pi-account-manager 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 John Henao
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,98 @@
-# Temporary Holding Version
+# pi-account-manager
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Use more than one Anthropic or OpenAI subscription in pi, and switch between them with `/model`.
+
+Sign in as `anthropic@work` and `anthropic@personal`, and each account keeps its own login and its own usage.
+
+## Install
+
+```bash
+pi install npm:pi-account-manager
+```
+
+Restart pi, or run `/reload`. You need pi 1.2.0 or newer, and pi warns you at startup if yours is older.
+
+## Add an account
+
+```text
+/account add work
+```
+
+Pick a provider. Pi puts `/login anthropic@work` in your editor, so press enter and sign in as usual.
+
+That's it. `anthropic@work` now works like any other provider:
+
+```text
+/model                     switch between accounts and their models
+/login anthropic@work      sign in again
+/logout                    sign out of an account
+```
+
+The first time you sign in, pick one of the account's models with `/model`.
+
+## Supported providers
+
+| Choose | Alias | Signs in with |
+| --- | --- | --- |
+| Anthropic | `anthropic@<name>` | Your Claude subscription |
+| OpenAI | `openai@<name>` | Sign in with ChatGPT |
+| OpenAI Codex | `openai-codex@<name>` | The legacy Codex login |
+
+Each account signs in on its own. A named account never uses pi's built-in login for that provider, or an API key.
+
+## Commands
+
+```text
+/account                        list your accounts
+/account add [name]             add an account
+/account remove [name|alias]    remove an account
+```
+
+`/account` shows each account and whether it's signed in:
+
+```text
+NAME      PROVIDER      ALIAS ID            STATUS
+personal  Anthropic     anthropic@personal  not authenticated
+work      Anthropic     anthropic@work      authenticated
+work      OpenAI        openai@work         authenticated
+```
+
+`/account` only works in pi's interactive mode.
+
+## Start on an account by default
+
+Name the account and model in `/settings`:
+
+```json
+{ "defaultProvider": "anthropic@work", "defaultModel": "claude-sonnet-5" }
+```
+
+## Remove an account
+
+```text
+/account remove work
+```
+
+This only forgets the name and never deletes your login. Before removing an account, sign out with `/logout` and switch to another model. `/account remove` tells you if either step is still needed.
+
+## Account names
+
+Names can use 1 to 32 characters: lowercase letters, digits, `_` and `-`, starting with a letter or digit. Uppercase letters are lowercased. You can reuse a name across providers, so `anthropic@work` and `openai@work` can both exist.
+
+## Good to know
+
+- **Anthropic billing:** the first time in a pi run that you use an `anthropic@<name>` account, pi warns that third-party usage is billed per token as extra usage, not against your Claude plan limits. To turn the warning off, set `{ "warnings": { "anthropicExtraUsage": false } }` in `/settings`.
+- **Message threads:** Anthropic accounts use pi's message threads, kept separately for each account. That needs pi 1.5.1 or newer.
+- **`models.json`:** named accounts follow the built-in provider's settings there, including any `headers`. An `Authorization` header there replaces the account's own login.
+- **Where accounts live:** account names are kept in `~/.pi/agent/pi-account-manager/accounts.json`. Logins stay in pi's own `auth.json`, like any other provider.
+
+## Development
+
+```bash
+npm ci
+npm run check    # type check and tests
+```
+
+## License
+
+MIT

package/package.json

@@ -1,6 +1,50 @@
 {
-  "name": "pi-account-manager",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+	"name": "pi-account-manager",
+	"version": "0.1.0",
+	"description": "Pi extension for managing multiple named OAuth accounts per provider",
+	"license": "MIT",
+	"author": "John Henao <johnhenaot@gmail.com>",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/johnhenaot/pi-account-manager.git"
+	},
+	"keywords": [
+		"pi-package"
+	],
+	"type": "module",
+	"pi": {
+		"extensions": [
+			"./src/index.ts"
+		]
+	},
+	"files": [
+		"src"
+	],
+	"scripts": {
+		"prepublishOnly": "npm run check",
+		"test": "vitest --run",
+		"typecheck": "tsc --noEmit",
+		"check": "npm run typecheck && npm test"
+	},
+	"peerDependencies": {
+		"@earendil-works/pi-ai": "*",
+		"@earendil-works/pi-coding-agent": "*"
+	},
+	"peerDependenciesMeta": {
+		"@earendil-works/pi-ai": {
+			"optional": true
+		},
+		"@earendil-works/pi-coding-agent": {
+			"optional": true
+		}
+	},
+	"devDependencies": {
+		"@earendil-works/pi-ai": "1.5.2",
+		"@earendil-works/pi-coding-agent": "1.5.2",
+		"typescript": "^5.9.3",
+		"vitest": "^3.2.4"
+	},
+	"engines": {
+		"node": ">=22.19.0"
+	}
+}

package/src/account.ts

@@ -0,0 +1,32 @@
+export const PROVIDERS = {
+	anthropic: "Anthropic",
+	openai: "OpenAI",
+	"openai-codex": "OpenAI Codex",
+} as const;
+
+export type ProviderId = keyof typeof PROVIDERS;
+
+export interface Account {
+	provider: ProviderId;
+	name: string;
+}
+
+export const errorMessage = (error: unknown): string =>
+	error instanceof Error ? error.message : String(error);
+
+export const NAME_RULE = 'Use 1-32 characters from a-z, 0-9, "_" and "-", starting with a letter or digit.';
+
+// ASCII-only: `.toLowerCase()` would fold non-ASCII such as "İ" and change identity.
+export const normalizeName = (raw: string): string => raw.trim().replace(/[A-Z]/g, (c) => c.toLowerCase());
+
+export const isValidName = (name: string): boolean => /^[a-z0-9][a-z0-9_-]{0,31}$/.test(name);
+
+export const isProviderId = (value: string): value is ProviderId => Object.hasOwn(PROVIDERS, value);
+
+export const accountId = (account: Account): string => `${account.provider}@${account.name}`;
+
+// Not `localeCompare`: ICU collation varies by platform, making the saved order vary too.
+// Provider IDs sort the same as their labels, so this one order serves display as well.
+const compare = (x: string, y: string): number => (x < y ? -1 : x > y ? 1 : 0);
+export const sortAccounts = (accounts: readonly Account[]): Account[] =>
+	[...accounts].sort((a, b) => compare(a.provider, b.provider) || compare(a.name, b.name));

package/src/alias.ts

@@ -0,0 +1,84 @@
+import type { Api, Model, Provider, StreamOptions } from "@earendil-works/pi-ai";
+import { builtinProviders } from "@earendil-works/pi-ai/providers/all";
+import { type Account, accountId, type ProviderId, PROVIDERS } from "./account.ts";
+
+export const bundledProvider = (provider: ProviderId): Provider | undefined =>
+	builtinProviders().find((candidate) => candidate.id === provider);
+
+export function buildAlias(base: Provider | undefined, account: Account): Provider {
+	const id = accountId(account);
+	const oauth = base?.auth.oauth;
+	if (!base || !oauth) throw new Error(`provider "${account.provider}" has no OAuth flow.`);
+
+	const reprovision = (models: readonly Model<Api>[], provider: string) =>
+		models.map((model) => ({ ...model, provider }));
+
+	const isChatGPTSubscription = (model: Model<Api>, options: StreamOptions | undefined) =>
+		account.provider === "openai" && model.api === "openai-responses" &&
+		model.baseUrl === "https://api.openai.com/v1" &&
+		options?.apiKey !== undefined && !options.apiKey.startsWith("sk-");
+
+	const withoutMidConvoEffort = (model: Model<Api>) => ({
+		...model,
+		compat: { ...model.compat, supportsMidConvoEffort: false },
+	});
+
+	const omitUnsupportedFields = (options: StreamOptions | undefined): StreamOptions["onPayload"] =>
+		async (payload, requestModel) => {
+			const params = payload as Record<string, unknown>;
+			delete params.max_output_tokens;
+			delete params.temperature;
+			delete params.prompt_cache_retention;
+			delete params.prompt_cache_options;
+			return options?.onPayload?.(payload, requestModel);
+		};
+
+	const streamRequest = <T extends StreamOptions | undefined>(model: Model<Api>, options: T) => {
+		if (account.provider === "anthropic" && model.api === "anthropic-messages") {
+			// Pi 49fe0a2 makes this the default for every provider; remove once MIN_PI includes it.
+			if ((model as Model<"anthropic-messages">).compat?.supportsMessageThreads === undefined &&
+				model.baseUrl.includes("api.anthropic.com")) {
+				model = { ...model, compat: { ...model.compat, supportsMessageThreads: true } };
+			}
+			// Keeps each account's thread and fallback state apart. Shortcut: Pi's session cleanup misses
+			// these scoped ids; Pi's 10k caps bound them. Track the ids if that ever matters.
+			if (options?.sessionId) options = { ...options, sessionId: `${options.sessionId}:${id}` };
+		}
+		return isChatGPTSubscription(model, options)
+			? {
+				model: withoutMidConvoEffort(model),
+				options: { ...options, onPayload: omitUnsupportedFields(options) } satisfies T,
+			}
+			: { model, options };
+	};
+
+	return {
+		id,
+		name: `${PROVIDERS[account.provider]} (${account.name})`,
+		baseUrl: base.baseUrl,
+		headers: base.headers,
+		// Omitting `apiKey` is the isolation: the alias can only reach its own OAuth token,
+		// never the native key or an ambient credential. Exception (documented in the README):
+		// headers that models.json attaches to the native provider's OAuth still apply.
+		auth: { oauth },
+		getModels: () => reprovision(base.getModels(), id),
+		filterModels:
+			base.filterModels &&
+			((models, credential) => {
+				const kept = new Set(
+					base.filterModels!(reprovision(models, base.id), credential).map((model) => model.id),
+				);
+				return models.filter((model) => kept.has(model.id));
+			}),
+		// The model keeps `provider: <alias id>`, which is what makes pi attribute every stream
+		// event, message, and session entry to this account.
+		stream: (model, context, options) => {
+			const request = streamRequest(model, options);
+			return base.stream(request.model, context, request.options);
+		},
+		streamSimple: (model, context, options) => {
+			const request = streamRequest(model, options);
+			return base.streamSimple(request.model, context, request.options);
+		},
+	};
+}

package/src/index.ts

@@ -0,0 +1,234 @@
+import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext, ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { getAgentDir, SettingsManager, VERSION } from "@earendil-works/pi-coding-agent";
+import {
+	type Account,
+	accountId,
+	errorMessage,
+	isProviderId,
+	isValidName,
+	NAME_RULE,
+	normalizeName,
+	PROVIDERS,
+	sortAccounts,
+} from "./account.ts";
+import { buildAlias, bundledProvider } from "./alias.ts";
+import { loadAccounts, saveAccounts } from "./state.ts";
+
+export const ANTHROPIC_EXTRA_USAGE_WARNING =
+	"Anthropic subscription auth is active. Third-party harness usage draws from extra usage and is billed per token, not your Claude plan limits. Manage extra usage at https://claude.ai/settings/usage. Disable this warning in /settings.";
+
+export const USAGE = [
+	"Usage:",
+	"  /account                        list named accounts",
+	"  /account list                   list named accounts",
+	"  /account add [name]             add a named account",
+	"  /account remove [name|alias-id] remove a named account",
+].join("\n");
+
+export const EMPTY_LIST = "No named accounts. Use /account add NAME.";
+
+// A peer range cannot express this: pi supplies the bundled packages at load time, so the
+// package manager never sees which pi binary runs.
+export const MIN_PI = "1.2.0";
+export const meetsMinimum = (version: string): boolean =>
+	version.localeCompare(MIN_PI, undefined, { numeric: true }) >= 0;
+
+// On globalThis, not the closure: `/reload` re-runs the factory in the same process, and
+// both warnings must fire at most once per process.
+export const WARNED = Symbol.for("pi-account-manager.warned");
+// SAFETY: only this extension's Symbol.for key is read or written on globalThis.
+const warned = (): { anthropic?: true; version?: true } =>
+	((globalThis as unknown as Record<symbol, object>)[WARNED] ??= {});
+
+export function isAuthenticated(registry: ModelRegistry, id: string): boolean {
+	try {
+		return registry.getProviderAuthStatus(id)?.configured === true;
+	} catch {
+		return false;
+	}
+}
+
+function anthropicWarningEnabled(ctx: ExtensionContext): boolean {
+	try {
+		const settings = SettingsManager.create(ctx.cwd, undefined, { projectTrusted: ctx.isProjectTrusted() });
+		return settings.getWarnings().anthropicExtraUsage !== false;
+	} catch {
+		// An unreadable setting must not silently disable the warning.
+		return true;
+	}
+}
+
+export function formatList(accounts: readonly Account[], registry: ModelRegistry): string {
+	if (accounts.length === 0) return EMPTY_LIST;
+	const rows = [
+		["NAME", "PROVIDER", "ALIAS ID", "STATUS"],
+		...accounts.map((account) => [
+			account.name,
+			PROVIDERS[account.provider],
+			accountId(account),
+			isAuthenticated(registry, accountId(account)) ? "authenticated" : "not authenticated",
+		]),
+	];
+	const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => row[column].length)));
+	return rows.map((row) => row.map((cell, i) => cell.padEnd(widths[i])).join("  ").trimEnd()).join("\n");
+}
+
+export default async function (pi: ExtensionAPI) {
+	const agentDir = getAgentDir();
+	let snapshot: Account[] = [];
+	let loadError: string | undefined;
+
+	const registerAll = (base: (account: Account) => Parameters<typeof buildAlias>[0]) => {
+		try {
+			for (const account of snapshot) pi.registerProvider(buildAlias(base(account), account));
+		} catch (error) {
+			for (const account of snapshot) pi.unregisterProvider(accountId(account));
+			loadError = `Named accounts are unavailable: ${errorMessage(error)}`;
+			snapshot = [];
+		}
+	};
+
+	// Registered at load so startup model selection and `pi --list-models` see the aliases.
+	try {
+		snapshot = await loadAccounts(agentDir);
+	} catch (error) {
+		loadError = `Named accounts are unavailable: ${errorMessage(error)}`;
+	}
+	registerAll((account) => bundledProvider(account.provider));
+
+	const isOwnAnthropicAlias = (providerId: string | undefined): boolean =>
+		snapshot.some((account) => account.provider === "anthropic" && accountId(account) === providerId);
+
+	// Pi never warns for alias providers itself, and never emits model_select on restore.
+	const maybeWarnAnthropic = (ctx: ExtensionContext, providerId: string | undefined) => {
+		if (ctx.mode !== "tui" || warned().anthropic || !providerId || !isOwnAnthropicAlias(providerId)) return;
+		if (!isAuthenticated(ctx.modelRegistry, providerId) || !anthropicWarningEnabled(ctx)) return;
+		warned().anthropic = true;
+		ctx.ui.notify(ANTHROPIC_EXTRA_USAGE_WARNING, "warning");
+	};
+
+	pi.on("session_start", async (_event, ctx) => {
+		if (ctx.mode === "tui" && !warned().version && !meetsMinimum(VERSION)) {
+			warned().version = true;
+			ctx.ui.notify(
+				`pi-account-manager requires pi ${MIN_PI} or newer; this host is ${VERSION}. Named accounts may not work correctly.`,
+				"warning",
+			);
+		}
+
+		// Rebuilt against the effective registry, which includes any models.json overlay. Through
+		// `pi` rather than ctx.modelRegistry, because only that path refreshes the live model.
+		registerAll((account) => ctx.modelRegistry.getProvider(account.provider));
+
+		// A restored session assigns its model directly, emitting no model_select.
+		if (isOwnAnthropicAlias(ctx.model?.provider)) {
+			// Advisory only, so a refresh failure must not break session restore.
+			await ctx.modelRegistry.refresh().catch(() => {});
+			maybeWarnAnthropic(ctx, ctx.model?.provider);
+		}
+	});
+
+	// Pi reuses one ModelRuntime across /reload but hands the reload a fresh closure, so
+	// without this the previous instance's aliases stay registered forever.
+	pi.on("session_shutdown", (event, ctx) => {
+		if (event.reason !== "reload") return;
+		for (const account of snapshot) ctx.modelRegistry.unregisterProvider(accountId(account));
+	});
+
+	pi.on("model_select", (event, ctx) => maybeWarnAnthropic(ctx, event.model?.provider));
+
+	const add = async (ctx: ExtensionCommandContext, argument: string | undefined) => {
+		const entered = argument ?? (await ctx.ui.input("Account name", "e.g. work"));
+		if (entered === undefined) return;
+		const name = normalizeName(entered);
+		if (!isValidName(name)) {
+			ctx.ui.notify(`Invalid account name "${entered.trim()}". ${NAME_RULE}`, "error");
+			return;
+		}
+		const label = await ctx.ui.select("Provider", Object.values(PROVIDERS));
+		const provider = Object.keys(PROVIDERS).find((id) => PROVIDERS[id as keyof typeof PROVIDERS] === label);
+		if (!provider || !isProviderId(provider)) return;
+
+		const account: Account = { provider, name };
+		const id = accountId(account);
+		try {
+			// Re-read so an account another pi process added since startup is kept.
+			const accounts = await loadAccounts(agentDir);
+			if (accounts.some((existing) => accountId(existing) === id))
+				throw new Error(`already exists. Use /login ${id} to reauthenticate it.`);
+			if (ctx.modelRegistry.getProvider(id)) throw new Error(`provider ID "${id}" is already in use.`);
+			const alias = buildAlias(ctx.modelRegistry.getProvider(provider), account);
+			await saveAccounts(agentDir, [...accounts, account]);
+			snapshot = sortAccounts([...snapshot, account]);
+			try {
+				pi.registerProvider(alias);
+			} catch (error) {
+				throw new Error(`saved, but pi rejected the provider (${errorMessage(error)}). Run /reload.`);
+			}
+		} catch (error) {
+			ctx.ui.notify(`Cannot add ${id}: ${errorMessage(error)}`, "error");
+			return;
+		}
+
+		const login = `/login ${id}`;
+		// Not trimmed: a fresh pi editor is exactly "", so whitespace is a real draft.
+		if (ctx.ui.getEditorText() === "") {
+			ctx.ui.setEditorText(login);
+			ctx.ui.notify(`Added ${id}. Submit the prepared command to sign in.`, "info");
+		} else {
+			ctx.ui.notify(`Added ${id}. Run ${login} to sign in.`, "info");
+		}
+	};
+
+	const remove = async (ctx: ExtensionCommandContext, argument: string | undefined) => {
+		let matches = snapshot;
+		if (argument !== undefined) {
+			matches = snapshot.filter((account) => accountId(account) === argument);
+			if (matches.length === 0) matches = snapshot.filter((account) => account.name === normalizeName(argument));
+		}
+		if (matches.length === 0) {
+			ctx.ui.notify(argument === undefined ? EMPTY_LIST : `No named account matches "${argument}".`, "error");
+			return;
+		}
+		// No argument always asks, so a lone account is never removed without confirmation.
+		const id =
+			argument !== undefined && matches.length === 1
+				? accountId(matches[0])
+				: await ctx.ui.select("Remove account", matches.map(accountId));
+		if (id === undefined) return;
+
+		const blockers: string[] = [];
+		if (isAuthenticated(ctx.modelRegistry, id)) blockers.push(`Run /logout for ${id} first.`);
+		if (ctx.model?.provider === id) blockers.push("Select another model with /model first.");
+		try {
+			if (blockers.length > 0) throw new Error(blockers.join("\n"));
+			const accounts = await loadAccounts(agentDir);
+			await saveAccounts(agentDir, accounts.filter((account) => accountId(account) !== id));
+			snapshot = snapshot.filter((account) => accountId(account) !== id);
+			pi.unregisterProvider(id);
+		} catch (error) {
+			ctx.ui.notify(`Cannot remove ${id}: ${errorMessage(error)}`, "error");
+			return;
+		}
+		ctx.ui.notify(`Removed ${id}. Its credential is untouched; use /logout to remove that.`, "info");
+	};
+
+	pi.registerCommand("account", {
+		description: "Manage named OAuth accounts",
+		handler: async (args, ctx) => {
+			if (ctx.mode !== "tui") {
+				ctx.ui.notify("/account is available in interactive mode only.", "error");
+				return;
+			}
+			const [command = "list", argument, extra] = args.trim().split(/\s+/).filter(Boolean);
+			const valid =
+				extra === undefined &&
+				(command === "add" || command === "remove" || (command === "list" && argument === undefined));
+			if (!valid) ctx.ui.notify(USAGE, "error");
+			else if (command === "list") ctx.ui.notify(loadError ?? formatList(snapshot, ctx.modelRegistry), loadError ? "error" : "info");
+			else if (loadError) ctx.ui.notify(`${loadError} Fix the account state, then run /reload.`, "error");
+			else if (command === "add") await add(ctx, argument);
+			else await remove(ctx, argument);
+		},
+	});
+}

package/src/state.ts

@@ -0,0 +1,52 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { type Account, accountId, isProviderId, isValidName, sortAccounts } from "./account.ts";
+
+export const statePath = (agentDir: string): string => join(agentDir, "pi-account-manager", "accounts.json");
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+	typeof value === "object" && value !== null && !Array.isArray(value);
+
+export function parseState(text: string): Account[] {
+	let raw: unknown;
+	try {
+		raw = JSON.parse(text);
+	} catch {
+		throw new Error("accounts.json is not valid JSON.");
+	}
+	if (!isRecord(raw) || raw.version !== 1 || !Array.isArray(raw.accounts))
+		throw new Error('accounts.json must be {"version": 1, "accounts": [...]}.');
+	const accounts: Account[] = [];
+	for (const entry of raw.accounts) {
+		const { provider, name } = isRecord(entry) ? entry : {};
+		if (typeof provider !== "string" || !isProviderId(provider))
+			throw new Error(`accounts.json has unsupported provider ${JSON.stringify(provider)}.`);
+		if (typeof name !== "string" || !isValidName(name))
+			throw new Error(`accounts.json has invalid account name ${JSON.stringify(name)}.`);
+		const account = { provider, name };
+		if (accounts.some((other) => accountId(other) === accountId(account)))
+			throw new Error(`accounts.json has duplicate account ${accountId(account)}.`);
+		accounts.push(account);
+	}
+	return sortAccounts(accounts);
+}
+
+export async function loadAccounts(agentDir: string): Promise<Account[]> {
+	try {
+		return parseState(await readFile(statePath(agentDir), "utf8"));
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+		throw error;
+	}
+}
+
+// shortcut: no lock, so two pi processes changing accounts at the same instant can lose one
+// change; add a lock file if that ever happens in practice.
+export async function saveAccounts(agentDir: string, accounts: readonly Account[]): Promise<void> {
+	const path = statePath(agentDir);
+	await mkdir(dirname(path), { recursive: true });
+	// Write-then-rename so a crash never leaves a half-written file.
+	const temp = `${path}.${process.pid}.tmp`;
+	await writeFile(temp, `${JSON.stringify({ version: 1, accounts: sortAccounts(accounts) }, null, 2)}\n`, "utf8");
+	await rename(temp, path);
+}