pi-antigravity-rotator 2.2.1 → 2.3.0

package/CHANGELOG.md

@@ -2,13 +2,32 @@
 
 ## [Unreleased]
 
+## [2.3.0] - 2026-06-22
+
+### Added
+- **PostgreSQL Storage Layer**: Optional PostgreSQL persistence support via a clean Repository Pattern (`ISettingsRepository`), enabling deployments without local disk writes. (PR [#13](https://github.com/tuxevil/pi-antigravity-rotator/pull/13) by [@josenicomaia](https://github.com/josenicomaia))
+- **Web-based Account Management**: Add, remove, and update accounts and their tier directly from the dashboard UI without manually editing JSON files.
+- **Improved Auth Flow**: Added `/login-cli` endpoint to dramatically simplify the OAuth login callback process.
+
+### Changed
+- **Token Regeneration**: As part of the refactor to the new storage abstraction, upgrading to this version will automatically regenerate the `PI_ROTATOR_ADMIN_TOKEN` on first boot. The new token will be printed to the console output.
+
+
+## [2.2.2] - 2026-06-21
+
+### Fixed
+- **Telemetry HTTPS Error**: Reverted the default telemetry endpoint from `https://` back to `http://` because the backend server does not support SSL, which was causing silent "packet length too long" errors and preventing telemetry and broadcast notifications from working.
+
+### Refactored
+- **Compatibility Layer**: Massively refactored the 2,400-line `src/compat.ts` into smaller, single-responsibility modules under `src/compat/` for easier maintenance. (PR [#11](https://github.com/tuxevil/pi-antigravity-rotator/pull/11) by [@josenicomaia](https://github.com/josenicomaia))
+
 ## [2.2.1] - 2026-06-20
 
 ### Fixed
-- **Support tool response images**: Extracted any image content (`image_url` or `image` formats) from OpenAI tool response content and mapped them to Antigravity `inlineData` parts.
-- **Ordered tool results**: Guaranteed all tool results remain clustered at the top of the parts array, complying with Claude's strict layout requirements.
-- **Dangling tool call filtering**: Filtered out any `tool_calls` that do not have a matching `tool_result` in the subsequent message to prevent `400 Bad Request`.
-- **Inline JSON-Schema union types**: Collapsed Draft-2020-12 inline union type arrays (e.g. `type: ["number", "null"]`) to the first non-null type and lifted nullability into the proto-supported `nullable` flag to fix 400 errors.
+- **Support tool response images**: Extracted any image content (`image_url` or `image` formats) from OpenAI tool response content and mapped them to Antigravity `inlineData` parts. (PR [#9](https://github.com/tuxevil/pi-antigravity-rotator/pull/9) by [@josenicomaia](https://github.com/josenicomaia))
+- **Ordered tool results**: Guaranteed all tool results remain clustered at the top of the parts array, complying with Claude's strict layout requirements. (PR [#9](https://github.com/tuxevil/pi-antigravity-rotator/pull/9) by [@josenicomaia](https://github.com/josenicomaia))
+- **Dangling tool call filtering**: Filtered out any `tool_calls` that do not have a matching `tool_result` in the subsequent message to prevent `400 Bad Request`. (PR [#9](https://github.com/tuxevil/pi-antigravity-rotator/pull/9) by [@josenicomaia](https://github.com/josenicomaia))
+- **Inline JSON-Schema union types**: Collapsed Draft-2020-12 inline union type arrays (e.g. `type: ["number", "null"]`) to the first non-null type and lifted nullability into the proto-supported `nullable` flag to fix 400 errors. (PR [#10](https://github.com/tuxevil/pi-antigravity-rotator/pull/10) by [@yashyadav711](https://github.com/yashyadav711))
 
 ## [2.2.0] - 2026-06-16
 

package/README.md

@@ -153,7 +153,7 @@ If login fails at project discovery:
 
 After starting the proxy, open `http://localhost:51200/dashboard` or `http://<your-server-ip>:51200/dashboard` from any machine on the same network (the proxy binds to `0.0.0.0`).
 
-If `PI_ROTATOR_ADMIN_TOKEN` is unset, dashboard and `/api/*` access remains open for backwards compatibility. v2.0 now surfaces loud warnings about that state in startup logs, `/api/status`, and the dashboard itself.
+If `PI_ROTATOR_ADMIN_TOKEN` is unset, the proxy automatically generates a cryptographically secure token on first run and saves it to a `.admin-token` file in the root directory. This token will be printed to the console on first startup. You must append `?token=<your-token>` to the dashboard URL to access it, or set `PI_ROTATOR_ADMIN_TOKEN` in your environment to override it.
 
 The dashboard shows:
 
@@ -164,6 +164,7 @@ The dashboard shows:
 - **Quota Forecast** -- Predictive modeling showing when each model's quota will run out based on the current requests/hour burn rate.
 - **Searchable Request Log** -- Live feed of the last 200 requests with exact timestamps, models, masked accounts, status codes, and latency.
 - **Account Cards** -- Sorted by total quota. Shows status (`active`, `ready`, `cooldown`, `flagged`, `disabled`), quota bars with timers, and precise error messages.
+- **Web-based Account Management** -- Add, remove, and manage account credentials and tier configurations directly from the UI without touching JSON files.
 - **Operator Panels** -- "Attention Needed" summaries for quarantined accounts, unroutable models, token-bucket pressure, and a real-time event feed of rotator actions.
 - **Routing Inspector** -- On-demand modal showing the active routing policy, candidate scores, local token bucket state, and rejection reasons per model.
 
@@ -282,12 +283,19 @@ The dashboard is intended to replace day-to-day `journalctl` digging for normal
 Config files (`accounts.json`, `state.json`) are stored in `~/.pi-antigravity-rotator/` by default. Override with:
 
 ```bash
+
 # Environment variables
 export PI_ROTATOR_DIR=/path/to/config
 export PI_ROTATOR_QUOTA_USER_AGENT="antigravity/1.107.0 darwin/arm64"
-# Optional: require this token for dashboard/API access. If unset, legacy open access is preserved.
+
+# Postgres Storage Support (v2.3.0+)
+# Optional: Set this to use a Postgres database instead of local JSON files for persistence.
+export PI_ROTATOR_DATABASE_URL="postgres://user:pass@localhost:5432/rotatordb"
+export DATABASE_URL="postgres://user:pass@localhost:5432/rotatordb" # Fallback
+
+# Optional: require this token for dashboard/API access. If unset, a secure token is auto-generated.
+# Note: Upgrading to v2.3.0+ will regenerate your existing auto-generated token. Check logs!
 export PI_ROTATOR_ADMIN_TOKEN="change-me"
-# Optional: bind the proxy to a safer local-only interface.
 export PI_ROTATOR_BIND_HOST="127.0.0.1"
 # Optional: max accepted proxy request body size in bytes. Default: 26214400 (25 MiB).
 export PI_ROTATOR_MAX_BODY_BYTES=26214400
@@ -410,7 +418,7 @@ Login now fails if Google does not return a project ID. No shared fallback.
 | `POST` | `/v1/chat/completions` | OpenAI-compatible non-streaming chat adapter |
 | `POST` | `/v1/messages` | Anthropic-compatible non-streaming messages adapter |
 
-If `PI_ROTATOR_ADMIN_TOKEN` is set, dashboard/API requests must include either `Authorization: Bearer <token>`, `X-Rotator-Admin-Token: <token>`, or `?token=<token>` for browser dashboard access. The native pi proxy endpoint and compatibility adapters remain unauthenticated so existing clients keep working. Put this service behind a trusted local boundary if exposing beyond localhost/LAN.
+Dashboard and internal `/api/*` requests must include either `Authorization: Bearer <token>`, `X-Rotator-Admin-Token: <token>`, or `?token=<token>` for browser dashboard access. The native pi proxy endpoint and compatibility adapters (`/v1/*`) remain unauthenticated by design, so your AI agents and existing clients will keep working without requiring a token. Put this service behind a trusted local boundary if exposing beyond localhost/LAN.
 
 ### Compatibility Adapters
 
@@ -471,7 +479,8 @@ Current adapter scope:
 
 Thanks to these amazing people who have contributed to the project:
 
-- **[@josenicomaia](https://github.com/josenicomaia)** (José Nicodemos Maia Neto) — Fixed streaming pass-through to emit correct `finish_reason` for tool calls, fixing tool execution on ZED editor. ([PR #8](https://github.com/tuxevil/pi-antigravity-rotator/pull/8))
+- **[@josenicomaia](https://github.com/josenicomaia)** (José Nicodemos Maia Neto) — Modularized the compatibility layer architecture, added multimodal tool response support, and fixed streaming pass-through for tool executions. ([PR #8](https://github.com/tuxevil/pi-antigravity-rotator/pull/8), [PR #9](https://github.com/tuxevil/pi-antigravity-rotator/pull/9), [PR #11](https://github.com/tuxevil/pi-antigravity-rotator/pull/11))
+- **[@yashyadav711](https://github.com/yashyadav711)** (Yash) — Fixed Draft-2020-12 inline JSON-Schema union type mapping for Gemini tools support. ([PR #10](https://github.com/tuxevil/pi-antigravity-rotator/pull/10))
 - **[@javargasm](https://github.com/javargasm)** (Jeisson Alexander Vargas Marroquin) — Anthropic tool-use compatibility layer (`tool_use`/`tool_result` content block conversion), JSON schema round-trip fixes, and compat test suite expansion. ([PR #3](https://github.com/tuxevil/pi-antigravity-rotator/pull/3), [PR #7](https://github.com/tuxevil/pi-antigravity-rotator/pull/7))
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-antigravity-rotator",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "description": "Multi-account rotation proxy for Google Antigravity with per-model routing, real-time quota tracking, and infringement detection",
   "license": "MIT",
   "type": "module",
@@ -42,11 +42,13 @@
   },
   "author": "Sebastián Real (tuxevil)",
   "dependencies": {
+    "pg": "^8.22.0",
     "tsx": "^4.19.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.0.0",
+    "@types/pg": "^8.20.0",
     "c8": "^11.0.0",
     "eslint": "^10.5.0",
     "typescript": "^5.7.0",

package/src/account-store.ts

@@ -2,9 +2,22 @@ import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { getAccountsPath } from "./paths.js";
-import type { AccountConfig, Config } from "./types.js";
-import { backupFile, readJsonFile, writeJsonFileAtomic } from "./storage.js";
-import { formatValidationErrors, validateConfig } from "./validators.js";
+import type { AccountConfig } from "./types.js";
+import { writeJsonFileAtomic } from "./storage.js";
+import {
+  loadConfig,
+  loadOrCreateAccountsConfig,
+  saveAccountsConfig,
+} from "./config-storage.js";
+import { applyConfigDefaults, getDefaultConfig } from "./config-defaults.js";
+
+export {
+  loadConfig,
+  loadOrCreateAccountsConfig,
+  saveAccountsConfig,
+  applyConfigDefaults,
+  getDefaultConfig,
+};
 
 const ACCOUNTS_FILE = getAccountsPath();
 const PI_DIR = join(homedir(), ".pi", "agent");
@@ -13,93 +26,7 @@ const PI_AUTH_FILE = join(PI_DIR, "auth.json");
 const TOKEN_USAGE_FILE = join(join(ACCOUNTS_FILE, ".."), "token-usage.json");
 
 export function getTokenUsagePath(): string {
-	return TOKEN_USAGE_FILE;
-}
-
-export function applyConfigDefaults(config: Config): Config {
-	return {
-		proxyPort: config.proxyPort || 51200,
-		bindHost: config.bindHost || process.env.PI_ROTATOR_BIND_HOST || "0.0.0.0",
-		routingPolicy: config.routingPolicy || "timer-first",
-		requestsPerRotation: config.requestsPerRotation || 5,
-		rotateOnQuotaDrop: config.rotateOnQuotaDrop ?? 20,
-		quotaPollIntervalMs: config.quotaPollIntervalMs || 300000,
-		maxConcurrentRequestsPerAccount: config.maxConcurrentRequestsPerAccount ?? 1,
-		maxConcurrentRequestsPerProjectModel: config.maxConcurrentRequestsPerProjectModel ?? 1,
-		projectCircuitBreaker429Threshold: config.projectCircuitBreaker429Threshold ?? 3,
-		projectCircuitBreakerWindowMs: config.projectCircuitBreakerWindowMs ?? 10 * 60 * 1000,
-		projectCircuitBreakerCooldownMs: config.projectCircuitBreakerCooldownMs ?? 60 * 60 * 1000,
-		modelCircuitBreaker429Threshold: config.modelCircuitBreaker429Threshold ?? 3,
-		modelCircuitBreakerCooldownMs: config.modelCircuitBreakerCooldownMs ?? 6 * 60 * 60 * 1000,
-		dailyAccountSlowRequests: config.dailyAccountSlowRequests ?? 250,
-		dailyAccountStopRequests: config.dailyAccountStopRequests ?? 350,
-		dailyProjectSlowRequests: config.dailyProjectSlowRequests ?? 900,
-		dailyProjectStopRequests: config.dailyProjectStopRequests ?? 1200,
-		slowModeJitterMinMs: config.slowModeJitterMinMs ?? 8_000,
-		slowModeJitterMaxMs: config.slowModeJitterMaxMs ?? 25_000,
-		protectivePauseMs: config.protectivePauseMs ?? 21600000,
-		useRequestCountRotationWhenQuotaUnknownOnly: config.useRequestCountRotationWhenQuotaUnknownOnly ?? true,
-		tokenBucketEnabled: config.tokenBucketEnabled ?? false,
-		tokenBucketMaxTokens: config.tokenBucketMaxTokens ?? 50,
-		tokenBucketRefillPerMinute: config.tokenBucketRefillPerMinute ?? 6,
-		tokenBucketInitialTokens: config.tokenBucketInitialTokens ?? (config.tokenBucketMaxTokens ?? 50),
-		accounts: config.accounts.map((account) => ({
-			...account,
-			tier: account.tier || "unknown",
-		})),
-	};
-}
-
-export function getDefaultConfig(): Config {
-	return applyConfigDefaults({
-		proxyPort: 51200,
-		accounts: [],
-		requestsPerRotation: 5,
-		rotateOnQuotaDrop: 20,
-		quotaPollIntervalMs: 300000,
-		maxConcurrentRequestsPerAccount: 1,
-		maxConcurrentRequestsPerProjectModel: 1,
-		projectCircuitBreaker429Threshold: 3,
-		projectCircuitBreakerWindowMs: 10 * 60 * 1000,
-		projectCircuitBreakerCooldownMs: 60 * 60 * 1000,
-		modelCircuitBreaker429Threshold: 3,
-		modelCircuitBreakerCooldownMs: 6 * 60 * 60 * 1000,
-		dailyAccountSlowRequests: 250,
-		dailyAccountStopRequests: 350,
-		dailyProjectSlowRequests: 900,
-		dailyProjectStopRequests: 1200,
-		slowModeJitterMinMs: 8_000,
-		slowModeJitterMaxMs: 25_000,
-		protectivePauseMs: 21600000,
-		useRequestCountRotationWhenQuotaUnknownOnly: true,
-		tokenBucketEnabled: false,
-		tokenBucketMaxTokens: 50,
-		tokenBucketRefillPerMinute: 6,
-		tokenBucketInitialTokens: 50,
-	});
-}
-
-export function loadConfigFromDisk(): Config {
-	const parsed = readJsonFile<unknown>(ACCOUNTS_FILE);
-	if (parsed === null) return getDefaultConfig();
-	const validation = validateConfig(parsed);
-	if (!validation.ok || !validation.value) {
-		throw new Error(formatValidationErrors(validation.errors));
-	}
-	return applyConfigDefaults(validation.value);
-}
-
-export function loadOrCreateAccountsConfig(): Config {
-	try {
-		return loadConfigFromDisk();
-	} catch {
-		return getDefaultConfig();
-	}
-}
-
-export function saveAccountsConfig(config: Config): void {
-	backupFile(ACCOUNTS_FILE, "accounts");
-	writeJsonFileAtomic(ACCOUNTS_FILE, applyConfigDefaults(config));
+  return TOKEN_USAGE_FILE;
 }
 
 // Reasonable upper bounds on per-account fields. These are defensive
@@ -112,93 +39,107 @@ export const MAX_PROJECT_ID_LENGTH = 100;
 export const MAX_REFRESH_TOKEN_LENGTH = 4096;
 
 function validateAccountConfigLengths(entry: AccountConfig): void {
-	const checks: Array<[string, number]> = [
-		["email", MAX_EMAIL_LENGTH],
-		["label", MAX_LABEL_LENGTH],
-		["projectId", MAX_PROJECT_ID_LENGTH],
-		["refreshToken", MAX_REFRESH_TOKEN_LENGTH],
-	];
-	for (const [field, max] of checks) {
-		const value = entry[field as keyof AccountConfig];
-		if (typeof value === "string" && value.length > max) {
-			throw new Error(
-				`Account ${field} exceeds maximum length ${max} (got ${value.length}). ` +
-				`This usually indicates a malformed input — refusing to write to accounts.json.`,
-			);
-		}
-	}
+  const checks: Array<[string, number]> = [
+    ["email", MAX_EMAIL_LENGTH],
+    ["label", MAX_LABEL_LENGTH],
+    ["projectId", MAX_PROJECT_ID_LENGTH],
+    ["refreshToken", MAX_REFRESH_TOKEN_LENGTH],
+  ];
+  for (const [field, max] of checks) {
+    const value = entry[field as keyof AccountConfig];
+    if (typeof value === "string" && value.length > max) {
+      throw new Error(
+        `Account ${field} exceeds maximum length ${max} (got ${value.length}). ` +
+          `This usually indicates a malformed input — refusing to write to accounts.json.`,
+      );
+    }
+  }
 }
 
 export { validateAccountConfigLengths };
 
 export function addAccountToConfig(entry: AccountConfig): { isNew: boolean } {
-	validateAccountConfigLengths(entry);
-	const config = loadOrCreateAccountsConfig();
-	const existing = config.accounts.findIndex((a) => a.email === entry.email);
-
-	if (existing >= 0) {
-		config.accounts[existing] = { ...config.accounts[existing], ...entry };
-		saveAccountsConfig(config);
-		return { isNew: false };
-	}
-
-	config.accounts.push(entry);
-	saveAccountsConfig(config);
-	return { isNew: true };
+  validateAccountConfigLengths(entry);
+  const config = loadOrCreateAccountsConfig();
+  const existing = config.accounts.findIndex((a) => a.email === entry.email);
+
+  if (existing >= 0) {
+    config.accounts[existing] = { ...config.accounts[existing], ...entry };
+    saveAccountsConfig(config);
+    return { isNew: false };
+  }
+
+  config.accounts.push(entry);
+  saveAccountsConfig(config);
+  return { isNew: true };
+}
+
+export function removeAccountFromConfig(email: string): boolean {
+  const config = loadOrCreateAccountsConfig();
+  const idx = config.accounts.findIndex((a) => a.email === email);
+  if (idx < 0) return false;
+  config.accounts.splice(idx, 1);
+  saveAccountsConfig(config);
+  return true;
 }
 
 export function ensurePiModelsConfig(): void {
-	mkdirSync(PI_DIR, { recursive: true });
-
-	let models: Record<string, unknown> = {};
-	if (existsSync(PI_MODELS_FILE)) {
-		try {
-			models = JSON.parse(readFileSync(PI_MODELS_FILE, "utf-8"));
-		} catch {
-			// Corrupted, will overwrite
-		}
-	}
-
-	const providers = (models.providers || {}) as Record<string, Record<string, unknown>>;
-	const antigravity = providers["google-antigravity"] || {};
-
-	if (antigravity.baseUrl === "http://localhost:51200") {
-		return;
-	}
-
-	antigravity.baseUrl = "http://localhost:51200";
-	providers["google-antigravity"] = antigravity;
-	models.providers = providers;
-
-	writeJsonFileAtomic(PI_MODELS_FILE, models);
-	console.log(`  Updated ${PI_MODELS_FILE}`);
+  mkdirSync(PI_DIR, { recursive: true });
+
+  let models: Record<string, unknown> = {};
+  if (existsSync(PI_MODELS_FILE)) {
+    try {
+      models = JSON.parse(readFileSync(PI_MODELS_FILE, "utf-8"));
+    } catch {
+      // Corrupted, will overwrite
+    }
+  }
+
+  const providers = (models.providers || {}) as Record<
+    string,
+    Record<string, unknown>
+  >;
+  const antigravity = providers["google-antigravity"] || {};
+
+  if (antigravity.baseUrl === "http://localhost:51200") {
+    return;
+  }
+
+  antigravity.baseUrl = "http://localhost:51200";
+  providers["google-antigravity"] = antigravity;
+  models.providers = providers;
+
+  writeJsonFileAtomic(PI_MODELS_FILE, models);
+  console.log(`  Updated ${PI_MODELS_FILE}`);
 }
 
 export function ensurePiAuthConfig(): void {
-	mkdirSync(PI_DIR, { recursive: true });
-
-	let auth: Record<string, unknown> = {};
-	if (existsSync(PI_AUTH_FILE)) {
-		try {
-			auth = JSON.parse(readFileSync(PI_AUTH_FILE, "utf-8"));
-		} catch {
-			// Corrupted, will overwrite
-		}
-	}
-
-	const existing = auth["google-antigravity"] as Record<string, unknown> | undefined;
-	if (existing?.type === "oauth" && existing?.refresh === "proxy-managed") {
-		return;
-	}
-
-	auth["google-antigravity"] = {
-		type: "oauth",
-		refresh: "proxy-managed",
-		access: "proxy-managed",
-		expires: 32503680000000,
-		projectId: "proxy-managed",
-	};
-
-	writeJsonFileAtomic(PI_AUTH_FILE, auth);
-	console.log(`  Updated ${PI_AUTH_FILE}`);
+  mkdirSync(PI_DIR, { recursive: true });
+
+  let auth: Record<string, unknown> = {};
+  if (existsSync(PI_AUTH_FILE)) {
+    try {
+      auth = JSON.parse(readFileSync(PI_AUTH_FILE, "utf-8"));
+    } catch {
+      // Corrupted, will overwrite
+    }
+  }
+
+  const existing = auth["google-antigravity"] as
+    | Record<string, unknown>
+    | undefined;
+  if (existing?.type === "oauth" && existing?.refresh === "proxy-managed") {
+    return;
+  }
+
+  auth["google-antigravity"] = {
+    type: "oauth",
+    refresh: "proxy-managed",
+    access: "proxy-managed",
+    expires: 32503680000000,
+    projectId: "proxy-managed",
+  };
+
+  writeJsonFileAtomic(PI_AUTH_FILE, auth);
+  console.log(`  Updated ${PI_AUTH_FILE}`);
 }

package/src/admin-auth.ts

@@ -1,15 +1,12 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { randomBytes } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
-import { join } from "node:path";
+import { getCachedAdminToken, setCachedAdminToken } from "./db-store.js";
 
 interface AdminAuthRequest {
-	url?: string;
-	headers: IncomingMessage["headers"];
+  url?: string;
+  headers: IncomingMessage["headers"];
 }
 
-const ADMIN_TOKEN_FILENAME = ".admin-token";
-
 let persistedToken: string | null = null;
 
 /**
@@ -18,13 +15,15 @@ let persistedToken: string | null = null;
  * getConfiguredAdminToken() will return this token if no env var is set.
  */
 export function setPersistedAdminToken(token: string | null): void {
-	persistedToken = token && token.length > 0 ? token : null;
+  persistedToken = token && token.length > 0 ? token : null;
 }
 
-export function getConfiguredAdminToken(env: NodeJS.ProcessEnv = process.env): string | null {
-	const token = env.PI_ROTATOR_ADMIN_TOKEN?.trim();
-	if (token) return token;
-	return persistedToken;
+export function getConfiguredAdminToken(
+  env: NodeJS.ProcessEnv = process.env,
+): string | null {
+  const token = env.PI_ROTATOR_ADMIN_TOKEN?.trim();
+  if (token) return token;
+  return persistedToken;
 }
 
 /**
@@ -32,100 +31,92 @@ export function getConfiguredAdminToken(env: NodeJS.ProcessEnv = process.env): s
  * 64 hex characters = 256 bits of entropy.
  */
 export function generateAdminToken(): string {
-	return randomBytes(32).toString("hex");
+  return randomBytes(32).toString("hex");
 }
 
-export function readPersistedAdminToken(configDir: string): string | null {
-	const tokenPath = join(configDir, ADMIN_TOKEN_FILENAME);
-	if (!existsSync(tokenPath)) return null;
-	try {
-		const raw = readFileSync(tokenPath, "utf-8").trim();
-		return raw ? raw : null;
-	} catch {
-		return null;
-	}
+export function readPersistedAdminToken(): string | null {
+  return getCachedAdminToken();
 }
 
-export function writePersistedAdminToken(configDir: string, token: string): void {
-	const tokenPath = join(configDir, ADMIN_TOKEN_FILENAME);
-	writeFileSync(tokenPath, token, { mode: 0o600, encoding: "utf-8" });
-	try {
-		chmodSync(tokenPath, 0o600);
-	} catch {
-		// Best effort: some filesystems (e.g. Windows) don't support POSIX perms.
-	}
+export function writePersistedAdminToken(token: string): void {
+  setCachedAdminToken(token);
 }
 
 export interface ResolvedAdminToken {
-	token: string;
-	source: "env" | "file" | "generated";
-	generated: boolean;
+  token: string;
+  source: "env" | "repository" | "generated";
+  generated: boolean;
 }
 
 /**
  * Resolve the effective admin token, generating and persisting one if needed.
- * Priority: PI_ROTATOR_ADMIN_TOKEN env var > .admin-token file > generate new.
+ * Priority: PI_ROTATOR_ADMIN_TOKEN env var > repository > generate new.
  *
- * When a token is generated, it is persisted to .admin-token with 0600 perms
- * and returned. The caller is responsible for printing it to the operator.
+ * When a token is generated, it is persisted to the repository and returned.
+ * The caller is responsible for printing it to the operator.
  */
 export function ensureAdminToken(
-	configDir: string,
-	env: NodeJS.ProcessEnv = process.env,
+  env: NodeJS.ProcessEnv = process.env,
 ): ResolvedAdminToken {
-	const envToken = env.PI_ROTATOR_ADMIN_TOKEN?.trim();
-	if (envToken) {
-		return { token: envToken, source: "env", generated: false };
-	}
-
-	const fileToken = readPersistedAdminToken(configDir);
-	if (fileToken) {
-		return { token: fileToken, source: "file", generated: false };
-	}
-
-	const newToken = generateAdminToken();
-	try {
-		writePersistedAdminToken(configDir, newToken);
-	} catch {
-		// If we cannot write the file (read-only fs, perms), still return the
-		// token for this session. The next restart will simply generate again.
-	}
-	return { token: newToken, source: "generated", generated: true };
+  const envToken = env.PI_ROTATOR_ADMIN_TOKEN?.trim();
+  if (envToken) {
+    return { token: envToken, source: "env", generated: false };
+  }
+
+  const existing = readPersistedAdminToken();
+  if (existing) {
+    return { token: existing, source: "repository", generated: false };
+  }
+
+  const newToken = generateAdminToken();
+  try {
+    writePersistedAdminToken(newToken);
+  } catch {
+    // If we cannot persist (e.g. DB down, read-only fs), still return the
+    // token for this session. The next restart will simply generate again.
+  }
+  return { token: newToken, source: "generated", generated: true };
 }
 
 export function getRequestAdminToken(req: AdminAuthRequest): string | null {
-	const headerToken = req.headers["x-rotator-admin-token"];
-	if (typeof headerToken === "string" && headerToken) return headerToken;
-	if (Array.isArray(headerToken) && headerToken[0]) return headerToken[0];
-
-	const authorization = req.headers.authorization;
-	if (typeof authorization === "string" && authorization.toLowerCase().startsWith("bearer ")) {
-		return authorization.slice("bearer ".length).trim();
-	}
-
-	try {
-		const requestUrl = new URL(req.url || "/", "http://localhost");
-		return requestUrl.searchParams.get("token");
-	} catch {
-		return null;
-	}
+  const headerToken = req.headers["x-rotator-admin-token"];
+  if (typeof headerToken === "string" && headerToken) return headerToken;
+  if (Array.isArray(headerToken) && headerToken[0]) return headerToken[0];
+
+  const authorization = req.headers.authorization;
+  if (
+    typeof authorization === "string" &&
+    authorization.toLowerCase().startsWith("bearer ")
+  ) {
+    return authorization.slice("bearer ".length).trim();
+  }
+
+  try {
+    const requestUrl = new URL(req.url || "/", "http://localhost");
+    return requestUrl.searchParams.get("token");
+  } catch {
+    return null;
+  }
 }
 
 export function isAdminAuthorized(
-	req: AdminAuthRequest,
-	expectedToken: string | null = getConfiguredAdminToken(),
+  req: AdminAuthRequest,
+  expectedToken: string | null = getConfiguredAdminToken(),
 ): boolean {
-	if (!expectedToken) return true;
-	return getRequestAdminToken(req) === expectedToken;
+  if (!expectedToken) return true;
+  return getRequestAdminToken(req) === expectedToken;
 }
 
-export function requireAdmin(req: IncomingMessage, res: ServerResponse): boolean {
-	if (isAdminAuthorized(req)) return true;
-	res.writeHead(401, {
-		"Content-Type": "application/json",
-		"Cache-Control": "no-store",
-		"WWW-Authenticate": "Bearer",
-	});
-	res.end(JSON.stringify({ error: "Unauthorized" }));
-	return false;
+export function requireAdmin(
+  req: IncomingMessage,
+  res: ServerResponse,
+): boolean {
+  if (isAdminAuthorized(req)) return true;
+  res.writeHead(401, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store",
+    "WWW-Authenticate": "Bearer",
+  });
+  res.end(JSON.stringify({ error: "Unauthorized" }));
+  return false;
 }