@jameslovespancakes/pi-plus 1.0.12 → 1.0.13

package/README.md

@@ -61,7 +61,7 @@ quota-aware routing.
 Your live quota, always in the footer:
 
 ```
-  Claude Σ2 · 2/2 ready · partial                 Codex · pro
+  Claude Σ2 · 2/2 ready                           Codex · pro
   5h     █████████████████░░░░░░░░░   65% 1h     5h     ███████████████████████░░░   88% 57m
   weekly ███████████████░░░░░░░░░░░   58% 3d     weekly ████████████████████████░░   93% 6d
   Fable  ████████████░░░░░░░░░░░░░░  ~47% 3d
@@ -154,6 +154,25 @@ across every running pi agent. `/board` opens the messaging view:
 any Mac or Linux host over SSH, where launchd or systemd brings it back after a
 reboot.
 
+### Compact without deleting the source
+
+Better Compact replaces Pi's normal compaction with a reversible local archive,
+deterministic protection and extractive compression. Jev mode adds six-signal
+routing through OpenRouter's decisions API; Jev ranks compression but cannot
+override protected facts or authorize source deletion.
+
+```
+/compact better on    # switch to local deterministic routing and compact now
+/compact better jev   # switch to Jev routing and compact now
+/compact better off   # restore Pi compaction and compact now
+```
+
+The selected mode persists for later manual and automatic compactions. Jev mode
+requires `OPENROUTER_API_KEY` (or OpenRouter auth configured in Pi). Original
+chunks stay under `~/.pi/agent/super-context/archives/`; the
+`super_context_recall` tool performs bounded retrieval from the current branch's
+checkpoint.
+
 ### Orchestrate repeatable workflows
 
 The built-in workflow engine runs named or inline multi-agent workflows with
@@ -194,11 +213,12 @@ with workflow options when a task needs them.
 | `/remote add \| rename \| remove` | jump to one step |
 | `/board` | live agent board UI |
 | `/board setup \| restart \| clear \| status` | manage the board server |
+| `/compact better on \| off \| jev` | select reversible compaction and compact now |
 | `/workflow` | open the running workflow agent board |
 | `/workflow <name> [args]` | run a bundled workflow |
 
 **Tools available to the agent:** `workflow`, `list_models`, `agent_board`,
-`remote_status`, `remote_test`.
+`remote_status`, `remote_test`, `super_context_recall`.
 
 ---
 
@@ -210,7 +230,8 @@ Everything lives in one file, `~/.pi/agent/pi-plus.json`, created on first use:
 {
   "env":    { "ARTIFICIAL_ANALYSIS_API_KEY": "aa_…", "AGENT_BOARD_URL": "ws://…" },
   "policy": { "autoApprove": [], "requireApproval": [], "deny": [] },
-  "remote": { "workers": [] }
+  "remote": { "workers": [] },
+  "compact": { "better": "off" }
 }
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jameslovespancakes/pi-plus",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "type": "module",
   "description": "pi and more",
   "license": "MIT",
@@ -37,6 +37,7 @@
       "./src/domains/setup/index.ts",
       "./src/domains/subscriptions/index.ts",
       "./src/domains/models/index.ts",
+      "./src/domains/compact/index.ts",
       "./src/domains/workflows/index.ts",
       "./src/domains/agents/index.ts",
       "./src/domains/remote/index.ts"
@@ -64,6 +65,7 @@
     "version:next": "node scripts/bump-version.mjs --dry-run"
   },
   "devDependencies": {
-    "oxlint": "^1.83.0"
+    "oxlint": "^1.83.0",
+    "typescript": "5.9.3"
   }
 }

package/src/core/accounts/oauth-pool.ts

@@ -19,6 +19,22 @@ export interface ProviderOAuthPool {
   mode: OAuthPoolMode;
 }
 
+/**
+ * Storage behind a pooled provider.
+ *
+ * Most providers share one `pi-plus-oauth-accounts.json`, but a provider that
+ * already owns a file with extra fields (Codex carries `accountId`/`plan`, and
+ * its quota snapshot feeds the usage bars) supplies its own implementation so
+ * it can join the shared serving path without a risky file migration.
+ */
+export interface PooledOAuthStore {
+  load(): ProviderOAuthPool;
+  saveAccount(account: PooledOAuthAccount): void;
+  saveMode(mode: OAuthPoolMode): void;
+  /** Routing state for the credential pi itself is logged in as. */
+  primaryQuota(): AccountQuotaState | undefined;
+}
+
 interface OAuthPoolFile {
   version: 1;
   providers: Record<string, ProviderOAuthPool>;
@@ -97,6 +113,25 @@ export function oauthIdentity(access: string): string | undefined {
   return undefined;
 }
 
+/** In-memory quota for each provider's primary (host) credential. */
+const primaryQuotas = new Map<string, AccountQuotaState>();
+
+/** Default store: the shared pool file, with primary quota held in memory. */
+export function sharedOAuthPoolStore(providerId: string): PooledOAuthStore {
+  return {
+    load: () => loadOAuthPool(providerId),
+    saveAccount: (account) => saveOAuthAccount(providerId, account),
+    saveMode: (mode) => setOAuthPoolMode(providerId, mode),
+    primaryQuota: () => primaryQuotas.get(providerId),
+  };
+}
+
+/** Records routing state for a provider's primary credential. */
+export function setPrimaryQuota(providerId: string, quota: AccountQuotaState): void {
+  primaryQuotas.set(providerId, quota);
+}
+
 export function resetOAuthPoolCache(): void {
   fileCache.clear();
+  primaryQuotas.clear();
 }

package/src/core/accounts/registry.ts

@@ -9,6 +9,8 @@ export interface ManagedAccount {
   expiresAt?: number;
   /** True for the account pi itself is authenticated as. */
   primary?: boolean;
+  /** Provider-stable identity used only to collapse duplicate logins. */
+  identity?: string;
 }
 
 /** Fixed account order or provider quota-aware selection. */
@@ -41,6 +43,8 @@ export interface AccountProvider {
   /** Human name, e.g. "Claude". */
   label: string;
   list(): Promise<ManagedAccount[]>;
+  /** Resolves a provider-stable identity from an OAuth access token. */
+  identify?(accessToken: string): string | undefined | Promise<string | undefined>;
   /** Returns the label of the account that was added. */
   add(ctx: AccountContext, label: string): Promise<string | undefined>;
   /** Returns the label of the account that was reauthorized. */

package/src/core/accounts/routing.ts

@@ -15,6 +15,23 @@ export interface AccountRoutingCandidate<T> {
 
 export type AccountRoutingMode = "sequential" | "quota-aware";
 
+/**
+ * Upper bound on a token refresh, matching pi-ai's own
+ * `DEFAULT_OAUTH_REFRESH_TIMEOUT_MS` in `auth/resolve.js`.
+ *
+ * Routed auth runs outside pi-ai's refresh path, so nothing else bounds it.
+ * An unbounded refresh against a stalled token endpoint hangs the request
+ * forever, and because in-flight refreshes are de-duplicated per account,
+ * every later request joins the same hung promise.
+ */
+export const OAUTH_REFRESH_TIMEOUT_MS = 15_000;
+
+/** Bounds a refresh, honouring a caller signal when one is available. */
+export function refreshAbortSignal(signal?: AbortSignal): AbortSignal {
+  const timeout = AbortSignal.timeout(OAUTH_REFRESH_TIMEOUT_MS);
+  return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+
 /** Maps stored legacy names onto the two routing modes. */
 export function normalizeRoutingMode(value: string | undefined): AccountRoutingMode {
   return value === "quota-aware" || value === "optimal" || value === "sticky-balanced"
@@ -83,6 +100,11 @@ export function quotaStateFromHeaders(
   return { remainingPercent, resetAt, checkedAt: now };
 }
 
+/**
+ * Exhausted-with-no-reset is already handled by `isCandidateViable` below, so
+ * callers never need a sentinel `blockedUntil`. Persisting `Infinity` would
+ * serialize to `null` and silently unblock on the next load.
+ */
 function isCandidateViable(quota: AccountQuotaState | undefined, now: number): boolean {
   if (!quota) return true;
   if (quota.blockedUntil !== undefined && quota.blockedUntil > now) return false;

package/src/core/anthropic/identity.ts

@@ -0,0 +1,54 @@
+import { createHash } from "node:crypto";
+import { CLAUDE_CODE_VERSION } from "./client-identity.ts";
+
+/** Resolves the stable Claude account UUID exposed by the CLI bootstrap API. */
+
+const resolved = new Map<string, string>();
+const pending = new Map<string, Promise<string | undefined>>();
+
+function tokenKey(accessToken: string): string {
+  return createHash("sha256").update(accessToken).digest("hex");
+}
+
+/** Synchronous lookup for request routing; never starts network I/O. */
+export function cachedAnthropicAccountIdentity(accessToken: string): string | undefined {
+  return resolved.get(tokenKey(accessToken));
+}
+
+export async function anthropicAccountIdentity(
+  accessToken: string,
+  fetchImpl: typeof fetch = fetch,
+): Promise<string | undefined> {
+  if (!accessToken.startsWith("sk-ant-oat")) return undefined;
+
+  const key = tokenKey(accessToken);
+  const cached = resolved.get(key);
+  if (cached) return cached;
+  const active = pending.get(key);
+  if (active) return active;
+
+  const request = (async () => {
+    try {
+      const response = await fetchImpl("https://api.anthropic.com/api/claude_cli/bootstrap?entrypoint=cli", {
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${accessToken}`,
+          "anthropic-beta": "oauth-2025-04-20",
+          "user-agent": `claude-cli/${CLAUDE_CODE_VERSION} (external, cli)`,
+        },
+        signal: AbortSignal.timeout(5_000),
+      });
+      if (!response.ok) return undefined;
+      const body = await response.json() as any;
+      const identity = body?.oauth_account?.account_uuid;
+      if (typeof identity !== "string" || !identity) return undefined;
+      resolved.set(key, identity);
+      return identity;
+    } catch {
+      return undefined;
+    }
+  })().finally(() => pending.delete(key));
+
+  pending.set(key, request);
+  return request;
+}

package/src/core/anthropic/oauth.ts

@@ -149,6 +149,8 @@ export interface RefreshOptions {
   baseDelayMs?: number;
   fetchImpl?: typeof fetch;
   now?: () => number;
+  /** Bounds the entire refresh, including retries. */
+  signal?: AbortSignal;
 }
 
 /**
@@ -172,6 +174,7 @@ export async function refreshToken(options: RefreshOptions): Promise<TokenSet> {
       const response = await doFetch(TOKEN_URL, {
         method: "POST",
         headers: TOKEN_HEADERS,
+        signal: options.signal,
         body: JSON.stringify({
           grant_type: "refresh_token",
           refresh_token: options.refreshToken,

package/src/core/anthropic/quota.ts

@@ -1,10 +1,27 @@
-import { loadAccounts, saveAccount, type Account, type QuotaSnapshot } from "./store.ts";
-import { refreshToken } from "./oauth.ts";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, mkdirSync, openSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { refreshAbortSignal } from "../accounts/routing.ts";
+import {
+  configPath as defaultConfigPath,
+  loadAccounts,
+  saveAccount,
+  statePath,
+  type Account,
+  type QuotaSnapshot,
+} from "./store.ts";
+import { refreshToken, type RefreshOptions, type TokenSet } from "./oauth.ts";
 
 /** Uses free response headers first, polling only stale idle accounts. */
 
 const QUOTA_URL = "https://api.anthropic.com/api/oauth/usage";
 const TIMEOUT_MS = 10_000;
+/** Refresh early enough to absorb transient OAuth rate limits before expiry. */
+export const ACCESS_REFRESH_WINDOW_MS = 4 * 60 * 60_000;
+/** Background refresh cadence; each process adds a small startup jitter. */
+export const ACCESS_REFRESH_INTERVAL_MS = 5 * 60_000;
+const REFRESH_LOCK_TTL_MS = 60_000;
+const REFRESH_JOIN_WAIT_MS = 16_000;
 /** Snapshot lifetime and minimum interval between polls. */
 export const QUOTA_FRESH_MS = 10 * 60_000;
 /** After a 429, wait at least this long before touching the endpoint again. */
@@ -170,31 +187,208 @@ export async function pollQuota(
   }
 }
 
-/** A token good for at least a minute, refreshing and persisting if needed. */
-export async function ensureAccessToken(account: Account): Promise<string | undefined> {
-  if (account.access && typeof account.expires === "number" && Date.now() + 60_000 < account.expires) {
-    return account.access;
+export function accessTokenNeedsRefresh(account: Account, now = Date.now()): boolean {
+  return !account.access
+    || typeof account.expires !== "number"
+    || account.expires - now <= ACCESS_REFRESH_WINDOW_MS;
+}
+
+type RefreshTokenFn = (options: RefreshOptions) => Promise<TokenSet>;
+
+export interface EnsureAccessTokenOptions {
+  config?: string;
+  now?: () => number;
+  refresh?: RefreshTokenFn;
+}
+
+export interface RefreshAllQuotaOptions extends EnsureAccessTokenOptions {
+  poll?: typeof pollQuota;
+}
+
+interface RefreshLock {
+  release(): void;
+}
+
+const refreshes = new Map<string, Promise<string | undefined>>();
+
+function refreshLockPath(accountId: string, config: string): string {
+  const id = createHash("sha256").update(accountId).digest("hex").slice(0, 16);
+  return `${statePath(config)}.refresh-${id}.lock`;
+}
+
+/** Cross-process exclusion for Anthropic's rotating refresh tokens. */
+function acquireRefreshLock(accountId: string, config: string, now: number): RefreshLock | undefined {
+  const path = refreshLockPath(accountId, config);
+  const owner = randomUUID();
+  mkdirSync(dirname(path), { recursive: true });
+
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fd = openSync(path, "wx", 0o600);
+      try {
+        writeFileSync(fd, JSON.stringify({ owner, expiresAt: now + REFRESH_LOCK_TTL_MS }), "utf8");
+      } finally {
+        closeSync(fd);
+      }
+      return {
+        release() {
+          try {
+            const current = JSON.parse(readFileSync(path, "utf8"));
+            if (current?.owner === owner) rmSync(path, { force: true });
+          } catch {
+            // A stale or externally removed lock needs no cleanup.
+          }
+        },
+      };
+    } catch (error: any) {
+      if (error?.code !== "EEXIST") throw error;
+      try {
+        const current = JSON.parse(readFileSync(path, "utf8"));
+        if (Number(current?.expiresAt) > now) return undefined;
+        rmSync(path, { force: true });
+      } catch {
+        // A malformed lock is stale; remove it and retry once.
+        try { rmSync(path, { force: true }); } catch { /* best effort */ }
+      }
+    }
   }
-  if (!account.refresh) return account.access;
-
-  const refreshed = await refreshToken({ refreshToken: account.refresh, maxRetries: 0 });
-  // Persist immediately: Anthropic may rotate the refresh token, and losing the
-  // new one would invalidate the account.
-  saveAccount({
-    ...account,
-    access: refreshed.access,
-    refresh: refreshed.refresh,
-    expires: refreshed.expires,
-    lastRefreshedAt: Date.now(),
-  });
-  return refreshed.access;
-}
-
-/** Refreshes stale account quota in parallel. */
-export async function refreshAllQuota(force = false): Promise<number> {
-  const storage = loadAccounts();
+  return undefined;
+}
+
+function storedAccount(accountId: string, config: string): Account | undefined {
+  return loadAccounts(config)?.accounts.find((candidate) => candidate.id === accountId);
+}
+
+function usableAccess(account: Account | undefined, now: number): string | undefined {
+  return account?.access && typeof account.expires === "number" && account.expires > now
+    ? account.access
+    : undefined;
+}
+
+async function joinConcurrentRefresh(
+  account: Account,
+  config: string,
+  now: () => number,
+): Promise<string | undefined> {
+  const deadline = now() + REFRESH_JOIN_WAIT_MS;
+  while (now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, 100));
+    const latest = storedAccount(account.id, config);
+    const changed = latest && (
+      latest.access !== account.access
+      || latest.refresh !== account.refresh
+      || (latest.expires ?? 0) > (account.expires ?? 0) + 60_000
+    );
+    if (changed && !accessTokenNeedsRefresh(latest, now())) return latest.access;
+  }
+  return usableAccess(storedAccount(account.id, config) ?? account, now());
+}
+
+function refreshErrorMessage(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/sk-ant-[A-Za-z0-9_-]+/g, "[redacted]").slice(0, 500);
+}
+
+async function refreshAccountNow(
+  account: Account,
+  options: EnsureAccessTokenOptions,
+): Promise<string | undefined> {
+  const config = options.config ?? defaultConfigPath();
+  const now = options.now ?? Date.now;
+  const refresh = options.refresh ?? refreshToken;
+  let latest = storedAccount(account.id, config) ?? account;
+  if (!accessTokenNeedsRefresh(latest, now())) return latest.access;
+  if (!latest.refresh) return usableAccess(latest, now());
+
+  const lock = acquireRefreshLock(account.id, config, now());
+  if (!lock) return joinConcurrentRefresh(latest, config, now);
+
+  try {
+    // The lock winner re-reads so it never spends a refresh token rotated by a
+    // different process immediately before the lock was acquired.
+    latest = storedAccount(account.id, config) ?? latest;
+    if (!accessTokenNeedsRefresh(latest, now())) return latest.access;
+    if (!latest.refresh) return usableAccess(latest, now());
+
+    const sourceRefresh = latest.refresh;
+    try {
+      const refreshed = await refresh({
+        refreshToken: sourceRefresh,
+        signal: refreshAbortSignal(),
+      });
+      const current = storedAccount(account.id, config) ?? latest;
+      // A changed refresh token is a stronger, newer write. Never overwrite it
+      // with the result of an older token family.
+      if (current.refresh !== sourceRefresh) return usableAccess(current, now());
+      saveAccount({
+        ...current,
+        access: refreshed.access,
+        refresh: refreshed.refresh,
+        expires: refreshed.expires,
+        lastRefreshedAt: now(),
+        lastRefreshError: undefined,
+      }, config);
+      return refreshed.access;
+    } catch (error) {
+      const current = storedAccount(account.id, config) ?? latest;
+      if (current.refresh === sourceRefresh) {
+        saveAccount({ ...current, lastRefreshError: refreshErrorMessage(error) }, config);
+      }
+      throw error;
+    }
+  } finally {
+    lock.release();
+  }
+}
+
+/** Returns a usable token, proactively rotating it well before expiry. */
+export async function ensureAccessToken(
+  account: Account,
+  options: EnsureAccessTokenOptions = {},
+): Promise<string | undefined> {
+  const config = options.config ?? defaultConfigPath();
+  const now = options.now ?? Date.now;
+  if (!accessTokenNeedsRefresh(account, now())) return account.access;
+  if (!account.refresh) return usableAccess(account, now());
+
+  const key = `${config}\0${account.id}`;
+  const active = refreshes.get(key);
+  if (active) return active;
+  const pending = refreshAccountNow(account, options).finally(() => refreshes.delete(key));
+  refreshes.set(key, pending);
+  return pending;
+}
+
+/** Rotates every due sidecar token independently of quota freshness. */
+export async function refreshDueAccessTokens(
+  config = defaultConfigPath(),
+  options: EnsureAccessTokenOptions = {},
+): Promise<number> {
+  const now = options.now ?? Date.now;
+  const accounts = (loadAccounts(config)?.accounts ?? []).filter(
+    (account) => account.enabled !== false && account.type === "oauth" && accessTokenNeedsRefresh(account, now()),
+  );
+  const results = await Promise.all(accounts.map(async (account) => {
+    try {
+      return Boolean(await ensureAccessToken(account, { ...options, config }));
+    } catch {
+      return false;
+    }
+  }));
+  return results.filter(Boolean).length;
+}
+
+/** Refreshes due access tokens, then polls only stale quota snapshots. */
+export async function refreshAllQuota(
+  force = false,
+  config = defaultConfigPath(),
+  options: RefreshAllQuotaOptions = {},
+): Promise<number> {
+  await refreshDueAccessTokens(config, options);
+  const storage = loadAccounts(config);
   if (!storage) return 0;
-  const now = Date.now();
+  const now = options.now?.() ?? Date.now();
+  const poll = options.poll ?? pollQuota;
 
   const stale = storage.accounts.filter(
     (a) => a.enabled !== false && a.type === "oauth"
@@ -203,11 +397,16 @@ export async function refreshAllQuota(force = false): Promise<number> {
 
   const results = await Promise.all(stale.map(async (account) => {
     try {
-      const token = await ensureAccessToken(account);
+      const token = await ensureAccessToken(account, { ...options, config });
       if (!token) return false;
-      const quota = await pollQuota(token, account.id);
+      const quota = await poll(token, account.id);
       if (!quota) return false;
-      saveAccount({ ...account, quota });
+      // Do not restore the pre-refresh account snapshot here. That used to
+      // overwrite a freshly rotated access/refresh pair with the now-invalid
+      // old pair immediately after a successful quota poll.
+      const current = storedAccount(account.id, config);
+      if (!current || current.access !== token) return false;
+      saveAccount({ ...current, quota }, config);
       return true;
     } catch {
       return false;

package/src/core/anthropic/store.ts

@@ -48,6 +48,9 @@ export interface Account {
   expires?: number;
   lastUsed?: number;
   lastRefreshedAt?: number;
+  lastRefreshError?: string;
+  /** Stable provider account UUID; survives OAuth token rotation. */
+  identity?: string;
   authLineageId?: string;
   quota?: QuotaSnapshot;
   apiKey?: string;
@@ -68,7 +71,7 @@ export interface Storage {
 const CONFIG_FIELDS = ["id", "label", "type", "enabled", "addedAt", "baseURL", "authHeader"] as const;
 /** Fields that belong in the state file. */
 const STATE_FIELDS = [
-  "authLineageId", "access", "refresh", "expires", "lastUsed",
+  "authLineageId", "identity", "access", "refresh", "expires", "lastUsed",
   "lastRefreshedAt", "lastRefreshError", "lastQuotaRefreshError", "quota", "profile", "prime", "apiKey",
 ] as const;
 

package/src/core/codex/quota.ts

@@ -73,22 +73,54 @@ export function parseCodexQuotaHeaders(
   } as QuotaSnapshot;
 }
 
-/** Merges a header-derived snapshot into the stored account. */
+/**
+ * True when two snapshots carry the same reading. `checkedAt` moves on every
+ * response, so comparing it would defeat the whole check.
+ */
+function sameQuota(left: QuotaSnapshot | undefined, right: QuotaSnapshot | undefined): boolean {
+  if (!left || !right) return false;
+  const compare = (snapshot: QuotaSnapshot) => {
+    const window = (value: QuotaSnapshot["five_hour"]) =>
+      value ? { used: value.usedPercent, resets: value.resetsAt, minutes: (value as any).windowMinutes } : undefined;
+    return JSON.stringify({
+      five_hour: window(snapshot.five_hour),
+      seven_day: window(snapshot.seven_day),
+      plan: (snapshot as any).plan,
+    });
+  };
+  return compare(left) === compare(right);
+}
+
+/**
+ * Merges a header-derived snapshot into the stored account.
+ *
+ * Runs from `onResponse` on every single reply, so it is deliberately quiet
+ * and cheap: unchanged readings never touch the disk, and a failed write is
+ * swallowed. Throwing here would reject the awaited `onResponse` inside the
+ * provider and kill an in-flight stream — quota telemetry must never do that.
+ */
 export function applyCodexQuotaHeaders(
   accountId: string,
   headers: Record<string, unknown> | undefined,
   now = Date.now(),
 ): boolean {
-  const quota = parseCodexQuotaHeaders(headers, now);
-  if (!quota) return false;
-  const storage = loadCodexAccounts();
-  if (accountId === MAIN_ACCOUNT_ID) {
-    storage.main = { ...storage.main, quota };
-    saveCodexAccounts(storage);
+  try {
+    const quota = parseCodexQuotaHeaders(headers, now);
+    if (!quota) return false;
+    const storage = loadCodexAccounts();
+    if (accountId === MAIN_ACCOUNT_ID) {
+      if (sameQuota(storage.main?.quota, quota)) return false;
+      storage.main = { ...storage.main, quota };
+      saveCodexAccounts(storage);
+      return true;
+    }
+    const account = storage.accounts.find((candidate) => candidate.id === accountId);
+    if (!account) return false;
+    if (sameQuota(account.quota, quota)) return false;
+    saveCodexAccount({ ...account, quota });
     return true;
+  } catch {
+    // Best effort: a quota write must never break the request that produced it.
+    return false;
   }
-  const account = storage.accounts.find((candidate) => candidate.id === accountId);
-  if (!account) return false;
-  saveCodexAccount({ ...account, quota });
-  return true;
 }

package/src/core/codex/store.ts

@@ -1,6 +1,6 @@
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { readJson, writeJson } from "../store.ts";
 import type { QuotaSnapshot } from "../anthropic/store.ts";
 
 /**
@@ -44,19 +44,29 @@ export function codexAccountsPath(): string {
 }
 
 export function loadCodexAccounts(path = codexAccountsPath()): CodexStorage {
-  try {
-    const raw = JSON.parse(readFileSync(path, "utf8"));
-    const accounts = Array.isArray(raw?.accounts) ? raw.accounts : [];
-    return { accounts, main: raw?.main, routing: raw?.routing };
-  } catch {
-    return { accounts: [] };
-  }
+  const raw = readJson<Partial<CodexStorage>>(path, {});
+  return {
+    accounts: Array.isArray(raw?.accounts) ? raw.accounts : [],
+    main: raw?.main,
+    routing: raw?.routing,
+  };
 }
 
+/**
+ * Atomic write (temp file + rename), matching every other store in the repo.
+ *
+ * A truncate-in-place `writeFileSync` here let a concurrent reader observe a
+ * half-written file; `loadCodexAccounts` swallows the parse error and returns
+ * an empty account list, so the next save persisted that emptiness and the
+ * user's accounts disappeared. On Windows the same overlap surfaces as
+ * EPERM/EBUSY. Callers that mutate credentials want to hear about a failed
+ * write, so this still throws — only the per-response quota path swallows it.
+ */
 export function saveCodexAccounts(storage: CodexStorage, path = codexAccountsPath()): void {
-  mkdirSync(dirname(path), { recursive: true });
   // 0600: these are live OAuth credentials.
-  writeFileSync(path, JSON.stringify(storage, null, 2) + "\n", { mode: 0o600 });
+  if (!writeJson(path, storage, true, 0o600)) {
+    throw new Error(`Could not write Codex accounts to ${path}`);
+  }
 }
 
 /** Inserts or replaces one account, leaving the others untouched. */