@jameslovespancakes/pi-plus 1.0.11 → 1.0.13

package/src/core/anthropic/routing.ts

@@ -1,17 +1,7 @@
+import { selectRoutingCandidate, type AccountQuotaState } from "../accounts/routing.ts";
 import { MAIN_ACCOUNT_ID, type Account, type QuotaSnapshot, type QuotaWindow, type RoutingMode } from "./store.ts";
 
-/**
- * Account selection and sticky session assignment.
- *
- * Two jobs:
- *   1. score each candidate by how much work it can absorb
- *   2. keep a session on one account, because Anthropic's prompt cache is
- *      per-account and migrating throws it away
- */
-
-/** How long each window takes to refill completely. */
-export const WINDOW_HOURS = { five_hour: 5, seven_day: 168, scoped: 168 } as const;
-export type WindowKey = keyof typeof WINDOW_HOURS;
+/** Claude quota normalization and account selection. */
 
 export type Family = "fable" | "opus" | "general";
 
@@ -28,25 +18,10 @@ export interface Candidate {
   quota?: QuotaSnapshot;
   /** Config order; `main` is 0, so it wins ties. */
   order: number;
+  lastUsed?: number;
   account?: Account;
 }
 
-/**
- * Hours of wall-clock recovery per point of quota spent.
- *
- * Expressed against the window's own length rather than its distance to reset:
- * a 5h window regenerates 34x faster than a 7d one, so a point spent there is
- * far cheaper. Returns Infinity at or below zero, which collapses the account's
- * weight to 0 and removes it from selection.
- */
-export function recoveryCost(window: QuotaWindow | undefined, key: WindowKey, reserve = 0): number {
-  const remaining = window?.remainingPercent;
-  if (!Number.isFinite(remaining)) return Infinity;
-  const spendable = Math.max(0, (remaining as number) - reserve);
-  if (spendable <= 0) return Infinity;
-  return WINDOW_HOURS[key] / spendable;
-}
-
 /** Scoped windows are model-specific; match the one governing this model. */
 export function scopedWindowFor(quota: QuotaSnapshot | undefined, modelId?: string): QuotaWindow | undefined {
   const scoped = quota?.scoped;
@@ -59,110 +34,60 @@ export function scopedWindowFor(quota: QuotaSnapshot | undefined, modelId?: stri
   }) ?? scoped[0];
 }
 
-/**
- * Capacity score. Higher is better, 0 means unusable.
- *
- * Costs are summed and inverted rather than taking the minimum window, so a
- * cheap fast-refilling window still contributes instead of being masked by a
- * slow one. Any window at zero yields Infinity and zeroes the account, which
- * preserves the hard exclusion rule.
- */
-export function candidateWeight(candidate: Candidate, family: Family, modelId?: string, reserve = 0): number {
-  const quota = candidate.quota;
-  if (!quota) return 0;
-
-  const costs = [
-    recoveryCost(quota.five_hour, "five_hour", reserve),
-    recoveryCost(quota.seven_day, "seven_day", reserve),
-  ];
-
-  // Fable requests are additionally gated by their scoped window.
-  if (family === "fable") {
-    const scoped = scopedWindowFor(quota, modelId);
-    if (scoped) costs.push(recoveryCost(scoped, "scoped", reserve));
-  }
-
-  const total = costs.reduce((sum, c) => sum + c, 0);
-  return Number.isFinite(total) && total > 0 ? 1 / total : 0;
-}
-
-export interface Assignment {
-  accountId: string;
-  family: Family;
-  assignedAt: number;
-  lastSeenAt: number;
-}
-
 export interface SelectInput {
   candidates: Candidate[];
   family: Family;
   modelId?: string;
   mode: RoutingMode;
-  /** Existing sticky assignment for this session, if any. */
-  assignment?: Assignment;
   now?: number;
 }
 
 export interface Selection {
   candidate: Candidate;
-  reason: "sticky" | "weighted" | "main-first" | "fallback-first" | "only";
+  reason: "quota-aware" | "sequential" | "only";
+}
+
+function routingQuota(candidate: Candidate, family: Family, modelId?: string): AccountQuotaState | undefined {
+  const quota = candidate.quota;
+  if (!quota) return undefined;
+  const windows: (QuotaWindow | undefined)[] = [quota.five_hour, quota.seven_day];
+  if (family === "fable") windows.push(scopedWindowFor(quota, modelId));
+  const measured = windows.filter((window) => window && Number.isFinite(window.remainingPercent));
+  if (measured.length === 0) return undefined;
+
+  const remainingPercent = Math.min(...measured.map((window) => window!.remainingPercent!));
+  const resetTimes = measured
+    .filter((window) => (window!.remainingPercent ?? 0) <= 0 && window!.resetsAt)
+    .map((window) => Date.parse(window!.resetsAt!))
+    .filter(Number.isFinite);
+  const resetAt = resetTimes.length > 0 ? Math.min(...resetTimes) : undefined;
+  return {
+    remainingPercent,
+    resetAt,
+    checkedAt: quota.checkedAt ?? Date.now(),
+    blockedUntil: remainingPercent <= 0 ? resetAt ?? Number.POSITIVE_INFINITY : undefined,
+  };
 }
 
-/**
- * Picks an account.
- *
- * `main-first` and `fallback-first` are simple orderings. `sticky-balanced`
- * keeps the session where it is while that account is still viable, and
- * otherwise takes the highest-weight candidate.
- */
+/** Picks an account using the shared sequential or quota-aware policy. */
 export function selectAccount(input: SelectInput): Selection | undefined {
-  const usable = input.candidates.filter((c) => c.access);
+  const usable = input.candidates.filter((candidate) => candidate.access);
   if (usable.length === 0) return undefined;
   if (usable.length === 1) return { candidate: usable[0], reason: "only" };
 
-  if (input.mode === "main-first" || input.mode === "fallback-first") {
-    const ordered = [...usable].sort((a, b) =>
-      input.mode === "main-first" ? a.order - b.order : b.order - a.order);
-    const viable = ordered.find((c) => candidateWeight(c, input.family, input.modelId) > 0);
-    return viable ? { candidate: viable, reason: input.mode } : undefined;
-  }
-
-  const weighted = usable
-    .map((candidate) => ({ candidate, weight: candidateWeight(candidate, input.family, input.modelId) }))
-    .filter((entry) => entry.weight > 0);
-  if (weighted.length === 0) return undefined;
-
-  // Stay put while the assigned account can still serve: migrating discards
-  // the prompt cache, which costs more than a slightly better weight gains.
-  if (input.assignment) {
-    const held = weighted.find((e) => e.candidate.id === input.assignment!.accountId);
-    if (held) return { candidate: held.candidate, reason: "sticky" };
-  }
-
-  weighted.sort((a, b) =>
-    b.weight - a.weight
-    || a.candidate.order - b.candidate.order
-    || a.candidate.id.localeCompare(b.candidate.id));
-  return { candidate: weighted[0].candidate, reason: "weighted" };
+  const selected = selectRoutingCandidate(
+    usable.map((candidate) => ({
+      id: candidate.id,
+      order: candidate.order,
+      lastUsed: candidate.lastUsed ?? candidate.account?.lastUsed ?? 0,
+      quota: routingQuota(candidate, input.family, input.modelId),
+      value: candidate,
+    })),
+    input.mode,
+    input.now,
+  );
+  return selected ? { candidate: selected.value, reason: input.mode } : undefined;
 }
 
-/** Seconds until the soonest window that would unblock this model resets. */
-export function retryAfterSeconds(candidates: Candidate[], family: Family, modelId?: string, now = Date.now()): number {
-  const resets: number[] = [];
-  for (const candidate of candidates) {
-    const quota = candidate.quota;
-    if (!quota) continue;
-    const windows: (QuotaWindow | undefined)[] = [quota.five_hour, quota.seven_day];
-    if (family === "fable") windows.push(scopedWindowFor(quota, modelId));
-    for (const w of windows) {
-      if (!w?.resetsAt) continue;
-      if ((w.remainingPercent ?? 0) > 0) continue;
-      const at = Date.parse(w.resetsAt);
-      if (Number.isFinite(at) && at > now) resets.push(at);
-    }
-  }
-  if (resets.length === 0) return 60;
-  return Math.max(1, Math.ceil((Math.min(...resets) - now) / 1000));
-}
 
 export { MAIN_ACCOUNT_ID };

package/src/core/anthropic/store.ts

@@ -1,14 +1,13 @@
 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { normalizeRoutingMode, type AccountRoutingMode } from "../accounts/routing.ts";
 
 /**
  * Anthropic account store.
  *
- * Byte-compatible with @cortexkit/anthropic-auth-core so both implementations
- * can read the same files and reverting stays possible. The split is theirs and
- * is worth preserving: durable identity in `anthropic-auth.json`, live secrets
- * and volatile quota in `anthropic-auth-state.json`.
+ * Keeps durable identity in `anthropic-auth.json` and live secrets and quota
+ * in `anthropic-auth-state.json`.
  *
  *   anthropic-auth.json        id, label, type, enabled, addedAt, routing
  *   anthropic-auth-state.json  access, refresh, expires, quota, lastUsed, ...
@@ -49,12 +48,15 @@ export interface Account {
   expires?: number;
   lastUsed?: number;
   lastRefreshedAt?: number;
+  lastRefreshError?: string;
+  /** Stable provider account UUID; survives OAuth token rotation. */
+  identity?: string;
   authLineageId?: string;
   quota?: QuotaSnapshot;
   apiKey?: string;
 }
 
-export type RoutingMode = "main-first" | "fallback-first" | "sticky-balanced";
+export type RoutingMode = AccountRoutingMode;
 
 export interface Storage {
   version?: number;
@@ -69,7 +71,7 @@ export interface Storage {
 const CONFIG_FIELDS = ["id", "label", "type", "enabled", "addedAt", "baseURL", "authHeader"] as const;
 /** Fields that belong in the state file. */
 const STATE_FIELDS = [
-  "authLineageId", "access", "refresh", "expires", "lastUsed",
+  "authLineageId", "identity", "access", "refresh", "expires", "lastUsed",
   "lastRefreshedAt", "lastRefreshError", "lastQuotaRefreshError", "quota", "profile", "prime", "apiKey",
 ] as const;
 
@@ -136,7 +138,7 @@ const pick = <T extends object>(source: any, keys: readonly string[]): T =>
   Object.fromEntries(keys.filter((k) => source?.[k] !== undefined).map((k) => [k, source[k]])) as T;
 
 export function emptyStorage(): Storage {
-  return { version: 1, accounts: [], routing: { mode: "main-first" } };
+  return { version: 1, accounts: [], routing: { mode: "sequential" } };
 }
 
 /**
@@ -208,8 +210,7 @@ export const isOAuthAccount = (a: Account): boolean => a.type === "oauth" && !!a
 export const isUsable = (a: Account): boolean => a.enabled !== false && isOAuthAccount(a);
 
 export function getRoutingMode(storage: Storage | undefined): RoutingMode {
-  const mode = storage?.routing?.mode;
-  return mode === "sticky-balanced" || mode === "fallback-first" || mode === "main-first" ? mode : "main-first";
+  return normalizeRoutingMode(storage?.routing?.mode as string | undefined);
 }
 
 export function setRoutingMode(mode: RoutingMode, config = configPath()): Storage {
@@ -228,7 +229,7 @@ export function setRoutingMode(mode: RoutingMode, config = configPath()): Storag
  * the state file is normal.
  *
  * This is easy to mistake for stale data and delete. Doing so breaks
- * `main-first` routing and orphans every routing assignment targeting `main`.
+ * sequential routing and orphans every routing assignment targeting `main`.
  */
 export const MAIN_ACCOUNT_ID = "main";
 

package/src/core/catalog/quality.ts

@@ -82,7 +82,15 @@ interface QualityStore {
 }
 
 let cache: QualityStore | undefined;
+let cachedRecords: QualityRecord[] = [];
 let inFlight: Promise<string[]> | undefined;
+const lookupCache = new Map<string, QualityLookup>();
+
+function setCache(next: QualityStore): void {
+  cache = next;
+  cachedRecords = Object.values(next.records);
+  lookupCache.clear();
+}
 
 function agentDir(): string {
   return process.env.PI_AGENT_DIR ?? join(homedir(), ".pi", "agent");
@@ -119,18 +127,18 @@ function loadCache(): void {
     const parsed = JSON.parse(readFileSync(cachePath(), "utf8")) as QualityStore & { fetchedAt?: number };
     if (!parsed?.records) return;
     // Migrate the pre-store format, which only had `fetchedAt`.
-    cache = {
+    setCache({
       records: parsed.records,
       checkedAt: parsed.checkedAt ?? parsed.fetchedAt,
       lastModified: parsed.lastModified,
       etag: parsed.etag,
       source: parsed.source ?? "artificial-analysis",
-    };
+    });
   } catch { /* first run */ }
 }
 
 function persist(next: QualityStore): void {
-  cache = next;
+  setCache(next);
   try {
     writeFileSync(cachePath(), JSON.stringify(next), "utf8");
   } catch { /* cache write is best effort */ }
@@ -289,26 +297,36 @@ export interface QualityLookup {
  */
 export function qualityFor(modelId: string, thinkingLevel?: string): QualityLookup {
   loadCache();
+  const key = `${modelId}\0${thinkingLevel ?? ""}`;
+  const cached = lookupCache.get(key);
+  if (cached) return cached;
+
   const records = cache?.records ?? {};
   const base = normalizeSlug(modelId);
-
   const levelled = thinkingLevel && thinkingLevel !== "off" ? records[`${base}-${thinkingLevel}`] : undefined;
-  if (levelled) return { record: levelled, efficiency: costEfficiency(levelled), confidence: "measured", basis: levelled.slug };
-
   const exact = records[base];
-  if (exact) return { record: exact, efficiency: costEfficiency(exact), confidence: "measured", basis: exact.slug };
-
-  let best: QualityRecord | undefined;
-  for (const record of Object.values(records)) {
-    if (!base.includes(record.slug) && !record.slug.includes(base)) continue;
-    if (!best || record.slug.length > best.slug.length) best = record;
+  let result: QualityLookup;
+
+  if (levelled) {
+    result = { record: levelled, efficiency: costEfficiency(levelled), confidence: "measured", basis: levelled.slug };
+  } else if (exact) {
+    result = { record: exact, efficiency: costEfficiency(exact), confidence: "measured", basis: exact.slug };
+  } else {
+    let best: QualityRecord | undefined;
+    for (const record of cachedRecords) {
+      if (!base.includes(record.slug) && !record.slug.includes(base)) continue;
+      if (!best || record.slug.length > best.slug.length) best = record;
+    }
+    result = best
+      ? { record: best, efficiency: costEfficiency(best), confidence: "inferred", basis: `nearest match ${best.slug}` }
+      : { efficiency: {}, confidence: "unrated", basis: "no Artificial Analysis entry" };
   }
-  if (best) return { record: best, efficiency: costEfficiency(best), confidence: "inferred", basis: `nearest match ${best.slug}` };
 
-  return { efficiency: {}, confidence: "unrated", basis: "no Artificial Analysis entry" };
+  lookupCache.set(key, result);
+  return result;
 }
 
 export function allRecords(): QualityRecord[] {
   loadCache();
-  return Object.values(cache?.records ?? {});
+  return [...cachedRecords];
 }

package/src/core/codex/quota.ts

@@ -1,5 +1,5 @@
 import type { QuotaSnapshot } from "../anthropic/store.ts";
-import { loadCodexAccounts, saveCodexAccount } from "./store.ts";
+import { MAIN_ACCOUNT_ID, loadCodexAccounts, saveCodexAccount, saveCodexAccounts } from "./store.ts";
 
 /**
  * Codex quota, read from response headers.
@@ -73,16 +73,54 @@ export function parseCodexQuotaHeaders(
   } as QuotaSnapshot;
 }
 
-/** Merges a header-derived snapshot into the stored account. */
+/**
+ * True when two snapshots carry the same reading. `checkedAt` moves on every
+ * response, so comparing it would defeat the whole check.
+ */
+function sameQuota(left: QuotaSnapshot | undefined, right: QuotaSnapshot | undefined): boolean {
+  if (!left || !right) return false;
+  const compare = (snapshot: QuotaSnapshot) => {
+    const window = (value: QuotaSnapshot["five_hour"]) =>
+      value ? { used: value.usedPercent, resets: value.resetsAt, minutes: (value as any).windowMinutes } : undefined;
+    return JSON.stringify({
+      five_hour: window(snapshot.five_hour),
+      seven_day: window(snapshot.seven_day),
+      plan: (snapshot as any).plan,
+    });
+  };
+  return compare(left) === compare(right);
+}
+
+/**
+ * Merges a header-derived snapshot into the stored account.
+ *
+ * Runs from `onResponse` on every single reply, so it is deliberately quiet
+ * and cheap: unchanged readings never touch the disk, and a failed write is
+ * swallowed. Throwing here would reject the awaited `onResponse` inside the
+ * provider and kill an in-flight stream — quota telemetry must never do that.
+ */
 export function applyCodexQuotaHeaders(
   accountId: string,
   headers: Record<string, unknown> | undefined,
   now = Date.now(),
 ): boolean {
-  const quota = parseCodexQuotaHeaders(headers, now);
-  if (!quota) return false;
-  const account = loadCodexAccounts().accounts.find((a) => a.id === accountId);
-  if (!account) return false;
-  saveCodexAccount({ ...account, quota });
-  return true;
+  try {
+    const quota = parseCodexQuotaHeaders(headers, now);
+    if (!quota) return false;
+    const storage = loadCodexAccounts();
+    if (accountId === MAIN_ACCOUNT_ID) {
+      if (sameQuota(storage.main?.quota, quota)) return false;
+      storage.main = { ...storage.main, quota };
+      saveCodexAccounts(storage);
+      return true;
+    }
+    const account = storage.accounts.find((candidate) => candidate.id === accountId);
+    if (!account) return false;
+    if (sameQuota(account.quota, quota)) return false;
+    saveCodexAccount({ ...account, quota });
+    return true;
+  } catch {
+    // Best effort: a quota write must never break the request that produced it.
+    return false;
+  }
 }

package/src/core/codex/store.ts

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { readJson, writeJson } from "../store.ts";
 import type { QuotaSnapshot } from "../anthropic/store.ts";
 
 /**
@@ -26,38 +26,51 @@ export interface CodexAccount {
   plan?: string;
   addedAt?: number;
   lastRefreshedAt?: number;
+  lastUsed?: number;
+  blockedUntil?: number;
   quota?: QuotaSnapshot;
 }
 
 export interface CodexStorage {
   accounts: CodexAccount[];
+  main?: { quota?: QuotaSnapshot; lastUsed?: number; blockedUntil?: number };
   routing?: { mode?: string };
 }
 
 export const MAIN_ACCOUNT_ID = "main";
 
-function storePath(): string {
-  return join(homedir(), ".pi", "agent", "codex-accounts.json");
+export function codexAccountsPath(): string {
+  return process.env.PI_PLUS_CODEX_ACCOUNTS_FILE ?? join(homedir(), ".pi", "agent", "codex-accounts.json");
 }
 
-export function loadCodexAccounts(path = storePath()): CodexStorage {
-  try {
-    const raw = JSON.parse(readFileSync(path, "utf8"));
-    const accounts = Array.isArray(raw?.accounts) ? raw.accounts : [];
-    return { accounts, routing: raw?.routing };
-  } catch {
-    return { accounts: [] };
-  }
+export function loadCodexAccounts(path = codexAccountsPath()): CodexStorage {
+  const raw = readJson<Partial<CodexStorage>>(path, {});
+  return {
+    accounts: Array.isArray(raw?.accounts) ? raw.accounts : [],
+    main: raw?.main,
+    routing: raw?.routing,
+  };
 }
 
-export function saveCodexAccounts(storage: CodexStorage, path = storePath()): void {
-  mkdirSync(join(homedir(), ".pi", "agent"), { recursive: true });
+/**
+ * Atomic write (temp file + rename), matching every other store in the repo.
+ *
+ * A truncate-in-place `writeFileSync` here let a concurrent reader observe a
+ * half-written file; `loadCodexAccounts` swallows the parse error and returns
+ * an empty account list, so the next save persisted that emptiness and the
+ * user's accounts disappeared. On Windows the same overlap surfaces as
+ * EPERM/EBUSY. Callers that mutate credentials want to hear about a failed
+ * write, so this still throws — only the per-response quota path swallows it.
+ */
+export function saveCodexAccounts(storage: CodexStorage, path = codexAccountsPath()): void {
   // 0600: these are live OAuth credentials.
-  writeFileSync(path, JSON.stringify(storage, null, 2) + "\n", { mode: 0o600 });
+  if (!writeJson(path, storage, true, 0o600)) {
+    throw new Error(`Could not write Codex accounts to ${path}`);
+  }
 }
 
 /** Inserts or replaces one account, leaving the others untouched. */
-export function saveCodexAccount(account: CodexAccount, path = storePath()): void {
+export function saveCodexAccount(account: CodexAccount, path = codexAccountsPath()): void {
   const storage = loadCodexAccounts(path);
   const index = storage.accounts.findIndex((a) => a.id === account.id);
   if (index >= 0) storage.accounts[index] = { ...storage.accounts[index], ...account };
@@ -65,7 +78,7 @@ export function saveCodexAccount(account: CodexAccount, path = storePath()): voi
   saveCodexAccounts(storage, path);
 }
 
-export function removeCodexAccount(id: string, path = storePath()): boolean {
+export function removeCodexAccount(id: string, path = codexAccountsPath()): boolean {
   const storage = loadCodexAccounts(path);
   const before = storage.accounts.length;
   storage.accounts = storage.accounts.filter((a) => a.id !== id);

package/src/core/config.ts

@@ -2,21 +2,8 @@ import { existsSync } from "node:fs";
 import { agentPath, readJson, writeJson } from "./store.ts";
 
 /**
- * One file for everything pi-plus owns: `~/.pi/agent/pi-plus.json`.
- *
- * ```json
- * {
- *   "env":    { "ARTIFICIAL_ANALYSIS_API_KEY": "aa_…", "AGENT_BOARD_URL": "…" },
- *   "policy": { "autoApprove": [], "requireApproval": [], "deny": [] },
- *   "remote": { "injectStatus": true, "defaults": {}, "workers": [] }
- * }
- * ```
- *
- * Pi's own `settings.json` and `models.json` are deliberately NOT absorbed:
- * pi reads those from fixed paths and folding them in here would break it.
- *
- * Every legacy file is migrated on first read and left on disk, so downgrading
- * keeps working.
+ * Unified pi-plus config. Pi's own settings stay separate, while legacy files
+ * migrate without being deleted.
  */
 
 export const CONFIG_FILE = "pi-plus.json";
@@ -33,20 +20,28 @@ export interface RemoteSection {
   workers: Record<string, unknown>[];
 }
 
+export type BetterCompactMode = "off" | "on" | "jev";
+
+export interface CompactSection {
+  better: BetterCompactMode;
+}
+
 export interface PiPlusConfig {
   env: Record<string, string>;
   policy: PolicySection;
   remote: RemoteSection;
+  compact: CompactSection;
 }
 
 const DEFAULTS: PiPlusConfig = {
   env: {},
   policy: {
-    autoApprove: ["anthropic/*", "openai-codex/*"],
-    requireApproval: ["openrouter/*", "google/*", "openai/*", "xai/*"],
+    autoApprove: ["anthropic/*", "openai-codex/*", "kimi-coding/*", "xai/*"],
+    requireApproval: ["openrouter/*", "google/*", "openai/*"],
     deny: [],
   },
   remote: { injectStatus: true, workers: [] },
+  compact: { better: "off" },
 };
 
 /** Legacy file -> section, applied only when that section is still absent. */
@@ -116,6 +111,7 @@ export function configPath(): string {
 }
 
 function normalize(raw: Partial<PiPlusConfig> | undefined): PiPlusConfig {
+  const better = raw?.compact?.better;
   return {
     env: raw?.env && typeof raw.env === "object" ? { ...raw.env } : {},
     policy: {
@@ -130,6 +126,9 @@ function normalize(raw: Partial<PiPlusConfig> | undefined): PiPlusConfig {
       defaults: raw?.remote?.defaults,
       workers: Array.isArray(raw?.remote?.workers) ? raw.remote.workers : [],
     },
+    compact: {
+      better: better === "on" || better === "jev" ? better : "off",
+    },
   };
 }
 

package/src/core/store.ts

@@ -1,13 +1,8 @@
-import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
-/**
- * Small JSON config helper shared by every domain.
- *
- * Writes go through a temp file + rename so a crash mid-write cannot leave a
- * truncated config behind; several of these files hold auth state.
- */
+/** Shared JSON storage with atomic writes. */
 
 export function agentDir(): string {
   return process.env.PI_AGENT_DIR ?? join(homedir(), ".pi", "agent");
@@ -25,19 +20,25 @@ export function readJson<T>(path: string, fallback: T): T {
   }
 }
 
-/** Best-effort atomic write. Returns false instead of throwing. */
-export function writeJson(path: string, value: unknown, pretty = false): boolean {
+/** Best-effort atomic write. */
+export function writeJson(path: string, value: unknown, pretty = false, mode?: number): boolean {
   const temp = `${path}.${process.pid}.tmp`;
+  const content = JSON.stringify(value, undefined, pretty ? 2 : undefined);
+  const options = { encoding: "utf8" as const, ...(mode === undefined ? {} : { mode }) };
+
   try {
-    writeFileSync(temp, JSON.stringify(value, undefined, pretty ? 2 : undefined), "utf8");
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(temp, content, options);
     renameSync(temp, path);
     return true;
   } catch {
     try {
-      writeFileSync(path, JSON.stringify(value, undefined, pretty ? 2 : undefined), "utf8");
+      writeFileSync(path, content, options);
       return true;
     } catch {
       return false;
+    } finally {
+      try { rmSync(temp, { force: true }); } catch { /* best effort */ }
     }
   }
 }