Run Perplexity search and auth requests through pi's Node runtime instead of
shelling out to Bun. Move development and CI commands to npm, add a Node test
build path, and keep OTP auth fail-fast when Set-Cookie headers are not
available.
mock.module() in index-execute.test.ts permanently poisons Bun's
module cache — mock.restore() does not undo it in Bun 1.3.11.
Use cache-busted dynamic imports (../src/mod.ts?t=${Date.now()}) in
beforeEach for the three affected test files so each test gets a
fresh, unpoisoned module instance.
The REAL_JWE_TOKEN constant in otp-flow.test.ts contained an actual
token captured from a live Perplexity auth response. Replace with a
structurally valid but non-functional placeholder.
Enforce 0600 permissions after every auth token write so existing files
with broader modes are corrected.
Add a regression test for the permission hardening path and document the
Bun runtime dependency used by the Node/jiti search subprocess path.
Also declare bun in package dependencies and engines.
Ivan Pereira