@oh-my-pi/pi-ai 18.2.1 → 18.2.3

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [18.2.3] - 2026-09-17
+
+### Added
+
+- `stream()` and `streamSimple()` support asynchronous model header resolution for each request attempt, including authentication retries and cancellation.
+- Provider login prompts can request masked entry with `secret: true`.
+
+## [18.2.2] - 2026-09-16
+
+### Added
+
+- Added configurable `baseUrl` support for `bedrock-converse-stream` requests, enabling Amazon Bedrock providers and compatible custom providers to use VPC or PrivateLink endpoints, FIPS hosts, and internal gateways, including endpoints mounted under a path or authenticated with query parameters.
+
+### Fixed
+
+- Corrupt credential databases are now backed up privately and recreated instead of preventing startup; signing in again restores credentials.
+- Fixed malformed Anthropic thinking signatures that could freeze sessions at 100% CPU.
+- Fixed Anthropic-compatible gateway tool-call handling so client-declared tools are reported with `stop_reason: "tool_use"` and already-executed native provider tools are not exposed for clients to run again.
+- Fixed gateway session isolation when clients omit a session key, preventing one conversation's retained provider state from affecting another.
+- Fixed retained provider state across credential switches so account-specific capabilities are re-evaluated while reusable endpoint capabilities remain available.
+- Fixed session retention limits closing provider state while a request is still streaming.
+- ChatGPT accounts that have exhausted a plan's usage window but still have available Codex credit can now continue to be selected for Codex requests.
+- Cursor requests now honor explicit max-mode markers on wire-backed models instead of inferring the mode from the model suffix.
+- OpenAI-compatible chat responses containing only structured tool calls now report time to first token correctly.
+
 ## [18.2.1] - 2026-09-15
 
 ### Added

package/README.md

@@ -1084,6 +1084,8 @@ omp auth-broker logout             # interactive — pick a stored credential to
 
 Credentials are saved to `agent.db` in the agent directory. `/login qianfan` opens the Qianfan console and stores the pasted API key.
 
+If SQLite reports corruption during startup, the damaged database and remaining journal sidecars are preserved beside it as private `agent.db.corrupt-<timestamp>-<id>*` backups before a fresh database is created. The log records the backup path. This restores startup, not unreadable credentials: log in again; retain the backups for manual data recovery. Lock contention and other non-corruption errors never reset the database.
+
 `login` supports OAuth providers (Anthropic, OpenAI Codex, GitHub Copilot, Gemini CLI, Antigravity) and API-key onboarding flows.
 
 For the current API-key onboarding flows, the library covers Together, Moonshot, Qianfan, NVIDIA, NanoGPT, Novita, DeepInfra, Hugging Face, Venice, Xiaomi, vLLM, LiteLLM, Cloudflare AI Gateway, Qwen Portal, and Ollama Cloud. Ollama remains the local runtime integration; set `OLLAMA_API_KEY` only when your local or self-hosted deployment enforces bearer auth.

package/dist/types/auth/sqlite-credential-store.d.ts

@@ -4,7 +4,7 @@
  * The public AuthCredentialStore interface remains in ../auth-storage so local
  * and remote stores share the same contract.
  */
-import { Database } from "bun:sqlite";
+import type { Database } from "bun:sqlite";
 import { isSqliteBusyError, isSqliteCorruptionError } from "@oh-my-pi/pi-utils";
 import type { AuthCredential, AuthCredentialStore, CredentialRefreshLeaseFence, DisabledCredentialSummary, StoredAuthCredential, StoredCredentialBlock } from "../auth-storage.js";
 import type { OAuthCredentials } from "../registry/oauth/types.js";
@@ -29,6 +29,7 @@ export declare function resolveCredentialIdentityKey(provider: string, credentia
 export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
     #private;
     constructor(db: Database);
+    /** Opens credential storage with bounded busy retries and one-shot corruption recovery. */
     static open(dbPath?: string): Promise<SqliteAuthCredentialStore>;
     listAuthCredentials(provider?: string): StoredAuthCredential[];
     listDisabledCredentials(provider?: string): Promise<DisabledCredentialSummary[]>;

package/dist/types/auth-gateway/session-state.d.ts

@@ -19,9 +19,11 @@
  * A plain `Map<sessionId, …>` in a long-lived server process is a leak: nothing
  * ever reclaims an entry, and the entries own timers and sockets. This store is
  * an LRU with a hard entry ceiling that calls `close()` on everything it drops
- * and on everything it still holds at shutdown.
+ * and on everything it still holds at shutdown — but it only ever drops an
+ * entry no request is holding, because `close()` on a live entry tears down
+ * state an in-flight stream is still streaming through.
  */
-import type { Api, Model, ProviderSessionState } from "../types.js";
+import type { Api, Context, Model, ProviderSessionState } from "../types.js";
 /**
  * Retained logical sessions. Each entry is a handful of small provider records
  * plus, for Codex, a WebSocket session — cheap to keep, but not free, so the
@@ -30,11 +32,58 @@ import type { Api, Model, ProviderSessionState } from "../types.js";
  * have been quiet longer than the 256 most recent ones.
  */
 export declare const AUTH_GATEWAY_MAX_SESSION_STATES = 256;
+/**
+ * One request's claim on a retained session.
+ *
+ * `release()` is what makes the entry evictable again, so it MUST run for every
+ * outcome of the request — a `finally` at the call site for the synchronous
+ * paths, stream completion for the streaming ones. It is idempotent, so the
+ * two can overlap.
+ */
+export interface AuthGatewaySessionStateLease {
+    /** The map to hand to `streamSimple` as `providerSessionState`. */
+    readonly states: Map<string, ProviderSessionState>;
+    /** Reset account-scoped records if an in-request auth retry switches accounts. */
+    updateAccount(account: string): void;
+    /** Give up this request's claim. Idempotent. */
+    release(): void;
+}
+/** Everything the store needs to place one request on a retained session. */
+export interface AuthGatewaySessionStateRequest {
+    /**
+     * The client's own session key (`prompt_cache_key` / `sessionId`), or
+     * `undefined` when it sent none — blank counts as none. A supplied key is
+     * authoritative: the client is telling us which conversation this is.
+     */
+    clientKey: string | undefined;
+    model: Model<Api>;
+    /**
+     * System prompt, tools and message history of this request. Used only when
+     * `clientKey` is absent, to place the request on the conversation it
+     * continues.
+     */
+    context: Context;
+    /**
+     * Stable identity of the account this request's credential resolved to.
+     * A change means the gateway switched the session to a sibling credential,
+     * so the account-dependent lessons in the retained map are re-probed. The
+     * comparison happens on acquire and whenever an in-request auth retry
+     * resolves a sibling credential.
+     */
+    account: string;
+}
 /**
  * Bounded per-session provider state, owned by one gateway server instance.
  *
  * Two gateways in the same process get separate stores, so neither can hand a
  * request another gateway's learned state or close it out from under one.
+ *
+ * The recency order is this class's own (a `Map` iterates in insertion order,
+ * and every acquire re-inserts) rather than `LRUCache`'s, because the policy
+ * needs two things a general cache cannot express: an entry that a request is
+ * still holding must be skipped when picking a victim, and an entry must be
+ * able to change key — `LRUCache` disposes on every removal, which is precisely
+ * the `close()` we must not run here.
  */
 export declare class AuthGatewaySessionStateStore {
     #private;
@@ -42,24 +91,28 @@ export declare class AuthGatewaySessionStateStore {
     /** Retained logical sessions. */
     get size(): number;
     /**
-     * The provider-session map for one logical session on one model, created on
-     * first use and returned by reference so provider mutations persist into the
-     * next request.
+     * Claim the provider-session map for one request, created on first use and
+     * returned by reference so provider mutations persist into the next request.
      *
-     * Keyed by session + provider + model id. The session is the identity that
-     * matters — it is the same identity used for credential stickiness and
-     * prefix-cache keying — but a client is free to reuse one session id across
-     * models, and the coarsest provider entries do not separate models
-     * themselves (`openai-responses` keys its strict-tools / history-replay
-     * record by provider alone, Antigravity by a single constant), so the model
-     * belongs in the key here. Endpoint is deliberately absent: every provider
-     * whose learning is endpoint-specific already sub-keys it internally
+     * Keyed by provider + model + conversation (see {@link sessionKeys}). A
+     * client is free to reuse one session id across models, and the coarsest
+     * provider entries do not separate models themselves (`openai-responses`
+     * keys its strict-tools / history-replay record by provider alone,
+     * Antigravity by a single constant), so the model belongs in the key here.
+     * Endpoint is deliberately absent: every provider whose learning is
+     * endpoint-specific already sub-keys it internally
      * (`anthropic-messages:${baseUrl}\0${modelId}`,
      * `openai-completions:${provider}:${baseUrl}:${modelId}`), and repeating it
-     * would only fragment the map. NUL separates the components so none of them
-     * can forge the boundary.
+     * would only fragment the map. The credential is absent for the same reason
+     * — most of what is retained is true of the endpoint whoever calls it, and
+     * Codex already sub-keys its transport by account and bearer — so a
+     * credential switch resets the account-dependent subset instead of
+     * splitting the entry (see `resetAccountScopedProviderSessionState`).
+     *
+     * The returned lease MUST be released; until then the entry cannot be
+     * evicted.
      */
-    acquire(sessionId: string, model: Model<Api>): Map<string, ProviderSessionState>;
+    acquire(request: AuthGatewaySessionStateRequest): AuthGatewaySessionStateLease;
     /** Close and drop every retained state. Called when the gateway shuts down. */
     close(): void;
 }

package/dist/types/auth-storage.d.ts

@@ -1,5 +1,5 @@
 import type { ApiKeyResolver } from "./auth-retry.js";
-import type { OAuthAuthInfo, OAuthController, OAuthCredentials, OAuthProviderId } from "./registry/oauth/types.js";
+import type { OAuthAuthInfo, OAuthController, OAuthCredentials, OAuthPrompt, OAuthProviderId } from "./registry/oauth/types.js";
 import type { Provider } from "./types.js";
 import type { ClientUsageIdentity, ClientUsageReport, ClientUsageSummary, CredentialRankingStrategy, ObservedUsageEntry, UsageHistoryEntry, UsageHistoryQuery, UsageLogger, UsageProvider, UsageReport } from "./usage.js";
 import { type CodexResetConsumeCode, type CodexResetCredit } from "./usage/openai-codex-reset.js";
@@ -800,7 +800,7 @@ export declare class AuthStorage {
      * Lower priority than {@link setRuntimeApiKey} so a CLI `--api-key`
      * still wins for the duration of a single invocation.
      */
-    setConfigApiKey(provider: string, apiKey: string): void;
+    setConfigApiKey(provider: string, apiKeyConfig: string): void;
     /**
      * Remove a single config-sourced API key override.
      */
@@ -815,6 +815,13 @@ export declare class AuthStorage {
      * Used for custom provider keys from models.json.
      */
     setFallbackResolver(resolver: (provider: string) => string | undefined): void;
+    /**
+     * Install the host's async config-value resolver. Coding-agent uses this so
+     * every stored/config credential reference shares command caching,
+     * failure backoff, and process hardening even when AuthStorage was created
+     * independently and later attached to a registry.
+     */
+    setConfigValueResolver(resolver: (config: string) => Promise<string | undefined>): void;
     /**
      * Reload credentials from storage.
      */
@@ -935,10 +942,7 @@ export declare class AuthStorage {
         /** onAuth is required by auth-storage but optional in OAuthController */
         onAuth: (info: OAuthAuthInfo) => void;
         /** onPrompt is required for some providers (github-copilot, openai-codex) */
-        onPrompt: (prompt: {
-            message: string;
-            placeholder?: string;
-        }) => Promise<string>;
+        onPrompt: (prompt: OAuthPrompt) => Promise<string>;
     }): Promise<OAuthLoginIdentity | undefined>;
     /**
      * Logout from a provider.
@@ -976,6 +980,7 @@ export declare class AuthStorage {
     ingestUsageHeaders(provider: Provider, headers: Record<string, string>, options?: {
         sessionId?: string;
         baseUrl?: string;
+        responseStatus?: number;
     }): boolean;
     /**
      * The {@link UsageProvider} registered for `provider`, or undefined when the

package/dist/types/index.d.ts

@@ -8,6 +8,7 @@ export * from "./auth-storage.js";
 export * from "./error/rate-limit.js";
 export * from "./oneshot-retry.js";
 export * from "./provider-details.js";
+export * from "./provider-session-state.js";
 export * from "./providers/anthropic.js";
 export * from "./providers/anthropic-client.js";
 export * from "./providers/azure-openai-responses.js";

package/dist/types/provider-session-state.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Credential-rotation handling for a retained `providerSessionState` map.
+ *
+ * A host that keeps one provider-session map per logical conversation (the
+ * auth-gateway's server-owned store, an in-process omp session) can outlive the
+ * credential that filled it: `AuthStorage.markUsageLimitReached` and the
+ * auth-retry resolver both switch a session to a sibling account mid-flight.
+ * Most of what a provider learns is a property of the *endpoint*, so rebuilding
+ * the whole map on a switch would re-pay every rejected round-trip the map
+ * exists to avoid. A minority is a property of the *account*, and keeping that
+ * across a switch is a bug.
+ *
+ * Audit of what the retained records hold, per provider:
+ *
+ * - **Anthropic** — `fastModeDisabled` is account-scoped: the rejection reads
+ *   "this model does not support fast mode for your account", i.e. a plan
+ *   entitlement, so a switch to an entitled sibling must re-probe. Its
+ *   siblings are endpoint-scoped and stay: `strictToolsDisabled`
+ *   (grammar-too-large 400 for the model's tool schema),
+ *   `replayUnsignedThinkingDisabled` / `thinkingReplayDisabled` (the endpoint
+ *   is a signing proxy), `prefixDroppedThinkingBlocks` (blocks the API itself
+ *   dropped), `controlStates` (per-conversation control baselines).
+ * - **OpenAI Responses** — the `previous_response_id` chain baselines are
+ *   account-scoped: a stored response belongs to the account that created it.
+ *   Strict-tools / reasoning-effort fallbacks, replay warmup and the chaining
+ *   circuit breaker are endpoint-scoped and stay.
+ * - **OpenAI Completions** — strict-tools and reasoning-effort fallbacks only;
+ *   both endpoint-scoped. Nothing to reset.
+ * - **Codex** — already sub-keys its WebSocket sessions by account id AND
+ *   bearer (`getCodexWebSocketSessionKey`), so a switch naturally lands on a
+ *   fresh transport session while the old one stays reachable for teardown.
+ *   Resetting from the outside would close a socket a retry may still be on.
+ * - **Antigravity** — `lastGoodEndpoint` is endpoint-scoped; the agent /
+ *   conversation ids are conversation-scoped. Neither depends on the account.
+ * - **GitLab Duo** — the active workflow is account-bound, but it is a live
+ *   server-side workflow plus socket, and the switch happens *inside* the
+ *   request that may still be resuming it. Tearing it down here would abort the
+ *   very turn that rotated; it stays on its existing session-close path.
+ */
+import type { ProviderSessionState } from "./types.js";
+/**
+ * Reset the account-dependent lessons in `states`, keeping everything a
+ * provider learned about the endpoint. Call when a retained map is about to be
+ * reused for a session whose credential now resolves to a different account.
+ */
+export declare function resetAccountScopedProviderSessionState(states: Map<string, ProviderSessionState>): void;

package/dist/types/providers/amazon-bedrock.d.ts

@@ -5,6 +5,9 @@
  * SigV4 signing and decodes the `application/vnd.amazon.eventstream` response.
  * No `@aws-sdk/*`, no `@smithy/*`, no `proxy-agent`. Proxies are honored via
  * Bun's native `HTTPS_PROXY` support.
+ *
+ * A `models.yml` `baseUrl` is the request origin verbatim (VPC endpoint, gateway, …);
+ * only AWS's own regional host is re-pointed at the resolved region. SigV4 unaffected.
  */
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
 import type { StreamFunction, StreamOptions, ThinkingBudgets } from "../types.js";

package/dist/types/providers/aws-sigv4.d.ts

@@ -45,6 +45,18 @@ export declare function formatAmzDate(d: Date): {
     longDate: string;
     shortDate: string;
 };
+/**
+ * AWS's canonical-request spec encodes each name/value first, THEN sorts by
+ * the encoded form ("Sort the encoded parameter names by character code" —
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/create-canonical-request.html).
+ * Sorting the decoded form instead gives the wrong order whenever encoding
+ * changes a character's relative position — e.g. raw key `%7B` (decodes to
+ * `{`, 0x7B) vs `x` (0x78): decoded, `x` < `{`; encoded, `%` (0x25) < `x`, so
+ * `%7B` sorts first. A gateway that validates SigV4 (or AWS itself) computes
+ * the signature over ITS OWN canonicalization and rejects ours if the two
+ * disagree on order.
+ */
+export declare function canonicalQuery(query: string | undefined): string;
 export interface SignedHeaders {
     host: string;
     "x-amz-date": string;

package/dist/types/providers/openai-responses.d.ts

@@ -85,6 +85,21 @@ interface OpenAIResponsesChainState {
     /** Set once chaining is judged unsupported for this session (circuit breaker). */
     disabled: boolean;
 }
+/**
+ * Drop the account-bound half of every retained `openai-responses` record in
+ * `states`: the stateful `previous_response_id` chain baselines.
+ *
+ * Chaining stores the turn server-side under the account that created it, so a
+ * baseline minted by one credential is dead weight the moment the session is
+ * switched to a sibling account — the next delta request answers
+ * `Previous response not found` and burns a turn re-learning that. Everything
+ * else this record holds describes the *deployment*, not the account
+ * (strict-tools demotion, reasoning-effort fallback, native-history-replay
+ * warmup, the chaining circuit breaker), and is deliberately preserved:
+ * re-learning an endpoint's limits on every credential switch is the cost this
+ * state exists to avoid.
+ */
+export declare function resetOpenAIResponsesAccountScopedState(states: Map<string, ProviderSessionState>): void;
 type OpenRouterAnthropicCacheControl = {
     type: "ephemeral";
     ttl?: "1h";

package/dist/types/registry/oauth/github-copilot.d.ts

@@ -1,12 +1,8 @@
 import type { FetchImpl } from "../../types.js";
-import type { OAuthController, OAuthCredentials } from "./types.js";
+import type { OAuthController, OAuthCredentials, OAuthPrompt } from "./types.js";
 type GitHubCopilotLoginOptions = {
     onAuth: (url: string, instructions?: string) => void;
-    onPrompt: (prompt: {
-        message: string;
-        placeholder?: string;
-        allowEmpty?: boolean;
-    }) => Promise<string>;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
     onProgress?: (message: string) => void;
     copilotIntegrationId?: unknown;
     signal?: AbortSignal;

package/dist/types/registry/oauth/kimi.d.ts

@@ -1,7 +1,8 @@
 /**
  * Kimi Code OAuth flow (device authorization grant)
  */
-export declare let getKimiCommonHeaders: () => Readonly<{
+/** Lazily resolve the process-stable device headers used by Kimi requests. */
+export declare const getKimiCommonHeaders: () => Readonly<{
     "User-Agent": `KimiCLI/${string}`;
     "X-Msh-Platform": "kimi_cli";
     "X-Msh-Version": string;

package/dist/types/registry/oauth/types.d.ts

@@ -33,6 +33,8 @@ export type OAuthPrompt = {
     message: string;
     placeholder?: string;
     allowEmpty?: boolean;
+    /** Request masked entry from interactive hosts. Hosts that cannot hide input must reject the prompt. */
+    secret?: boolean;
 };
 export type OAuthAuthInfo = {
     /**

package/dist/types/usage/openai-codex.d.ts

@@ -5,6 +5,8 @@ import type { CredentialRankingStrategy, UsageProvider, UsageReport } from "../u
  * ingesting them lets credential selection block an exhausted account before
  * the next request burns a wire 429.
  */
-export declare function parseCodexRateLimitHeaders(headers: Record<string, string>, now?: number): UsageReport | null;
+export declare function parseCodexRateLimitHeaders(headers: Record<string, string>, now?: number, context?: {
+    responseStatus?: number;
+}): UsageReport | null;
 export declare const openaiCodexUsageProvider: UsageProvider;
 export declare const codexRankingStrategy: CredentialRankingStrategy;

package/dist/types/usage.d.ts

@@ -480,7 +480,9 @@ export interface UsageProvider {
     id: Provider;
     fetchUsage(params: UsageFetchParams, ctx: UsageFetchContext): Promise<UsageReport | null>;
     /** Parse provider rate-limit response headers (lowercased keys) into a usage report, if supported. */
-    parseRateLimitHeaders?(headers: Record<string, string>, now?: number): UsageReport | null;
+    parseRateLimitHeaders?(headers: Record<string, string>, now?: number, context?: {
+        responseStatus?: number;
+    }): UsageReport | null;
     supports?(params: UsageFetchParams): boolean;
     /** True when fetchUsage contacts upstream and can authenticate the credential for health checks. */
     validatesCredentials?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.2.1",
+	"version": "18.2.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -124,11 +124,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.2.1",
-		"@oh-my-pi/pi-catalog": "18.2.1",
-		"@oh-my-pi/pi-natives": "18.2.1",
-		"@oh-my-pi/pi-utils": "18.2.1",
-		"@oh-my-pi/pi-wire": "18.2.1"
+		"@oh-my-pi/omptype": "18.2.3",
+		"@oh-my-pi/pi-catalog": "18.2.3",
+		"@oh-my-pi/pi-natives": "18.2.3",
+		"@oh-my-pi/pi-utils": "18.2.3",
+		"@oh-my-pi/pi-wire": "18.2.3"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/sqlite-credential-store.ts

@@ -4,7 +4,7 @@
  * The public AuthCredentialStore interface remains in ../auth-storage so local
  * and remote stores share the same contract.
  */
-import { Database, type Statement } from "bun:sqlite";
+import type { Database, Statement } from "bun:sqlite";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { parseAlibabaTokenPlanCredential } from "@oh-my-pi/pi-catalog/wire/alibaba-token-plan";
@@ -15,6 +15,7 @@ import {
 	isSqliteBusyError,
 	isSqliteCorruptionError,
 	logger,
+	openSqliteDatabase,
 } from "@oh-my-pi/pi-utils";
 import type {
 	AuthCredential,
@@ -25,7 +26,6 @@ import type {
 	StoredAuthCredential,
 	StoredCredentialBlock,
 } from "../auth-storage";
-import * as AIError from "../error";
 import type { OAuthCredentials } from "../registry/oauth/types";
 import type { Provider } from "../types";
 import type {
@@ -509,6 +509,7 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		);
 	}
 
+	/** Opens credential storage with bounded busy retries and one-shot corruption recovery. */
 	static async open(dbPath: string = getAgentDbPath()): Promise<SqliteAuthCredentialStore> {
 		const dir = path.dirname(dbPath);
 		const dirExists = await fs
@@ -519,23 +520,9 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 			await fs.mkdir(dir, { recursive: true, mode: 0o700 });
 		}
 
-		// Concurrent omp startups can race against WAL recovery and the schema
-		// init's first lock-taking statement. Bun's default `busy_timeout` is 0,
-		// so retry the open on `SQLITE_BUSY` / `SQLITE_BUSY_RECOVERY` with bounded
-		// exponential backoff before surfacing the failure. See issue #2421.
-		const maxAttempts = 4;
-		const baseDelayMs = 100;
-		let lastBusyError: Error | undefined;
-		for (let attempt = 0; attempt < maxAttempts; attempt++) {
-			let db: Database | undefined;
-			try {
-				db = new Database(dbPath);
-				// Install the busy handler BEFORE the first lock-taking statement
-				// on this connection. The leases DDL below and the constructor's
-				// schema init both acquire locks during WAL recovery; without a
-				// non-zero `busy_timeout` they fail immediately with SQLITE_BUSY.
-				// See issue #2421.
-				SqliteAuthCredentialStore.#installBusyTimeout(db);
+		return openSqliteDatabase(
+			dbPath,
+			async db => {
 				try {
 					await fs.chmod(dbPath, 0o600);
 				} catch {
@@ -543,20 +530,8 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 				}
 				SqliteAuthCredentialStore.#ensureAuthCredentialRefreshLeasesTable(db);
 				return new SqliteAuthCredentialStore(db);
-			} catch (err) {
-				db?.close();
-				if (!isSqliteBusyError(err)) {
-					throw err;
-				}
-				lastBusyError = err instanceof Error ? err : new Error(String(err));
-				if (attempt < maxAttempts - 1) {
-					await Bun.sleep(baseDelayMs * 2 ** attempt);
-				}
-			}
-		}
-		throw new AIError.ConfigurationError(
-			`Failed to open auth database at '${dbPath}' after ${maxAttempts} attempts: ${lastBusyError?.message}`,
-			{ cause: lastBusyError },
+			},
+			{ recoverCorruption: true },
 		);
 	}