SourceIndex 0.1.2__tar.gz → 0.1.3__tar.gz

sourceindex-0.1.3/LICENSE

@@ -0,0 +1,115 @@
+SourceIndex — Software License Agreement
+
+Copyright (c) 2026 MANTEON PTE. LTD. (Singapore). All rights reserved.
+
+SourceIndex is commercial software. It is licensed, not sold. By installing,
+copying, or using it you agree to this Agreement. If you do not agree, do not
+install or use it.
+
+1. DEFINITIONS
+
+   "Licensor" means MANTEON PTE. LTD., a company incorporated in the Republic
+   of Singapore. "Software" means the SourceIndex program distributed by the
+   Licensor, in source or object form, together with its documentation.
+   "You" means the individual or entity exercising rights under this
+   Agreement.
+
+2. GRANT OF LICENSE
+
+   Subject to Your compliance with this Agreement, the Licensor grants You a
+   limited, non-exclusive, non-transferable, non-sublicensable, revocable
+   licence to install and use unmodified copies of the Software for Your own
+   internal purposes.
+
+   No other rights are granted. All rights not expressly granted are reserved
+   by the Licensor.
+
+3. RESTRICTIONS
+
+   Except to the extent that this restriction is prohibited by applicable law,
+   or expressly permitted by the Licensor in writing, You may not:
+
+   (a) distribute, publish, sublicense, sell, rent, lease, lend, or otherwise
+       make the Software available to any third party;
+   (b) modify the Software or create derivative works from it;
+   (c) reverse engineer, decompile, or disassemble the Software, or otherwise
+       attempt to derive its source code, methods, or prompts, save to the
+       extent applicable law confers a non-excludable right to do so for
+       interoperability purposes;
+   (d) use the Software, or any information derived from it, to develop,
+       train, or improve a product or service that competes with it;
+   (e) remove, obscure, or alter any copyright, trademark, or other
+       proprietary notice; or
+   (f) circumvent or disable any licensing, metering, or security mechanism.
+
+   The Software is distributed in a human-readable form because it is written
+   in an interpreted language. That fact does not grant any right beyond
+   Clause 2, and does not make the Software open source.
+
+4. OWNERSHIP
+
+   The Software is protected by copyright and other intellectual property
+   laws. The Licensor and its licensors retain all right, title, and interest
+   in and to the Software, including all prompts, templates, indexes, models
+   of operation, and other content contained in it.
+
+5. THIRD-PARTY COMPONENTS
+
+   The Software depends on third-party components distributed under their own
+   licences. Those components are licensed to You by their respective owners
+   under those licences, not under this Agreement, and nothing here limits
+   Your rights under them.
+
+6. HOSTED SERVICES
+
+   The Software may communicate with services operated by the Licensor. Use of
+   those services is governed by separate terms and may require a valid
+   subscription or API credential. The Licensor may modify, suspend, or
+   discontinue those services at any time.
+
+7. NO WARRANTY
+
+   THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF
+   ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
+   WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE,
+   SATISFACTORY QUALITY, AND NON-INFRINGEMENT. THE LICENSOR DOES NOT WARRANT
+   THAT THE SOFTWARE WILL BE UNINTERRUPTED, ERROR-FREE, OR THAT ITS OUTPUT
+   WILL BE ACCURATE OR COMPLETE.
+
+8. LIMITATION OF LIABILITY
+
+   TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE LICENSOR SHALL NOT BE LIABLE
+   FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY
+   DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING
+   OUT OF OR IN CONNECTION WITH THE SOFTWARE, EVEN IF ADVISED OF THE
+   POSSIBILITY OF SUCH DAMAGES.
+
+   THE LICENSOR'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION
+   WITH THIS AGREEMENT SHALL NOT EXCEED THE GREATER OF (a) THE AMOUNTS PAID BY
+   YOU TO THE LICENSOR FOR THE SOFTWARE IN THE TWELVE MONTHS PRECEDING THE
+   CLAIM, OR (b) ONE HUNDRED SINGAPORE DOLLARS (SGD 100).
+
+   Nothing in this Agreement excludes or limits liability that cannot lawfully
+   be excluded or limited, including liability for death or personal injury
+   caused by negligence, or for fraud or fraudulent misrepresentation.
+
+9. TERMINATION
+
+   This licence terminates automatically if You breach any term of it. On
+   termination You must cease all use of the Software and destroy all copies
+   in Your possession. Clauses 4, 7, 8, and 10 survive termination.
+
+10. GOVERNING LAW AND JURISDICTION
+
+    This Agreement is governed by the laws of the Republic of Singapore,
+    without regard to its conflict of laws rules. The courts of Singapore
+    have exclusive jurisdiction over any dispute arising out of or in
+    connection with it.
+
+11. ENTIRE AGREEMENT
+
+    This Agreement is the entire agreement between You and the Licensor
+    regarding the Software, and supersedes any prior understanding. If any
+    provision is held unenforceable, the remainder stays in effect.
+
+For licensing enquiries, contact MANTEON PTE. LTD.

{sourceindex-0.1.2 → sourceindex-0.1.3}/PKG-INFO

@@ -1,7 +1,14 @@
 Metadata-Version: 2.4
 Name: SourceIndex
-Version: 0.1.2
+Version: 0.1.3
 Summary: Codebase index for agentic coding
+Author: MANTEON PTE. LTD.
+License-Expression: LicenseRef-Proprietary
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.10
 Requires-Dist: cryptography>=42
 Requires-Dist: keyring>=24

{sourceindex-0.1.2 → sourceindex-0.1.3}/pyproject.toml

@@ -4,10 +4,25 @@ build-backend = "hatchling.build"
 
 [project]
 name = "SourceIndex"
-version = "0.1.2"
+version = "0.1.3"
 description = "Codebase index for agentic coding"
 readme = "GETTING_STARTED.md"
 requires-python = ">=3.10"
+authors = [{ name = "MANTEON PTE. LTD." }]
+# Proprietary: the published wheel ships readable .py because Python is
+# interpreted, not because the source is licensed for reuse. LicenseRef-* is
+# how PEP 639 spells a licence with no SPDX identifier.
+license = "LicenseRef-Proprietary"
+license-files = ["LICENSE"]
+# No "License ::" classifier: PEP 639 deprecates them, and pairing one with
+# License-Expression is the case where tools are permitted to reject the
+# upload. The expression above is the authoritative declaration.
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Topic :: Software Development :: Libraries",
+]
 dependencies = [
     "litellm>=1.50",
     "tree-sitter>=0.23",
@@ -46,4 +61,5 @@ include = [
     "sourceindex/",
     "pyproject.toml",
     "GETTING_STARTED.md",
+    "LICENSE",
 ]

{sourceindex-0.1.2 → sourceindex-0.1.3}/sourceindex/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "0.1.2"
+__version__ = "0.1.3"
 
 # Surfaced at the top level so the CLI's argparse setup can use it for
 # --workers help/default without importing the build pipeline (which

{sourceindex-0.1.2 → sourceindex-0.1.3}/sourceindex/cli/api_key.py

@@ -23,6 +23,39 @@ _log = get_logger(__name__)
 PERSISTED_KEY_FILENAME = ".env"
 _GLOBAL_API_KEY_MARKER = "_SOURCEINDEX_API_KEY_FROM_GLOBAL"
 
+# Records the key the user's *shell* exported, as opposed to one the loaders
+# below put into SOURCEINDEX_API_KEY themselves. The daemon is exec'd with our
+# environment and cannot otherwise tell the two apart — and it must, because
+# only a genuine export outranks the config files it re-reads per RPC. Pinning
+# a file-sourced key at that tier is what used to make `api-key set` a no-op
+# until the daemon restarted.
+#
+# Set at import, which `cli/__init__.py` performs before any loader runs, so
+# the value is the shell's or nothing. `setdefault` preserves what an outer
+# sourceindex process already established.
+_SHELL_API_KEY_VAR = "_SOURCEINDEX_SHELL_API_KEY"
+
+
+def _capture_shell_api_key() -> None:
+    """Snapshot SOURCEINDEX_API_KEY as the shell's, once per process tree.
+
+    Writes the variable even when there is no key, because the empty value is
+    what tells a child process not to snapshot again. The daemon is exec'd by
+    a CLI that has already loaded a key out of a config file into the shared
+    environment; without that sentinel the daemon's own import would re-badge
+    that key as a shell export — the exact bug this indirection exists to fix.
+    """
+    os.environ.setdefault(_SHELL_API_KEY_VAR, os.environ.get("SOURCEINDEX_API_KEY", ""))
+
+
+_capture_shell_api_key()
+
+
+def shell_api_key() -> str | None:
+    """The key exported into this process tree's environment by the user's
+    shell, or None if SOURCEINDEX_API_KEY was only ever loaded from a file."""
+    return os.environ.get(_SHELL_API_KEY_VAR) or None
+
 # Loose shape check: alphanumerics + `_` / `-`, at least 20 chars, no
 # whitespace or other punctuation. Designed to reject obvious paste
 # mistakes (prompt strings, error messages, paths, URLs) without
@@ -58,27 +91,30 @@ def _warn_if_provider_key(key: str) -> None:
 def _require_api_key(cli_arg: str | None, *, daemon_managed: bool = False) -> str | None:
     """Resolve the API key from --api-key/env, asserting it exists.
 
-    ``daemon_managed=True`` tolerates a missing key on encrypted-store
-    repos: the daemon loaded ``SOURCEINDEX_API_KEY`` from its own encrypted
-    .env at startup (see ``daemon/server.py:_load_env_from_store``), so RPC
-    handlers fall back to env when the client passes no key. Necessary for
-    hook-triggered subprocesses (post-commit ``sourceindex update``, the
-    Claude Code subagent's ``sourceindex search``) that spawn fresh and
-    don't inherit the user's shell env after init prompted for the key.
+    ``daemon_managed=True`` returns only an *explicit* key — ``--api-key`` or
+    a genuine shell export — and ``None`` otherwise, deferring to the daemon's
+    own per-RPC resolution (``daemon/server.py:_resolve_api_key``). Forwarding
+    a file-sourced key here would pin it for the call and defeat that, which is
+    how a rotated key used to keep getting ignored. Returning ``None`` is also
+    what lets hook-triggered subprocesses (post-commit ``sourceindex update``,
+    the Claude Code subagent's ``sourceindex search``) work at all: they spawn
+    without the user's shell env and rely on the daemon to supply the key.
     """
     from ..lib.llm import resolve_api_key
+    if daemon_managed:
+        explicit = _explicit_api_key(cli_arg)
+        if explicit:
+            _warn_if_provider_key(explicit)
+        return explicit
     key = resolve_api_key(cli_arg)
     if key:
         _warn_if_provider_key(key)
         return key
-    if daemon_managed:
-        return None
-    assert key, (
+    raise AssertionError(
         "No API key found. Pass --api-key or set SOURCEINDEX_API_KEY "
         "(a sourceindex bearer key from the hosted backend, or a direct "
         "provider key if SOURCEINDEX_BACKEND_URL=\"\" disables the backend)."
     )
-    return None
 
 
 def _prompt_api_key(cli_arg: str | None) -> str:
@@ -157,18 +193,26 @@ def _global_env_path() -> Path:
     return _user_config_dir() / PERSISTED_KEY_FILENAME
 
 
-def _persist_env_path_var(env_path: Path, key: str, value: str) -> None:
-    existing = _parse_env_file(env_path)
-    existing[key] = value
+def _write_env_path(env_path: Path, values: dict[str, str]) -> None:
+    """Write a ``.env``, creating its directory and clamping permissions.
+    Every writer goes through here so the hardening can't end up applying to
+    only some of them."""
+    from ..lib.env import format_env_text
     env_path.parent.mkdir(parents=True, exist_ok=True)
     try:
         env_path.parent.chmod(0o700)
     except OSError:
         pass
-    env_path.write_text("".join(f"{k}={v}\n" for k, v in existing.items()))
+    env_path.write_text(format_env_text(values))
     env_path.chmod(0o600)
 
 
+def _persist_env_path_var(env_path: Path, key: str, value: str) -> None:
+    existing = _parse_env_file(env_path)
+    existing[key] = value
+    _write_env_path(env_path, existing)
+
+
 def _persist_env_var(index_dir: Path, key: str, value: str) -> None:
     """Merge ``key=value`` into ``<index_dir>/.env`` without clobbering other keys.
 
@@ -183,6 +227,16 @@ def _persist_env_var(index_dir: Path, key: str, value: str) -> None:
     _persist_env_path_var(index_dir / PERSISTED_KEY_FILENAME, key, value)
 
 
+def _clear_env_path_var(env_path: Path, key: str) -> bool:
+    """Remove one variable from a plaintext .env, leaving the rest intact.
+    Returns whether it was there."""
+    existing = _parse_env_file(env_path)
+    if existing.pop(key, None) is None:
+        return False
+    _write_env_path(env_path, existing)
+    return True
+
+
 def _persist_api_key(index_dir: Path, key: str) -> None:
     if not _is_plausible_api_key(key):
         # Skip (don't abort) an explicitly-provided key whose shape is unusual but
@@ -248,6 +302,14 @@ def _load_env_path(path: Path, *, source: str | None = None) -> None:
                     os.environ.pop(_GLOBAL_API_KEY_MARKER, None)
 
 
+def _explicit_api_key(cli_arg: str | None) -> str | None:
+    """The key this invocation was *given*: ``--api-key``, else a genuine
+    shell export. A key merely loaded from a config file is not explicit —
+    the daemon reads those files itself and must stay free to re-resolve
+    them per RPC."""
+    return (cli_arg or "").strip() or shell_api_key()
+
+
 def _load_global_env() -> None:
     _load_env_path(_global_env_path(), source="global")
 
@@ -259,14 +321,17 @@ def _api_key_from_global_fallback(cli_arg: str | None) -> bool:
 def _load_persisted_env(repo_root: Path) -> None:
     """Merge plaintext .sourceindex/.env into os.environ (pre-existing vars
     win, standard dotenv semantics), then fall back to the user-level config.
-    Encrypted .env is loaded by the daemon/server itself at startup — client
-    processes can't read it without risking global keys overriding local ones."""
+
+    An encrypted repo has no readable repo-level .env — the daemon owns it —
+    but the user-level config is still ours to read, and skipping it used to
+    hide the global key from every indexed repo. Loading it is safe now that
+    file-sourced keys are marked and never forwarded over RPC, so they can no
+    longer shadow the per-repo key the daemon holds."""
     from ..daemon import IndexDir
     os.environ.pop(_GLOBAL_API_KEY_MARKER, None)
     idx = IndexDir.for_repo(repo_root)
-    if idx.is_encrypted_layout():
-        return
-    env_path = idx.path / PERSISTED_KEY_FILENAME
-    if env_path.is_file():
-        _load_env_path(env_path)
+    if not idx.is_encrypted_layout():
+        env_path = idx.path / PERSISTED_KEY_FILENAME
+        if env_path.is_file():
+            _load_env_path(env_path)
     _load_global_env()

{sourceindex-0.1.2 → sourceindex-0.1.3}/sourceindex/cli/commands.py

@@ -14,6 +14,7 @@ from pathlib import Path
 
 from ..lib.log import get_logger
 from .api_key import (
+    PERSISTED_KEY_FILENAME,
     _api_key_from_global_fallback,
     _persist_api_key,
     _persist_global_api_key,
@@ -30,6 +31,7 @@ from .install import (
     _ensure_gitignored,
     _install_hooks,
 )
+from .upgrade import schedule_auto_upgrade
 
 
 def _parse_languages(value: str | None):
@@ -109,6 +111,10 @@ def cmd_init(args: argparse.Namespace) -> None:
 
     api_key_is_global_fallback = _api_key_from_global_fallback(args.api_key)
     api_key = _prompt_api_key(args.api_key)
+    # apply_remote_config and the preflight below read the key from the
+    # environment, so it has to go there. The daemon we spawn inherits this,
+    # but only treats _SHELL_API_KEY_VAR as an export, so a prompted key
+    # cannot masquerade as one.
     os.environ["SOURCEINDEX_API_KEY"] = api_key
     if not api_key_is_global_fallback:
         _persist_global_api_key(api_key)
@@ -176,6 +182,8 @@ def cmd_update(args: argparse.Namespace) -> None:
     from ..lib.backend import apply_remote_config
     from ..lib.llm import llm_error_to_systemexit
 
+    schedule_auto_upgrade()
+
     repo_root = Path(args.repo_root).resolve()
     idx = IndexDir.for_repo(repo_root)
     index_dir = idx.path
@@ -208,6 +216,42 @@ def cmd_update(args: argparse.Namespace) -> None:
             )
 
 
+def _clear_local_api_key_override(repo_root: Path) -> None:
+    """Drop any per-repo key for ``repo_root`` after a global set.
+
+    A per-repo key outranks the user-level one in both resolvers, so a global
+    `api-key set` run from an indexed repo would otherwise report success and
+    change nothing there. Encrypted stores can only be rewritten by the daemon;
+    plaintext ones we edit directly. A repo with no index has neither.
+    """
+    from ..daemon import Client, IndexDir
+    from .api_key import _clear_env_path_var
+
+    idx = IndexDir.for_repo(repo_root)
+    if idx.is_encrypted_layout():
+        try:
+            cleared = bool(Client(repo_root).set_api_key(scope="global").get("cleared_local"))
+        except Exception as e:
+            _log.warning(
+                f"Saved the global key, but could not reach this repository's "
+                f"daemon to clear a per-repo override ({e}). If searches keep "
+                f"failing with the old key, run `sourceindex api-key set --local`.",
+                extra={"event": "api_key.local_override_clear_failed"},
+            )
+            return
+    else:
+        cleared = _clear_env_path_var(
+            idx.path / PERSISTED_KEY_FILENAME, "SOURCEINDEX_API_KEY"
+        )
+    if cleared:
+        _log.info(
+            "Cleared this repository's per-repo API key so the global one "
+            "applies. Run `sourceindex api-key set --local` to pin a key to "
+            "this repository again.",
+            extra={"event": "api_key.local_override_cleared"},
+        )
+
+
 def cmd_api_key_set(args: argparse.Namespace) -> None:
     from ..daemon import Client, IndexDir
 
@@ -226,6 +270,7 @@ def cmd_api_key_set(args: argparse.Namespace) -> None:
 
     if not local_key:
         _persist_global_api_key(api_key)
+        _clear_local_api_key_override(Path(args.repo_root).resolve())
         return
 
     repo_root = Path(args.repo_root).resolve()
@@ -300,6 +345,8 @@ def cmd_search(args: argparse.Namespace) -> None:
     from ..lib.llm import llm_error_to_systemexit
     from ..search import search_index
 
+    schedule_auto_upgrade()
+
     repo_root = Path(args.repo_root).resolve()
     idx = IndexDir.for_repo(repo_root, args.index_dir)
     index_dir = idx.path

sourceindex-0.1.3/sourceindex/cli/upgrade.py

@@ -0,0 +1,143 @@
+"""Background self-upgrade for the installed sourceindex package.
+
+``sourceindex search`` and ``sourceindex update`` call
+:func:`schedule_auto_upgrade` on every invocation, which defers the work to
+interpreter exit; at most once per :data:`CHECK_INTERVAL_S` it then spawns
+the package manager that owns this install (pip / pipx / ``uv tool``) fully
+detached to pull the latest release. The finished invocation is unaffected —
+every CLI run is a fresh interpreter, and a live daemon is recycled by the
+version handshake in ``daemon/client.py`` the next time a newer client talks
+to it.
+
+Hard rules:
+
+- Never write to stdout/stderr. Search's stdout is relayed verbatim by the
+  subagent, so any stray line would corrupt the roadmap completion signal.
+  The package manager's output goes to ``auto-upgrade.log`` in the user
+  config dir instead.
+- Never raise, and never block: an upgrade problem must not break or slow
+  the search that triggered it.
+
+``SOURCEINDEX_AUTO_UPGRADE=0`` disables the whole mechanism (evals and CI
+should set it). Installs that did not come from a package index — editable
+checkouts, local wheels, VCS installs, anything with a ``direct_url.json``
+— are never touched: PyPI is not their source, so an automatic upgrade
+would silently switch sources.
+"""
+
+from __future__ import annotations
+
+import atexit
+import fcntl
+import importlib.metadata
+import os
+import shutil
+import subprocess
+import sys
+import time
+
+from ..lib.log import get_logger
+from .api_key import _user_config_dir
+
+_log = get_logger(__name__)
+
+CHECK_INTERVAL_S = 3600.0
+STAMP_FILENAME = "auto-upgrade.stamp"
+LOG_FILENAME = "auto-upgrade.log"
+
+
+def schedule_auto_upgrade() -> None:
+    """Arrange for the upgrade to be spawned once this command is finished.
+
+    Registered rather than spawned on the spot, because pip upgrades by
+    deleting the installed package and unpacking the new one — and this
+    process is still reading from it. Most of the package's imports are
+    deferred into function bodies, so a long command (a post-commit
+    ``update`` reindexing a large diff) has modules left to load minutes
+    after startup, and ``search`` execs a whole new interpreter from that
+    same install partway through. Overwriting it underneath either one risks
+    a half-old, half-new import or an exec of a momentarily incomplete
+    package. By interpreter exit there is nothing left to disturb.
+
+    Deferring also keeps pip off the CPU and network while the command is
+    doing its own work.
+
+    atexit runs on SystemExit too, so a command that failed still upgrades —
+    the newer version may be exactly the fix. It does not run on a signal or
+    ``os._exit``, which only costs a skipped cycle.
+    """
+    atexit.register(maybe_spawn_auto_upgrade)
+
+
+def maybe_spawn_auto_upgrade() -> None:
+    """Spawn a detached best-effort upgrade, throttled to once per hour."""
+    try:
+        _maybe_spawn()
+    except Exception as e:  # noqa: BLE001 — must never break the caller
+        _log.debug(
+            "auto-upgrade skipped", extra={"event": "upgrade.skipped", "error": str(e)}
+        )
+
+
+def _disabled() -> bool:
+    return os.environ.get("SOURCEINDEX_AUTO_UPGRADE", "").strip().lower() in (
+        "0", "false", "no", "off",
+    )
+
+
+def _upgrade_command() -> list[str] | None:
+    """Pick the upgrade command for this install, or ``None`` to leave it alone."""
+    try:
+        dist = importlib.metadata.distribution("sourceindex")
+    except importlib.metadata.PackageNotFoundError:
+        return None  # running from a checkout that was never installed
+    if dist.read_text("direct_url.json"):
+        return None  # editable / local / VCS install — not ours to upgrade
+    exe = sys.executable
+    if "/uv/tools/" in exe and shutil.which("uv"):
+        return ["uv", "tool", "upgrade", "sourceindex"]
+    if "/pipx/venvs/" in exe and shutil.which("pipx"):
+        return ["pipx", "upgrade", "sourceindex"]
+    return [exe, "-m", "pip", "install", "--upgrade", "--quiet", "sourceindex"]
+
+
+def _maybe_spawn() -> None:
+    if _disabled():
+        return
+    cmd = _upgrade_command()
+    if cmd is None:
+        return
+
+    config_dir = _user_config_dir()
+    config_dir.mkdir(parents=True, exist_ok=True)
+    stamp = config_dir / STAMP_FILENAME
+    fd = os.open(stamp, os.O_RDWR | os.O_CREAT, 0o644)
+    try:
+        try:
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except OSError:
+            return  # a concurrent invocation is claiming this window
+        st = os.fstat(fd)
+        # A zero-size stamp is the O_CREAT of a claimant that died before
+        # writing — its fresh mtime must not count as a completed claim.
+        if st.st_size and time.time() - st.st_mtime < CHECK_INTERVAL_S:
+            return
+        os.ftruncate(fd, 0)
+        os.write(fd, f"{time.time():.0f}\n".encode())
+
+        with open(config_dir / LOG_FILENAME, "wb") as out:
+            out.write((" ".join(cmd) + "\n").encode())
+            out.flush()
+            subprocess.Popen(
+                cmd,
+                stdin=subprocess.DEVNULL,
+                stdout=out,
+                stderr=out,
+                start_new_session=True,
+            )
+        _log.info(
+            "Spawned background upgrade: %s", " ".join(cmd),
+            extra={"event": "upgrade.spawned", "cmd": cmd},
+        )
+    finally:
+        os.close(fd)

{sourceindex-0.1.2 → sourceindex-0.1.3}/sourceindex/daemon/client.py

@@ -10,6 +10,10 @@ from typing import Any
 
 from . import lifecycle
 from .protocol import E_SERVER, RpcError, encode_frame, make_request, read_frame_sync
+from .. import __version__
+from ..lib.log import get_logger
+
+_log = get_logger(__name__)
 
 
 def _drop_none(**kwargs: Any) -> dict[str, Any]:
@@ -35,6 +39,7 @@ class Client:
         self.allow_dump_on_spawn = allow_dump_on_spawn
         self.repo_hash = lifecycle.repo_hash_for(self._main_worktree())
         self._next_id = 1
+        self._version_checked = False
 
     def _main_worktree(self) -> Path:
         from ..lib.git import resolve_main_worktree
@@ -49,6 +54,7 @@ class Client:
 
     def _ensure_running(self) -> None:
         if lifecycle.is_daemon_running(self.repo_root):
+            self._recycle_if_stale()
             return
         if not self.auto_spawn:
             raise FileNotFoundError(
@@ -57,6 +63,38 @@ class Client:
             )
         lifecycle.spawn_daemon(self.repo_root, allow_dump=self.allow_dump_on_spawn)
 
+    def _recycle_if_stale(self) -> None:
+        """Restart a running daemon that predates the installed package.
+
+        The background auto-upgrade (``cli/upgrade.py``) swaps the code on
+        disk, but a live daemon keeps serving whatever it loaded at startup.
+        Ping reports that version; when it differs from ours, restart the
+        daemon so RPCs run the same code as this CLI. Checked once per
+        Client. Admin clients skip (ping is a user-socket method), and so
+        does a client that may not spawn — it must not kill a daemon it
+        cannot replace.
+        """
+        if self._version_checked or self.admin or not self.auto_spawn:
+            return
+        self._version_checked = True
+        try:
+            info = self._call("ping")
+        except Exception:
+            return  # let the real RPC surface any failure
+        daemon_version = info.get("version")
+        if daemon_version == __version__:
+            return
+        _log.info(
+            "Daemon runs sourceindex %s but %s is installed; restarting it",
+            daemon_version, __version__,
+            extra={"event": "daemon.version_recycle", "daemon_version": daemon_version},
+        )
+        lifecycle.stop_daemon(self.repo_root)
+        lifecycle.spawn_daemon(
+            self.repo_root,
+            allow_dump=bool(info.get("allow_dump")) or self.allow_dump_on_spawn,
+        )
+
     def _call(self, method: str, params: dict | None = None) -> Any:
         self._ensure_running()
         path = self._socket_path()
@@ -129,8 +167,14 @@ class Client:
     def usage(self) -> dict:
         return self._call("usage")
 
-    def set_api_key(self, api_key: str) -> dict:
-        return self._call("set_api_key", {"api_key": api_key})
+    def set_api_key(self, api_key: str | None = None, *, scope: str = "local") -> dict:
+        params: dict = {"scope": scope}
+        # A global set needs no secret over the wire — the client has already
+        # written the user-level config and only wants the per-repo override
+        # out of the way.
+        if scope == "local":
+            params["api_key"] = api_key
+        return self._call("set_api_key", params)
 
     def dump_all(self, out_dir: Path) -> dict:
         return self._call("dump_all", {"out_dir": str(Path(out_dir).resolve())})

{sourceindex-0.1.2 → sourceindex-0.1.3}/sourceindex/daemon/server.py

@@ -26,6 +26,7 @@ from .protocol import (
     read_frame_async,
 )
 from .store import EncryptedStore
+from .. import __version__
 from ..lib.log import log_error
 
 
@@ -81,10 +82,13 @@ class Daemon:
         self._last_activity = time.monotonic()
         self._shutdown_evt: asyncio.Event | None = None
         self._repo_was_deleted = False
-        # Captured here, before run() loads either .env, so a key genuinely
-        # exported into our environment stays distinguishable from one this
-        # daemon loaded itself. Only the former outranks the persisted files.
-        self._exported_api_key = os.environ.get("SOURCEINDEX_API_KEY") or None
+        # Only a key the user's shell exported outranks the persisted files we
+        # re-read per RPC. Reading SOURCEINDEX_API_KEY directly would not do:
+        # we are exec'd from a CLI that may have loaded that value out of a
+        # config file itself, and pinning such a key at the top tier is what
+        # used to survive every rotation.
+        from ..cli.api_key import shell_api_key
+        self._exported_api_key = shell_api_key()
         self._api_key_source: str | None = None
         self._api_key_fingerprint: str | None = None
         self._user_handlers: dict[str, Callable[[dict], Awaitable[dict]]] = {}
@@ -141,29 +145,40 @@ class Daemon:
             lifecycle.pidfile(self.repo_hash).unlink(missing_ok=True)
             lifecycle.cleanup_stale_files(self.repo_hash)
 
-    def _load_env_from_store(self) -> None:
+    def _read_store_env(self) -> dict[str, str]:
+        """Decrypt and parse the store's ``.env``. A store without one, or one
+        we cannot read, is reported as empty — every caller treats a missing
+        setting the same way, and none of them can act on a decrypt failure."""
         if not self.store.exists(".env"):
-            return
+            return {}
         try:
             text = self.store.read_text(".env")
         except Exception as e:
-            _log.warning("could not load encrypted .env: %s", e)
-            return
+            _log.warning("could not read encrypted .env: %s", e)
+            return {}
         from ..lib.env import parse_env_text
-        for k, v in parse_env_text(text).items():
+        return parse_env_text(text)
+
+    def _write_store_env(self, env_vars: dict[str, str]) -> None:
+        from ..lib.env import format_env_text
+        self.store.write_text(".env", format_env_text(env_vars))
+
+    def _load_env_from_store(self) -> None:
+        for k, v in self._read_store_env().items():
             if k and k not in os.environ:
                 os.environ[k] = v
 
     def _api_key_from_store(self) -> str | None:
-        if not self.store.exists(".env"):
-            return None
-        try:
-            text = self.store.read_text(".env")
-        except Exception as e:
-            _log.warning("could not read encrypted .env: %s", e)
-            return None
-        from ..lib.env import parse_env_text
-        return parse_env_text(text).get("SOURCEINDEX_API_KEY") or None
+        return self._read_store_env().get("SOURCEINDEX_API_KEY") or None
+
+    def _clear_store_api_key(self) -> bool:
+        """Drop the per-repo key override, leaving the store's other settings
+        alone. Returns whether one was actually there."""
+        env_vars = self._read_store_env()
+        if env_vars.pop("SOURCEINDEX_API_KEY", None) is None:
+            return False
+        self._write_store_env(env_vars)
+        return True
 
     def _resolve_api_key(self) -> tuple[str | None, str]:
         """Resolve the effective API key from scratch, highest precedence
@@ -385,6 +400,10 @@ class Daemon:
             "ok": True,
             "repo_hash": self.repo_hash,
             "allow_dump": self.allow_dump,
+            # The code loaded at startup, not what is on disk — the client
+            # compares this against its own version to recycle a daemon that
+            # predates a background auto-upgrade.
+            "version": __version__,
             "idle_for_s": time.monotonic() - self._last_activity,
         }
 
@@ -486,21 +505,34 @@ class Daemon:
         return {"budget": budget}
 
     async def _h_set_api_key(self, params: dict) -> dict:
-        api_key = params.get("api_key")
-        if not isinstance(api_key, str) or not api_key:
-            raise RpcError(E_INVALID_PARAMS, "api_key is required")
-        if "\n" in api_key or "\r" in api_key:
-            raise RpcError(E_INVALID_PARAMS, "api_key must be a single line")
+        """Apply an ``api-key set``.
 
-        from ..lib.env import parse_env_text
+        ``scope="local"`` writes the key into this repo's store as a per-repo
+        override. ``scope="global"`` means the client already wrote the
+        user-level config and we only need to stand out of the way: clear any
+        per-repo override, which would otherwise outrank it and make the
+        global command a silent no-op on every indexed repo.
+        """
+        scope = params.get("scope") or "local"
+        if scope not in ("local", "global"):
+            raise RpcError(E_INVALID_PARAMS, "scope must be 'local' or 'global'")
+
+        api_key = params.get("api_key")
+        cleared_local = False
+        if scope == "local":
+            if not isinstance(api_key, str) or not api_key:
+                raise RpcError(E_INVALID_PARAMS, "api_key is required")
+            if "\n" in api_key or "\r" in api_key:
+                raise RpcError(E_INVALID_PARAMS, "api_key must be a single line")
+
+            env_vars = self._read_store_env()
+            env_vars["SOURCEINDEX_API_KEY"] = api_key
+            self._write_store_env(env_vars)
+        else:
+            # The client narrates this one to the user off `cleared_local`;
+            # duplicating it here would double-count the event in the logs.
+            cleared_local = self._clear_store_api_key()
 
-        env_vars = {}
-        if self.store.exists(".env"):
-            env_vars = parse_env_text(self.store.read_text(".env"))
-        env_vars["SOURCEINDEX_API_KEY"] = api_key
-        self.store.write_text(
-            ".env", "".join(f"{k}={v}\n" for k, v in env_vars.items())
-        )
         # An explicit `api-key set` is a deliberate act and outranks whatever
         # was exported into the environment we were launched with — otherwise
         # a stale export would silently shadow the key just written, which is
@@ -508,14 +540,14 @@ class Daemon:
         if self._exported_api_key and self._exported_api_key != api_key:
             _log.warning(
                 "Superseding the SOURCEINDEX_API_KEY exported in the daemon's "
-                "environment (%s) with the key just set (%s). Remove that "
-                "export so every SourceIndex process agrees on one key.",
-                _key_fingerprint(self._exported_api_key), _key_fingerprint(api_key),
+                "environment (%s). Remove that export so every SourceIndex "
+                "process agrees on one key.",
+                _key_fingerprint(self._exported_api_key),
                 extra={"event": "api_key.export_superseded"},
             )
         self._exported_api_key = None
         self._refresh_api_key()
-        return {"updated": True}
+        return {"updated": True, "cleared_local": cleared_local}
 
     def _register_admin_handlers(self) -> None:
         self._admin_handlers = {
@@ -545,10 +577,7 @@ class Daemon:
         return {"text": self.store.read_text(f"details/{rel}.md")}
 
     async def _h_read_env(self, params: dict) -> dict:
-        if not self.store.exists(".env"):
-            return {"vars": {}}
-        from ..lib.env import parse_env_text
-        return {"vars": parse_env_text(self.store.read_text(".env"))}
+        return {"vars": self._read_store_env()}
 
     async def _h_shutdown(self, params: dict) -> dict:
         self._request_shutdown()

{sourceindex-0.1.2 → sourceindex-0.1.3}/sourceindex/lib/env.py

@@ -28,3 +28,9 @@ def parse_env_text(contents: str) -> dict[str, str]:
         k, _, v = line.partition("=")
         out[k.strip()] = v.strip()
     return out
+
+
+def format_env_text(values: dict[str, str]) -> str:
+    """Serialize ``{key: value}`` back to ``.env``-style text. Round-trip
+    partner of ``parse_env_text`` — kept beside it so the two cannot drift."""
+    return "".join(f"{k}={v}\n" for k, v in values.items())