@lunaroute/cli 0.2.1 → 0.2.3

package/README.md

@@ -15,11 +15,10 @@ Requires Node.js 20+.
 ## Quickstart
 
 ```sh
-lunaroute login          # authorize this device in your browser
-lunaroute setup pi       # or: claude-code | opencode | copilot-cli | generic
+lunaroute setup pi       # or: opencode | claude-code | copilot-cli | generic
 ```
 
-`setup` asks before touching anything: for `pi` it first offers to install the LunaRoute Pi extension + MCP adapter (recommended — models then auto-sync), and falls back to a `~/.pi/agent/models.json` merge if you decline. It finishes with an `export LUNAROUTE_API_KEY=…` line — run it in your shell, then start your agent and it routes through LunaRoute.
+One command from a fresh machine: `setup` asks before touching anything — for `pi` it first offers to install the LunaRoute Pi extension + MCP adapter (recommended — models then auto-sync, and you sign in with `/login lunaroute` inside pi), then offers to start pi for you. `opencode` works the same way with its extension (`/connect` to sign in). Decline an extension — or pick a harness whose config needs a key — and `setup` offers to run `lunaroute login` right there (it opens your browser) before writing. The fallback config finishes with an `export LUNAROUTE_API_KEY=…` line — run it in your shell, then start your agent and it routes through LunaRoute.
 
 Prefer a script? `setup pi --extension` / `--models` pick a flow, `--yes` accepts all prompts, and `--print` previews without writing.
 

package/dist/index.js

@@ -4,7 +4,7 @@
 import { Command, InvalidArgumentError, Option } from "commander";
 
 // package.json
-var version = "0.2.1";
+var version = "0.2.3";
 
 // src/login.ts
 import { createServer } from "http";
@@ -78,6 +78,71 @@ async function getUsage(ctx, limit) {
   const q = limit ? `?limit=${limit}` : "";
   return cliGet(ctx, `/v1/cli/usage${q}`);
 }
+async function cliRequestRaw(ctx, method, path, body) {
+  const res = await fetch(`${ctx.apiUrl}${path}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${ctx.apiKey}`,
+      ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+  });
+  if (!res.ok) {
+    let detail = `HTTP ${res.status}`;
+    let envelope = false;
+    try {
+      const parsed2 = await res.json();
+      const code = parsed2?.error?.code;
+      const message = parsed2?.error?.message;
+      if (code) {
+        envelope = true;
+        detail = message ? `${code}: ${message}` : code;
+      } else if (message) {
+        detail = message;
+      }
+    } catch {
+    }
+    if (res.status === 404 && !envelope) {
+      throw new Error("this server does not support search-keys (server upgrade required)");
+    }
+    throw new Error(`request failed: ${detail}`);
+  }
+  const text = await res.text();
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error("request failed: unexpected response body");
+  }
+  if (parsed?.success === false && parsed.error?.code) {
+    const { code, message } = parsed.error;
+    throw new Error(`request failed: ${message ? `${code}: ${message}` : code}`);
+  }
+  if (parsed?.success !== true || parsed.data === void 0) {
+    throw new Error("request failed: unexpected response body");
+  }
+  return text;
+}
+async function cliRequest(ctx, method, path, body) {
+  const text = await cliRequestRaw(ctx, method, path, body);
+  const parsed = JSON.parse(text);
+  return parsed.data;
+}
+async function listSearchProviders(ctx) {
+  return cliRequest(ctx, "GET", "/v1/cli/search-providers");
+}
+async function listSearchKeys(ctx) {
+  return cliRequest(ctx, "GET", "/v1/cli/search-provider-keys");
+}
+async function listSearchKeysRaw(ctx) {
+  return cliRequestRaw(ctx, "GET", "/v1/cli/search-provider-keys");
+}
+async function putSearchKey(ctx, provider, apiKey) {
+  return cliRequest(ctx, "PUT", "/v1/cli/search-provider-keys", { provider, api_key: apiKey });
+}
+async function deleteSearchKey(ctx, provider) {
+  await cliRequest(ctx, "DELETE", `/v1/cli/search-provider-keys?provider=${encodeURIComponent(provider)}`);
+}
 
 // src/config.ts
 import { homedir } from "os";
@@ -206,6 +271,7 @@ async function startLoopbackServer() {
     const state = url.searchParams.get("state") ?? "";
     res.statusCode = 200;
     res.setHeader("Content-Type", "text/html");
+    res.setHeader("Access-Control-Allow-Origin", "*");
     res.end(
       "<html><body><h2>LunaRoute CLI authorized.</h2><p>You can close this tab and return to your terminal.</p></body></html>"
     );
@@ -400,9 +466,101 @@ async function confirm(question, opts = {}) {
     rl.close();
   }
 }
+async function promptInput(question, opts = {}) {
+  if (!process.stdin.isTTY && opts.default === void 0) {
+    throw new NonInteractiveTerminalError(`${question} requires a TTY \u2014 pass a flag instead`);
+  }
+  if (!process.stdin.isTTY) {
+    return opts.default;
+  }
+  process.stdout.write(question + (opts.default !== void 0 ? ` [${opts.default}] ` : ": "));
+  const raw = !!opts.hidden && !!process.stdin.isTTY;
+  if (raw) {
+    process.stdin.setRawMode(true);
+  }
+  const chunks = [];
+  process.stdin.resume();
+  await new Promise((resolve) => {
+    const off = () => {
+      process.stdin.removeListener("data", onData);
+      process.stdin.pause();
+    };
+    const trimOneCodepoint = () => {
+      const all = Buffer.concat(chunks);
+      let end = all.length;
+      while (end > 0 && (all[end - 1] & 192) === 128) end--;
+      if (end > 0) end--;
+      chunks.length = 0;
+      if (end > 0) chunks.push(all.subarray(0, end));
+    };
+    const onData = (c) => {
+      let i = 0;
+      let runStart = -1;
+      const flushRun = (upto) => {
+        if (runStart >= 0) {
+          chunks.push(c.subarray(runStart, upto));
+          runStart = -1;
+        }
+      };
+      while (i < c.length) {
+        const b = c[i];
+        if (raw && b === 3) {
+          off();
+          process.stdin.setRawMode(false);
+          process.exit(130);
+        }
+        if (b === 13 || b === 10) {
+          flushRun(i);
+          off();
+          resolve();
+          return;
+        }
+        if (raw && (b === 127 || b === 8)) {
+          flushRun(i);
+          trimOneCodepoint();
+          i++;
+          continue;
+        }
+        if (runStart < 0) runStart = i;
+        i++;
+      }
+      flushRun(c.length);
+    };
+    process.stdin.on("data", onData);
+  });
+  if (raw) {
+    process.stdin.setRawMode(false);
+    process.stdout.write("\n");
+  }
+  const value = Buffer.concat(chunks).toString("utf8").trim();
+  return value === "" && opts.default !== void 0 ? opts.default : value;
+}
 
-// src/commands/setup.ts
-import { spawn } from "child_process";
+// src/spawn.ts
+import { spawn as nodeSpawn } from "child_process";
+import { spawn as crossSpawn } from "cross-spawn";
+function makeRealSpawn(platform = process.platform) {
+  if (platform === "win32") {
+    return (command, args, env) => crossSpawn(command, args, { stdio: "inherit", env });
+  }
+  return (command, args, env) => nodeSpawn(command, args, { stdio: "inherit", env });
+}
+function describeSpawnError(command, installHint, err) {
+  const code = err?.code;
+  if (code === "ENOENT") {
+    return {
+      message: `Error: "${command}" not found on PATH. ${installHint} (exit 127)`,
+      exitCode: 127
+    };
+  }
+  if (code === "EINVAL") {
+    return {
+      message: `Error: "${command}" could not be launched \u2014 Node on Windows refuses to execute npm .cmd shims directly (EINVAL). The tool is likely installed; try running it manually. (exit 126)`,
+      exitCode: 126
+    };
+  }
+  return { message: err instanceof Error ? err.message : String(err), exitCode: 1 };
+}
 
 // src/setup/paths.ts
 import { execSync } from "child_process";
@@ -657,24 +815,24 @@ function buildPlan5(ctx) {
 
 // src/setup/routing-url.ts
 function validatedRoutingUrl(routingUrl) {
-  function fail(reason) {
+  function fail2(reason) {
     throw new Error(
       `routingUrl rejected (reason: ${reason}; <redacted URL>) \u2014 check --routing-url or the profile's routing URL`
     );
   }
-  if (!/^https?:\/\/[^/?#]/.test(routingUrl)) fail("invalid-url");
-  if (/[?#]/.test(routingUrl)) fail("query-or-fragment");
-  if (routingUrl !== routingUrl.trim()) fail("whitespace");
-  if (routingUrl.endsWith("/")) fail("trailing-slash");
+  if (!/^https?:\/\/[^/?#]/.test(routingUrl)) fail2("invalid-url");
+  if (/[?#]/.test(routingUrl)) fail2("query-or-fragment");
+  if (routingUrl !== routingUrl.trim()) fail2("whitespace");
+  if (routingUrl.endsWith("/")) fail2("trailing-slash");
   let parsed;
   try {
     parsed = new URL(routingUrl);
   } catch {
-    fail("invalid-url");
+    fail2("invalid-url");
   }
-  if (parsed.username !== "" || parsed.password !== "") fail("userinfo");
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") fail("invalid-url");
-  if (parsed.hostname === "") fail("invalid-url");
+  if (parsed.username !== "" || parsed.password !== "") fail2("userinfo");
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") fail2("invalid-url");
+  if (parsed.hostname === "") fail2("invalid-url");
   return routingUrl;
 }
 
@@ -750,7 +908,8 @@ var ADAPTERS = {
 var PI_INSTALL_PACKAGES = ["npm:@lunaroute/pi-extension", "npm:pi-mcp-adapter"];
 async function runSetup(harness, opts, deps = {
   confirm,
-  spawn: (command, args) => spawn(command, args, { stdio: "inherit" })
+  spawn: makeRealSpawn(),
+  runLogin
 }) {
   if (harness === "pi" && opts.extension && opts.models) {
     console.error("Choose one of --extension or --models.");
@@ -763,12 +922,9 @@ async function runSetup(harness, opts, deps = {
     );
     return 1;
   }
-  const creds = loadProfile(opts.profile);
-  if (!creds || !creds.routing_key) {
-    console.error('Not logged in. Run "lunaroute login" first.');
-    return 1;
-  }
-  const routingUrlRaw = opts.routingUrl || creds.routing_url;
+  const stored = loadProfile(opts.profile);
+  const settings = resolveSettings(opts.profile);
+  const routingUrlRaw = opts.routingUrl || stored?.routing_url || settings.routing_url;
   if (!routingUrlRaw) {
     console.error("No routing URL in profile; pass --routing-url.");
     return 1;
@@ -781,11 +937,13 @@ async function runSetup(harness, opts, deps = {
     return 1;
   }
   if (harness === "pi" && !opts.print) {
-    return runPiSetup(opts, deps);
+    return runPiSetup(opts, stored, routingUrl, deps);
   }
   if (harness === "opencode") {
-    return runOpencodeSetup(creds, routingUrl, opts, deps);
+    return runOpencodeSetup(stored, settings, routingUrl, opts, deps);
   }
+  const creds = await requireCreds(opts, deps, stored);
+  if (!creds) return 1;
   if (harness === "hermes") {
     return runHermesSetup(creds, routingUrl, opts, deps);
   }
@@ -822,7 +980,39 @@ Wrote: ${summary.written.join(", ")}`);
     return 1;
   }
 }
-async function runPiSetup(opts, deps) {
+var NOT_LOGGED_IN = 'Not logged in. Run "lunaroute login" first.';
+var OPENCODE_LOGIN_HINT = "Or re-run and choose the extension \u2014 it logs in via /connect inside opencode.";
+var PI_LOGIN_HINT = "Or re-run and choose the extension \u2014 login happens via /login lunaroute inside pi.";
+async function requireCreds(opts, deps, stored, hint) {
+  if (stored?.routing_key) return stored;
+  const decline = [NOT_LOGGED_IN, hint].filter(Boolean).join(" ");
+  try {
+    const ok = await deps.confirm('Not logged in. Run "lunaroute login" now? (opens your browser)');
+    if (!ok) {
+      console.error(decline);
+      return null;
+    }
+  } catch (err) {
+    if (err instanceof NonInteractiveTerminalError) {
+      console.error(decline);
+      return null;
+    }
+    throw err;
+  }
+  try {
+    await deps.runLogin(opts.profile);
+  } catch (err) {
+    console.error(`Login failed: ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+  const fresh = loadProfile(opts.profile);
+  if (!fresh?.routing_key) {
+    console.error(NOT_LOGGED_IN);
+    return null;
+  }
+  return fresh;
+}
+async function runPiSetup(opts, stored, routingUrl, deps) {
   try {
     if (opts.extension) {
       const ok = await deps.confirm(
@@ -834,19 +1024,28 @@ async function runPiSetup(opts, deps) {
         console.log(`  pi install ${PI_INSTALL_PACKAGES.join(" && pi install ")}`);
         return 0;
       }
-      return installPiExtension(deps.spawn);
+      return installPiExtension(deps, opts);
     }
     if (opts.models) {
-      return applyPiModels(opts, await deps.confirm("Merge LunaRoute provider into ~/.pi/agent/models.json (backup kept, other providers preserved)?", { yes: opts.yes }));
+      const creds2 = await requireCreds(opts, deps, stored, PI_LOGIN_HINT);
+      if (!creds2) return 1;
+      return applyPiModels(
+        creds2,
+        routingUrl,
+        await deps.confirm("Merge LunaRoute provider into ~/.pi/agent/models.json (backup kept, other providers preserved)?", { yes: opts.yes })
+      );
     }
     if (await deps.confirm(
       "Install the LunaRoute Pi extension + MCP adapter via 'pi install' (recommended \u2014 auto-registers models)?",
       { yes: opts.yes }
     )) {
-      return installPiExtension(deps.spawn);
+      return installPiExtension(deps, opts);
     }
+    const creds = await requireCreds(opts, deps, stored, PI_LOGIN_HINT);
+    if (!creds) return 1;
     return applyPiModels(
-      opts,
+      creds,
+      routingUrl,
       await deps.confirm("Merge LunaRoute provider into ~/.pi/agent/models.json (backup kept, other providers preserved)?", {
         yes: opts.yes
       })
@@ -899,23 +1098,20 @@ function hermesConfigSetArgs(routingUrl, key) {
     ["config", "set", "LUNAROUTE_API_KEY", key]
   ];
 }
-async function runHermesConfigSets(spawn3, routingUrl, key) {
+async function runHermesConfigSets(spawn, routingUrl, key) {
   const commands = hermesConfigSetArgs(routingUrl, key);
   const setKeys = commands.map((c) => c[2]);
   for (let i = 0; i < commands.length; i++) {
     const code = await new Promise((resolve) => {
-      const child = spawn3("hermes", commands[i]);
+      const child = spawn("hermes", commands[i]);
       child.on("error", (err) => {
-        const e = err;
-        if (e?.code === "ENOENT") {
-          console.error(
-            `Error: "hermes" not found on PATH. Install Hermes Agent first: https://hermes-agent.nousresearch.com (exit 127)`
-          );
-          resolve(127);
-          return;
-        }
-        console.error(err instanceof Error ? err.message : String(err));
-        resolve(1);
+        const { message, exitCode } = describeSpawnError(
+          "hermes",
+          "Install Hermes Agent first: https://hermes-agent.nousresearch.com",
+          err
+        );
+        console.error(message);
+        resolve(exitCode);
       });
       child.on("exit", (code2) => {
         resolve(typeof code2 === "number" ? code2 : 1);
@@ -934,24 +1130,24 @@ async function runHermesConfigSets(spawn3, routingUrl, key) {
   console.log("  hermes model                      # interactive provider/model picker");
   return 0;
 }
-async function runOpencodeSetup(creds, routingUrl, opts, deps) {
+async function runOpencodeSetup(stored, settings, routingUrl, opts, deps) {
   try {
     if (opts.print) {
       const plan = buildPlan(
-        { routingUrl, orgId: creds.org_id, models: [], keyEnvVar: "LUNAROUTE_API_KEY" },
+        { routingUrl, orgId: settings.org_id, models: [], keyEnvVar: "LUNAROUTE_API_KEY" },
         { extension: true }
       );
-      return applyAndReport(plan, creds.routing_key, false);
+      return applyAndReport(plan, stored?.routing_key ?? "", false);
     }
     if (await deps.confirm(
       "Install the LunaRoute OpenCode extension (recommended \u2014 /connect login, models auto-sync)?",
       { yes: opts.yes }
     )) {
       const plan = buildPlan(
-        { routingUrl, orgId: creds.org_id, models: [], keyEnvVar: "LUNAROUTE_API_KEY" },
+        { routingUrl, orgId: settings.org_id, models: [], keyEnvVar: "LUNAROUTE_API_KEY" },
         { extension: true }
       );
-      const code = await applyAndReport(plan, creds.routing_key, !opts.print);
+      const code = await applyAndReport(plan, stored?.routing_key ?? "", true);
       if (code !== 0) return code;
       if (await deps.confirm("Start opencode now? (if it's already open, quit and reopen it to load the extension)", {
         yes: opts.yes
@@ -961,6 +1157,8 @@ async function runOpencodeSetup(creds, routingUrl, opts, deps) {
       console.log("\nStart opencode when ready \u2014 then run /connect to log in and /models to pick a LunaRoute model.");
       return 0;
     }
+    const creds = await requireCreds(opts, deps, stored, OPENCODE_LOGIN_HINT);
+    if (!creds) return 1;
     const write = await deps.confirm(
       "Merge LunaRoute provider into opencode.json instead? (backup kept, other providers preserved)",
       { yes: opts.yes }
@@ -1007,37 +1205,35 @@ Wrote: ${summary.written.join(", ")}`);
     return 1;
   }
 }
-async function launchOpencode(spawn3) {
+async function launchOpencode(spawn) {
   return new Promise((resolve) => {
-    const child = spawn3("opencode", []);
+    const child = spawn("opencode", []);
     child.on("error", (err) => {
-      const e = err;
-      if (e?.code === "ENOENT") {
-        console.error(`Error: "opencode" not found on PATH. Install OpenCode first: https://opencode.ai (exit 127)`);
-        resolve(127);
-        return;
-      }
-      console.error(err instanceof Error ? err.message : String(err));
-      resolve(1);
+      const { message, exitCode } = describeSpawnError(
+        "opencode",
+        "Install OpenCode first: https://opencode.ai",
+        err
+      );
+      console.error(message);
+      resolve(exitCode);
     });
     child.on("exit", (code) => {
       resolve(typeof code === "number" ? code : 1);
     });
   });
 }
-async function installPiExtension(spawn3) {
+async function installPiExtension(deps, opts) {
   for (const pkg of PI_INSTALL_PACKAGES) {
     const code = await new Promise((resolve) => {
-      const child = spawn3("pi", ["install", pkg]);
+      const child = deps.spawn("pi", ["install", pkg]);
       child.on("error", (err) => {
-        const e = err;
-        if (e?.code === "ENOENT") {
-          console.error(`Error: "pi" not found on PATH. Install pi first: https://pi.dev (exit 127)`);
-          resolve(127);
-          return;
-        }
-        console.error(err instanceof Error ? err.message : String(err));
-        resolve(1);
+        const { message, exitCode } = describeSpawnError(
+          "pi",
+          "Install pi first: https://pi.dev",
+          err
+        );
+        console.error(message);
+        resolve(exitCode);
       });
       child.on("exit", (code2) => {
         resolve(typeof code2 === "number" ? code2 : 1);
@@ -1051,22 +1247,41 @@ async function installPiExtension(spawn3) {
       return code || 1;
     }
   }
-  console.log("\nInstalled. Next steps inside pi:");
+  if (await deps.confirm("Start pi now? (then run /login lunaroute to sign in)", { yes: opts.yes })) {
+    return launchPi(deps.spawn);
+  }
+  console.log("\nStart pi when ready \u2014 then inside pi:");
   console.log("  1. /login lunaroute \u2014 browser login issues and stores an lr_ key.");
   console.log("  2. /model \u2014 pick a lunaroute/* model (models auto-sync from /v1/models).");
   return 0;
 }
-async function applyPiModels(opts, write) {
-  const creds = loadProfile(opts.profile);
+async function launchPi(spawn) {
+  return new Promise((resolve) => {
+    const child = spawn("pi", []);
+    child.on("error", (err) => {
+      const { message, exitCode } = describeSpawnError(
+        "pi",
+        "Install pi first: https://pi.dev",
+        err
+      );
+      console.error(message);
+      resolve(exitCode);
+    });
+    child.on("exit", (code) => {
+      resolve(typeof code === "number" ? code : 1);
+    });
+  });
+}
+async function applyPiModels(creds, routingUrl, write) {
   let models;
   try {
-    models = await fetchModels(opts.routingUrl || creds.routing_url || "");
+    models = await fetchModels(routingUrl);
   } catch (err) {
     console.error(`Could not fetch the model catalog: ${err instanceof Error ? err.message : err}`);
     return 1;
   }
   const plan = buildPlan2({
-    routingUrl: opts.routingUrl || creds.routing_url,
+    routingUrl,
     orgId: creds.org_id,
     models,
     keyEnvVar: "LUNAROUTE_API_KEY"
@@ -1260,12 +1475,12 @@ async function readMemory(ctx, p) {
 }
 
 // src/commands/memory.ts
-var NOT_LOGGED_IN = 'Not logged in. Run "lunaroute login" first.';
+var NOT_LOGGED_IN2 = 'Not logged in. Run "lunaroute login" first.';
 var NO_PROJECT = "No project context: run inside a git repo with an origin remote, or set LUNAROUTE_PROJECT_ID.";
 function contextFor(profile) {
   const s = resolveSettings(profile);
   if (!s.routing_key) {
-    console.error(NOT_LOGGED_IN);
+    console.error(NOT_LOGGED_IN2);
     return 1;
   }
   const projectId = resolveProjectId();
@@ -1333,6 +1548,86 @@ async function runMemoryRead(profile, id, opts) {
   return 0;
 }
 
+// src/commands/searchKeys.ts
+var notLoggedIn = () => {
+  console.error('Not logged in. Run "lunaroute login" first.');
+  return 1;
+};
+var fail = (err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  return 1;
+};
+async function runSearchKeysList(profile, opts) {
+  const s = resolveSettings(profile);
+  if (!s.routing_key) return notLoggedIn();
+  const ctx = { apiUrl: s.api_url, apiKey: s.routing_key };
+  try {
+    if (opts.json) {
+      console.log(await listSearchKeysRaw(ctx));
+      return 0;
+    }
+    const keys = await listSearchKeys(ctx);
+    if (keys.length === 0) {
+      console.log("No search provider keys configured.");
+      return 0;
+    }
+    console.log(
+      renderTable(
+        ["PROVIDER", "CREATED", "UPDATED"],
+        keys.map((k) => [k.provider, k.created_at, k.updated_at])
+      )
+    );
+    return 0;
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function runSearchKeysSet(profile, opts) {
+  const s = resolveSettings(profile);
+  if (!s.routing_key) return notLoggedIn();
+  const ctx = { apiUrl: s.api_url, apiKey: s.routing_key };
+  try {
+    let provider = opts.provider;
+    let apiKey = opts.apiKey ?? process.env.LUNAROUTE_SEARCH_API_KEY;
+    const providers = await listSearchProviders(ctx);
+    const known = providers.map((p) => p.key);
+    if (!provider) {
+      provider = await promptInput(`Provider (${known.join(", ")})`);
+    }
+    if (!known.includes(provider)) {
+      console.error(`unknown provider "${provider}" \u2014 this server offers: ${known.join(", ")}`);
+      return 1;
+    }
+    if (!apiKey) {
+      apiKey = await promptInput("API key", { hidden: true });
+    }
+    const meta = await putSearchKey(ctx, provider, apiKey);
+    console.log(`Stored key for ${meta.provider} (updated ${meta.updated_at}).`);
+    return 0;
+  } catch (err) {
+    return fail(err);
+  }
+}
+async function runSearchKeysRemove(profile, provider, opts) {
+  const s = resolveSettings(profile);
+  if (!s.routing_key) return notLoggedIn();
+  const ctx = { apiUrl: s.api_url, apiKey: s.routing_key };
+  try {
+    if (!opts.yes) {
+      const ok = await confirm(`Remove the ${provider} search key?`);
+      if (!ok) {
+        console.log("Aborted.");
+        return 0;
+      }
+    }
+    await deleteSearchKey(ctx, provider);
+    console.log(`Removed key for ${provider}.`);
+    return 0;
+  } catch (err) {
+    return fail(err);
+  }
+}
+
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -1513,9 +1808,6 @@ async function runSkillInstall(profile, opts) {
   return 0;
 }
 
-// src/commands/run.ts
-import { spawn as spawn2 } from "child_process";
-
 // src/run/adapters/claudeCode.ts
 function buildRunSpec(ctx) {
   return {
@@ -1562,7 +1854,7 @@ var INSTALL_HINT = {
   codex: "Install Codex: https://github.com/openai/codex#install"
 };
 var realDeps = {
-  spawn: (command, args, env) => spawn2(command, args, { env, stdio: "inherit" }),
+  spawn: makeRealSpawn(),
   fetchModels
 };
 async function runRun(harness, opts, deps = realDeps) {
@@ -1602,16 +1894,9 @@ async function runRun(harness, opts, deps = realDeps) {
   const child = deps.spawn(spec.command, args, env);
   return new Promise((resolve) => {
     child.on("error", (err) => {
-      const e = err;
-      if (e?.code === "ENOENT") {
-        console.error(
-          `Error: "${spec.command}" not found on PATH. ${INSTALL_HINT[harness]} (exit 127)`
-        );
-        resolve(127);
-        return;
-      }
-      console.error(err instanceof Error ? err.message : String(err));
-      resolve(1);
+      const { message, exitCode } = describeSpawnError(spec.command, INSTALL_HINT[harness], err);
+      console.error(message);
+      resolve(exitCode);
     });
     child.on("exit", (code) => {
       resolve(typeof code === "number" ? code : 1);
@@ -1700,6 +1985,19 @@ skill.command("install").description("Install the LunaRoute memory skill + MCP s
   const code = await runSkillInstall(program.opts().profile, opts);
   if (code !== 0) process.exit(code);
 });
+var searchKeys = program.command("search-keys").description("Manage web-search provider keys (BYOK) for your organization.");
+searchKeys.command("list").description("List configured search provider keys.").option("--json", "output the raw API envelope", false).action(async (opts) => {
+  const code = await runSearchKeysList(program.opts().profile, { json: opts.json });
+  if (code !== 0) process.exit(code);
+});
+searchKeys.command("set").description("Store or replace a search provider key (prompts for missing values).").option("--provider <key>", "provider key (e.g. kagi, brave, exa)").option("--api-key <key>", "API key (visible in shell history \u2014 prefer the prompt or LUNAROUTE_SEARCH_API_KEY)").action(async (opts) => {
+  const code = await runSearchKeysSet(program.opts().profile, { provider: opts.provider, apiKey: opts.apiKey });
+  if (code !== 0) process.exit(code);
+});
+searchKeys.command("remove <provider>").description("Remove a search provider key.").option("--yes", "skip the confirmation prompt", false).action(async (provider, opts) => {
+  const code = await runSearchKeysRemove(program.opts().profile, provider, { yes: opts.yes });
+  if (code !== 0) process.exit(code);
+});
 program.parseAsync(process.argv).catch((err) => {
   console.error(err instanceof Error ? err.message : err);
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunaroute/cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "LunaRoute CLI — configure coding harnesses and manage your LunaRoute account.",
   "repository": {
     "type": "git",
@@ -30,10 +30,12 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "commander": "^15.0.0",
+    "cross-spawn": "^7.0.6",
     "open": "^11.0.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@types/cross-spawn": "^6.0.6",
     "@types/node": "^26.2.0",
     "tsup": "^8.3.0",
     "tsx": "^4.23.12",