@oh-my-pi/pi-ai 8.1.0 → 8.2.1

package/src/providers/openai-codex-responses.ts

@@ -1,6 +1,17 @@
-import os from "node:os";
-import { calculateCost } from "@oh-my-pi/pi-ai/models";
-import { getEnvApiKey } from "@oh-my-pi/pi-ai/stream";
+import * as os from "node:os";
+import { abortableSleep } from "@oh-my-pi/pi-utils";
+import type {
+	ResponseFunctionToolCall,
+	ResponseInput,
+	ResponseInputContent,
+	ResponseInputImage,
+	ResponseInputText,
+	ResponseOutputMessage,
+	ResponseReasoningItem,
+} from "openai/resources/responses/responses";
+import packageJson from "../../package.json" with { type: "json" };
+import { calculateCost } from "../models";
+import { getEnvApiKey } from "../stream";
 import type {
 	Api,
 	AssistantMessage,
@@ -13,22 +24,11 @@ import type {
 	ThinkingContent,
 	Tool,
 	ToolCall,
-} from "@oh-my-pi/pi-ai/types";
-import { AssistantMessageEventStream } from "@oh-my-pi/pi-ai/utils/event-stream";
-import { parseStreamingJson } from "@oh-my-pi/pi-ai/utils/json-parse";
-import { formatErrorMessageWithRetryAfter } from "@oh-my-pi/pi-ai/utils/retry-after";
-import { sanitizeSurrogates } from "@oh-my-pi/pi-ai/utils/sanitize-unicode";
-import { abortableSleep } from "@oh-my-pi/pi-utils";
-import type {
-	ResponseFunctionToolCall,
-	ResponseInput,
-	ResponseInputContent,
-	ResponseInputImage,
-	ResponseInputText,
-	ResponseOutputMessage,
-	ResponseReasoningItem,
-} from "openai/resources/responses/responses";
-import packageJson from "../../package.json" with { type: "json" };
+} from "../types";
+import { AssistantMessageEventStream } from "../utils/event-stream";
+import { parseStreamingJson } from "../utils/json-parse";
+import { formatErrorMessageWithRetryAfter } from "../utils/retry-after";
+import { sanitizeSurrogates } from "../utils/sanitize-unicode";
 import {
 	CODEX_BASE_URL,
 	JWT_CLAIM_PATH,
@@ -341,7 +341,7 @@ export const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses"
 				} else if (eventType === "response.output_item.done") {
 					const item = rawEvent.item as ResponseReasoningItem | ResponseOutputMessage | ResponseFunctionToolCall;
 					if (item.type === "reasoning" && currentBlock?.type === "thinking") {
-						currentBlock.thinking = item.summary?.map((s) => s.text).join("\n\n") || "";
+						currentBlock.thinking = item.summary?.map(s => s.text).join("\n\n") || "";
 						currentBlock.thinkingSignature = JSON.stringify(item);
 						stream.push({
 							type: "thinking_end",
@@ -351,7 +351,7 @@ export const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses"
 						});
 						currentBlock = null;
 					} else if (item.type === "message" && currentBlock?.type === "text") {
-						currentBlock.text = item.content.map((c) => (c.type === "output_text" ? c.text : c.refusal)).join("");
+						currentBlock.text = item.content.map(c => (c.type === "output_text" ? c.text : c.refusal)).join("");
 						currentBlock.textSignature = item.id;
 						stream.push({
 							type: "text_end",
@@ -396,7 +396,7 @@ export const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses"
 					}
 					calculateCost(model, output.usage);
 					output.stopReason = mapStopReason(response?.status);
-					if (output.content.some((b) => b.type === "toolCall") && output.stopReason === "stop") {
+					if (output.content.some(b => b.type === "toolCall") && output.stopReason === "stop") {
 						output.stopReason = "toolUse";
 					}
 				} else if (eventType === "error") {
@@ -593,9 +593,9 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 				});
 				// Filter out images if model doesn't support them, and empty text blocks
 				let filteredContent = !model.input.includes("image")
-					? content.filter((c) => c.type !== "input_image")
+					? content.filter(c => c.type !== "input_image")
 					: content;
-				filteredContent = filteredContent.filter((c) => {
+				filteredContent = filteredContent.filter(c => {
 					if (c.type === "input_text") {
 						return c.text.trim().length > 0;
 					}
@@ -647,10 +647,10 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 			messages.push(...output);
 		} else if (msg.role === "toolResult") {
 			const textResult = msg.content
-				.filter((c) => c.type === "text")
-				.map((c) => (c as { text: string }).text)
+				.filter(c => c.type === "text")
+				.map(c => (c as { text: string }).text)
 				.join("\n");
-			const hasImages = msg.content.some((c) => c.type === "image");
+			const hasImages = msg.content.some(c => c.type === "image");
 			const normalized = normalizeResponsesToolCallId(msg.toolCallId);
 
 			const hasText = textResult.length > 0;
@@ -692,7 +692,7 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 function convertTools(
 	tools: Tool[],
 ): Array<{ type: "function"; name: string; description: string; parameters: Record<string, unknown>; strict: null }> {
-	return tools.map((tool) => ({
+	return tools.map(tool => ({
 		type: "function",
 		name: tool.name,
 		description: tool.description,

package/src/providers/openai-completions.ts

@@ -1,5 +1,15 @@
-import { calculateCost } from "@oh-my-pi/pi-ai/models";
-import { getEnvApiKey } from "@oh-my-pi/pi-ai/stream";
+import OpenAI from "openai";
+import type {
+	ChatCompletionAssistantMessageParam,
+	ChatCompletionChunk,
+	ChatCompletionContentPart,
+	ChatCompletionContentPartImage,
+	ChatCompletionContentPartText,
+	ChatCompletionMessageParam,
+	ChatCompletionToolMessageParam,
+} from "openai/resources/chat/completions";
+import { calculateCost } from "../models";
+import { getEnvApiKey } from "../stream";
 import type {
 	AssistantMessage,
 	Context,
@@ -14,21 +24,11 @@ import type {
 	Tool,
 	ToolCall,
 	ToolResultMessage,
-} from "@oh-my-pi/pi-ai/types";
-import { AssistantMessageEventStream } from "@oh-my-pi/pi-ai/utils/event-stream";
-import { parseStreamingJson } from "@oh-my-pi/pi-ai/utils/json-parse";
-import { formatErrorMessageWithRetryAfter } from "@oh-my-pi/pi-ai/utils/retry-after";
-import { sanitizeSurrogates } from "@oh-my-pi/pi-ai/utils/sanitize-unicode";
-import OpenAI from "openai";
-import type {
-	ChatCompletionAssistantMessageParam,
-	ChatCompletionChunk,
-	ChatCompletionContentPart,
-	ChatCompletionContentPartImage,
-	ChatCompletionContentPartText,
-	ChatCompletionMessageParam,
-	ChatCompletionToolMessageParam,
-} from "openai/resources/chat/completions";
+} from "../types";
+import { AssistantMessageEventStream } from "../utils/event-stream";
+import { parseStreamingJson } from "../utils/json-parse";
+import { formatErrorMessageWithRetryAfter } from "../utils/retry-after";
+import { sanitizeSurrogates } from "../utils/sanitize-unicode";
 import { transformMessages } from "./transform-messages";
 
 /**
@@ -61,7 +61,7 @@ function hasToolHistory(messages: Message[]): boolean {
 			return true;
 		}
 		if (msg.role === "assistant") {
-			if (msg.content.some((block) => block.type === "toolCall")) {
+			if (msg.content.some(block => block.type === "toolCall")) {
 				return true;
 			}
 		}
@@ -287,7 +287,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 						for (const detail of reasoningDetails) {
 							if (detail.type === "reasoning.encrypted" && detail.id && detail.data) {
 								const matchingToolCall = output.content.find(
-									(b) => b.type === "toolCall" && b.id === detail.id,
+									b => b.type === "toolCall" && b.id === detail.id,
 								) as ToolCall | undefined;
 								if (matchingToolCall) {
 									matchingToolCall.thoughtSignature = JSON.stringify(detail);
@@ -356,12 +356,12 @@ function createClient(
 		headers["Openai-Intent"] = "conversation-edits";
 
 		// Copilot requires this header when sending images
-		const hasImages = messages.some((msg) => {
+		const hasImages = messages.some(msg => {
 			if (msg.role === "user" && Array.isArray(msg.content)) {
-				return msg.content.some((c) => c.type === "image");
+				return msg.content.some(c => c.type === "image");
 			}
 			if (msg.role === "toolResult" && Array.isArray(msg.content)) {
-				return msg.content.some((c) => c.type === "image");
+				return msg.content.some(c => c.type === "image");
 			}
 			return false;
 		});
@@ -516,7 +516,7 @@ export function convertMessages(
 					}
 				});
 				const filteredContent = !model.input.includes("image")
-					? content.filter((c) => c.type !== "image_url")
+					? content.filter(c => c.type !== "image_url")
 					: content;
 				if (filteredContent.length === 0) continue;
 				params.push({
@@ -531,29 +531,29 @@ export function convertMessages(
 				content: compat.requiresAssistantAfterToolResult ? "" : null,
 			};
 
-			const textBlocks = msg.content.filter((b) => b.type === "text") as TextContent[];
+			const textBlocks = msg.content.filter(b => b.type === "text") as TextContent[];
 			// Filter out empty text blocks to avoid API validation errors
-			const nonEmptyTextBlocks = textBlocks.filter((b) => b.text && b.text.trim().length > 0);
+			const nonEmptyTextBlocks = textBlocks.filter(b => b.text && b.text.trim().length > 0);
 			if (nonEmptyTextBlocks.length > 0) {
 				// GitHub Copilot requires assistant content as a string, not an array.
 				// Sending as array causes Claude models to re-answer all previous prompts.
 				if (model.provider === "github-copilot") {
-					assistantMsg.content = nonEmptyTextBlocks.map((b) => sanitizeSurrogates(b.text)).join("");
+					assistantMsg.content = nonEmptyTextBlocks.map(b => sanitizeSurrogates(b.text)).join("");
 				} else {
-					assistantMsg.content = nonEmptyTextBlocks.map((b) => {
+					assistantMsg.content = nonEmptyTextBlocks.map(b => {
 						return { type: "text", text: sanitizeSurrogates(b.text) };
 					});
 				}
 			}
 
 			// Handle thinking blocks
-			const thinkingBlocks = msg.content.filter((b) => b.type === "thinking") as ThinkingContent[];
+			const thinkingBlocks = msg.content.filter(b => b.type === "thinking") as ThinkingContent[];
 			// Filter out empty thinking blocks to avoid API validation errors
-			const nonEmptyThinkingBlocks = thinkingBlocks.filter((b) => b.thinking && b.thinking.trim().length > 0);
+			const nonEmptyThinkingBlocks = thinkingBlocks.filter(b => b.thinking && b.thinking.trim().length > 0);
 			if (nonEmptyThinkingBlocks.length > 0) {
 				if (compat.requiresThinkingAsText) {
 					// Convert thinking blocks to plain text (no tags to avoid model mimicking them)
-					const thinkingText = nonEmptyThinkingBlocks.map((b) => b.thinking).join("\n\n");
+					const thinkingText = nonEmptyThinkingBlocks.map(b => b.thinking).join("\n\n");
 					const textContent = assistantMsg.content as Array<{ type: "text"; text: string }> | null;
 					if (textContent) {
 						textContent.unshift({ type: "text", text: thinkingText });
@@ -564,14 +564,14 @@ export function convertMessages(
 					// Use the signature from the first thinking block if available (for llama.cpp server + gpt-oss)
 					const signature = nonEmptyThinkingBlocks[0].thinkingSignature;
 					if (signature && signature.length > 0) {
-						(assistantMsg as any)[signature] = nonEmptyThinkingBlocks.map((b) => b.thinking).join("\n");
+						(assistantMsg as any)[signature] = nonEmptyThinkingBlocks.map(b => b.thinking).join("\n");
 					}
 				}
 			}
 
-			const toolCalls = msg.content.filter((b) => b.type === "toolCall") as ToolCall[];
+			const toolCalls = msg.content.filter(b => b.type === "toolCall") as ToolCall[];
 			if (toolCalls.length > 0) {
-				assistantMsg.tool_calls = toolCalls.map((tc) => ({
+				assistantMsg.tool_calls = toolCalls.map(tc => ({
 					id: normalizeMistralToolId(tc.id, compat.requiresMistralToolIds),
 					type: "function" as const,
 					function: {
@@ -580,8 +580,8 @@ export function convertMessages(
 					},
 				}));
 				const reasoningDetails = toolCalls
-					.filter((tc) => tc.thoughtSignature)
-					.map((tc) => {
+					.filter(tc => tc.thoughtSignature)
+					.map(tc => {
 						try {
 							return JSON.parse(tc.thoughtSignature!);
 						} catch {
@@ -616,10 +616,10 @@ export function convertMessages(
 
 				// Extract text and image content
 				const textResult = toolMsg.content
-					.filter((c) => c.type === "text")
-					.map((c) => (c as any).text)
+					.filter(c => c.type === "text")
+					.map(c => (c as any).text)
 					.join("\n");
-				const hasImages = toolMsg.content.some((c) => c.type === "image");
+				const hasImages = toolMsg.content.some(c => c.type === "image");
 
 				// Always send tool result with text (or placeholder if only images)
 				const hasText = textResult.length > 0;
@@ -683,7 +683,7 @@ export function convertMessages(
 }
 
 function convertTools(tools: Tool[]): OpenAI.Chat.Completions.ChatCompletionTool[] {
-	return tools.map((tool) => ({
+	return tools.map(tool => ({
 		type: "function",
 		function: {
 			name: tool.name,

package/src/providers/openai-responses.ts

@@ -1,22 +1,3 @@
-import { calculateCost } from "@oh-my-pi/pi-ai/models";
-import { getEnvApiKey } from "@oh-my-pi/pi-ai/stream";
-import type {
-	Api,
-	AssistantMessage,
-	Context,
-	Model,
-	StopReason,
-	StreamFunction,
-	StreamOptions,
-	TextContent,
-	ThinkingContent,
-	Tool,
-	ToolCall,
-} from "@oh-my-pi/pi-ai/types";
-import { AssistantMessageEventStream } from "@oh-my-pi/pi-ai/utils/event-stream";
-import { parseStreamingJson } from "@oh-my-pi/pi-ai/utils/json-parse";
-import { formatErrorMessageWithRetryAfter } from "@oh-my-pi/pi-ai/utils/retry-after";
-import { sanitizeSurrogates } from "@oh-my-pi/pi-ai/utils/sanitize-unicode";
 import OpenAI from "openai";
 import type {
 	Tool as OpenAITool,
@@ -29,6 +10,25 @@ import type {
 	ResponseOutputMessage,
 	ResponseReasoningItem,
 } from "openai/resources/responses/responses";
+import { calculateCost } from "../models";
+import { getEnvApiKey } from "../stream";
+import type {
+	Api,
+	AssistantMessage,
+	Context,
+	Model,
+	StopReason,
+	StreamFunction,
+	StreamOptions,
+	TextContent,
+	ThinkingContent,
+	Tool,
+	ToolCall,
+} from "../types";
+import { AssistantMessageEventStream } from "../utils/event-stream";
+import { parseStreamingJson } from "../utils/json-parse";
+import { formatErrorMessageWithRetryAfter } from "../utils/retry-after";
+import { sanitizeSurrogates } from "../utils/sanitize-unicode";
 import { transformMessages } from "./transform-messages";
 
 /** Fast deterministic hash to shorten long strings */
@@ -240,12 +240,19 @@ export const streamOpenAIResponses: StreamFunction<"openai-responses"> = (
 						});
 					}
 				}
+				// Handle function call arguments done (some providers send this instead of deltas)
+				else if (event.type === "response.function_call_arguments.done") {
+					if (currentItem?.type === "function_call" && currentBlock?.type === "toolCall") {
+						currentBlock.partialJson = event.arguments;
+						currentBlock.arguments = parseStreamingJson(currentBlock.partialJson);
+					}
+				}
 				// Handle output item completion
 				else if (event.type === "response.output_item.done") {
 					const item = event.item;
 
 					if (item.type === "reasoning" && currentBlock && currentBlock.type === "thinking") {
-						currentBlock.thinking = item.summary?.map((s) => s.text).join("\n\n") || "";
+						currentBlock.thinking = item.summary?.map(s => s.text).join("\n\n") || "";
 						currentBlock.thinkingSignature = JSON.stringify(item);
 						stream.push({
 							type: "thinking_end",
@@ -255,7 +262,7 @@ export const streamOpenAIResponses: StreamFunction<"openai-responses"> = (
 						});
 						currentBlock = null;
 					} else if (item.type === "message" && currentBlock && currentBlock.type === "text") {
-						currentBlock.text = item.content.map((c) => (c.type === "output_text" ? c.text : c.refusal)).join("");
+						currentBlock.text = item.content.map(c => (c.type === "output_text" ? c.text : c.refusal)).join("");
 						currentBlock.textSignature = item.id;
 						stream.push({
 							type: "text_end",
@@ -265,13 +272,17 @@ export const streamOpenAIResponses: StreamFunction<"openai-responses"> = (
 						});
 						currentBlock = null;
 					} else if (item.type === "function_call") {
+						const args =
+							currentBlock?.type === "toolCall" && currentBlock.partialJson
+								? JSON.parse(currentBlock.partialJson)
+								: JSON.parse(item.arguments);
 						const toolCall: ToolCall = {
 							type: "toolCall",
 							id: `${item.call_id}|${item.id}`,
 							name: item.name,
-							arguments: JSON.parse(item.arguments),
+							arguments: args,
 						};
-
+						currentBlock = null;
 						stream.push({ type: "toolcall_end", contentIndex: blockIndex(), toolCall, partial: output });
 					}
 				}
@@ -293,7 +304,7 @@ export const streamOpenAIResponses: StreamFunction<"openai-responses"> = (
 					calculateCost(model, output.usage);
 					// Map status to stop reason
 					output.stopReason = mapStopReason(response?.status);
-					if (output.content.some((b) => b.type === "toolCall") && output.stopReason === "stop") {
+					if (output.content.some(b => b.type === "toolCall") && output.stopReason === "stop") {
 						output.stopReason = "toolUse";
 					}
 				}
@@ -358,12 +369,12 @@ function createClient(
 		headers["Openai-Intent"] = "conversation-edits";
 
 		// Copilot requires this header when sending images
-		const hasImages = messages.some((msg) => {
+		const hasImages = messages.some(msg => {
 			if (msg.role === "user" && Array.isArray(msg.content)) {
-				return msg.content.some((c) => c.type === "image");
+				return msg.content.some(c => c.type === "image");
 			}
 			if (msg.role === "toolResult" && Array.isArray(msg.content)) {
-				return msg.content.some((c) => c.type === "image");
+				return msg.content.some(c => c.type === "image");
 			}
 			return false;
 		});
@@ -491,9 +502,9 @@ function convertMessages(
 				});
 				// Filter out images if model doesn't support them, and empty text blocks
 				let filteredContent = !model.input.includes("image")
-					? content.filter((c) => c.type !== "input_image")
+					? content.filter(c => c.type !== "input_image")
 					: content;
-				filteredContent = filteredContent.filter((c) => {
+				filteredContent = filteredContent.filter(c => {
 					if (c.type === "input_text") {
 						return c.text.trim().length > 0;
 					}
@@ -567,10 +578,10 @@ function convertMessages(
 		} else if (msg.role === "toolResult") {
 			// Extract text and image content
 			const textResult = msg.content
-				.filter((c) => c.type === "text")
-				.map((c) => (c as any).text)
+				.filter(c => c.type === "text")
+				.map(c => (c as any).text)
 				.join("\n");
-			const hasImages = msg.content.some((c) => c.type === "image");
+			const hasImages = msg.content.some(c => c.type === "image");
 			const normalized = normalizeResponsesToolCallId(msg.toolCallId);
 			if (strictResponsesPairing && !knownCallIds.has(normalized.callId)) {
 				continue;
@@ -618,7 +629,7 @@ function convertMessages(
 }
 
 function convertTools(tools: Tool[]): OpenAITool[] {
-	return tools.map((tool) => ({
+	return tools.map(tool => ({
 		type: "function",
 		name: tool.name,
 		description: tool.description,

package/src/providers/transform-messages.ts

@@ -1,4 +1,4 @@
-import type { Api, AssistantMessage, Message, Model, ToolCall, ToolResultMessage } from "@oh-my-pi/pi-ai/types";
+import type { Api, AssistantMessage, Message, Model, ToolCall, ToolResultMessage } from "../types";
 
 /**
  * Normalize tool call ID for cross-provider compatibility.
@@ -98,7 +98,7 @@ export function transformMessages<TApi extends Api>(messages: Message[], model:
 			const needsToolCallIdNormalization = targetRequiresStrictIds && (crossProviderSwitch || copilotCrossApiSwitch);
 
 			// Transform message from different provider/model
-			const transformedContent = assistantMsg.content.flatMap((block) => {
+			const transformedContent = assistantMsg.content.flatMap(block => {
 				if (block.type === "thinking") {
 					// Skip empty thinking blocks, convert others to plain text
 					if (!block.thinking || block.thinking.trim() === "") return [];
@@ -173,7 +173,7 @@ export function transformMessages<TApi extends Api>(messages: Message[], model:
 
 			const assistantMsg = msg as AssistantMessage;
 			const isErroredAssistant = assistantMsg.stopReason === "error" || assistantMsg.stopReason === "aborted";
-			const toolCalls = assistantMsg.content.filter((b) => b.type === "toolCall") as ToolCall[];
+			const toolCalls = assistantMsg.content.filter(b => b.type === "toolCall") as ToolCall[];
 
 			result.push(msg);
 

package/src/storage.ts

@@ -4,9 +4,9 @@
  */
 
 import { Database } from "bun:sqlite";
-import { chmodSync, existsSync, mkdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
 import type { OAuthCredentials } from "./utils/oauth/types";
 
 type AuthCredential = { type: "api_key"; key: string } | ({ type: "oauth" } & OAuthCredentials);
@@ -24,7 +24,7 @@ type AuthRow = {
  * Get the agent config directory (e.g., ~/.omp/agent/)
  */
 function getAgentDir(): string {
-	const configDir = process.env.OMP_CODING_AGENT_DIR || join(homedir(), ".omp", "agent");
+	const configDir = process.env.OMP_CODING_AGENT_DIR || path.join(os.homedir(), ".omp", "agent");
 	return configDir;
 }
 
@@ -32,7 +32,7 @@ function getAgentDir(): string {
  * Get path to agent.db
  */
 function getAgentDbPath(): string {
-	return join(getAgentDir(), "agent.db");
+	return path.join(getAgentDir(), "agent.db");
 }
 
 function serializeCredential(credential: AuthCredential): { credentialType: string; data: string } | null {
@@ -79,6 +79,8 @@ function deserializeCredential(row: AuthRow): AuthCredential | null {
 
 /**
  * Simple storage class for CLI auth credentials.
+ *
+ * Use `CliAuthStorage.create()` to instantiate (async initialization).
  */
 export class CliAuthStorage {
 	private db: Database;
@@ -87,20 +89,8 @@ export class CliAuthStorage {
 	private listAllStmt: ReturnType<Database["prepare"]>;
 	private deleteByProviderStmt: ReturnType<Database["prepare"]>;
 
-	constructor(dbPath: string = getAgentDbPath()) {
-		// Ensure directory exists with secure permissions
-		const dir = dirname(dbPath);
-		if (!existsSync(dir)) {
-			mkdirSync(dir, { recursive: true, mode: 0o700 });
-		}
-
-		this.db = new Database(dbPath);
-		// Harden database file permissions to prevent credential leakage
-		try {
-			chmodSync(dbPath, 0o600);
-		} catch {
-			// Ignore chmod failures (e.g., Windows)
-		}
+	private constructor(db: Database) {
+		this.db = db;
 		this.initializeSchema();
 
 		this.insertStmt = this.db.prepare(
@@ -111,6 +101,26 @@ export class CliAuthStorage {
 		this.deleteByProviderStmt = this.db.prepare("DELETE FROM auth_credentials WHERE provider = ?");
 	}
 
+	static async create(dbPath: string = getAgentDbPath()): Promise<CliAuthStorage> {
+		const dir = path.dirname(dbPath);
+		const dirExists = await fs
+			.stat(dir)
+			.then(s => s.isDirectory())
+			.catch(() => false);
+		if (!dirExists) {
+			await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+		}
+
+		const db = new Database(dbPath);
+		try {
+			await fs.chmod(dbPath, 0o600);
+		} catch {
+			// Ignore chmod failures (e.g., Windows)
+		}
+
+		return new CliAuthStorage(db);
+	}
+
 	private initializeSchema(): void {
 		this.db.exec(`
 PRAGMA journal_mode=WAL;

package/src/stream.ts

@@ -1,6 +1,6 @@
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
 import { supportsXhigh } from "./models";
 import { type BedrockOptions, streamBedrock } from "./providers/amazon-bedrock";
 import { type AnthropicOptions, streamAnthropic } from "./providers/anthropic";
@@ -34,10 +34,10 @@ function hasVertexAdcCredentials(): boolean {
 	if (cachedVertexAdcCredentialsExists === null) {
 		const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
 		if (gacPath) {
-			cachedVertexAdcCredentialsExists = existsSync(gacPath);
+			cachedVertexAdcCredentialsExists = fs.existsSync(gacPath);
 		} else {
-			cachedVertexAdcCredentialsExists = existsSync(
-				join(homedir(), ".config", "gcloud", "application_default_credentials.json"),
+			cachedVertexAdcCredentialsExists = fs.existsSync(
+				path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json"),
 			);
 		}
 	}

package/src/types.ts

@@ -1,3 +1,4 @@
+import type { TSchema } from "@sinclair/typebox";
 import type { BedrockOptions } from "./providers/amazon-bedrock";
 import type { AnthropicOptions } from "./providers/anthropic";
 import type { CursorOptions } from "./providers/cursor";
@@ -237,8 +238,6 @@ export interface CursorExecHandlers {
 	onToolResult?: CursorToolResultHandler;
 }
 
-import type { TSchema } from "@sinclair/typebox";
-
 export interface Tool<TParameters extends TSchema = TSchema> {
 	name: string;
 	description: string;

package/src/usage/claude.ts

@@ -7,7 +7,7 @@ import type {
 	UsageReport,
 	UsageStatus,
 	UsageWindow,
-} from "@oh-my-pi/pi-ai/usage";
+} from "../usage";
 
 const DEFAULT_ENDPOINT = "https://api.anthropic.com/api/oauth";
 const DEFAULT_CACHE_TTL_MS = 60_000;
@@ -241,10 +241,10 @@ function buildCacheKey(params: UsageFetchParams): string {
 
 function resolveCacheExpiry(now: number, limits: UsageLimit[]): number {
 	const earliestReset = limits
-		.map((limit) => limit.window?.resetsAt)
+		.map(limit => limit.window?.resetsAt)
 		.filter((value): value is number => typeof value === "number" && Number.isFinite(value))
 		.reduce((min, value) => (min === undefined ? value : Math.min(min, value)), undefined as number | undefined);
-	const exhausted = limits.some((limit) => limit.status === "exhausted");
+	const exhausted = limits.some(limit => limit.status === "exhausted");
 	if (earliestReset === undefined) return now + DEFAULT_CACHE_TTL_MS;
 	if (exhausted) return earliestReset;
 	return Math.min(now + DEFAULT_CACHE_TTL_MS, earliestReset);
@@ -351,5 +351,5 @@ async function fetchClaudeUsage(params: UsageFetchParams, ctx: UsageFetchContext
 export const claudeUsageProvider: UsageProvider = {
 	id: "anthropic",
 	fetchUsage: fetchClaudeUsage,
-	supports: (params) => params.provider === "anthropic" && params.credential.type === "oauth",
+	supports: params => params.provider === "anthropic" && params.credential.type === "oauth",
 };

package/src/usage/github-copilot.ts

@@ -3,7 +3,6 @@
  *
  * Normalizes Copilot quota usage into the shared UsageReport schema.
  */
-
 import type {
 	UsageAmount,
 	UsageCacheEntry,
@@ -14,7 +13,7 @@ import type {
 	UsageReport,
 	UsageStatus,
 	UsageWindow,
-} from "@oh-my-pi/pi-ai/usage";
+} from "../usage";
 
 const COPILOT_HEADERS = {
 	"User-Agent": "GitHubCopilotChat/0.35.0",
@@ -316,7 +315,7 @@ function normalizeBillingUsage(data: BillingUsageResponse): UsageLimit[] {
 	};
 
 	const premiumItems = data.usageItems.filter(
-		(item) => item.sku === "Copilot Premium Request" || item.sku.includes("Premium"),
+		item => item.sku === "Copilot Premium Request" || item.sku.includes("Premium"),
 	);
 	const totalUsed = premiumItems.reduce((sum, item) => sum + item.grossQuantity, 0);
 	const totalLimit = premiumItems.reduce((sum, item) => sum + (item.limit ?? 0), 0) || undefined;
@@ -359,7 +358,7 @@ function normalizeBillingUsage(data: BillingUsageResponse): UsageLimit[] {
 function resolveCacheTtl(now: number, report: UsageReport | null): UsageCacheEntry["expiresAt"] {
 	if (!report) return now + DEFAULT_CACHE_TTL_MS;
 	const resetInMs = report.limits
-		.map((limit) => limit.window?.resetInMs)
+		.map(limit => limit.window?.resetInMs)
 		.find((value): value is number => typeof value === "number" && Number.isFinite(value));
 	if (!resetInMs || resetInMs <= 0) return now + DEFAULT_CACHE_TTL_MS;
 	return now + Math.min(MAX_CACHE_TTL_MS, resetInMs);