@jameslovespancakes/pi-plus 1.0.11 → 1.0.12

package/src/core/anthropic/quota.ts

@@ -1,33 +1,11 @@
 import { loadAccounts, saveAccount, type Account, type QuotaSnapshot } from "./store.ts";
 import { refreshToken } from "./oauth.ts";
 
-/**
- * Quota tracking.
- *
- * There are two sources, and the cheap one is strongly preferred:
- *
- *   1. Response headers. Every `/v1/messages` reply carries the same numbers
- *      as the usage endpoint, so the account actually serving traffic keeps
- *      its snapshot current at no request cost at all.
- *   2. The usage endpoint. Only needed for accounts that are NOT serving
- *      traffic, since routing compares accounts and an idle one would
- *      otherwise never update.
- *
- * Polling used to run on a 5 minute timer regardless of activity. That is what
- * the backoff below exists for: the endpoint rate limits, it answers 429 with
- * `retry-after: 0`, and `pollQuota` reports failure as `undefined`, so the
- * throttling was invisible and simply left routing on stale data.
- */
+/** Uses free response headers first, polling only stale idle accounts. */
 
 const QUOTA_URL = "https://api.anthropic.com/api/oauth/usage";
 const TIMEOUT_MS = 10_000;
-/**
- * Selection tolerates a snapshot this old before it is worth re-polling.
- *
- * This doubles as the poll rate limiter. Polling is triggered by sending a
- * message, so this is the floor between polls however fast you type: send a
- * message after the window and it polls, send ten inside it and it polls once.
- */
+/** Snapshot lifetime and minimum interval between polls. */
 export const QUOTA_FRESH_MS = 10 * 60_000;
 /** After a 429, wait at least this long before touching the endpoint again. */
 export const QUOTA_BACKOFF_MS = 15 * 60_000;
@@ -95,15 +73,8 @@ export function isFresh(quota: QuotaSnapshot | undefined, now = Date.now()): boo
 }
 
 /**
- * Reads a quota snapshot out of `/v1/messages` response headers.
- *
- * Anthropic reports utilisation here as a FRACTION (`0.16`), while the usage
- * endpoint reports a PERCENT (`16`). Verified against the same account at the
- * same moment, including matching reset timestamps. Scaling by 100 is what
- * makes the two sources comparable, so do not drop it.
- *
- * Returns undefined when the headers are absent, which is normal: they do not
- * appear on 4xx replies, and non-Anthropic transports may not expose them.
+ * Parses response quota headers. Header utilization is a fraction, while the
+ * usage endpoint returns a percentage, so header values are scaled by 100.
  */
 export function parseQuotaHeaders(
   headers: Record<string, unknown> | undefined,
@@ -145,12 +116,7 @@ export function parseQuotaHeaders(
   return { five_hour, seven_day, checkedAt: now, source: "headers" };
 }
 
-/**
- * Merges a header-derived snapshot into an account.
- *
- * Scoped per-model limits only come from the usage endpoint, so they are
- * carried over from the previous snapshot rather than dropped.
- */
+/** Merges header quota while preserving polled model limits. */
 export function applyQuotaHeaders(
   accountId: string,
   headers: Record<string, unknown> | undefined,
@@ -163,10 +129,7 @@ export function applyQuotaHeaders(
   const account = storage?.accounts.find((a) => a.id === accountId);
   if (!account) return false;
 
-  // Headers arrive on every response, but utilisation moves in whole percent
-  // steps over windows of hours. Rewriting two credential files per request to
-  // store an unchanged number is pure write amplification, and on Windows each
-  // rewrite is another chance for the rename to collide with a file lock.
+  // Skip unchanged values to avoid credential writes on every response.
   const previous = account.quota;
   const unchanged =
     previous?.five_hour?.usedPercent === fresh.five_hour?.usedPercent
@@ -177,12 +140,7 @@ export function applyQuotaHeaders(
   return true;
 }
 
-/**
- * Polls one account. Returns undefined rather than throwing on failure.
- *
- * Pass `accountId` so a 429 registers backoff; without it the caller can
- * hammer a throttled endpoint and silently keep stale quota.
- */
+/** Polls one account and records rate-limit backoff. */
 export async function pollQuota(
   accessToken: string,
   accountId?: string,
@@ -232,10 +190,7 @@ export async function ensureAccessToken(account: Account): Promise<string | unde
   return refreshed.access;
 }
 
-/**
- * Refreshes stale quota for every usable account, in parallel.
- * Best-effort: a failure leaves the previous snapshot in place.
- */
+/** Refreshes stale account quota in parallel. */
 export async function refreshAllQuota(force = false): Promise<number> {
   const storage = loadAccounts();
   if (!storage) return 0;

package/src/core/anthropic/routing.ts

@@ -1,17 +1,7 @@
+import { selectRoutingCandidate, type AccountQuotaState } from "../accounts/routing.ts";
 import { MAIN_ACCOUNT_ID, type Account, type QuotaSnapshot, type QuotaWindow, type RoutingMode } from "./store.ts";
 
-/**
- * Account selection and sticky session assignment.
- *
- * Two jobs:
- *   1. score each candidate by how much work it can absorb
- *   2. keep a session on one account, because Anthropic's prompt cache is
- *      per-account and migrating throws it away
- */
-
-/** How long each window takes to refill completely. */
-export const WINDOW_HOURS = { five_hour: 5, seven_day: 168, scoped: 168 } as const;
-export type WindowKey = keyof typeof WINDOW_HOURS;
+/** Claude quota normalization and account selection. */
 
 export type Family = "fable" | "opus" | "general";
 
@@ -28,25 +18,10 @@ export interface Candidate {
   quota?: QuotaSnapshot;
   /** Config order; `main` is 0, so it wins ties. */
   order: number;
+  lastUsed?: number;
   account?: Account;
 }
 
-/**
- * Hours of wall-clock recovery per point of quota spent.
- *
- * Expressed against the window's own length rather than its distance to reset:
- * a 5h window regenerates 34x faster than a 7d one, so a point spent there is
- * far cheaper. Returns Infinity at or below zero, which collapses the account's
- * weight to 0 and removes it from selection.
- */
-export function recoveryCost(window: QuotaWindow | undefined, key: WindowKey, reserve = 0): number {
-  const remaining = window?.remainingPercent;
-  if (!Number.isFinite(remaining)) return Infinity;
-  const spendable = Math.max(0, (remaining as number) - reserve);
-  if (spendable <= 0) return Infinity;
-  return WINDOW_HOURS[key] / spendable;
-}
-
 /** Scoped windows are model-specific; match the one governing this model. */
 export function scopedWindowFor(quota: QuotaSnapshot | undefined, modelId?: string): QuotaWindow | undefined {
   const scoped = quota?.scoped;
@@ -59,110 +34,60 @@ export function scopedWindowFor(quota: QuotaSnapshot | undefined, modelId?: stri
   }) ?? scoped[0];
 }
 
-/**
- * Capacity score. Higher is better, 0 means unusable.
- *
- * Costs are summed and inverted rather than taking the minimum window, so a
- * cheap fast-refilling window still contributes instead of being masked by a
- * slow one. Any window at zero yields Infinity and zeroes the account, which
- * preserves the hard exclusion rule.
- */
-export function candidateWeight(candidate: Candidate, family: Family, modelId?: string, reserve = 0): number {
-  const quota = candidate.quota;
-  if (!quota) return 0;
-
-  const costs = [
-    recoveryCost(quota.five_hour, "five_hour", reserve),
-    recoveryCost(quota.seven_day, "seven_day", reserve),
-  ];
-
-  // Fable requests are additionally gated by their scoped window.
-  if (family === "fable") {
-    const scoped = scopedWindowFor(quota, modelId);
-    if (scoped) costs.push(recoveryCost(scoped, "scoped", reserve));
-  }
-
-  const total = costs.reduce((sum, c) => sum + c, 0);
-  return Number.isFinite(total) && total > 0 ? 1 / total : 0;
-}
-
-export interface Assignment {
-  accountId: string;
-  family: Family;
-  assignedAt: number;
-  lastSeenAt: number;
-}
-
 export interface SelectInput {
   candidates: Candidate[];
   family: Family;
   modelId?: string;
   mode: RoutingMode;
-  /** Existing sticky assignment for this session, if any. */
-  assignment?: Assignment;
   now?: number;
 }
 
 export interface Selection {
   candidate: Candidate;
-  reason: "sticky" | "weighted" | "main-first" | "fallback-first" | "only";
+  reason: "quota-aware" | "sequential" | "only";
+}
+
+function routingQuota(candidate: Candidate, family: Family, modelId?: string): AccountQuotaState | undefined {
+  const quota = candidate.quota;
+  if (!quota) return undefined;
+  const windows: (QuotaWindow | undefined)[] = [quota.five_hour, quota.seven_day];
+  if (family === "fable") windows.push(scopedWindowFor(quota, modelId));
+  const measured = windows.filter((window) => window && Number.isFinite(window.remainingPercent));
+  if (measured.length === 0) return undefined;
+
+  const remainingPercent = Math.min(...measured.map((window) => window!.remainingPercent!));
+  const resetTimes = measured
+    .filter((window) => (window!.remainingPercent ?? 0) <= 0 && window!.resetsAt)
+    .map((window) => Date.parse(window!.resetsAt!))
+    .filter(Number.isFinite);
+  const resetAt = resetTimes.length > 0 ? Math.min(...resetTimes) : undefined;
+  return {
+    remainingPercent,
+    resetAt,
+    checkedAt: quota.checkedAt ?? Date.now(),
+    blockedUntil: remainingPercent <= 0 ? resetAt ?? Number.POSITIVE_INFINITY : undefined,
+  };
 }
 
-/**
- * Picks an account.
- *
- * `main-first` and `fallback-first` are simple orderings. `sticky-balanced`
- * keeps the session where it is while that account is still viable, and
- * otherwise takes the highest-weight candidate.
- */
+/** Picks an account using the shared sequential or quota-aware policy. */
 export function selectAccount(input: SelectInput): Selection | undefined {
-  const usable = input.candidates.filter((c) => c.access);
+  const usable = input.candidates.filter((candidate) => candidate.access);
   if (usable.length === 0) return undefined;
   if (usable.length === 1) return { candidate: usable[0], reason: "only" };
 
-  if (input.mode === "main-first" || input.mode === "fallback-first") {
-    const ordered = [...usable].sort((a, b) =>
-      input.mode === "main-first" ? a.order - b.order : b.order - a.order);
-    const viable = ordered.find((c) => candidateWeight(c, input.family, input.modelId) > 0);
-    return viable ? { candidate: viable, reason: input.mode } : undefined;
-  }
-
-  const weighted = usable
-    .map((candidate) => ({ candidate, weight: candidateWeight(candidate, input.family, input.modelId) }))
-    .filter((entry) => entry.weight > 0);
-  if (weighted.length === 0) return undefined;
-
-  // Stay put while the assigned account can still serve: migrating discards
-  // the prompt cache, which costs more than a slightly better weight gains.
-  if (input.assignment) {
-    const held = weighted.find((e) => e.candidate.id === input.assignment!.accountId);
-    if (held) return { candidate: held.candidate, reason: "sticky" };
-  }
-
-  weighted.sort((a, b) =>
-    b.weight - a.weight
-    || a.candidate.order - b.candidate.order
-    || a.candidate.id.localeCompare(b.candidate.id));
-  return { candidate: weighted[0].candidate, reason: "weighted" };
+  const selected = selectRoutingCandidate(
+    usable.map((candidate) => ({
+      id: candidate.id,
+      order: candidate.order,
+      lastUsed: candidate.lastUsed ?? candidate.account?.lastUsed ?? 0,
+      quota: routingQuota(candidate, input.family, input.modelId),
+      value: candidate,
+    })),
+    input.mode,
+    input.now,
+  );
+  return selected ? { candidate: selected.value, reason: input.mode } : undefined;
 }
 
-/** Seconds until the soonest window that would unblock this model resets. */
-export function retryAfterSeconds(candidates: Candidate[], family: Family, modelId?: string, now = Date.now()): number {
-  const resets: number[] = [];
-  for (const candidate of candidates) {
-    const quota = candidate.quota;
-    if (!quota) continue;
-    const windows: (QuotaWindow | undefined)[] = [quota.five_hour, quota.seven_day];
-    if (family === "fable") windows.push(scopedWindowFor(quota, modelId));
-    for (const w of windows) {
-      if (!w?.resetsAt) continue;
-      if ((w.remainingPercent ?? 0) > 0) continue;
-      const at = Date.parse(w.resetsAt);
-      if (Number.isFinite(at) && at > now) resets.push(at);
-    }
-  }
-  if (resets.length === 0) return 60;
-  return Math.max(1, Math.ceil((Math.min(...resets) - now) / 1000));
-}
 
 export { MAIN_ACCOUNT_ID };

package/src/core/anthropic/store.ts

@@ -1,14 +1,13 @@
 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { normalizeRoutingMode, type AccountRoutingMode } from "../accounts/routing.ts";
 
 /**
  * Anthropic account store.
  *
- * Byte-compatible with @cortexkit/anthropic-auth-core so both implementations
- * can read the same files and reverting stays possible. The split is theirs and
- * is worth preserving: durable identity in `anthropic-auth.json`, live secrets
- * and volatile quota in `anthropic-auth-state.json`.
+ * Keeps durable identity in `anthropic-auth.json` and live secrets and quota
+ * in `anthropic-auth-state.json`.
  *
  *   anthropic-auth.json        id, label, type, enabled, addedAt, routing
  *   anthropic-auth-state.json  access, refresh, expires, quota, lastUsed, ...
@@ -54,7 +53,7 @@ export interface Account {
   apiKey?: string;
 }
 
-export type RoutingMode = "main-first" | "fallback-first" | "sticky-balanced";
+export type RoutingMode = AccountRoutingMode;
 
 export interface Storage {
   version?: number;
@@ -136,7 +135,7 @@ const pick = <T extends object>(source: any, keys: readonly string[]): T =>
   Object.fromEntries(keys.filter((k) => source?.[k] !== undefined).map((k) => [k, source[k]])) as T;
 
 export function emptyStorage(): Storage {
-  return { version: 1, accounts: [], routing: { mode: "main-first" } };
+  return { version: 1, accounts: [], routing: { mode: "sequential" } };
 }
 
 /**
@@ -208,8 +207,7 @@ export const isOAuthAccount = (a: Account): boolean => a.type === "oauth" && !!a
 export const isUsable = (a: Account): boolean => a.enabled !== false && isOAuthAccount(a);
 
 export function getRoutingMode(storage: Storage | undefined): RoutingMode {
-  const mode = storage?.routing?.mode;
-  return mode === "sticky-balanced" || mode === "fallback-first" || mode === "main-first" ? mode : "main-first";
+  return normalizeRoutingMode(storage?.routing?.mode as string | undefined);
 }
 
 export function setRoutingMode(mode: RoutingMode, config = configPath()): Storage {
@@ -228,7 +226,7 @@ export function setRoutingMode(mode: RoutingMode, config = configPath()): Storag
  * the state file is normal.
  *
  * This is easy to mistake for stale data and delete. Doing so breaks
- * `main-first` routing and orphans every routing assignment targeting `main`.
+ * sequential routing and orphans every routing assignment targeting `main`.
  */
 export const MAIN_ACCOUNT_ID = "main";
 

package/src/core/catalog/quality.ts

@@ -82,7 +82,15 @@ interface QualityStore {
 }
 
 let cache: QualityStore | undefined;
+let cachedRecords: QualityRecord[] = [];
 let inFlight: Promise<string[]> | undefined;
+const lookupCache = new Map<string, QualityLookup>();
+
+function setCache(next: QualityStore): void {
+  cache = next;
+  cachedRecords = Object.values(next.records);
+  lookupCache.clear();
+}
 
 function agentDir(): string {
   return process.env.PI_AGENT_DIR ?? join(homedir(), ".pi", "agent");
@@ -119,18 +127,18 @@ function loadCache(): void {
     const parsed = JSON.parse(readFileSync(cachePath(), "utf8")) as QualityStore & { fetchedAt?: number };
     if (!parsed?.records) return;
     // Migrate the pre-store format, which only had `fetchedAt`.
-    cache = {
+    setCache({
       records: parsed.records,
       checkedAt: parsed.checkedAt ?? parsed.fetchedAt,
       lastModified: parsed.lastModified,
       etag: parsed.etag,
       source: parsed.source ?? "artificial-analysis",
-    };
+    });
   } catch { /* first run */ }
 }
 
 function persist(next: QualityStore): void {
-  cache = next;
+  setCache(next);
   try {
     writeFileSync(cachePath(), JSON.stringify(next), "utf8");
   } catch { /* cache write is best effort */ }
@@ -289,26 +297,36 @@ export interface QualityLookup {
  */
 export function qualityFor(modelId: string, thinkingLevel?: string): QualityLookup {
   loadCache();
+  const key = `${modelId}\0${thinkingLevel ?? ""}`;
+  const cached = lookupCache.get(key);
+  if (cached) return cached;
+
   const records = cache?.records ?? {};
   const base = normalizeSlug(modelId);
-
   const levelled = thinkingLevel && thinkingLevel !== "off" ? records[`${base}-${thinkingLevel}`] : undefined;
-  if (levelled) return { record: levelled, efficiency: costEfficiency(levelled), confidence: "measured", basis: levelled.slug };
-
   const exact = records[base];
-  if (exact) return { record: exact, efficiency: costEfficiency(exact), confidence: "measured", basis: exact.slug };
-
-  let best: QualityRecord | undefined;
-  for (const record of Object.values(records)) {
-    if (!base.includes(record.slug) && !record.slug.includes(base)) continue;
-    if (!best || record.slug.length > best.slug.length) best = record;
+  let result: QualityLookup;
+
+  if (levelled) {
+    result = { record: levelled, efficiency: costEfficiency(levelled), confidence: "measured", basis: levelled.slug };
+  } else if (exact) {
+    result = { record: exact, efficiency: costEfficiency(exact), confidence: "measured", basis: exact.slug };
+  } else {
+    let best: QualityRecord | undefined;
+    for (const record of cachedRecords) {
+      if (!base.includes(record.slug) && !record.slug.includes(base)) continue;
+      if (!best || record.slug.length > best.slug.length) best = record;
+    }
+    result = best
+      ? { record: best, efficiency: costEfficiency(best), confidence: "inferred", basis: `nearest match ${best.slug}` }
+      : { efficiency: {}, confidence: "unrated", basis: "no Artificial Analysis entry" };
   }
-  if (best) return { record: best, efficiency: costEfficiency(best), confidence: "inferred", basis: `nearest match ${best.slug}` };
 
-  return { efficiency: {}, confidence: "unrated", basis: "no Artificial Analysis entry" };
+  lookupCache.set(key, result);
+  return result;
 }
 
 export function allRecords(): QualityRecord[] {
   loadCache();
-  return Object.values(cache?.records ?? {});
+  return [...cachedRecords];
 }

package/src/core/codex/quota.ts

@@ -1,5 +1,5 @@
 import type { QuotaSnapshot } from "../anthropic/store.ts";
-import { loadCodexAccounts, saveCodexAccount } from "./store.ts";
+import { MAIN_ACCOUNT_ID, loadCodexAccounts, saveCodexAccount, saveCodexAccounts } from "./store.ts";
 
 /**
  * Codex quota, read from response headers.
@@ -81,7 +81,13 @@ export function applyCodexQuotaHeaders(
 ): boolean {
   const quota = parseCodexQuotaHeaders(headers, now);
   if (!quota) return false;
-  const account = loadCodexAccounts().accounts.find((a) => a.id === accountId);
+  const storage = loadCodexAccounts();
+  if (accountId === MAIN_ACCOUNT_ID) {
+    storage.main = { ...storage.main, quota };
+    saveCodexAccounts(storage);
+    return true;
+  }
+  const account = storage.accounts.find((candidate) => candidate.id === accountId);
   if (!account) return false;
   saveCodexAccount({ ...account, quota });
   return true;

package/src/core/codex/store.ts

@@ -1,5 +1,5 @@
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import type { QuotaSnapshot } from "../anthropic/store.ts";
 
@@ -26,38 +26,41 @@ export interface CodexAccount {
   plan?: string;
   addedAt?: number;
   lastRefreshedAt?: number;
+  lastUsed?: number;
+  blockedUntil?: number;
   quota?: QuotaSnapshot;
 }
 
 export interface CodexStorage {
   accounts: CodexAccount[];
+  main?: { quota?: QuotaSnapshot; lastUsed?: number; blockedUntil?: number };
   routing?: { mode?: string };
 }
 
 export const MAIN_ACCOUNT_ID = "main";
 
-function storePath(): string {
-  return join(homedir(), ".pi", "agent", "codex-accounts.json");
+export function codexAccountsPath(): string {
+  return process.env.PI_PLUS_CODEX_ACCOUNTS_FILE ?? join(homedir(), ".pi", "agent", "codex-accounts.json");
 }
 
-export function loadCodexAccounts(path = storePath()): CodexStorage {
+export function loadCodexAccounts(path = codexAccountsPath()): CodexStorage {
   try {
     const raw = JSON.parse(readFileSync(path, "utf8"));
     const accounts = Array.isArray(raw?.accounts) ? raw.accounts : [];
-    return { accounts, routing: raw?.routing };
+    return { accounts, main: raw?.main, routing: raw?.routing };
   } catch {
     return { accounts: [] };
   }
 }
 
-export function saveCodexAccounts(storage: CodexStorage, path = storePath()): void {
-  mkdirSync(join(homedir(), ".pi", "agent"), { recursive: true });
+export function saveCodexAccounts(storage: CodexStorage, path = codexAccountsPath()): void {
+  mkdirSync(dirname(path), { recursive: true });
   // 0600: these are live OAuth credentials.
   writeFileSync(path, JSON.stringify(storage, null, 2) + "\n", { mode: 0o600 });
 }
 
 /** Inserts or replaces one account, leaving the others untouched. */
-export function saveCodexAccount(account: CodexAccount, path = storePath()): void {
+export function saveCodexAccount(account: CodexAccount, path = codexAccountsPath()): void {
   const storage = loadCodexAccounts(path);
   const index = storage.accounts.findIndex((a) => a.id === account.id);
   if (index >= 0) storage.accounts[index] = { ...storage.accounts[index], ...account };
@@ -65,7 +68,7 @@ export function saveCodexAccount(account: CodexAccount, path = storePath()): voi
   saveCodexAccounts(storage, path);
 }
 
-export function removeCodexAccount(id: string, path = storePath()): boolean {
+export function removeCodexAccount(id: string, path = codexAccountsPath()): boolean {
   const storage = loadCodexAccounts(path);
   const before = storage.accounts.length;
   storage.accounts = storage.accounts.filter((a) => a.id !== id);

package/src/core/config.ts

@@ -2,21 +2,8 @@ import { existsSync } from "node:fs";
 import { agentPath, readJson, writeJson } from "./store.ts";
 
 /**
- * One file for everything pi-plus owns: `~/.pi/agent/pi-plus.json`.
- *
- * ```json
- * {
- *   "env":    { "ARTIFICIAL_ANALYSIS_API_KEY": "aa_…", "AGENT_BOARD_URL": "…" },
- *   "policy": { "autoApprove": [], "requireApproval": [], "deny": [] },
- *   "remote": { "injectStatus": true, "defaults": {}, "workers": [] }
- * }
- * ```
- *
- * Pi's own `settings.json` and `models.json` are deliberately NOT absorbed:
- * pi reads those from fixed paths and folding them in here would break it.
- *
- * Every legacy file is migrated on first read and left on disk, so downgrading
- * keeps working.
+ * Unified pi-plus config. Pi's own settings stay separate, while legacy files
+ * migrate without being deleted.
  */
 
 export const CONFIG_FILE = "pi-plus.json";
@@ -42,8 +29,8 @@ export interface PiPlusConfig {
 const DEFAULTS: PiPlusConfig = {
   env: {},
   policy: {
-    autoApprove: ["anthropic/*", "openai-codex/*"],
-    requireApproval: ["openrouter/*", "google/*", "openai/*", "xai/*"],
+    autoApprove: ["anthropic/*", "openai-codex/*", "kimi-coding/*", "xai/*"],
+    requireApproval: ["openrouter/*", "google/*", "openai/*"],
     deny: [],
   },
   remote: { injectStatus: true, workers: [] },

package/src/core/store.ts

@@ -1,13 +1,8 @@
-import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
-/**
- * Small JSON config helper shared by every domain.
- *
- * Writes go through a temp file + rename so a crash mid-write cannot leave a
- * truncated config behind; several of these files hold auth state.
- */
+/** Shared JSON storage with atomic writes. */
 
 export function agentDir(): string {
   return process.env.PI_AGENT_DIR ?? join(homedir(), ".pi", "agent");
@@ -25,19 +20,25 @@ export function readJson<T>(path: string, fallback: T): T {
   }
 }
 
-/** Best-effort atomic write. Returns false instead of throwing. */
-export function writeJson(path: string, value: unknown, pretty = false): boolean {
+/** Best-effort atomic write. */
+export function writeJson(path: string, value: unknown, pretty = false, mode?: number): boolean {
   const temp = `${path}.${process.pid}.tmp`;
+  const content = JSON.stringify(value, undefined, pretty ? 2 : undefined);
+  const options = { encoding: "utf8" as const, ...(mode === undefined ? {} : { mode }) };
+
   try {
-    writeFileSync(temp, JSON.stringify(value, undefined, pretty ? 2 : undefined), "utf8");
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(temp, content, options);
     renameSync(temp, path);
     return true;
   } catch {
     try {
-      writeFileSync(path, JSON.stringify(value, undefined, pretty ? 2 : undefined), "utf8");
+      writeFileSync(path, content, options);
       return true;
     } catch {
       return false;
+    } finally {
+      try { rmSync(temp, { force: true }); } catch { /* best effort */ }
     }
   }
 }

package/src/domains/models/provider-picker.ts

@@ -149,7 +149,7 @@ export async function openProviderPicker(ctx: any, deps: PickerDeps): Promise<vo
 
   const initial = await deps.rows();
   if (initial.length === 0) {
-    ctx.ui.notify("No providers are configured. Sign in with /account or pi auth.", "info");
+    ctx.ui.notify("No providers are configured. Sign in with /accounts or pi auth.", "info");
     return;
   }