SourceIndex 0.1.1__tar.gz → 0.1.2__tar.gz

{sourceindex-0.1.1 → sourceindex-0.1.2}/GETTING_STARTED.md

@@ -44,6 +44,28 @@ to re-run init later to add the other agent.
 If you don't have a `CLAUDE.md` (Claude Code) or `AGENTS.md` (opencode)
 yet, run `/init` in your agent first.
 
+To replace a rotated or expired key later:
+
+```bash
+sourceindex api-key set
+```
+
+That prompts for the new key and persists it as your user-level default. New
+repos and repos without a local override will use it automatically. For
+automation, use
+`sourceindex api-key set --from-env` with `SOURCEINDEX_API_KEY` already set,
+pass `--api-key sk-si-...`, or pass the key positionally:
+`sourceindex api-key set sk-si-...`.
+
+To set a repo-local override:
+
+```bash
+sourceindex api-key set --local
+```
+
+Explicit environment variables still win, and a repo-local key overrides the
+global default.
+
 ## Day-to-day
 
 Nothing. Open the repo in Claude Code or opencode as usual — it'll use

{sourceindex-0.1.1 → sourceindex-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: SourceIndex
-Version: 0.1.1
+Version: 0.1.2
 Summary: Codebase index for agentic coding
 Requires-Python: >=3.10
 Requires-Dist: cryptography>=42
@@ -16,8 +16,6 @@ Requires-Dist: tree-sitter-ruby>=0.23
 Requires-Dist: tree-sitter-rust>=0.23
 Requires-Dist: tree-sitter-typescript>=0.23
 Requires-Dist: tree-sitter>=0.23
-Provides-Extra: mcp
-Requires-Dist: mcp<2,>=1.0.0; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # Getting Started with SourceIndex
@@ -66,6 +64,28 @@ to re-run init later to add the other agent.
 If you don't have a `CLAUDE.md` (Claude Code) or `AGENTS.md` (opencode)
 yet, run `/init` in your agent first.
 
+To replace a rotated or expired key later:
+
+```bash
+sourceindex api-key set
+```
+
+That prompts for the new key and persists it as your user-level default. New
+repos and repos without a local override will use it automatically. For
+automation, use
+`sourceindex api-key set --from-env` with `SOURCEINDEX_API_KEY` already set,
+pass `--api-key sk-si-...`, or pass the key positionally:
+`sourceindex api-key set sk-si-...`.
+
+To set a repo-local override:
+
+```bash
+sourceindex api-key set --local
+```
+
+Explicit environment variables still win, and a repo-local key overrides the
+global default.
+
 ## Day-to-day
 
 Nothing. Open the repo in Claude Code or opencode as usual — it'll use

{sourceindex-0.1.1 → sourceindex-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "SourceIndex"
-version = "0.1.1"
+version = "0.1.2"
 description = "Codebase index for agentic coding"
 readme = "GETTING_STARTED.md"
 requires-python = ">=3.10"
@@ -32,9 +32,6 @@ dependencies = [
     "tree-sitter-typescript>=0.23",
 ]
 
-[project.optional-dependencies]
-mcp = ["mcp>=1.0.0,<2"]
-
 [project.scripts]
 sourceindex = "sourceindex.cli:main"
 

{sourceindex-0.1.1 → sourceindex-0.1.2}/sourceindex/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "0.1.1"
+__version__ = "0.1.2"
 
 # Surfaced at the top level so the CLI's argparse setup can use it for
 # --workers help/default without importing the build pipeline (which

{sourceindex-0.1.1 → sourceindex-0.1.2}/sourceindex/cli/__init__.py

@@ -4,7 +4,9 @@
 Usage:
     sourceindex init [--repo-root PATH] [--api-key KEY]
     sourceindex update [--repo-root PATH]
-    sourceindex serve [--repo-root PATH]
+    sourceindex api-key set
+    sourceindex api-key set --local [--repo-root PATH]
+    sourceindex search [--repo-root PATH] QUERY
     sourceindex report-savings   # Stop-hook entry point; reads payload JSON from stdin
     sourceindex statusline       # statusLine entry point; reads payload JSON from stdin
 """
@@ -20,13 +22,13 @@ from .commands import (
     cmd_daemon,
     cmd_deinit,
     cmd_dump,
+    cmd_api_key_set,
     cmd_init,
     cmd_install_hooks,
     cmd_log,
     cmd_report_savings,
     cmd_savings_summary,
     cmd_search,
-    cmd_serve,
     cmd_statusline,
     cmd_update,
     cmd_usage,
@@ -38,7 +40,7 @@ _LOG_LEVELS = ("DEBUG", "INFO", "WARNING", "ERROR")
 # Commands that do real backend/LLM work — the only ones that attach the error
 # upload handler. Others skip it so lightweight/read-only paths don't spin up
 # the background sender thread. (The gate itself is litellm-free.)
-_UPLOAD_COMMANDS = frozenset({"init", "update", "serve", "search", "deinit", "daemon"})
+_UPLOAD_COMMANDS = frozenset({"init", "update", "search", "deinit", "daemon"})
 
 
 def _add_log_flags(parser: argparse.ArgumentParser) -> None:
@@ -78,7 +80,16 @@ def _resolve_log_level(args: argparse.Namespace) -> str | None:
 
 def main() -> None:
     parser = argparse.ArgumentParser(prog="sourceindex", description="Codebase index for agentic coding")
-    sub = parser.add_subparsers(dest="command")
+    public_commands = (
+        "init,update,daemon,deinit,install-hooks,usage,api-key,search,"
+        "report-savings,statusline,savings-summary"
+    )
+    sub = parser.add_subparsers(dest="command", metavar="{" + public_commands + "}")
+
+    def _hide_subcommand_from_help(name: str) -> None:
+        # argparse keeps hidden subcommands in a private help-action list.
+        # Leave choices intact so internal/admin commands still parse.
+        sub._choices_actions = [a for a in sub._choices_actions if a.dest != name]
 
     lang_help = "Comma-separated languages to index (e.g. python,cpp,rust). Default: auto-detect."
     model_help = (
@@ -134,23 +145,12 @@ def main() -> None:
              "backend with SOURCEINDEX_BACKEND_URL=... to talk to a different deployment.",
     )
     p_init.add_argument("--languages", default=None, help=lang_help)
-    p_init.add_argument(
-        "--mode",
-        choices=["mcp", "agent"],
-        default="agent",
-        help="Delivery shape: 'agent' writes subagent configs for the selected/detected "
-             "platforms (see the positional `agent` args), 'mcp' writes .mcp.json + "
-             "CLAUDE.md (Claude-only, currently broken) (default: agent)",
-    )
     p_init.add_argument("--model", default=_DEFAULT_BUILD_MODEL, help=build_model_help)
     p_init.add_argument("--workers", type=int, default=_DEFAULT_WORKERS, help=workers_help)
     p_init.add_argument(
         "--allow-dump",
         action="store_true",
-        help="Start the daemon with its admin socket bound, enabling "
-             "`sourceindex dump`. Production never sets this; eval scripts "
-             "pass it so they can materialize a plaintext copy of the index "
-             "per task.",
+        help=argparse.SUPPRESS,
     )
 
     p_update = sub.add_parser("update", help="Update index for changed files", parents=[log_parent])
@@ -161,16 +161,17 @@ def main() -> None:
     p_update.add_argument(
         "--allow-dump",
         action="store_true",
-        help="See `sourceindex init --allow-dump`.",
+        help=argparse.SUPPRESS,
     )
 
     p_dump = sub.add_parser(
         "dump",
-        help="Admin-only: decrypt the index into a plaintext mirror at --out.",
+        help=argparse.SUPPRESS,
         parents=[log_parent],
     )
     p_dump.add_argument("--repo-root", default=".", help="Repository root (default: .)")
     p_dump.add_argument("--out", required=True, help="Output directory to write the plaintext mirror to.")
+    _hide_subcommand_from_help("dump")
 
     p_daemon = sub.add_parser(
         "daemon",
@@ -180,7 +181,7 @@ def main() -> None:
     p_daemon.add_argument("--repo-root", default=".", help="Repository root (default: .)")
     p_daemon.add_argument(
         "--allow-dump", action="store_true",
-        help="Bind the admin socket so `sourceindex dump` and other admin RPCs work.",
+        help=argparse.SUPPRESS,
     )
     p_daemon.add_argument(
         "--stop", action="store_true",
@@ -223,10 +224,6 @@ def main() -> None:
     )
     p_install_hooks.add_argument("--repo-root", default=".", help="Repository root (default: .)")
 
-    p_serve = sub.add_parser("serve", help="Start MCP server", parents=[log_parent])
-    p_serve.add_argument("--repo-root", default=".", help="Repository root (default: .)")
-    p_serve.add_argument("--index-dir", default=None, help="Index directory (default: REPO_ROOT/.sourceindex)")
-
     p_usage = sub.add_parser(
         "usage",
         help="Show this month's spend and remaining budget from the hosted backend.",
@@ -234,6 +231,46 @@ def main() -> None:
     )
     p_usage.add_argument("--repo-root", default=".", help="Repository root (default: .)")
 
+    p_api_key = sub.add_parser("api-key", help="Manage SourceIndex API keys")
+    api_key_sub = p_api_key.add_subparsers(dest="api_key_command")
+    p_api_key_set = api_key_sub.add_parser(
+        "set",
+        help="Replace the persisted SourceIndex API key",
+        parents=[log_parent],
+    )
+    p_api_key_set.add_argument(
+        "key",
+        nargs="?",
+        help="New SourceIndex bearer key. Prefer the prompt or --from-env if shell history is a concern.",
+    )
+    p_api_key_set.add_argument(
+        "--repo-root", default=".", help="Repository root for --local (default: .)"
+    )
+    key_scope = p_api_key_set.add_mutually_exclusive_group()
+    key_scope.add_argument(
+        "--local",
+        dest="local_key",
+        action="store_true",
+        help="Persist as a repo-local override instead of the user-level default key.",
+    )
+    key_scope.add_argument(
+        "--global",
+        dest="global_key",
+        action="store_true",
+        help=argparse.SUPPRESS,
+    )
+    api_key_input = p_api_key_set.add_mutually_exclusive_group()
+    api_key_input.add_argument(
+        "--api-key",
+        default=None,
+        help="New SourceIndex bearer key. Omitting this prompts on a TTY.",
+    )
+    api_key_input.add_argument(
+        "--from-env",
+        action="store_true",
+        help="Persist the current SOURCEINDEX_API_KEY environment value.",
+    )
+
     p_search = sub.add_parser("search", help="Run two-pass search and emit an enriched roadmap", parents=[log_parent])
     p_search.add_argument("--repo-root", default=".", help="Repository root (default: .)")
     p_search.add_argument("--index-dir", default=None, help="Index directory (default: REPO_ROOT/.sourceindex)")
@@ -261,7 +298,7 @@ def main() -> None:
     # Developer-only: pretty-print the JSONL log. Hidden from --help (help=...
     # is suppressed) so it doesn't appear in the user-facing surface; still
     # invokable as `sourceindex log` for debugging.
-    p_log = sub.add_parser("log", parents=[log_parent])
+    p_log = sub.add_parser("log", parents=[log_parent], help=argparse.SUPPRESS)
     p_log.add_argument("--repo-root", default=".")
     p_log.add_argument("--log-path", default=None,
                        help="Path to JSONL log (default: <repo>/.sourceindex/sourceindex.log)")
@@ -269,6 +306,7 @@ def main() -> None:
                        help="Show only the last N records.")
     p_log.add_argument("--filter", default=None,
                        help="Substring to match against the event name (e.g. 'llm', 'search').")
+    _hide_subcommand_from_help("log")
 
     args = parser.parse_args()
 
@@ -282,14 +320,24 @@ def main() -> None:
         args.repo_root = str(discover_repo_root(Path(args.repo_root)))
 
     repo_root_arg = getattr(args, "repo_root", None)
-    if repo_root_arg is not None:
+    replacing_key = (
+        getattr(args, "command", None) == "api-key"
+        and getattr(args, "api_key_command", None) == "set"
+    )
+    local_key_set = replacing_key and bool(getattr(args, "local_key", False))
+    if repo_root_arg is not None and not replacing_key:
         _load_persisted_env(Path(repo_root_arg).resolve())
 
     # Configure logging after _load_persisted_env so SOURCEINDEX_LOG_* picked
     # up from .sourceindex/.env take effect.
+    log_repo_root = (
+        None
+        if (replacing_key and not local_key_set) or repo_root_arg is None
+        else Path(repo_root_arg).resolve()
+    )
     configure(
         level=_resolve_log_level(args),
-        repo_root=Path(repo_root_arg).resolve() if repo_root_arg is not None else None,
+        repo_root=log_repo_root,
         log_file=getattr(args, "log_file", None),
         enable_file=not getattr(args, "no_log_file", False),
         enable_upload=getattr(args, "command", None) in _UPLOAD_COMMANDS,
@@ -298,7 +346,7 @@ def main() -> None:
     # `log` is intentionally excluded — it's a read-only viewer over the
     # log file, and recording each invocation pollutes the file it's
     # about to print.
-    if args.command in ("init", "update", "serve", "search", "install-hooks", "dump", "daemon", "deinit"):
+    if args.command in ("init", "update", "search", "install-hooks", "dump", "daemon", "deinit", "api-key"):
         get_logger(__name__).debug(
             "CLI invocation",
             extra={
@@ -315,8 +363,6 @@ def main() -> None:
             cmd_update(args)
         elif args.command == "install-hooks":
             cmd_install_hooks(args)
-        elif args.command == "serve":
-            cmd_serve(args)
         elif args.command == "search":
             cmd_search(args)
         elif args.command == "report-savings":
@@ -329,6 +375,12 @@ def main() -> None:
             cmd_log(args)
         elif args.command == "usage":
             cmd_usage(args)
+        elif args.command == "api-key":
+            if getattr(args, "api_key_command", None) == "set":
+                cmd_api_key_set(args)
+            else:
+                p_api_key.print_help()
+                sys.exit(1)
         elif args.command == "dump":
             cmd_dump(args)
         elif args.command == "daemon":

{sourceindex-0.1.1 → sourceindex-0.1.2}/sourceindex/cli/api_key.py

@@ -4,8 +4,9 @@ Three concerns share this module:
 
 - Look up the API key (CLI arg → env var → persisted file).
 - Prompt the user for one on a TTY when ``init`` runs without any source.
-- Persist the key into ``<repo>/.sourceindex/.env`` so the post-commit hook,
-  search subagent, and MCP server pick it up without an env var.
+- Persist the key into ``<repo>/.sourceindex/.env`` or the user-level
+  sourceindex config so the post-commit hook and search subagent pick it up
+  without an env var.
 """
 
 import getpass
@@ -20,6 +21,7 @@ _log = get_logger(__name__)
 
 
 PERSISTED_KEY_FILENAME = ".env"
+_GLOBAL_API_KEY_MARKER = "_SOURCEINDEX_API_KEY_FROM_GLOBAL"
 
 # Loose shape check: alphanumerics + `_` / `-`, at least 20 chars, no
 # whitespace or other punctuation. Designed to reject obvious paste
@@ -81,8 +83,8 @@ def _require_api_key(cli_arg: str | None, *, daemon_managed: bool = False) -> st
 
 def _prompt_api_key(cli_arg: str | None) -> str:
     """Like _require_api_key, but prompts on a TTY if no key is available.
-    Used only by `init` — non-interactive callers (post-commit hook, subagent,
-    MCP server) should keep using _require_api_key so they fail loudly."""
+    Used only by `init` — non-interactive callers (post-commit hook, subagent)
+    should keep using _require_api_key so they fail loudly."""
     from ..lib.llm import resolve_api_key
     key = resolve_api_key(cli_arg)
     if not key:
@@ -103,6 +105,40 @@ def _prompt_api_key(cli_arg: str | None) -> str:
     return key
 
 
+def _prompt_replacement_api_key(cli_arg: str | None, *, from_env: bool = False) -> str:
+    """Read a key for `sourceindex api-key set`.
+
+    Unlike init, the default interactive path prompts even if an old key was
+    loaded from .sourceindex/.env. Use --from-env when the current process env
+    is intentionally the new value.
+    """
+    key = (cli_arg or "").strip()
+    if not key and from_env:
+        key = os.environ.get("SOURCEINDEX_API_KEY", "").strip()
+        if not key:
+            raise SystemExit(
+                "[sourceindex] SOURCEINDEX_API_KEY is not set; pass --api-key "
+                "or run without --from-env to paste the key."
+            )
+    if not key and not from_env:
+        if not sys.stdin.isatty():
+            raise SystemExit(
+                "No API key provided. Pass --api-key, set SOURCEINDEX_API_KEY "
+                "and use --from-env, or run on a TTY to paste it."
+            )
+        _log.info("Paste your new sourceindex API key (input hidden):")
+        key = getpass.getpass("API key: ").strip()
+    if not key:
+        raise SystemExit("[sourceindex] Empty API key - aborting.")
+    if not _is_plausible_api_key(key):
+        raise SystemExit(
+            f"[sourceindex] That doesn't look like an API key ({len(key)} chars, "
+            "expected >=20 alphanumeric/_-). Aborting before persisting junk."
+        )
+    _warn_if_provider_key(key)
+    return key
+
+
 def _parse_env_file(path: Path) -> dict[str, str]:
     from ..lib.env import parse_env_text
     try:
@@ -111,6 +147,28 @@ def _parse_env_file(path: Path) -> dict[str, str]:
         return {}
 
 
+def _user_config_dir() -> Path:
+    xdg = os.environ.get("XDG_CONFIG_HOME")
+    base = Path(xdg).expanduser() if xdg else Path.home() / ".config"
+    return base / "sourceindex"
+
+
+def _global_env_path() -> Path:
+    return _user_config_dir() / PERSISTED_KEY_FILENAME
+
+
+def _persist_env_path_var(env_path: Path, key: str, value: str) -> None:
+    existing = _parse_env_file(env_path)
+    existing[key] = value
+    env_path.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        env_path.parent.chmod(0o700)
+    except OSError:
+        pass
+    env_path.write_text("".join(f"{k}={v}\n" for k, v in existing.items()))
+    env_path.chmod(0o600)
+
+
 def _persist_env_var(index_dir: Path, key: str, value: str) -> None:
     """Merge ``key=value`` into ``<index_dir>/.env`` without clobbering other keys.
 
@@ -122,12 +180,7 @@ def _persist_env_var(index_dir: Path, key: str, value: str) -> None:
             f"{index_dir} is an encrypted store; persist .env values via the "
             "daemon RPC instead of writing the file directly."
         )
-    index_dir.mkdir(parents=True, exist_ok=True)
-    env_path = index_dir / PERSISTED_KEY_FILENAME
-    existing = _parse_env_file(env_path)
-    existing[key] = value
-    env_path.write_text("".join(f"{k}={v}\n" for k, v in existing.items()))
-    env_path.chmod(0o600)
+    _persist_env_path_var(index_dir / PERSISTED_KEY_FILENAME, key, value)
 
 
 def _persist_api_key(index_dir: Path, key: str) -> None:
@@ -148,11 +201,26 @@ def _persist_api_key(index_dir: Path, key: str) -> None:
         return
     _persist_env_var(index_dir, "SOURCEINDEX_API_KEY", key)
     _log.info(
-        f"Persisted API key to {index_dir / PERSISTED_KEY_FILENAME}",
+        "Updated API key.",
         extra={"event": "api_key.persisted", "path": str(index_dir / PERSISTED_KEY_FILENAME)},
     )
 
 
+def _persist_global_api_key(key: str) -> None:
+    if not _is_plausible_api_key(key):
+        _log.warning(
+            f"Not persisting global API key ({len(key)} chars) — it doesn't "
+            "match the plausible shape (>=20 alphanumeric/_-, no whitespace).",
+            extra={"event": "api_key.global_persist_skipped_shape"},
+        )
+        return
+    _persist_env_path_var(_global_env_path(), "SOURCEINDEX_API_KEY", key)
+    _log.info(
+        "Updated global API key.",
+        extra={"event": "api_key.global_persisted", "path": str(_global_env_path())},
+    )
+
+
 def _persist_backend_url(index_dir: Path, url: str) -> None:
     """Persist a non-default ``SOURCEINDEX_BACKEND_URL`` next to the API key.
     Only needed when overriding the default backend baked into
@@ -169,13 +237,36 @@ def _persist_backend_url(index_dir: Path, url: str) -> None:
     )
 
 
+def _load_env_path(path: Path, *, source: str | None = None) -> None:
+    for k, v in _parse_env_file(path).items():
+        if k and k not in os.environ:
+            os.environ[k] = v
+            if k == "SOURCEINDEX_API_KEY":
+                if source == "global":
+                    os.environ[_GLOBAL_API_KEY_MARKER] = "1"
+                else:
+                    os.environ.pop(_GLOBAL_API_KEY_MARKER, None)
+
+
+def _load_global_env() -> None:
+    _load_env_path(_global_env_path(), source="global")
+
+
+def _api_key_from_global_fallback(cli_arg: str | None) -> bool:
+    return not cli_arg and os.environ.get(_GLOBAL_API_KEY_MARKER) == "1"
+
+
 def _load_persisted_env(repo_root: Path) -> None:
     """Merge plaintext .sourceindex/.env into os.environ (pre-existing vars
-    win, standard dotenv semantics). Encrypted .env is loaded by the
-    daemon itself at startup — client processes can't read it."""
+    win, standard dotenv semantics), then fall back to the user-level config.
+    Encrypted .env is loaded by the daemon/server itself at startup — client
+    processes can't read it without risking global keys overriding local ones."""
     from ..daemon import IndexDir
-    env_path = IndexDir.for_repo(repo_root).path / PERSISTED_KEY_FILENAME
+    os.environ.pop(_GLOBAL_API_KEY_MARKER, None)
+    idx = IndexDir.for_repo(repo_root)
+    if idx.is_encrypted_layout():
+        return
+    env_path = idx.path / PERSISTED_KEY_FILENAME
     if env_path.is_file():
-        for k, v in _parse_env_file(env_path).items():
-            if k and k not in os.environ:
-                os.environ[k] = v
+        _load_env_path(env_path)
+    _load_global_env()

{sourceindex-0.1.1 → sourceindex-0.1.2}/sourceindex/cli/commands.py

@@ -13,19 +13,22 @@ from datetime import datetime, timezone
 from pathlib import Path
 
 from ..lib.log import get_logger
-from .api_key import _persist_api_key, _prompt_api_key, _require_api_key
+from .api_key import (
+    _api_key_from_global_fallback,
+    _persist_api_key,
+    _persist_global_api_key,
+    _prompt_api_key,
+    _prompt_replacement_api_key,
+    _require_api_key,
+)
 
 _log = get_logger(__name__)
 from .install import (
     AGENT_INSTALLERS,
-    CLAUDE_MD_MARKER_MCP,
-    CLAUDE_MD_SECTION_MCP,
     KNOWN_AGENTS,
-    _append_claude_md,
     _detect_agents,
     _ensure_gitignored,
     _install_hooks,
-    _write_mcp_config,
 )
 
 
@@ -104,11 +107,11 @@ def cmd_init(args: argparse.Namespace) -> None:
             f"(choose from {', '.join(sorted(KNOWN_AGENTS))})"
         )
 
+    api_key_is_global_fallback = _api_key_from_global_fallback(args.api_key)
     api_key = _prompt_api_key(args.api_key)
-    # First-run write of plaintext .env; the daemon migrates it on its
-    # next start. Writing into an encrypted store would corrupt the blob.
-    if not idx.is_encrypted_layout():
-        _persist_api_key(index_dir, api_key)
+    os.environ["SOURCEINDEX_API_KEY"] = api_key
+    if not api_key_is_global_fallback:
+        _persist_global_api_key(api_key)
     _ensure_gitignored(repo_root)
 
     model = apply_remote_config(index_dir=index_dir, default_model=args.model).build
@@ -121,32 +124,21 @@ def cmd_init(args: argparse.Namespace) -> None:
     from ..lib import registry
     registry.add(idx.repo_hash, str(repo_root))
 
-    if mode == "mcp":
-        non_claude = sorted(set(requested) - {"claude"})
-        if non_claude:
-            _log.warning("--mode mcp is Claude-only; skipping %s", ", ".join(non_claude))
-        _log.info("Writing MCP config")
-        _write_mcp_config(repo_root)
-        _log.info("Updating CLAUDE.md with workflow instructions...")
-        _append_claude_md(repo_root, CLAUDE_MD_SECTION_MCP, CLAUDE_MD_MARKER_MCP)
-    elif mode == "agent":
-        # Positional selection wins; otherwise sniff the repo's own markers;
-        # a bare repo with no markers gets the claude set. Install order is
-        # owned by AGENT_INSTALLERS (see its comment in install.py).
-        agents = requested or _detect_agents(repo_root)
-        if not agents:
-            agents = ["claude"]
-            _log.info(
-                "No agent config detected in the repo; defaulting to claude. "
-                "Run `sourceindex init opencode` (or `claude opencode`) to choose."
-            )
-        elif not requested:
-            _log.info(f"Detected agent platforms: {', '.join(agents)}")
-        for name, installer in AGENT_INSTALLERS.items():
-            if name in agents:
-                installer(repo_root)
-    else:
-        raise ValueError(f"Unknown init mode: {mode!r} (expected 'mcp' or 'agent')")
+    # Positional selection wins; otherwise sniff the repo's own markers;
+    # a bare repo with no markers gets the claude set. Install order is
+    # owned by AGENT_INSTALLERS (see its comment in install.py).
+    agents = requested or _detect_agents(repo_root)
+    if not agents:
+        agents = ["claude"]
+        _log.info(
+            "No agent config detected in the repo; defaulting to claude. "
+            "Run `sourceindex init opencode` (or `claude opencode`) to choose."
+        )
+    elif not requested:
+        _log.info(f"Detected agent platforms: {', '.join(agents)}")
+    for name, installer in AGENT_INSTALLERS.items():
+        if name in agents:
+            installer(repo_root)
 
     if idx.is_encrypted_layout() or idx.has_plaintext_index():
         _log.info(
@@ -216,17 +208,40 @@ def cmd_update(args: argparse.Namespace) -> None:
             )
 
 
-def cmd_serve(args: argparse.Namespace) -> None:
-    from ..daemon import IndexDir
-    from ..lib.backend import apply_remote_config
-    from ..search import DEFAULT_SEARCH_MODEL
-    from ..server import run_server
+def cmd_api_key_set(args: argparse.Namespace) -> None:
+    from ..daemon import Client, IndexDir
+
+    positional_key = getattr(args, "key", None)
+    option_key = getattr(args, "api_key", None)
+    from_env = bool(getattr(args, "from_env", False))
+    local_key = bool(getattr(args, "local_key", False))
+    if positional_key and option_key:
+        raise SystemExit("[sourceindex] Pass the new key either positionally or via --api-key, not both.")
+    if positional_key and from_env:
+        raise SystemExit("[sourceindex] Pass the new key either positionally or via --from-env, not both.")
+    api_key = _prompt_replacement_api_key(
+        option_key or positional_key,
+        from_env=from_env,
+    )
+
+    if not local_key:
+        _persist_global_api_key(api_key)
+        return
 
     repo_root = Path(args.repo_root).resolve()
-    index_dir = IndexDir.for_repo(repo_root, args.index_dir).path
+    idx = IndexDir.for_repo(repo_root)
+    if idx.is_encrypted_layout():
+        Client(repo_root).set_api_key(api_key)
+        _log.info(
+            "Updated API key.",
+            extra={
+                "event": "api_key.updated",
+                "encrypted": True,
+            },
+        )
+        return
 
-    model = apply_remote_config(index_dir=index_dir, default_model=DEFAULT_SEARCH_MODEL).search
-    run_server(repo_root, index_dir, index_search_model=model)
+    _persist_api_key(idx.path, api_key)
 
 
 ROADMAP_FILENAME_PREFIX = "sourceindex-output"