4,10 @@ Terminal-based AI coding assistant powered by DeepSeek. Runs as an interactive R
 
 ## Features
 
-- **Autonomous Agent Loop** — Tool-calling loop (up to 500 turns) with seven filesystem tools
+- **Autonomous Agent Loop** — Tool-calling loop (up to 500 turns) with filesystem tools
 - **Codebase Scanner** — Pre-scans the project on startup, generating `.codebase/tree.yaml` and `.codebase/meta.json` so the LLM has structural context before the first prompt
-- **Interactive REPL** — Multiline input (Shift+Enter), session resumption, and persistent conversation history backed by Convex
+- **Interactive REPL** — Multiline input (Shift+Enter), session resumption, and persistent conversation history
 - **Encrypted API Key** — AES-256-GCM encrypted key storage at `~/.jawere/key.enc`
-- **Session Persistence** — Full message history, tool calls, and token usage stored in Convex
-- **Dual Environment** — Dev/prod modes with separate Convex deployments
 
 ## Quick Start
 
@@ -33,8 +31,6 @@ npm start
 | Command | Description |
 |---------|-------------|
 | `/help` | Show available commands |
-| `/sessions` | List recent Convex sessions |
-| `/load <id>` | Resume a previous session |
 | `/key` | Show API key status |
 | `/setup` | Re-enter and save API key |
 | `/clear` | Clear screen and start fresh |
@@ -42,7 +38,7 @@ npm start
 
 ## Tools
 
-The LLM has access to seven filesystem tools:
+The LLM has access to filesystem and web tools:
 
 - `bash` — Execute shell commands with configurable timeout (max 300s). Output truncated at 2000 lines / 50KB.
 - `read` — Read file contents with line offset/limit for large files.
@@ -51,6 +47,10 @@ The LLM has access to seven filesystem tools:
 - `ls` — List directory contents with sizes.
 - `find` — Find files by fuzzy name or glob pattern. Skips hidden dirs and node_modules.
 - `grep` — Search file contents with regex. Supports file glob filtering.
+- `stat` — Get file or directory metadata.
+- `diff` — Show git diff of working changes.
+- `web_search` — Search the web for up-to-date information.
+- `docs` — Search library/package documentation.
 
 ## Configuration
 
@@ -59,8 +59,6 @@ The LLM has access to seven filesystem tools:
 | `DEEPSEEK_API_KEY` | — | DeepSeek API key |
 | `DEEPSEEK_MODEL` | `deepseek-v4-pro` | Model name |
 | `WORK_DIR` | `process.cwd()` | Working directory |
-| `CONVEX_URL` | auto | Convex deployment URL |
-| `NODE_ENV` | auto-detected | `development` or `production` |
 
 ## Project Structure
 
@@ -71,12 +69,11 @@ The LLM has access to seven filesystem tools:
 │   ├── agent.ts               # Agent loop: LLM calls + tool execution
 │   ├── config.ts              # Configuration (env, key, mode)
 │   ├── tools.ts               # Tool definitions & implementations
-│   ├── convex-client.ts       # HTTP client for Convex backend
 │   ├── crypto.ts              # Encrypted API key storage (AES-256-GCM)
 │   ├── scanner.ts             # Codebase pre-scanner (.codebase/)
 │   ├── spinner.ts             # Terminal spinner animations
+│   ├── prompt.ts              # Interactive prompt (multiline)
 │   └── system-prompt.ts       # System prompt template
-├── convex/                    # Convex backend (schema, mutations, queries)
 ├── scripts/build.js           # esbuild bundler
 ├── dist/                      # Compiled output
 ├── package.json
@@ -90,11 +87,6 @@ The LLM has access to seven filesystem tools:
 | `npm start` | Run in dev mode |
 | `npm run start:prod` | Run in prod mode |
 | `npm run build` | Bundle with esbuild |
-| `npm run dev` | Run `convex dev` for backend |
-| `npm run deploy:dev` | Deploy Convex backend (dev) |
-| `npm run deploy:prod` | Deploy Convex backend (prod) |
-| `npm run seed:dev` | Seed dev database |
-| `npm run seed:prod` | Seed prod database |
 
 ## License
 

package/dist/index.js

@@ -2801,12 +2801,12 @@ var require_lib2 = __commonJS({
       const dest = new URL$1(destination).protocol;
       return orig === dest;
     };
-    function fetch3(url, opts) {
-      if (!fetch3.Promise) {
+    function fetch2(url, opts) {
+      if (!fetch2.Promise) {
         throw new Error("native promise missing, set fetch.Promise to your favorite alternative");
       }
-      Body.Promise = fetch3.Promise;
-      return new fetch3.Promise(function(resolve4, reject) {
+      Body.Promise = fetch2.Promise;
+      return new fetch2.Promise(function(resolve4, reject) {
         const request = new Request3(url, opts);
         const options = getNodeRequestOptions(request);
         const send = (options.protocol === "https:" ? https : http).request;
@@ -2877,7 +2877,7 @@ var require_lib2 = __commonJS({
         req.on("response", function(res) {
           clearTimeout(reqTimeout);
           const headers = createHeadersLenient(res.headers);
-          if (fetch3.isRedirect(res.statusCode)) {
+          if (fetch2.isRedirect(res.statusCode)) {
             const location = headers.get("Location");
             let locationURL = null;
             try {
@@ -2939,7 +2939,7 @@ var require_lib2 = __commonJS({
                   requestOpts.body = void 0;
                   requestOpts.headers.delete("content-length");
                 }
-                resolve4(fetch3(new Request3(locationURL, requestOpts)));
+                resolve4(fetch2(new Request3(locationURL, requestOpts)));
                 finalize();
                 return;
             }
@@ -3031,11 +3031,11 @@ var require_lib2 = __commonJS({
         stream.end();
       }
     }
-    fetch3.isRedirect = function(code) {
+    fetch2.isRedirect = function(code) {
       return code === 301 || code === 302 || code === 303 || code === 307 || code === 308;
     };
-    fetch3.Promise = global.Promise;
-    module.exports = exports = fetch3;
+    fetch2.Promise = global.Promise;
+    module.exports = exports = fetch2;
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.default = exports;
     exports.Headers = Headers3;
@@ -6817,7 +6817,7 @@ var VERSION = "4.104.0";
 // node_modules/openai/_shims/registry.mjs
 var auto = false;
 var kind = void 0;
-var fetch2 = void 0;
+var fetch = void 0;
 var Request = void 0;
 var Response = void 0;
 var Headers = void 0;
@@ -6838,7 +6838,7 @@ function setShims(shims, options = { auto: false }) {
   }
   auto = options.auto;
   kind = shims.kind;
-  fetch2 = shims.fetch;
+  fetch = shims.fetch;
   Request = shims.Request;
   Response = shims.Response;
   Headers = shims.Headers;
@@ -7950,7 +7950,7 @@ var APIClient = class {
     this.maxRetries = validatePositiveInteger("maxRetries", maxRetries);
     this.timeout = validatePositiveInteger("timeout", timeout);
     this.httpAgent = httpAgent;
-    this.fetch = overriddenFetch ?? fetch2;
+    this.fetch = overriddenFetch ?? fetch;
   }
   authHeaders(opts) {
     return {};
@@ -13194,6 +13194,34 @@ import { readFile, writeFile, mkdir, access, stat as fsStat } from "fs/promises"
 import { constants } from "fs";
 import { resolve, dirname } from "path";
 import { get as httpsGet } from "https";
+function safeResolve(workDir, userPath) {
+  const resolved = resolve(workDir, userPath);
+  const normalizedWd = resolve(workDir).replace(/\/+$/, "") + "/";
+  const normalizedResolved = resolved.replace(/\/+$/, "") + "/";
+  if (!normalizedResolved.startsWith(normalizedWd)) {
+    throw new Error(
+      `Path traversal blocked: "${userPath}" escapes the working directory. All file operations must stay within ${workDir}.`
+    );
+  }
+  return resolved;
+}
+var DANGEROUS_COMMANDS = [
+  { pattern: /(?:^|[;&|])\s*rm\s.*-rf\s*(?:\/|\/\*|\s+\/)/, reason: "rm -rf on root filesystem" },
+  { pattern: /(?:^|[;&|])\s*sudo\s/, reason: "sudo escalation" },
+  { pattern: /:.*\(.*\)\s*\{\s*:\|:.*&\s*\}\s*;\s*:/, reason: "fork bomb" },
+  { pattern: /(?:^|[;&|])\s*(?:dd|mkfs|fdisk|parted)\s.*if=\/dev\/|of=\/dev\//, reason: "raw device write" },
+  { pattern: /(?:^|[;&|])\s*chmod\s.*-R\s*(?:777|o\+rwx|a\+rwx)\s*(?:\/|\/etc|\/usr|\/var)/, reason: "recursive world-writable on system dirs" },
+  { pattern: /(?:^|[;&|])\s*(?:curl|wget)\s.*\|\s*(?:ba)?sh/, reason: "curl-pipe-shell \u2014 use safer methods" },
+  { pattern: /(?:^|[;&|])\s*git\s+push\s+--force.*main|master/, reason: "force push to main/master" }
+];
+function checkDangerousCommand(command) {
+  for (const { pattern, reason } of DANGEROUS_COMMANDS) {
+    if (pattern.test(command)) {
+      return `Blocked dangerous command (${reason}). If you need this, run it manually in your terminal.`;
+    }
+  }
+  return null;
+}
 var TOOL_DEFS = [
   {
     type: "function",
@@ -13478,6 +13506,8 @@ function truncateOutput(text) {
   return { text: truncated, totalLines, totalBytes, linesShown, truncated: true };
 }
 async function execBash(command, workDir, timeoutSec) {
+  const blocked = checkDangerousCommand(command);
+  if (blocked) return blocked;
   const timeout = Math.min(timeoutSec ?? 120, 300) * 1e3;
   return new Promise((resolve4) => {
     const child = exec(
@@ -13511,7 +13541,12 @@ async function execBash(command, workDir, timeoutSec) {
   });
 }
 async function readFileTool(path, workDir, offset, limit2) {
-  const fullPath = resolve(workDir, path);
+  let fullPath;
+  try {
+    fullPath = safeResolve(workDir, path);
+  } catch (err) {
+    return `Error: ${err.message}`;
+  }
   try {
     await access(fullPath, constants.R_OK);
   } catch {
@@ -13546,7 +13581,12 @@ function diffSummary(before, after) {
   return `(${linePart} lines, ${bytePart})`;
 }
 async function editFileTool(path, edits, workDir) {
-  const fullPath = resolve(workDir, path);
+  let fullPath;
+  try {
+    fullPath = safeResolve(workDir, path);
+  } catch (err) {
+    return `Error: ${err.message}`;
+  }
   let content;
   try {
     content = await readFile(fullPath, "utf-8");
@@ -13595,13 +13635,23 @@ ${errors.map((e2) => `  - ${e2}`).join("\n")}`;
   return parts.join("\n");
 }
 async function writeFileTool(path, content, workDir) {
-  const fullPath = resolve(workDir, path);
+  let fullPath;
+  try {
+    fullPath = safeResolve(workDir, path);
+  } catch (err) {
+    return `Error: ${err.message}`;
+  }
   await mkdir(dirname(fullPath), { recursive: true });
   await writeFile(fullPath, content, "utf-8");
   return `Successfully wrote ${Buffer.byteLength(content, "utf-8")} bytes to ${fullPath}`;
 }
 async function lsTool(path, workDir) {
-  const dir = resolve(workDir, path || ".");
+  let dir;
+  try {
+    dir = safeResolve(workDir, path || ".");
+  } catch (err) {
+    return `Error: ${err.message}`;
+  }
   const { readdir: readdir2, stat } = await import("fs/promises");
   try {
     const entries = await readdir2(dir, { withFileTypes: true });
@@ -13641,7 +13691,12 @@ ${lines.join("\n")}`).text;
   }
 }
 async function findTool(pattern, searchPath, workDir) {
-  const base = resolve(workDir, searchPath || ".");
+  let base;
+  try {
+    base = safeResolve(workDir, searchPath || ".");
+  } catch (err) {
+    return `Error: ${err.message}`;
+  }
   const SKIP_DIRS2 = /* @__PURE__ */ new Set([
     "node_modules",
     ".git",
@@ -13707,7 +13762,12 @@ ${results.join("\n")}`
   ).text;
 }
 async function grepTool(pattern, searchPath, include, workDir) {
-  const base = resolve(workDir, searchPath || ".");
+  let base;
+  try {
+    base = safeResolve(workDir, searchPath || ".");
+  } catch (err) {
+    return `Error: ${err.message}`;
+  }
   const SKIP_DIRS2 = /* @__PURE__ */ new Set([
     "node_modules",
     ".git",
@@ -13798,7 +13858,12 @@ ${results.join("\n")}`
   ).text;
 }
 async function statTool(path, workDir) {
-  const fullPath = resolve(workDir, path);
+  let fullPath;
+  try {
+    fullPath = safeResolve(workDir, path);
+  } catch (err) {
+    return `Error: ${err.message}`;
+  }
   try {
     const s2 = await fsStat(fullPath);
     const parts = [`${fullPath}:`];
@@ -14139,6 +14204,60 @@ async function executeTool(call, workDir) {
     };
   }
   let result;
+  try {
+    switch (fn.name) {
+      case "bash":
+        if (typeof args.command !== "string" || args.command.length === 0) throw new Error('bash requires a non-empty "command" (string)');
+        if (args.timeout !== void 0 && typeof args.timeout !== "number") throw new Error('bash "timeout" must be a number');
+        break;
+      case "read":
+        if (typeof args.path !== "string" || args.path.length === 0) throw new Error('read requires a non-empty "path" (string)');
+        if (args.offset !== void 0 && typeof args.offset !== "number") throw new Error('read "offset" must be a number');
+        if (args.limit !== void 0 && typeof args.limit !== "number") throw new Error('read "limit" must be a number');
+        break;
+      case "edit":
+        if (typeof args.path !== "string" || args.path.length === 0) throw new Error('edit requires a non-empty "path" (string)');
+        if (!Array.isArray(args.edits)) throw new Error('edit "edits" must be an array');
+        if (args.edits.length === 0) throw new Error('edit "edits" must be non-empty');
+        for (let i2 = 0; i2 < args.edits.length; i2++) {
+          const e2 = args.edits[i2];
+          if (typeof e2.oldText !== "string") throw new Error(`edit "edits[${i2}].oldText" must be a string`);
+          if (typeof e2.newText !== "string") throw new Error(`edit "edits[${i2}].newText" must be a string`);
+        }
+        break;
+      case "write":
+        if (typeof args.path !== "string" || args.path.length === 0) throw new Error('write requires a non-empty "path" (string)');
+        if (typeof args.content !== "string") throw new Error('write requires "content" (string)');
+        break;
+      case "find":
+        if (typeof args.pattern !== "string" || args.pattern.length === 0) throw new Error('find requires a non-empty "pattern" (string)');
+        if (args.path !== void 0 && typeof args.path !== "string") throw new Error('find "path" must be a string');
+        break;
+      case "grep":
+        if (typeof args.pattern !== "string" || args.pattern.length === 0) throw new Error('grep requires a non-empty "pattern" (string)');
+        if (args.path !== void 0 && typeof args.path !== "string") throw new Error('grep "path" must be a string');
+        if (args.include !== void 0 && typeof args.include !== "string") throw new Error('grep "include" must be a string');
+        break;
+      case "stat":
+        if (typeof args.path !== "string" || args.path.length === 0) throw new Error('stat requires a non-empty "path" (string)');
+        break;
+      case "web_search":
+        if (typeof args.query !== "string" || args.query.length === 0) throw new Error('web_search requires a non-empty "query" (string)');
+        if (args.count !== void 0 && typeof args.count !== "number") throw new Error('web_search "count" must be a number');
+        break;
+      case "docs":
+        if (typeof args.query !== "string" || args.query.length === 0) throw new Error('docs requires a non-empty "query" (string)');
+        if (args.count !== void 0 && typeof args.count !== "number") throw new Error('docs "count" must be a number');
+        if (args.library !== void 0 && typeof args.library !== "string") throw new Error('docs "library" must be a string');
+        break;
+    }
+  } catch (validationErr) {
+    return {
+      tool_call_id: id,
+      role: "tool",
+      content: `Error: ${validationErr.message}`
+    };
+  }
   try {
     switch (fn.name) {
       case "bash":
@@ -14215,7 +14334,7 @@ async function executeTool(call, workDir) {
 
 // src/crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
-import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, access as access2 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, access as access2, chmod } from "fs/promises";
 import { constants as constants2 } from "fs";
 import { homedir, hostname, userInfo } from "os";
 import { join } from "path";
@@ -14223,21 +14342,39 @@ var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 var TAG_LENGTH = 16;
 var SALT = "jawere-agent-key-vault-2026";
-function deriveKey() {
+var PEPPER_FILE = join(homedir(), ".jawere", ".pepper");
+async function loadOrCreatePepper() {
+  try {
+    await access2(PEPPER_FILE, constants2.R_OK);
+    return await readFile2(PEPPER_FILE);
+  } catch {
+    const pepper = randomBytes(32);
+    await mkdir2(join(homedir(), ".jawere"), { recursive: true });
+    await writeFile2(PEPPER_FILE, pepper);
+    try {
+      await chmod(PEPPER_FILE, 384);
+    } catch {
+    }
+    return pepper;
+  }
+}
+var _pepper = null;
+async function deriveKey() {
+  if (!_pepper) _pepper = await loadOrCreatePepper();
   const machineId = `${hostname()}-${userInfo().username}-jawere`;
-  return scryptSync(machineId, SALT, 32);
+  return scryptSync(machineId, Buffer.concat([Buffer.from(SALT), _pepper]), 32);
 }
-function encrypt(plaintext) {
-  const key = deriveKey();
+async function encrypt(plaintext) {
+  const key = await deriveKey();
   const iv = randomBytes(IV_LENGTH);
   const cipher = createCipheriv(ALGORITHM, key, iv);
   const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
   const tag = cipher.getAuthTag();
   return Buffer.concat([iv, tag, encrypted]).toString("base64");
 }
-function decrypt(encoded) {
+async function decrypt(encoded) {
   try {
-    const key = deriveKey();
+    const key = await deriveKey();
     const buf = Buffer.from(encoded, "base64");
     const iv = buf.subarray(0, IV_LENGTH);
     const tag = buf.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
@@ -14250,33 +14387,55 @@ function decrypt(encoded) {
   }
 }
 var KEY_FILE = join(homedir(), ".jawere", "key.enc");
-async function saveKey(apiKey) {
+var CONFIG_FILE = join(homedir(), ".jawere", "config.json");
+async function saveConfig(config) {
   const dir = join(homedir(), ".jawere");
   await mkdir2(dir, { recursive: true });
-  const encrypted = encrypt(apiKey.trim());
-  await writeFile2(KEY_FILE, encrypted, "utf-8");
+  await writeFile2(CONFIG_FILE, JSON.stringify(config, null, 2), "utf-8");
+  try {
+    await chmod(CONFIG_FILE, 384);
+  } catch {
+  }
 }
-async function loadKey() {
+async function loadSavedConfig() {
   try {
-    await access2(KEY_FILE, constants2.R_OK);
-    const encrypted = await readFile2(KEY_FILE, "utf-8");
-    return decrypt(encrypted.trim());
+    await access2(CONFIG_FILE, constants2.R_OK);
+    const raw = await readFile2(CONFIG_FILE, "utf-8");
+    return JSON.parse(raw);
   } catch {
     return null;
   }
 }
-async function hasKey() {
+async function saveKey(apiKey) {
+  const dir = join(homedir(), ".jawere");
+  await mkdir2(dir, { recursive: true });
+  const encrypted = await encrypt(apiKey.trim());
+  await writeFile2(KEY_FILE, encrypted, "utf-8");
+  try {
+    await chmod(KEY_FILE, 384);
+  } catch {
+  }
+  try {
+    await chmod(dir, 448);
+  } catch {
+  }
+}
+async function loadKey() {
   try {
     await access2(KEY_FILE, constants2.R_OK);
-    return true;
+    const encrypted = await readFile2(KEY_FILE, "utf-8");
+    return await decrypt(encrypted.trim());
   } catch {
-    return false;
+    return null;
   }
 }
 
 // src/config.ts
-var CONVEX_DEV = "https://dazzling-jackal-33.convex.cloud";
-var CONVEX_PROD = "https://friendly-pigeon-624.convex.cloud";
+var PROVIDER_DEFAULTS = {
+  deepseek: { baseURL: "https://api.deepseek.com/v1", model: "deepseek-v4-pro" },
+  openai: { baseURL: "https://api.openai.com/v1", model: "gpt-4o" },
+  custom: { baseURL: "https://api.openai.com/v1", model: "gpt-4o" }
+};
 function isDevMode() {
   if (process.env.NODE_ENV === "production") return false;
   if (process.env.NODE_ENV === "development") return true;
@@ -14298,14 +14457,27 @@ async function loadConfig() {
     keyFromFile = true;
   } else if (process.env.DEEPSEEK_API_KEY) {
     apiKey = process.env.DEEPSEEK_API_KEY;
+  } else if (process.env.OPENAI_API_KEY) {
+    apiKey = process.env.OPENAI_API_KEY;
+  } else if (process.env.AI_API_KEY) {
+    apiKey = process.env.AI_API_KEY;
   }
+  let savedConfig = null;
+  try {
+    savedConfig = await loadSavedConfig();
+  } catch {
+  }
+  const provider = process.env.AI_PROVIDER || savedConfig?.provider || "deepseek";
+  const defaults2 = PROVIDER_DEFAULTS[provider] || PROVIDER_DEFAULTS.deepseek;
+  const baseURL = process.env.AI_BASE_URL || savedConfig?.baseURL || defaults2.baseURL;
+  const model = process.env.AI_MODEL || savedConfig?.model || defaults2.model;
   const isDev = isDevMode();
   cachedConfig = {
-    baseURL: "https://api.deepseek.com/v1",
+    baseURL,
     apiKey,
-    model: process.env.DEEPSEEK_MODEL || "deepseek-v4-pro",
+    model,
+    provider,
     workDir: process.env.WORK_DIR || process.cwd(),
-    convexUrl: process.env.CONVEX_URL || (isDev ? CONVEX_DEV : CONVEX_PROD),
     keyFromFile,
     isDev
   };
@@ -14568,93 +14740,6 @@ function createSpinner() {
   return self;
 }
 
-// src/convex-client.ts
-async function convexMutation(convexUrl, name, args) {
-  const res = await fetch(`${convexUrl}/api/mutation`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ path: name, format: "json", args })
-  });
-  if (!res.ok) {
-    const err = await res.text();
-    throw new Error(`Convex mutation ${name} failed (${res.status}): ${err}`);
-  }
-  const json = await res.json();
-  if (json.status === "error") {
-    throw new Error(`Convex mutation ${name} error: ${json.errorMessage || JSON.stringify(json)}`);
-  }
-  return json.value;
-}
-async function convexQuery(convexUrl, name, args) {
-  const res = await fetch(`${convexUrl}/api/query`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ path: name, format: "json", args })
-  });
-  if (!res.ok) {
-    const err = await res.text();
-    throw new Error(`Convex query ${name} failed (${res.status}): ${err}`);
-  }
-  const json = await res.json();
-  if (json.status === "error") {
-    throw new Error(`Convex query ${name} error: ${json.errorMessage || JSON.stringify(json)}`);
-  }
-  return json.value;
-}
-async function createSession(convexUrl, title, model, systemPrompt, toolNames) {
-  return convexMutation(convexUrl, "sessions:create", {
-    title,
-    model,
-    systemPrompt,
-    toolNames
-  });
-}
-async function appendUserMessage(convexUrl, sessionId, text) {
-  return convexMutation(convexUrl, "sessions:appendMessage", {
-    sessionId,
-    role: "user",
-    content: [{ type: "text", text }],
-    timestamp: Date.now()
-  });
-}
-async function appendAssistantMessage(convexUrl, sessionId, text, toolCalls, usage) {
-  const content = [];
-  if (text) {
-    content.push({ type: "text", text });
-  }
-  if (toolCalls) {
-    for (const tc of toolCalls) {
-      content.push({
-        type: "tool_call",
-        id: tc.id,
-        name: tc.name,
-        arguments: tc.arguments
-      });
-    }
-  }
-  return convexMutation(convexUrl, "sessions:appendMessage", {
-    sessionId,
-    role: "assistant",
-    content,
-    timestamp: Date.now(),
-    usage
-  });
-}
-async function appendToolResult(convexUrl, sessionId, toolCallId, toolName, result, isError) {
-  return convexMutation(convexUrl, "sessions:appendMessage", {
-    sessionId,
-    role: "toolResult",
-    content: [{ type: "tool_result", toolCallId, content: result }],
-    toolCallId,
-    toolName,
-    isError,
-    timestamp: Date.now()
-  });
-}
-async function listSessions(convexUrl) {
-  return convexQuery(convexUrl, "sessions:list", {});
-}
-
 // src/agent.ts
 var MAX_TURNS = 500;
 var MAX_OUTPUT_TOKENS = 393216;
@@ -14714,13 +14799,6 @@ function displayToolLine(name, args, ok, spin) {
     spin.start("Working\u2026");
   }
 }
-async function safeCall(fn, label) {
-  try {
-    return await fn();
-  } catch {
-    return void 0;
-  }
-}
 async function withRetry(fn, maxRetries = 3, baseDelay = 1e3) {
   let lastErr;
   for (let i2 = 0; i2 <= maxRetries; i2++) {
@@ -14817,33 +14895,14 @@ async function runAgent(userMessage, options = {}) {
   const config = await loadConfig();
   if (!config.apiKey) {
     throw new Error(
-      "No API key configured. Run with --setup to save your DeepSeek API key, or set DEEPSEEK_API_KEY env var."
+      'No API key configured. Run "jawere --setup" to configure your AI provider and key, or set AI_API_KEY env var.'
     );
   }
   const client = new openai_default({
     baseURL: config.baseURL,
     apiKey: config.apiKey
   });
-  const toolNames = TOOL_DEFS.map((t2) => t2.function.name);
-  let sessionId = options.sessionId || "local";
-  const hasRealSession = sessionId !== "local";
-  const isNewSession = !options.sessionId;
-  if (isNewSession) {
-    const created = await safeCall(
-      () => createSession(
-        config.convexUrl,
-        options.title || userMessage.slice(0, 100),
-        config.model,
-        SYSTEM_PROMPT,
-        toolNames
-      ),
-      "createSession"
-    );
-    if (created) sessionId = created;
-  }
-  if (hasRealSession || sessionId !== "local") {
-    safeCall(() => appendUserMessage(config.convexUrl, sessionId, userMessage), "appendUserMessage");
-  }
+  const sessionId = options.sessionId || "local";
   const messages = [
     { role: "system", content: SYSTEM_PROMPT }
   ];
@@ -14933,21 +14992,6 @@ async function runAgent(userMessage, options = {}) {
     const hasToolCalls = streamedToolCalls.size > 0;
     if (hasToolCalls) {
       const toolCallArray = Array.from(streamedToolCalls.entries()).sort(([a2], [b2]) => a2 - b2).map(([_2, tc]) => tc);
-      const toolCallsMeta = toolCallArray.map((tc) => ({
-        id: tc.id,
-        name: tc.name,
-        arguments: tc.arguments
-      }));
-      safeCall(
-        () => appendAssistantMessage(
-          config.convexUrl,
-          sessionId,
-          streamedContent || null,
-          toolCallsMeta.length > 0 ? toolCallsMeta : null,
-          streamUsage
-        ),
-        "appendAssistantMessage"
-      );
       const openaiToolCalls = toolCallArray.map((tc) => ({
         id: tc.id,
         type: "function",
@@ -14985,34 +15029,17 @@ async function runAgent(userMessage, options = {}) {
           tool_call_id: result.tool_call_id,
           content: result.content
         });
-        const isError = !ok;
-        safeCall(
-          () => appendToolResult(
-            config.convexUrl,
-            sessionId,
-            result.tool_call_id,
-            tc.name,
-            result.content,
-            isError
-          ),
-          "appendToolResult"
-        );
       }
       continue;
     }
     spin.stop();
     const text = stripThinking(streamedContent) || "(empty response)";
-    safeCall(
-      () => appendAssistantMessage(config.convexUrl, sessionId, text, null, streamUsage),
-      "appendAssistantMessage"
-    );
     console.log("");
     printAssistantResponse(text);
     return { text, sessionId, history: messages };
   }
   spin.stop();
   const msg = "Agent reached maximum turns without completing the task.";
-  safeCall(() => appendAssistantMessage(config.convexUrl, sessionId, msg, null), "appendAssistantMessage");
   return { text: msg, sessionId, history: messages };
 }
 
@@ -15711,6 +15738,7 @@ function createPrompt() {
 // src/index.ts
 var G_GREEN = "\x1B[38;2;184;187;3m";
 var G_GRAY2 = "\x1B[38;2;146;131;116m";
+var G_AQUA = "\x1B[38;2;142;192;124m";
 var R3 = "\x1B[0m";
 function center(text, width) {
   const visible = text.replace(/\x1b\[[0-9;]*m/g, "");
@@ -15721,7 +15749,7 @@ function printBanner(config) {
   const cols = process.stdout.columns || 60;
   const sep = G_GRAY2 + "\u2500".repeat(Math.min(cols - 2, 50)) + R3;
   console.log("");
-  console.log(center(`${G_GRAY2}${config.model}${R3}  ${G_GRAY2}${config.isDev ? "dev" : "prod"}${R3}`, cols));
+  console.log(center(`${G_GRAY2}${config.provider} / ${config.model}${R3}  ${G_GRAY2}${config.isDev ? "dev" : "prod"}${R3}`, cols));
   console.log(center(sep, cols));
   console.log("");
 }
@@ -15729,57 +15757,71 @@ function printHelp() {
   console.log(`
 ${G_GREEN}Commands:${R3}
   ${G_GRAY2}/help${R3}          Show this help
-  ${G_GRAY2}/sessions${R3}      List recent Convex sessions
-  ${G_GRAY2}/load${R3} <num>    Resume a session (run /sessions first)
+
   ${G_GRAY2}/key${R3}           Show API key status
-  ${G_GRAY2}/setup${R3}         Re-enter API key
+  ${G_GRAY2}/setup${R3}         Re-configure AI provider & key
   ${G_GRAY2}/clear${R3}         Clear screen & start fresh session
   ${G_GRAY2}/exit${R3}, ${G_GRAY2}/quit${R3}   Quit
+
+${G_GREEN}CLI flags:${R3}
+  ${G_GRAY2}--setup${R3}        Run setup wizard (provider, key, model)
 `);
 }
 async function setupKey() {
   const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
-  console.log("\nEnter your DeepSeek API key (starts with sk-):");
-  const key = await new Promise((resolve4) => {
-    rl.question("API Key: ", (answer) => {
+  const ask = (q2) => new Promise((resolve4) => rl.question(q2, (a2) => resolve4(a2.trim())));
+  console.log("");
+  console.log(`${G_GREEN}\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557${R3}`);
+  console.log(`${G_GREEN}\u2551   jawere \u2014 Setup                         \u2551${R3}`);
+  console.log(`${G_GREEN}\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D${R3}`);
+  console.log("");
+  console.log("Select AI provider:");
+  console.log(`  ${G_AQUA}1.${R3} DeepSeek`);
+  console.log(`  ${G_AQUA}2.${R3} OpenAI`);
+  console.log(`  ${G_AQUA}3.${R3} Custom (enter base URL)`);
+  console.log("");
+  const choice = await ask(`Choice [1]: `) || "1";
+  let provider = "deepseek";
+  let baseURL;
+  let defaultModel;
+  if (choice === "2") {
+    provider = "openai";
+    defaultModel = "gpt-4o";
+  } else if (choice === "3") {
+    provider = "custom";
+    console.log("");
+    baseURL = await ask("Base URL (e.g. https://api.openai.com/v1): ");
+    if (!baseURL) {
+      console.log("No URL entered. Aborting setup.");
       rl.close();
-      resolve4(answer.trim());
-    });
-  });
+      return;
+    }
+    defaultModel = "gpt-4o";
+  } else {
+    provider = "deepseek";
+    defaultModel = "deepseek-v4-pro";
+  }
+  console.log("");
+  const keyHint = provider === "openai" ? "sk-" : provider === "deepseek" ? "sk-" : "";
+  const hintText = keyHint ? ` (starts with ${keyHint})` : "";
+  console.log(`Enter your API key${hintText}:`);
+  const key = await ask("API Key: ");
   if (!key) {
     console.log("No key entered. Aborting setup.");
+    rl.close();
     return;
   }
-  if (!key.startsWith("sk-")) {
-    console.log('Warning: Key does not start with "sk-". Saving anyway...');
-  }
+  console.log("");
+  const model = await ask(`Model [${defaultModel}]: `) || defaultModel;
   await saveKey(key);
-  console.log(`API key encrypted and saved to ~/.jawere/key.enc`);
-}
-async function showSessions(convexUrl) {
-  const map = /* @__PURE__ */ new Map();
-  try {
-    const sessions = await listSessions(convexUrl);
-    if (sessions.length === 0) {
-      console.log("No sessions found.");
-      return map;
-    }
-    console.log(`
-Recent sessions:`);
-    let i2 = 1;
-    for (const s2 of sessions) {
-      const date = new Date(s2.updatedAt).toLocaleString();
-      const shortId = s2._id.slice(0, 10);
-      console.log(`  ${i2}. ${shortId}\u2026  ${date}  ${s2.title.slice(0, 50)}`);
-      map.set(i2, s2._id);
-      i2++;
-    }
-    console.log(`
-Use /load <number> to resume a session.`);
-  } catch (err) {
-    console.log(`Error fetching sessions: ${err.message}`);
-  }
-  return map;
+  await saveConfig({ provider, baseURL: baseURL || void 0, model });
+  console.log("");
+  console.log(`${G_GREEN}Setup complete!${R3}`);
+  console.log(`  Provider : ${G_AQUA}${provider}${R3}`);
+  console.log(`  Model    : ${G_AQUA}${model}${R3}`);
+  console.log(`  Key saved: ~/.jawere/key.enc`);
+  console.log("");
+  rl.close();
 }
 async function main() {
   const setupMode = process.argv.includes("--setup");
@@ -15790,16 +15832,14 @@ async function main() {
     process.exit(0);
   }
   if (!config.apiKey) {
-    const hasExistingKey = await hasKey();
     console.log("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557");
-    console.log("\u2551   jawere \u2014 AI Coding Agent                  \u2551");
+    console.log("\u2551        jawere \u2014 AI Coding Agent          \u2551");
     console.log("\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563");
     console.log("\u2551 No API key found.                        \u2551");
     console.log("\u2551                                          \u2551");
-    console.log("\u2551 Option 1: Set DEEPSEEK_API_KEY env var   \u2551");
-    console.log("\u2551 Option 2: Run --setup to encrypt & save  \u2551");
+    console.log("\u2551 Option 1: Set AI_API_KEY env var         \u2551");
+    console.log("\u2551 Option 2: Run jawere --setup             \u2551");
     console.log("\u2551                                          \u2551");
-    console.log("\u2551   npx tsx src/index.ts --setup            \u2551");
     console.log("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D");
     process.exit(1);
   }
@@ -15822,7 +15862,6 @@ async function main() {
   }
   let currentSessionId;
   let conversationHistory = [];
-  let sessionMap = /* @__PURE__ */ new Map();
   let sessionShown = false;
   try {
     const codebaseDir = resolve3(config.workDir, ".codebase");
@@ -15871,35 +15910,12 @@ async function main() {
         case "help":
           printHelp();
           break;
-        case "sessions":
-          sessionMap = await showSessions(config.convexUrl);
-          break;
-        case "load":
-          if (arg) {
-            const num = parseInt(arg, 10);
-            if (!isNaN(num) && sessionMap.has(num)) {
-              currentSessionId = sessionMap.get(num);
-              conversationHistory = [];
-              sessionShown = true;
-              console.log(`Resumed session #${num}: ${currentSessionId?.slice(0, 12)}\u2026`);
-            } else if (arg.length > 10) {
-              currentSessionId = arg;
-              conversationHistory = [];
-              sessionShown = true;
-              console.log(`Resumed session: ${arg.slice(0, 12)}\u2026`);
-            } else {
-              console.log(`Session #${arg} not found. Run /sessions first.`);
-            }
-          } else {
-            console.log("Usage: /load <number>  (run /sessions first)");
-          }
-          break;
         case "key": {
           const savedKey = await loadKey();
           if (savedKey) {
-            console.log(`Key status: saved (encrypted) \u2014 ${savedKey.slice(0, 8)}...`);
+            console.log(`Key status: saved (encrypted) \u2014 ${savedKey.slice(0, 3)}...`);
           } else if (process.env.DEEPSEEK_API_KEY) {
-            console.log(`Key status: DEEPSEEK_API_KEY env var`);
+            console.log(`Key status: DEEPSEEK_API_KEY env var (starts ${process.env.DEEPSEEK_API_KEY.slice(0, 3)}...)`);
           } else {
             console.log(`Key status: NOT SET`);
           }

package/package.json

@@ -1,28 +1,21 @@
 {
   "name": "jawere",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "type": "module",
   "bin": {
     "jawere": "bin/jawere.js"
   },
   "files": [
     "bin",
-    "dist",
-    "convex/_generated"
+    "dist"
   ],
   "scripts": {
     "start": "node --env-file .env.local --import tsx src/index.ts",
     "start:prod": "tsx src/index.ts",
     "build": "node scripts/build.js",
-    "dev": "npx convex dev",
-    "deploy:dev": "npx convex dev --env-file .env.local",
-    "deploy:prod": "npx convex deploy --env-file .env.prod",
-    "seed:dev": "CONVEX_URL=https://dazzling-jackal-33.convex.cloud tsx scripts/seed.ts",
-    "seed:prod": "CONVEX_URL=https://friendly-pigeon-624.convex.cloud tsx scripts/seed.ts",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "convex": "^1.42.1",
     "marked": "^18.0.5",
     "openai": "^4.73.0"
   },