diff --git a/packages/agent/CHANGELOG.md b/packages/agent/CHANGELOG.md
index eafd24920..74a1c68e4 100644
--- a/packages/agent/CHANGELOG.md
+++ b/packages/agent/CHANGELOG.md
@@ -895,4 +895,4 @@ Initial release under @oh-my-pi scope. See previous releases at [badlogic/pi-mon
 ### Changed
 
 - `Agent` constructor now has all options optional (empty options use defaults).
-- `queueMessage()` is now synchronous (no longer returns a Promise).
\ No newline at end of file
+- `queueMessage()` is now synchronous (no longer returns a Promise).
diff --git a/packages/coding-agent/src/commands/token.ts b/packages/coding-agent/src/commands/token.ts
index 6b4a1b793..0ff556947 100644
--- a/packages/coding-agent/src/commands/token.ts
+++ b/packages/coding-agent/src/commands/token.ts
@@ -41,49 +41,53 @@ export default class Token extends Command {
 		const provider = providerName.toLowerCase();
 
 		const authStorage = await discoverAuthStorage();
-		const modelRegistry = new ModelRegistry(authStorage);
+		try {
+			const modelRegistry = new ModelRegistry(authStorage);
 
-		// Resolve the API key / token
-		const apiKey = await modelRegistry.getApiKeyForProvider(provider, undefined, {
-			forceRefresh: flags["force-refresh"],
-		});
+			// Resolve the API key / token
+			const apiKey = await modelRegistry.getApiKeyForProvider(provider, undefined, {
+				forceRefresh: flags["force-refresh"],
+			});
 
-		if (!isAuthenticated(apiKey)) {
-			// Find all active/configured providers
-			const activeProviders = new Set<string>();
-			for (const p of PROVIDER_REGISTRY) {
-				if (authStorage.hasAuth(p.id)) {
-					activeProviders.add(p.id);
+			if (!isAuthenticated(apiKey)) {
+				// Find all active/configured providers
+				const activeProviders = new Set<string>();
+				for (const p of PROVIDER_REGISTRY) {
+					if (authStorage.hasAuth(p.id)) {
+						activeProviders.add(p.id);
+					}
 				}
+				const all = authStorage.getAll();
+				for (const p in all) {
+					if (authStorage.hasAuth(p)) {
+						activeProviders.add(p);
+					}
+				}
+
+				const msg = `No active credential found for provider "${providerName}".`;
+				process.stderr.write(`${chalk.red(msg)}\n`);
+				if (activeProviders.size > 0) {
+					process.stderr.write(`Configured providers: ${Array.from(activeProviders).sort().join(", ")}\n`);
+				}
+				process.exitCode = 1;
+				return;
 			}
-			const all = authStorage.getAll();
-			for (const p in all) {
-				if (authStorage.hasAuth(p)) {
-					activeProviders.add(p);
+
+			if (!flags.raw) {
+				try {
+					const parsed = JSON.parse(apiKey);
+					if (parsed && typeof parsed === "object" && typeof parsed.token === "string") {
+						process.stdout.write(`${parsed.token}\n`);
+						return;
+					}
+				} catch {
+					// Not a JSON string, print as-is
 				}
 			}
 
-			const msg = `No active credential found for provider "${providerName}".`;
-			process.stderr.write(`${chalk.red(msg)}\n`);
-			if (activeProviders.size > 0) {
-				process.stderr.write(`Configured providers: ${Array.from(activeProviders).sort().join(", ")}\n`);
-			}
-			process.exitCode = 1;
-			return;
+			process.stdout.write(`${apiKey}\n`);
+		} finally {
+			authStorage.close();
 		}
-
-		if (!flags.raw) {
-			try {
-				const parsed = JSON.parse(apiKey);
-				if (parsed && typeof parsed === "object" && typeof parsed.token === "string") {
-					process.stdout.write(`${parsed.token}\n`);
-					return;
-				}
-			} catch {
-				// Not a JSON string, print as-is
-			}
-		}
-
-		process.stdout.write(`${apiKey}\n`);
 	}
 }
diff --git a/packages/mnemopi/CHANGELOG.md b/packages/mnemopi/CHANGELOG.md
index 413b58d0a..5a300670a 100644
--- a/packages/mnemopi/CHANGELOG.md
+++ b/packages/mnemopi/CHANGELOG.md
@@ -9,9 +9,6 @@
 ### Fixed
 
 - Fixed background fact extraction skipping runtime-configured remote LLM endpoints when `MNEMOPI_LLM_BASE_URL` was unset, so `remember(..., { extract: true })` now stores remote-distilled facts from `mnemopi.llm` config instead of falling back to regex heuristics. ([#3041](https://github.com/can1357/oh-my-pi/issues/3041))
-
-### Fixed
-
 - Fixed local fastembed startup on macOS ARM64 by letting `fastembed@2.1.0` install its matching `onnxruntime-node@1.21.0` native runtime instead of forcing `1.26.0`, and by repairing missing tokenizer sidecars from the upstream Hugging Face model cache when a stale fastembed archive lacks them. ([#3054](https://github.com/can1357/oh-my-pi/issues/3054))
 
 ## [16.0.6] - 2026-06-18