@lunaroute/cli 0.2.0 → 0.2.2

package/README.md

@@ -15,11 +15,10 @@ Requires Node.js 20+.
 ## Quickstart
 
 ```sh
-lunaroute login          # authorize this device in your browser
-lunaroute setup pi       # or: claude-code | opencode | copilot-cli | generic
+lunaroute setup pi       # or: opencode | claude-code | copilot-cli | generic
 ```
 
-`setup` asks before touching anything: for `pi` it first offers to install the LunaRoute Pi extension + MCP adapter (recommended — models then auto-sync), and falls back to a `~/.pi/agent/models.json` merge if you decline. It finishes with an `export LUNAROUTE_API_KEY=…` line — run it in your shell, then start your agent and it routes through LunaRoute.
+One command from a fresh machine: `setup` asks before touching anything — for `pi` it first offers to install the LunaRoute Pi extension + MCP adapter (recommended — models then auto-sync, and you sign in with `/login lunaroute` inside pi), then offers to start pi for you. `opencode` works the same way with its extension (`/connect` to sign in). Decline an extension — or pick a harness whose config needs a key — and `setup` offers to run `lunaroute login` right there (it opens your browser) before writing. The fallback config finishes with an `export LUNAROUTE_API_KEY=…` line — run it in your shell, then start your agent and it routes through LunaRoute.
 
 Prefer a script? `setup pi --extension` / `--models` pick a flow, `--yes` accepts all prompts, and `--print` previews without writing.
 

package/dist/index.js

@@ -3,6 +3,9 @@
 // src/index.ts
 import { Command, InvalidArgumentError, Option } from "commander";
 
+// package.json
+var version = "0.2.2";
+
 // src/login.ts
 import { createServer } from "http";
 import { hostname } from "os";
@@ -75,6 +78,71 @@ async function getUsage(ctx, limit) {
   const q = limit ? `?limit=${limit}` : "";
   return cliGet(ctx, `/v1/cli/usage${q}`);
 }
+async function cliRequestRaw(ctx, method, path, body) {
+  const res = await fetch(`${ctx.apiUrl}${path}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${ctx.apiKey}`,
+      ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+  });
+  if (!res.ok) {
+    let detail = `HTTP ${res.status}`;
+    let envelope = false;
+    try {
+      const parsed2 = await res.json();
+      const code = parsed2?.error?.code;
+      const message = parsed2?.error?.message;
+      if (code) {
+        envelope = true;
+        detail = message ? `${code}: ${message}` : code;
+      } else if (message) {
+        detail = message;
+      }
+    } catch {
+    }
+    if (res.status === 404 && !envelope) {
+      throw new Error("this server does not support search-keys (server upgrade required)");
+    }
+    throw new Error(`request failed: ${detail}`);
+  }
+  const text = await res.text();
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error("request failed: unexpected response body");
+  }
+  if (parsed?.success === false && parsed.error?.code) {
+    const { code, message } = parsed.error;
+    throw new Error(`request failed: ${message ? `${code}: ${message}` : code}`);
+  }
+  if (parsed?.success !== true || parsed.data === void 0) {
+    throw new Error("request failed: unexpected response body");
+  }
+  return text;
+}
+async function cliRequest(ctx, method, path, body) {
+  const text = await cliRequestRaw(ctx, method, path, body);
+  const parsed = JSON.parse(text);
+  return parsed.data;
+}
+async function listSearchProviders(ctx) {
+  return cliRequest(ctx, "GET", "/v1/cli/search-providers");
+}
+async function listSearchKeys(ctx) {
+  return cliRequest(ctx, "GET", "/v1/cli/search-provider-keys");
+}
+async function listSearchKeysRaw(ctx) {
+  return cliRequestRaw(ctx, "GET", "/v1/cli/search-provider-keys");
+}
+async function putSearchKey(ctx, provider, apiKey) {
+  return cliRequest(ctx, "PUT", "/v1/cli/search-provider-keys", { provider, api_key: apiKey });
+}
+async function deleteSearchKey(ctx, provider) {
+  await cliRequest(ctx, "DELETE", `/v1/cli/search-provider-keys?provider=${encodeURIComponent(provider)}`);
+}
 
 // src/config.ts
 import { homedir } from "os";
@@ -203,6 +271,7 @@ async function startLoopbackServer() {
     const state = url.searchParams.get("state") ?? "";
     res.statusCode = 200;
     res.setHeader("Content-Type", "text/html");
+    res.setHeader("Access-Control-Allow-Origin", "*");
     res.end(
       "<html><body><h2>LunaRoute CLI authorized.</h2><p>You can close this tab and return to your terminal.</p></body></html>"
     );
@@ -397,6 +466,75 @@ async function confirm(question, opts = {}) {
     rl.close();
   }
 }
+async function promptInput(question, opts = {}) {
+  if (!process.stdin.isTTY && opts.default === void 0) {
+    throw new NonInteractiveTerminalError(`${question} requires a TTY \u2014 pass a flag instead`);
+  }
+  if (!process.stdin.isTTY) {
+    return opts.default;
+  }
+  process.stdout.write(question + (opts.default !== void 0 ? ` [${opts.default}] ` : ": "));
+  const raw = !!opts.hidden && !!process.stdin.isTTY;
+  if (raw) {
+    process.stdin.setRawMode(true);
+  }
+  const chunks = [];
+  process.stdin.resume();
+  await new Promise((resolve) => {
+    const off = () => {
+      process.stdin.removeListener("data", onData);
+      process.stdin.pause();
+    };
+    const trimOneCodepoint = () => {
+      const all = Buffer.concat(chunks);
+      let end = all.length;
+      while (end > 0 && (all[end - 1] & 192) === 128) end--;
+      if (end > 0) end--;
+      chunks.length = 0;
+      if (end > 0) chunks.push(all.subarray(0, end));
+    };
+    const onData = (c) => {
+      let i = 0;
+      let runStart = -1;
+      const flushRun = (upto) => {
+        if (runStart >= 0) {
+          chunks.push(c.subarray(runStart, upto));
+          runStart = -1;
+        }
+      };
+      while (i < c.length) {
+        const b = c[i];
+        if (raw && b === 3) {
+          off();
+          process.stdin.setRawMode(false);
+          process.exit(130);
+        }
+        if (b === 13 || b === 10) {
+          flushRun(i);
+          off();
+          resolve();
+          return;
+        }
+        if (raw && (b === 127 || b === 8)) {
+          flushRun(i);
+          trimOneCodepoint();
+          i++;
+          continue;
+        }
+        if (runStart < 0) runStart = i;
+        i++;
+      }
+      flushRun(c.length);
+    };
+    process.stdin.on("data", onData);
+  });
+  if (raw) {
+    process.stdin.setRawMode(false);
+    process.stdout.write("\n");
+  }
+  const value = Buffer.concat(chunks).toString("utf8").trim();
+  return value === "" && opts.default !== void 0 ? opts.default : value;
+}
 
 // src/commands/setup.ts
 import { spawn } from "child_process";
@@ -588,21 +726,24 @@ function buildPlan3(ctx) {
       { name: ctx.keyEnvVar, value: "__KEY__" },
       // Point at the routing root; Claude Code appends /v1/messages itself.
       { name: "ANTHROPIC_BASE_URL", value: ctx.routingUrl },
-      // Claude Code sends ANTHROPIC_API_KEY as the native x-api-key header. The
-      // routing edge recognizes the lr_ prefix, authenticates it, and strips the
-      // header before forwarding upstream — so the key never leaks and never
-      // sits in the URL path.
-      { name: "ANTHROPIC_API_KEY", value: `$${ctx.keyEnvVar}` },
+      // Claude Code sends ANTHROPIC_AUTH_TOKEN as `Authorization: Bearer`. The
+      // routing edge recognizes the lr_ prefix, authenticates it, and strips
+      // the header before forwarding upstream — so the key never leaks and
+      // never sits in the URL path. Bearer also outranks a stored claude.ai
+      // subscription OAuth login; ANTHROPIC_API_KEY does not (unapproved env
+      // keys are ignored and the OAuth token 401s through the gateway, kata
+      // 009h).
+      { name: "ANTHROPIC_AUTH_TOKEN", value: `$${ctx.keyEnvVar}` },
       { name: "ANTHROPIC_MODEL", value: firstModel }
     ],
     notes: [
       "\nClaude Code: add the exports above to your shell profile, then restart Claude Code.",
       `Change ANTHROPIC_MODEL to any of: ${ctx.models.map((m) => m.id).join(", ")}`,
-      "(Auth travels in the native x-api-key header via ANTHROPIC_API_KEY.)",
-      "If your Claude Code build requires a bearer token instead, set ANTHROPIC_AUTH_TOKEN=$LUNAROUTE_API_KEY \u2014 LunaRoute also authenticates lr_ keys sent as Authorization: Bearer.",
+      "(Auth travels in the Authorization: Bearer header via ANTHROPIC_AUTH_TOKEN.)",
+      "If your Claude Code build predates ANTHROPIC_AUTH_TOKEN support, set ANTHROPIC_API_KEY=$LUNAROUTE_API_KEY instead \u2014 LunaRoute also authenticates lr_ keys sent as x-api-key. Bearer wins whenever both are set.",
       "To set these in ~/.claude/settings.json instead, note its env values are literal \u2014 the key would be baked into the file rather than read from $LUNAROUTE_API_KEY.",
       "If Claude Code hangs or keeps retrying when connecting, your key is likely wrong \u2014 it retries auth errors silently. Debug with the curl below, which fails fast with the real error:",
-      `  curl ${ctx.routingUrl}/v1/messages -H "x-api-key: $${ctx.keyEnvVar}" -H "content-type: application/json" -d '{"model":"${firstModel}","max_tokens":16,"messages":[{"role":"user","content":"ping"}]}'`
+      `  curl ${ctx.routingUrl}/v1/messages -H "Authorization: Bearer $${ctx.keyEnvVar}" -H "content-type: application/json" -d '{"model":"${firstModel}","max_tokens":16,"messages":[{"role":"user","content":"ping"}]}'`
     ]
   };
 }
@@ -651,24 +792,24 @@ function buildPlan5(ctx) {
 
 // src/setup/routing-url.ts
 function validatedRoutingUrl(routingUrl) {
-  function fail(reason) {
+  function fail2(reason) {
     throw new Error(
       `routingUrl rejected (reason: ${reason}; <redacted URL>) \u2014 check --routing-url or the profile's routing URL`
     );
   }
-  if (!/^https?:\/\/[^/?#]/.test(routingUrl)) fail("invalid-url");
-  if (/[?#]/.test(routingUrl)) fail("query-or-fragment");
-  if (routingUrl !== routingUrl.trim()) fail("whitespace");
-  if (routingUrl.endsWith("/")) fail("trailing-slash");
+  if (!/^https?:\/\/[^/?#]/.test(routingUrl)) fail2("invalid-url");
+  if (/[?#]/.test(routingUrl)) fail2("query-or-fragment");
+  if (routingUrl !== routingUrl.trim()) fail2("whitespace");
+  if (routingUrl.endsWith("/")) fail2("trailing-slash");
   let parsed;
   try {
     parsed = new URL(routingUrl);
   } catch {
-    fail("invalid-url");
+    fail2("invalid-url");
   }
-  if (parsed.username !== "" || parsed.password !== "") fail("userinfo");
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") fail("invalid-url");
-  if (parsed.hostname === "") fail("invalid-url");
+  if (parsed.username !== "" || parsed.password !== "") fail2("userinfo");
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") fail2("invalid-url");
+  if (parsed.hostname === "") fail2("invalid-url");
   return routingUrl;
 }
 
@@ -744,23 +885,23 @@ var ADAPTERS = {
 var PI_INSTALL_PACKAGES = ["npm:@lunaroute/pi-extension", "npm:pi-mcp-adapter"];
 async function runSetup(harness, opts, deps = {
   confirm,
-  spawn: (command, args) => spawn(command, args, { stdio: "inherit" })
+  spawn: (command, args) => spawn(command, args, { stdio: "inherit" }),
+  runLogin
 }) {
   if (harness === "pi" && opts.extension && opts.models) {
     console.error("Choose one of --extension or --models.");
     return 1;
   }
   const adapter = ADAPTERS[harness];
-  if (!adapter) {
-    console.error(`Unknown harness "${harness}". Choose one of: ${Object.keys(ADAPTERS).join(", ")}.`);
-    return 1;
-  }
-  const creds = loadProfile(opts.profile);
-  if (!creds || !creds.routing_key) {
-    console.error('Not logged in. Run "lunaroute login" first.');
+  if (!adapter && harness !== "hermes") {
+    console.error(
+      `Unknown harness "${harness}". Choose one of: ${[...Object.keys(ADAPTERS), "hermes"].join(", ")}.`
+    );
     return 1;
   }
-  const routingUrlRaw = opts.routingUrl || creds.routing_url;
+  const stored = loadProfile(opts.profile);
+  const settings = resolveSettings(opts.profile);
+  const routingUrlRaw = opts.routingUrl || stored?.routing_url || settings.routing_url;
   if (!routingUrlRaw) {
     console.error("No routing URL in profile; pass --routing-url.");
     return 1;
@@ -773,10 +914,15 @@ async function runSetup(harness, opts, deps = {
     return 1;
   }
   if (harness === "pi" && !opts.print) {
-    return runPiSetup(opts, deps);
+    return runPiSetup(opts, stored, routingUrl, deps);
   }
   if (harness === "opencode") {
-    return runOpencodeSetup(creds, routingUrl, opts, deps);
+    return runOpencodeSetup(stored, settings, routingUrl, opts, deps);
+  }
+  const creds = await requireCreds(opts, deps, stored);
+  if (!creds) return 1;
+  if (harness === "hermes") {
+    return runHermesSetup(creds, routingUrl, opts, deps);
   }
   let models;
   try {
@@ -811,7 +957,39 @@ Wrote: ${summary.written.join(", ")}`);
     return 1;
   }
 }
-async function runPiSetup(opts, deps) {
+var NOT_LOGGED_IN = 'Not logged in. Run "lunaroute login" first.';
+var OPENCODE_LOGIN_HINT = "Or re-run and choose the extension \u2014 it logs in via /connect inside opencode.";
+var PI_LOGIN_HINT = "Or re-run and choose the extension \u2014 login happens via /login lunaroute inside pi.";
+async function requireCreds(opts, deps, stored, hint) {
+  if (stored?.routing_key) return stored;
+  const decline = [NOT_LOGGED_IN, hint].filter(Boolean).join(" ");
+  try {
+    const ok = await deps.confirm('Not logged in. Run "lunaroute login" now? (opens your browser)');
+    if (!ok) {
+      console.error(decline);
+      return null;
+    }
+  } catch (err) {
+    if (err instanceof NonInteractiveTerminalError) {
+      console.error(decline);
+      return null;
+    }
+    throw err;
+  }
+  try {
+    await deps.runLogin(opts.profile);
+  } catch (err) {
+    console.error(`Login failed: ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+  const fresh = loadProfile(opts.profile);
+  if (!fresh?.routing_key) {
+    console.error(NOT_LOGGED_IN);
+    return null;
+  }
+  return fresh;
+}
+async function runPiSetup(opts, stored, routingUrl, deps) {
   try {
     if (opts.extension) {
       const ok = await deps.confirm(
@@ -823,19 +1001,28 @@ async function runPiSetup(opts, deps) {
         console.log(`  pi install ${PI_INSTALL_PACKAGES.join(" && pi install ")}`);
         return 0;
       }
-      return installPiExtension(deps.spawn);
+      return installPiExtension(deps, opts);
     }
     if (opts.models) {
-      return applyPiModels(opts, await deps.confirm("Merge LunaRoute provider into ~/.pi/agent/models.json (backup kept, other providers preserved)?", { yes: opts.yes }));
+      const creds2 = await requireCreds(opts, deps, stored, PI_LOGIN_HINT);
+      if (!creds2) return 1;
+      return applyPiModels(
+        creds2,
+        routingUrl,
+        await deps.confirm("Merge LunaRoute provider into ~/.pi/agent/models.json (backup kept, other providers preserved)?", { yes: opts.yes })
+      );
     }
     if (await deps.confirm(
       "Install the LunaRoute Pi extension + MCP adapter via 'pi install' (recommended \u2014 auto-registers models)?",
       { yes: opts.yes }
     )) {
-      return installPiExtension(deps.spawn);
+      return installPiExtension(deps, opts);
     }
+    const creds = await requireCreds(opts, deps, stored, PI_LOGIN_HINT);
+    if (!creds) return 1;
     return applyPiModels(
-      opts,
+      creds,
+      routingUrl,
       await deps.confirm("Merge LunaRoute provider into ~/.pi/agent/models.json (backup kept, other providers preserved)?", {
         yes: opts.yes
       })
@@ -851,24 +1038,96 @@ async function runPiSetup(opts, deps) {
     return 1;
   }
 }
-async function runOpencodeSetup(creds, routingUrl, opts, deps) {
+async function runHermesSetup(creds, routingUrl, opts, deps) {
+  const commands = hermesConfigSetArgs(routingUrl, creds.routing_key);
+  try {
+    if (opts.print) {
+      console.log("\n# would run:");
+      for (const args of commands) console.log(`  hermes ${args.join(" ")}`);
+      console.log(
+        "\nThen start hermes and run /model custom:lunaroute:<model> to pick a LunaRoute model (models auto-discover from /v1/models)."
+      );
+      return 0;
+    }
+    if (await deps.confirm("Configure LunaRoute for Hermes via 'hermes config set'? (recommended \u2014 models auto-discover)", {
+      yes: opts.yes
+    })) {
+      return runHermesConfigSets(deps.spawn, routingUrl, creds.routing_key);
+    }
+    console.log("Skipped. Re-run with --yes, or configure manually:");
+    for (const args of commands) console.log(`  hermes ${args.join(" ")}`);
+    console.log("\nThen start hermes and run /model custom:lunaroute:<model> to pick a LunaRoute model.");
+    return 0;
+  } catch (err) {
+    if (err instanceof NonInteractiveTerminalError) {
+      console.error("No interactive terminal available. Re-run with --yes to accept prompts, or --print to preview.");
+      return 1;
+    }
+    console.error(err instanceof Error ? err.message : String(err));
+    return 1;
+  }
+}
+function hermesConfigSetArgs(routingUrl, key) {
+  return [
+    ["config", "set", "providers.lunaroute.api", `${routingUrl}/v1`],
+    ["config", "set", "providers.lunaroute.key_env", "LUNAROUTE_API_KEY"],
+    ["config", "set", "providers.lunaroute.transport", "chat_completions"],
+    ["config", "set", "LUNAROUTE_API_KEY", key]
+  ];
+}
+async function runHermesConfigSets(spawn3, routingUrl, key) {
+  const commands = hermesConfigSetArgs(routingUrl, key);
+  const setKeys = commands.map((c) => c[2]);
+  for (let i = 0; i < commands.length; i++) {
+    const code = await new Promise((resolve) => {
+      const child = spawn3("hermes", commands[i]);
+      child.on("error", (err) => {
+        const e = err;
+        if (e?.code === "ENOENT") {
+          console.error(
+            `Error: "hermes" not found on PATH. Install Hermes Agent first: https://hermes-agent.nousresearch.com (exit 127)`
+          );
+          resolve(127);
+          return;
+        }
+        console.error(err instanceof Error ? err.message : String(err));
+        resolve(1);
+      });
+      child.on("exit", (code2) => {
+        resolve(typeof code2 === "number" ? code2 : 1);
+      });
+    });
+    if (code !== 0) {
+      const done = setKeys.slice(0, i);
+      console.error(
+        `'hermes config set ${setKeys[i]}' failed (exit ${code}). Set so far: ${done.length ? done.join(", ") : "nothing"}. Re-run 'lunaroute setup hermes' to retry (all steps are idempotent).`
+      );
+      return code || 1;
+    }
+  }
+  console.log("\nConfigured. Start hermes (or restart it if already running), then:");
+  console.log("  /model custom:lunaroute:<model>   # switch to a LunaRoute model (models auto-discover from /v1/models)");
+  console.log("  hermes model                      # interactive provider/model picker");
+  return 0;
+}
+async function runOpencodeSetup(stored, settings, routingUrl, opts, deps) {
   try {
     if (opts.print) {
       const plan = buildPlan(
-        { routingUrl, orgId: creds.org_id, models: [], keyEnvVar: "LUNAROUTE_API_KEY" },
+        { routingUrl, orgId: settings.org_id, models: [], keyEnvVar: "LUNAROUTE_API_KEY" },
         { extension: true }
       );
-      return applyAndReport(plan, creds.routing_key, false);
+      return applyAndReport(plan, stored?.routing_key ?? "", false);
     }
     if (await deps.confirm(
       "Install the LunaRoute OpenCode extension (recommended \u2014 /connect login, models auto-sync)?",
       { yes: opts.yes }
     )) {
       const plan = buildPlan(
-        { routingUrl, orgId: creds.org_id, models: [], keyEnvVar: "LUNAROUTE_API_KEY" },
+        { routingUrl, orgId: settings.org_id, models: [], keyEnvVar: "LUNAROUTE_API_KEY" },
         { extension: true }
       );
-      const code = await applyAndReport(plan, creds.routing_key, !opts.print);
+      const code = await applyAndReport(plan, stored?.routing_key ?? "", true);
       if (code !== 0) return code;
       if (await deps.confirm("Start opencode now? (if it's already open, quit and reopen it to load the extension)", {
         yes: opts.yes
@@ -878,6 +1137,8 @@ async function runOpencodeSetup(creds, routingUrl, opts, deps) {
       console.log("\nStart opencode when ready \u2014 then run /connect to log in and /models to pick a LunaRoute model.");
       return 0;
     }
+    const creds = await requireCreds(opts, deps, stored, OPENCODE_LOGIN_HINT);
+    if (!creds) return 1;
     const write = await deps.confirm(
       "Merge LunaRoute provider into opencode.json instead? (backup kept, other providers preserved)",
       { yes: opts.yes }
@@ -942,10 +1203,10 @@ async function launchOpencode(spawn3) {
     });
   });
 }
-async function installPiExtension(spawn3) {
+async function installPiExtension(deps, opts) {
   for (const pkg of PI_INSTALL_PACKAGES) {
     const code = await new Promise((resolve) => {
-      const child = spawn3("pi", ["install", pkg]);
+      const child = deps.spawn("pi", ["install", pkg]);
       child.on("error", (err) => {
         const e = err;
         if (e?.code === "ENOENT") {
@@ -968,22 +1229,42 @@ async function installPiExtension(spawn3) {
       return code || 1;
     }
   }
-  console.log("\nInstalled. Next steps inside pi:");
+  if (await deps.confirm("Start pi now? (then run /login lunaroute to sign in)", { yes: opts.yes })) {
+    return launchPi(deps.spawn);
+  }
+  console.log("\nStart pi when ready \u2014 then inside pi:");
   console.log("  1. /login lunaroute \u2014 browser login issues and stores an lr_ key.");
   console.log("  2. /model \u2014 pick a lunaroute/* model (models auto-sync from /v1/models).");
   return 0;
 }
-async function applyPiModels(opts, write) {
-  const creds = loadProfile(opts.profile);
+async function launchPi(spawn3) {
+  return new Promise((resolve) => {
+    const child = spawn3("pi", []);
+    child.on("error", (err) => {
+      const e = err;
+      if (e?.code === "ENOENT") {
+        console.error(`Error: "pi" not found on PATH. Install pi first: https://pi.dev (exit 127)`);
+        resolve(127);
+        return;
+      }
+      console.error(err instanceof Error ? err.message : String(err));
+      resolve(1);
+    });
+    child.on("exit", (code) => {
+      resolve(typeof code === "number" ? code : 1);
+    });
+  });
+}
+async function applyPiModels(creds, routingUrl, write) {
   let models;
   try {
-    models = await fetchModels(opts.routingUrl || creds.routing_url || "");
+    models = await fetchModels(routingUrl);
   } catch (err) {
     console.error(`Could not fetch the model catalog: ${err instanceof Error ? err.message : err}`);
     return 1;
   }
   const plan = buildPlan2({
-    routingUrl: opts.routingUrl || creds.routing_url,
+    routingUrl,
     orgId: creds.org_id,
     models,
     keyEnvVar: "LUNAROUTE_API_KEY"
@@ -1177,12 +1458,12 @@ async function readMemory(ctx, p) {
 }
 
 // src/commands/memory.ts
-var NOT_LOGGED_IN = 'Not logged in. Run "lunaroute login" first.';
+var NOT_LOGGED_IN2 = 'Not logged in. Run "lunaroute login" first.';
 var NO_PROJECT = "No project context: run inside a git repo with an origin remote, or set LUNAROUTE_PROJECT_ID.";
 function contextFor(profile) {
   const s = resolveSettings(profile);
   if (!s.routing_key) {
-    console.error(NOT_LOGGED_IN);
+    console.error(NOT_LOGGED_IN2);
     return 1;
   }
   const projectId = resolveProjectId();
@@ -1250,6 +1531,86 @@ async function runMemoryRead(profile, id, opts) {
   return 0;
 }
 
+// src/commands/searchKeys.ts
+var notLoggedIn = () => {
+  console.error('Not logged in. Run "lunaroute login" first.');
+  return 1;
+};
+var fail = (err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  return 1;
+};
+async function runSearchKeysList(profile, opts) {
+  const s = resolveSettings(profile);
+  if (!s.routing_key) return notLoggedIn();
+  const ctx = { apiUrl: s.api_url, apiKey: s.routing_key };
+  try {
+    if (opts.json) {
+      console.log(await listSearchKeysRaw(ctx));
+      return 0;
+    }
+    const keys = await listSearchKeys(ctx);
+    if (keys.length === 0) {
+      console.log("No search provider keys configured.");
+      return 0;
+    }
+    console.log(
+      renderTable(
+        ["PROVIDER", "CREATED", "UPDATED"],
+        keys.map((k) => [k.provider, k.created_at, k.updated_at])
+      )
+    );
+    return 0;
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function runSearchKeysSet(profile, opts) {
+  const s = resolveSettings(profile);
+  if (!s.routing_key) return notLoggedIn();
+  const ctx = { apiUrl: s.api_url, apiKey: s.routing_key };
+  try {
+    let provider = opts.provider;
+    let apiKey = opts.apiKey ?? process.env.LUNAROUTE_SEARCH_API_KEY;
+    const providers = await listSearchProviders(ctx);
+    const known = providers.map((p) => p.key);
+    if (!provider) {
+      provider = await promptInput(`Provider (${known.join(", ")})`);
+    }
+    if (!known.includes(provider)) {
+      console.error(`unknown provider "${provider}" \u2014 this server offers: ${known.join(", ")}`);
+      return 1;
+    }
+    if (!apiKey) {
+      apiKey = await promptInput("API key", { hidden: true });
+    }
+    const meta = await putSearchKey(ctx, provider, apiKey);
+    console.log(`Stored key for ${meta.provider} (updated ${meta.updated_at}).`);
+    return 0;
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function runSearchKeysRemove(profile, provider, opts) {
+  const s = resolveSettings(profile);
+  if (!s.routing_key) return notLoggedIn();
+  const ctx = { apiUrl: s.api_url, apiKey: s.routing_key };
+  try {
+    if (!opts.yes) {
+      const ok = await confirm(`Remove the ${provider} search key?`);
+      if (!ok) {
+        console.log("Aborted.");
+        return 0;
+      }
+    }
+    await deleteSearchKey(ctx, provider);
+    console.log(`Removed key for ${provider}.`);
+    return 0;
+  } catch (err) {
+    return fail(err);
+  }
+}
+
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -1305,7 +1666,7 @@ async function runMcp(profile) {
     read: (p) => readMemory(ctx, p),
     resolveProjectId
   };
-  const server = new McpServer({ name: "lunaroute-memory", version: "0.1.0" });
+  const server = new McpServer({ name: "lunaroute-memory", version });
   server.registerTool(
     "search",
     {
@@ -1440,7 +1801,7 @@ function buildRunSpec(ctx) {
     args: [],
     env: {
       ANTHROPIC_BASE_URL: ctx.routingUrl,
-      ANTHROPIC_API_KEY: ctx.apiKey,
+      ANTHROPIC_AUTH_TOKEN: ctx.apiKey,
       ANTHROPIC_MODEL: ctx.model,
       // Pins the Haiku/background model so Claude Code's background tasks
       // (titles, summaries, compaction) route through LunaRoute instead of
@@ -1538,7 +1899,7 @@ async function runRun(harness, opts, deps = realDeps) {
 
 // src/index.ts
 var program = new Command();
-program.name("lunaroute").description("LunaRoute CLI \u2014 configure coding harnesses and manage your account.").version("0.1.0").option("-p, --profile <name>", "credential profile to use", "default");
+program.name("lunaroute").description("LunaRoute CLI \u2014 configure coding harnesses and manage your account.").version(version).option("-p, --profile <name>", "credential profile to use", "default");
 program.command("login").description("Authorize this device via the browser and store a routing key.").action(async () => {
   await login(program.opts().profile);
 });
@@ -1548,7 +1909,7 @@ program.command("whoami").description("Show the signed-in user and organization.
 program.command("logout").description("Remove stored credentials for the active profile.").action(() => {
   logout(program.opts().profile);
 });
-program.command("setup <harness>").description("Configure a coding harness (opencode | pi | claude-code | copilot-cli | generic).").option("--print", "print the config instead of writing files", false).option("--routing-url <url>", "override the routing base URL").option("--yes", "accept all confirmation prompts without a TTY (for scripts)", false).option("--extension", "pi only: jump straight to installing the Pi extension + MCP adapter").option("--models", "pi only: jump straight to writing the models.json provider block").action(async (harness, opts) => {
+program.command("setup <harness>").description("Configure a coding harness (opencode | pi | hermes | claude-code | copilot-cli | openclaw | generic).").option("--print", "print the config instead of writing files", false).option("--routing-url <url>", "override the routing base URL").option("--yes", "accept all confirmation prompts without a TTY (for scripts)", false).option("--extension", "pi only: jump straight to installing the Pi extension + MCP adapter").option("--models", "pi only: jump straight to writing the models.json provider block").action(async (harness, opts) => {
   const code = await runSetup(harness, {
     profile: program.opts().profile,
     print: opts.print,
@@ -1617,6 +1978,19 @@ skill.command("install").description("Install the LunaRoute memory skill + MCP s
   const code = await runSkillInstall(program.opts().profile, opts);
   if (code !== 0) process.exit(code);
 });
+var searchKeys = program.command("search-keys").description("Manage web-search provider keys (BYOK) for your organization.");
+searchKeys.command("list").description("List configured search provider keys.").option("--json", "output the raw API envelope", false).action(async (opts) => {
+  const code = await runSearchKeysList(program.opts().profile, { json: opts.json });
+  if (code !== 0) process.exit(code);
+});
+searchKeys.command("set").description("Store or replace a search provider key (prompts for missing values).").option("--provider <key>", "provider key (e.g. kagi, brave, exa)").option("--api-key <key>", "API key (visible in shell history \u2014 prefer the prompt or LUNAROUTE_SEARCH_API_KEY)").action(async (opts) => {
+  const code = await runSearchKeysSet(program.opts().profile, { provider: opts.provider, apiKey: opts.apiKey });
+  if (code !== 0) process.exit(code);
+});
+searchKeys.command("remove <provider>").description("Remove a search provider key.").option("--yes", "skip the confirmation prompt", false).action(async (provider, opts) => {
+  const code = await runSearchKeysRemove(program.opts().profile, provider, { yes: opts.yes });
+  if (code !== 0) process.exit(code);
+});
 program.parseAsync(process.argv).catch((err) => {
   console.error(err instanceof Error ? err.message : err);
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunaroute/cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "LunaRoute CLI — configure coding harnesses and manage your LunaRoute account.",
   "repository": {
     "type": "git",