jev-agent-tools 0.1.3 → 0.2.0

package/src/adapters/private-storage.ts

@@ -0,0 +1,143 @@
+import { execFile } from "node:child_process";
+import type { Stats } from "node:fs";
+import { join } from "node:path";
+import { PRIVATE_STORAGE_TIMEOUT_MS } from "../constants.ts";
+
+/**
+ * Owner-only storage, checked with each operating system's own model.
+ *
+ * POSIX: no group/other mode bits and owned by the current user.
+ * Windows: mode bits are synthesized (always 0o666), so the real ACL is read.
+ * Storage is private when every allow entry belongs to the current user,
+ * SYSTEM or the Administrators group (the Windows equivalent of root), and
+ * the owner is the current user or Administrators. Entries are compared as
+ * SIDs, so localized account names do not matter.
+ */
+export interface PrivateStorage {
+  /** True when every path is private. One check for all paths. */
+  isPrivate(
+    entries: readonly { path: string; stat: Stats }[],
+  ): Promise<boolean>;
+  /** Restrict a directory the current user owns so new files inherit privacy. */
+  restrictDirectory(path: string): Promise<void>;
+}
+
+const SYSTEM = "S-1-5-18";
+const ADMINISTRATORS = "S-1-5-32-544";
+const CREATOR_OWNER = "S-1-3-0";
+
+export const posixStorage: PrivateStorage = {
+  async isPrivate(entries) {
+    return entries.every(
+      ({ stat }) =>
+        (stat.mode & 0o077) === 0 &&
+        (!process.getuid || stat.uid === process.getuid()),
+    );
+  },
+  async restrictDirectory() {
+    // mkdir(..., { mode: 0o700 }) already creates POSIX directories privately.
+  },
+};
+
+// Paths arrive as JSON in an environment variable, never in the command text.
+const CHECK = `$ErrorActionPreference = 'Stop'
+$me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$trusted = @($me, '${SYSTEM}', '${ADMINISTRATORS}')
+$sid = [System.Security.Principal.SecurityIdentifier]
+$results = foreach ($path in (ConvertFrom-Json $env:JEV_PRIVATE_PATHS)) {
+  try {
+    $acl = Get-Acl -LiteralPath $path
+    $owner = $acl.GetOwner($sid).Value
+    $private = ($owner -eq $me) -or ($owner -eq '${ADMINISTRATORS}')
+    foreach ($rule in $acl.GetAccessRules($true, $true, $sid)) {
+      if ($rule.AccessControlType -ne 'Allow') { continue }
+      $id = $rule.IdentityReference.Value
+      $inheritOnly = ($rule.PropagationFlags -band [System.Security.AccessControl.PropagationFlags]::InheritOnly) -ne 0
+      if ($id -eq '${CREATOR_OWNER}' -and $inheritOnly) { continue }
+      if ($trusted -notcontains $id) { $private = $false }
+    }
+    $private
+  } catch { $false }
+}
+ConvertTo-Json -Compress @($results)`;
+
+const RESTRICT = `$ErrorActionPreference = 'Stop'
+$path = $env:JEV_PRIVATE_PATH
+$me = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$acl = Get-Acl -LiteralPath $path
+if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $me.Value) { throw 'not owner' }
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($rule in @($acl.Access)) { [void]$acl.RemoveAccessRuleAll($rule) }
+$inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+foreach ($id in @($me.Value, '${SYSTEM}', '${ADMINISTRATORS}')) {
+  $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
+    (New-Object System.Security.Principal.SecurityIdentifier($id)),
+    'FullControl', $inherit, 'None', 'Allow')
+  $acl.AddAccessRule($rule)
+}
+Set-Acl -LiteralPath $path -AclObject $acl`;
+
+function powershell(
+  script: string,
+  env: Record<string, string>,
+): Promise<string> {
+  const root = process.env.SystemRoot ?? "C:\\Windows";
+  // A fixed system path, so a powershell.exe earlier on PATH is never used.
+  const executable = join(
+    root,
+    "System32",
+    "WindowsPowerShell",
+    "v1.0",
+    "powershell.exe",
+  );
+  // PowerShell 7 parents export PSModulePath, which stops Windows PowerShell
+  // 5.1 from loading its own Get-Acl module; 5.1 rebuilds it when unset.
+  const childEnv: NodeJS.ProcessEnv = { ...process.env, ...env };
+  for (const key of Object.keys(childEnv))
+    if (key.toLowerCase() === "psmodulepath") delete childEnv[key];
+  const { promise, resolve, reject } = Promise.withResolvers<string>();
+  execFile(
+    executable,
+    [
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      // UTF-16LE base64 runs the script as one unit; stdin runs line by line.
+      "-EncodedCommand",
+      Buffer.from(script, "utf16le").toString("base64"),
+    ],
+    { env: childEnv, windowsHide: true, timeout: PRIVATE_STORAGE_TIMEOUT_MS },
+    (error, stdout) => (error ? reject(error) : resolve(stdout)),
+  );
+  return promise;
+}
+
+export const windowsStorage: PrivateStorage = {
+  async isPrivate(entries) {
+    if (!entries.length) return true;
+    try {
+      const output = await powershell(CHECK, {
+        JEV_PRIVATE_PATHS: JSON.stringify(entries.map(({ path }) => path)),
+      });
+      const results: unknown = JSON.parse(output.trim());
+      return (
+        Array.isArray(results) &&
+        results.length === entries.length &&
+        results.every((result) => result === true)
+      );
+    } catch {
+      // An ACL that cannot be read is never treated as private.
+      return false;
+    }
+  },
+  async restrictDirectory(path) {
+    await powershell(RESTRICT, { JEV_PRIVATE_PATH: path });
+  },
+};
+
+export function privateStorage(
+  platform: NodeJS.Platform = process.platform,
+): PrivateStorage {
+  return platform === "win32" ? windowsStorage : posixStorage;
+}

package/src/adapters/risk-callers.ts

@@ -1,5 +1,5 @@
 import { type FileHandle, lstat } from "node:fs/promises";
-import { resolve } from "node:path";
+import { posix } from "node:path";
 import type { SgNode } from "@ast-grep/napi";
 import { CONCURRENCY, STATE_MAX_CHARS, TIMEOUT_MS } from "../constants.ts";
 import type { GitExec } from "../core/git.ts";
@@ -460,8 +460,10 @@ export async function collectRiskCallers(
                   typeof source.beforePath === "string"
                     ? source.beforePath
                     : source.path;
+                // Repository paths are always "/"-separated; the platform
+                // resolve would yield "C:\\src\\..." on Windows.
                 const basePath = specifier.startsWith(".")
-                  ? resolve("/", sourcePath, "..", specifier).slice(1)
+                  ? posix.resolve("/", sourcePath, "..", specifier).slice(1)
                   : specifier.replaceAll(".", "/");
                 const runtimeSource = basePath.replace(
                   /\.(js|jsx|mjs|cjs)$/,

package/src/adapters/shell.ts

@@ -0,0 +1,97 @@
+import { accessSync, constants } from "node:fs";
+// Candidates are Windows paths whatever the host OS, so the helpers use win32
+// semantics explicitly; the host-native `node:path` splits PATH on ":" on POSIX.
+import { win32 } from "node:path";
+
+export interface ShellInvocation {
+  executable: string;
+  /** Arguments placed before the `-c` script. */
+  prefix: string[];
+  /** Exports prepended to the script when the launcher cannot set them. */
+  scriptPrefix: string;
+}
+
+export type ShellResolution =
+  | ({ ok: true } & ShellInvocation)
+  | { ok: false; error: string };
+
+function executable(path: string): boolean {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Windows ships `bash.exe` launchers for WSL in System32 (and SysWOW64,
+ * Sysnative) and in WindowsApps. They run in a Linux VM that cannot see Windows
+ * temporary paths, so they are never used for command evidence, including
+ * when named explicitly in JEV_TOOLS_BASH.
+ */
+export function isWslLauncher(path: string): boolean {
+  const lower = win32.normalize(path).toLowerCase();
+  return (
+    /\\windows\\(system32|syswow64|sysnative)\\/.test(lower) ||
+    lower.includes("\\microsoft\\windowsapps\\")
+  );
+}
+
+/** Permitted Git for Windows bash candidates, most specific first. */
+export function windowsBashCandidates(env: NodeJS.ProcessEnv): string[] {
+  const candidates: string[] = [];
+  if (env.JEV_TOOLS_BASH?.trim()) candidates.push(env.JEV_TOOLS_BASH.trim());
+  const pathEntries = (env.PATH ?? env.Path ?? "")
+    .split(win32.delimiter)
+    .filter(Boolean);
+  for (const entry of pathEntries) {
+    candidates.push(win32.join(entry, "bash.exe"));
+    // Git\cmd\git.exe or Git\bin\git.exe on PATH implies Git\bin\bash.exe.
+    if (/[\\/](cmd|bin)$/i.test(entry))
+      candidates.push(win32.join(win32.dirname(entry), "bin", "bash.exe"));
+  }
+  for (const root of [
+    env.ProgramFiles,
+    env["ProgramFiles(x86)"],
+    env.LOCALAPPDATA && win32.join(env.LOCALAPPDATA, "Programs"),
+  ])
+    if (root) candidates.push(win32.join(root, "Git", "bin", "bash.exe"));
+  // Filter every source, so no candidate can reintroduce a WSL launcher.
+  return [...new Set(candidates)].filter(
+    (candidate) => win32.isAbsolute(candidate) && !isWslLauncher(candidate),
+  );
+}
+
+const UNAVAILABLE =
+  "No permitted bash found: install Git for Windows or set JEV_TOOLS_BASH to the full path of a bash that is not the WSL launcher.";
+let cached: ShellResolution | undefined;
+
+/**
+ * POSIX hosts keep `env CI=1 bash -c`. Windows has no `env` and its default
+ * `bash` is the WSL launcher, so resolve Git for Windows bash (or
+ * JEV_TOOLS_BASH) to an absolute, permitted path and export CI inside the
+ * script. When none is found this fails closed: no bare name is returned,
+ * because spawning one would search PATH again without the WSL exclusion.
+ */
+export function resolveShell(
+  platform: NodeJS.Platform = process.platform,
+  env: NodeJS.ProcessEnv = process.env,
+  isExecutable: (path: string) => boolean = executable,
+): ShellResolution {
+  if (platform !== "win32")
+    return {
+      ok: true,
+      executable: "env",
+      prefix: ["CI=1", "bash"],
+      scriptPrefix: "",
+    };
+  const useCache = isExecutable === executable && env === process.env;
+  if (useCache && cached) return cached;
+  const found = windowsBashCandidates(env).find((path) => isExecutable(path));
+  const resolved: ShellResolution = found
+    ? { ok: true, executable: found, prefix: [], scriptPrefix: "export CI=1; " }
+    : { ok: false, error: UNAVAILABLE };
+  if (useCache && found) cached = resolved;
+  return resolved;
+}

package/src/configuration.ts

@@ -0,0 +1,294 @@
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import {
+  type PrivateStorage,
+  privateStorage,
+} from "./adapters/private-storage.ts";
+import { createJevClient } from "./jev/client.ts";
+import type { JevClient } from "./jev/types.ts";
+
+export interface ConfigurationValues {
+  url: string;
+  apiKey: string;
+  model: string;
+}
+
+type SavedConfiguration = Partial<ConfigurationValues>;
+const fields = ["url", "apiKey", "model"] as const;
+const defaults: ConfigurationValues = { url: "", apiKey: "", model: "openjev" };
+const storageError = () =>
+  new Error(
+    "Cannot read or save Jev configuration. Check that the configuration directory and config.json are owned by you, private, regular storage without symlinks, and contain valid configuration JSON.",
+  );
+
+function nonempty(value: string | undefined): value is string {
+  return value !== undefined && value.trim().length > 0;
+}
+
+function validate(values: ConfigurationValues): void {
+  let validUrl = false;
+  try {
+    const url = new URL(values.url);
+    validUrl =
+      /^https?:\/\//i.test(values.url) &&
+      (url.protocol === "http:" || url.protocol === "https:") &&
+      url.hostname !== "" &&
+      url.username === "" &&
+      url.password === "";
+  } catch {
+    // Keep user-controlled URL and credentials out of error messages.
+  }
+  if (
+    !validUrl ||
+    !nonempty(values.apiKey) ||
+    /[^\x20-\x7e\x80-\xff]/.test(values.apiKey) ||
+    !nonempty(values.model)
+  ) {
+    throw new Error(
+      "Jev configuration requires a full HTTP(S) URL without embedded credentials, a nonempty HTTP-header-compatible API key, and a nonempty model.",
+    );
+  }
+}
+
+/** Effective configuration and its client move together, only after a save succeeds. */
+export class ConfigController {
+  private readonly environment: SavedConfiguration = {};
+  private flags: SavedConfiguration = {};
+  private saved: SavedConfiguration = {};
+  private session: SavedConfiguration = {};
+  private readonly directory: string;
+  private readonly storage: PrivateStorage;
+  private initialization: Promise<void> | undefined;
+  private currentClient: JevClient | undefined;
+
+  constructor(
+    options: {
+      env?: NodeJS.ProcessEnv;
+      directory?: string;
+      storage?: PrivateStorage;
+    } = {},
+  ) {
+    const env = options.env ?? process.env;
+    this.storage = options.storage ?? privateStorage();
+    for (const [field, name] of [
+      ["url", "JEV_TOOLS_URL"],
+      ["apiKey", "JEV_TOOLS_API_KEY"],
+      ["model", "JEV_TOOLS_MODEL"],
+    ] as const) {
+      if (nonempty(env[name])) this.environment[field] = env[name];
+    }
+    const base =
+      nonempty(env.XDG_CONFIG_HOME) && isAbsolute(env.XDG_CONFIG_HOME)
+        ? env.XDG_CONFIG_HOME
+        : join(homedir(), ".config");
+    this.directory = resolve(
+      options.directory ?? join(base, "jev-agent-tools"),
+    );
+    if (nonempty(this.environment.url) && nonempty(this.environment.apiKey)) {
+      const effective = this.values();
+      validate(effective);
+      this.currentClient = createJevClient(effective);
+    }
+  }
+
+  get client(): JevClient | undefined {
+    return this.currentClient;
+  }
+
+  initialize(flags: { url?: string; model?: string }): Promise<void> {
+    if (this.initialization) return this.initialization;
+    this.initialization = this.load(flags).catch((error: unknown) => {
+      this.initialization = undefined;
+      throw error;
+    });
+    return this.initialization;
+  }
+
+  values(): ConfigurationValues {
+    return {
+      ...defaults,
+      ...this.saved,
+      ...this.session,
+      ...this.flags,
+      ...this.environment,
+    };
+  }
+
+  locked(field: keyof ConfigurationValues): boolean {
+    return (
+      this.environment[field] !== undefined || this.flags[field] !== undefined
+    );
+  }
+
+  async apply(values: ConfigurationValues, persist: boolean): Promise<void> {
+    if (!this.initialization) {
+      throw new Error("Initialize Jev configuration before applying changes.");
+    }
+    await this.initialization;
+    const session = { ...this.session };
+    for (const field of fields) {
+      if (!this.locked(field)) session[field] = values[field];
+    }
+    const effective = {
+      ...defaults,
+      ...this.saved,
+      ...session,
+      ...this.flags,
+      ...this.environment,
+    };
+    validate(effective);
+    const saved = { ...this.saved, ...session };
+    if (persist) await this.save(saved);
+    const previous = this.values();
+    this.session = session;
+    if (persist) this.saved = saved;
+    if (fields.some((field) => previous[field] !== effective[field])) {
+      this.currentClient?.clearCache();
+      this.currentClient = createJevClient(effective);
+    } else {
+      this.currentClient ??= createJevClient(effective);
+    }
+  }
+
+  private async load(flags: { url?: string; model?: string }): Promise<void> {
+    const saved = await this.readSaved();
+    const supplied: SavedConfiguration = {};
+    if (nonempty(flags.url)) supplied.url = flags.url;
+    if (nonempty(flags.model)) supplied.model = flags.model;
+    const effective = {
+      ...defaults,
+      ...saved,
+      ...supplied,
+      ...this.environment,
+    };
+    if (nonempty(effective.url) && nonempty(effective.apiKey)) {
+      validate(effective);
+      this.currentClient?.clearCache();
+      this.currentClient = createJevClient(effective);
+    }
+    this.saved = saved;
+    this.flags = supplied;
+  }
+
+  private async checkDirectory(): Promise<boolean> {
+    // Check ancestors too: recursive mkdir and path-based reads must not follow symlinks.
+    // Privacy of the directory itself is checked with its file in readSaved,
+    // using the operating system's own permission model.
+    let path = this.directory;
+    let exists = true;
+    while (true) {
+      try {
+        const stat = await lstat(path);
+        if (!stat.isDirectory() || stat.isSymbolicLink()) throw storageError();
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException)?.code !== "ENOENT")
+          throw storageError();
+        if (path === this.directory) exists = false;
+      }
+      const parent = dirname(path);
+      if (parent === path) break;
+      path = parent;
+    }
+    return exists;
+  }
+
+  private async readSaved(): Promise<SavedConfiguration> {
+    try {
+      if (!(await this.checkDirectory())) return {};
+      const directory = {
+        path: this.directory,
+        stat: await lstat(this.directory),
+      };
+      const path = join(this.directory, "config.json");
+      try {
+        const stat = await lstat(path);
+        if (!stat.isFile() || stat.isSymbolicLink()) throw storageError();
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException)?.code === "ENOENT") {
+          if (!(await this.storage.isPrivate([directory])))
+            throw storageError();
+          return {};
+        }
+        throw error;
+      }
+      const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+      try {
+        const stat = await file.stat();
+        if (
+          !stat.isFile() ||
+          stat.nlink !== 1 ||
+          !(await this.storage.isPrivate([directory, { path, stat }]))
+        ) {
+          throw storageError();
+        }
+        const value: unknown = JSON.parse(await file.readFile("utf8"));
+        if (
+          value === null ||
+          typeof value !== "object" ||
+          Array.isArray(value) ||
+          Object.entries(value).some(
+            ([key, entry]) =>
+              !fields.some((field) => field === key) ||
+              typeof entry !== "string",
+          )
+        ) {
+          throw storageError();
+        }
+        return value as SavedConfiguration;
+      } finally {
+        await file.close();
+      }
+    } catch {
+      throw storageError();
+    }
+  }
+
+  private async save(values: SavedConfiguration): Promise<void> {
+    let temporary: string | undefined;
+    try {
+      const existed = await this.checkDirectory();
+      if (!existed) {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+      }
+      // Windows ignores mkdir's mode, so restrict the ACL before any secret is
+      // written: always for a new directory, and for an existing one only while
+      // it holds no configuration (e.g. left behind by an earlier failed save).
+      // Existing configuration is never re-permissioned; readSaved refuses it.
+      if (
+        !existed ||
+        !(await lstat(join(this.directory, "config.json")).then(
+          () => true,
+          () => false,
+        ))
+      )
+        await this.storage.restrictDirectory(this.directory);
+      // Refuse to replace malformed, insecure or newly introduced storage.
+      await this.readSaved();
+      temporary = join(this.directory, `.config-${randomUUID()}.tmp`);
+      const file = await open(
+        temporary,
+        constants.O_WRONLY |
+          constants.O_CREAT |
+          constants.O_EXCL |
+          constants.O_NOFOLLOW,
+        0o600,
+      );
+      try {
+        await file.writeFile(`${JSON.stringify(values, null, 2)}\n`, "utf8");
+        await file.sync();
+      } finally {
+        await file.close();
+      }
+      await this.readSaved();
+      await rename(temporary, join(this.directory, "config.json"));
+      temporary = undefined;
+    } catch {
+      throw storageError();
+    } finally {
+      if (temporary) await unlink(temporary).catch(() => {});
+    }
+  }
+}

package/src/constants.ts

@@ -5,6 +5,17 @@ export const ASK_NOTE_MAX_CHARS = 8_000;
 export const ASK_MAX_FILES = 20;
 export const ASK_TIMEOUT_S = 60;
 export const ASK_TIMEOUT_MAX_S = 300;
+export const PROCESS_KILL_GRACE_MS = 2_000;
+export const PROCESS_PIPE_GRACE_MS = 1_000;
+export const PROCESS_TREE_TIMEOUT_MS = 5_000;
+export const MCP_SHUTDOWN_FLUSH_TIMEOUT_MS = 1_000;
+export const PRIVATE_STORAGE_TIMEOUT_MS = 20_000;
+export const MCP_VALIDATION_MAX_ERRORS = 5;
+export const MCP_PACKAGE_REPLY_TIMEOUT_MS = 20_000;
+export const MCP_PACKAGE_EXIT_TIMEOUT_MS = 10_000;
+export const MCP_PACKAGE_KILL_TIMEOUT_MS = 2_000;
+export const MCP_PACKAGE_INSTALL_TIMEOUT_MS = 300_000;
+export const MCP_PACKAGE_STDERR_MAX_CHARS = 2_000;
 export const OUTPUT_REPEAT_MIN = 5;
 export const OUTPUT_CHUNK_CHARS = 2_500;
 export const OUTPUT_FIND_MAX_CALLS = 40;

package/src/core/command-output.ts

@@ -241,9 +241,25 @@ export function failureTargets(text: string): {
     // window when no failing-tests block exists (short outputs).
     if (node && (inSecondWindow || (secondAnchor < 0 && inFirstWindow)))
       targets.push({
-        path: node[1]?.replace(/^file:\/\//, "") ?? "",
+        path: nodeTestPath(node[1] ?? ""),
         assertion: true,
       });
   }
   return { assertion: signature === "assertion", signature, targets };
 }
+
+/**
+ * node:test reports absolute locations as file URLs: file:///repo/a.mjs on
+ * POSIX and file:///C:/repo/a%20b.mjs on Windows. Convert them to plain,
+ * decoded paths; other locations are returned unchanged.
+ */
+export function nodeTestPath(location: string): string {
+  if (!location.startsWith("file://")) return location;
+  let path = location.slice("file://".length);
+  if (/^\/[A-Za-z]:\//.test(path)) path = path.slice(1);
+  try {
+    return decodeURIComponent(path);
+  } catch {
+    return path;
+  }
+}

package/src/host-tui.d.ts

@@ -0,0 +1,14 @@
+// Runtime implementations are supplied by the pi/omp extension loader.
+declare module "@earendil-works/pi-tui" {
+  export function matchesKey(
+    data: string,
+    key: "enter" | "escape" | "backspace" | "ctrl+c" | "ctrl+u",
+  ): boolean;
+  export const decodePrintableKey:
+    | ((data: string) => string | undefined)
+    | undefined;
+  export const decodeKittyPrintable:
+    | ((data: string) => string | undefined)
+    | undefined;
+  export function isKeyRelease(data: string): boolean;
+}

package/src/host.ts

@@ -20,3 +20,14 @@ export interface Names {
   byName: string;
   semantic: string;
 }
+/** MCP clients name their native tools differently; describe them generically. */
+export function mcpHost(): Host {
+  return {
+    isOmp: false,
+    names: {
+      grep: "your text search tool",
+      byName: "your file-name search tool",
+      semantic: "jev_find_files",
+    },
+  };
+}

package/src/index.ts

@@ -1,9 +1,10 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { ConfigController } from "./configuration.ts";
 import { Guide } from "./guide.ts";
 import { detectHost } from "./host.ts";
-import { createJevClient, readConfig } from "./jev/client.ts";
 import { RunEnd, type RunEndHost } from "./run-end.ts";
 import { readSessionLimits, Session } from "./session.ts";
+import { Setup } from "./setup.ts";
 import { createAskTool } from "./tools/ask.ts";
 import { createAskFilesTool } from "./tools/ask-files.ts";
 import { createCheckDiffTool } from "./tools/check-diff.ts";
@@ -12,8 +13,7 @@ import { createLocateTool } from "./tools/locate.ts";
 import { createSelectTestsTool } from "./tools/select-tests.ts";
 export default function extension(api: ExtensionAPI & { pi?: unknown }): void {
   const host = detectHost(api);
-  const config = readConfig(process.env);
-  const client = config ? createJevClient(config) : undefined;
+  const config = new ConfigController();
   const runtime = {
     session: new Session(readSessionLimits(process.env)),
     guide: new Guide(host),
@@ -22,14 +22,22 @@ export default function extension(api: ExtensionAPI & { pi?: unknown }): void {
   api.on("session_start", async () => {
     runtime.session.reset();
     runtime.guide.reset();
-    client?.clearCache();
+    config.client?.clearCache();
     if (host.isOmp) {
       const active = api.getActiveTools();
       if (!active.includes("find"))
         await api.setActiveTools([...active, "jev_find_files"]);
     }
   });
-  const dependencies = { client, host, runtime, exec: api.exec.bind(api) };
+  new Setup(config).attach(api);
+  const dependencies = {
+    get client() {
+      return config.client;
+    },
+    host,
+    runtime,
+    exec: api.exec.bind(api),
+  };
   new RunEnd(dependencies).attach(api as unknown as RunEndHost);
   api.registerTool(createAskTool(dependencies));
   api.registerTool(createSelectTestsTool(dependencies));