feat: simplify local administrator login

.env.docker.example

@@ -1,14 +1,16 @@
 COMPOSE_PROJECT_NAME=opencli-admin
 DOCKER_REGISTRY=ghcr.io/
 DOCKER_IMAGE_NAMESPACE=2233admin
-IMAGE_TAG=0.4.0
+IMAGE_TAG=0.4.1
 
 FRONTEND_PORT=3010
 API_PORT=8031
 PUBLIC_URL=http://localhost:8031
 
-# Required. The installers generate all four values automatically.
+# API transport token is required for non-localhost binds and Fleet/Agent/API
+# integrations. The installer generates it automatically.
 API_AUTH_TOKEN=
+# Optional legacy emergency/OIDC bootstrap token; local login does not use it.
 BOOTSTRAP_ADMIN_TOKEN=
 SECRET_KEY=
 CREDENTIAL_ENCRYPTION_KEY=

.nvmrc

@@ -1 +1 @@
-26.3.1
+26.5.1

CONTEXT.md

@@ -4,7 +4,7 @@ OpenCLI is an Agent-driven research and intelligence pipeline for continuously c
 
 ## Public Release Baseline
 
-The public v0.4.0 release has one end-to-end product path:
+The public v0.4.1 release has one end-to-end product path:
 
 <strong>Project → Workflow → Run → Records / Evidence → Delivery</strong>
 

Dockerfile

@@ -23,12 +23,12 @@ WORKDIR /app
 # Runtime system deps (psycopg2 needs libpq, opencli needs Node.js 22+)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     libpq5 curl ca-certificates git \
-    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && curl -fsSL https://deb.nodesource.com/setup_26.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && rm -rf /var/lib/apt/lists/*
 
 # Install opencli globally — available as 'opencli' on PATH
-ARG OPENCLI_VERSION=1.8.5
+ARG OPENCLI_VERSION=1.8.6
 ARG IMAGE_TAG=latest
 COPY scripts/patch-opencli.js /tmp/patch-opencli.js
 RUN npm install -g @jackwener/opencli@${OPENCLI_VERSION} \

README.md

@@ -26,7 +26,7 @@ opencli-Razormind 是一个开源、自托管的研究与情报管线。它把
 
 图中的网站变化监控项目已发布不可变 `v1`，并完成了基于该发布版本的真实运行与 Trace 记录。
 
-当前公开版本 **v0.4.0** 已打通：
+当前公开版本 **v0.4.1** 已打通：
 
 **登录采集账号 → 创建研究项目 → 编排工作流 → 执行与追踪 → 查看记录和证据 → 定时运行 / 对外交付**
 
@@ -37,13 +37,13 @@ opencli-Razormind 是一个开源、自托管的研究与情报管线。它把
 Linux / macOS：
 
 ~~~bash
-curl -fsSL https://raw.githubusercontent.com/2233admin/opencli-Razormind/v0.4.0/scripts/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/2233admin/opencli-Razormind/v0.4.1/scripts/install.sh | sh
 ~~~
 
 Windows PowerShell：
 
 ~~~powershell
-Invoke-WebRequest https://raw.githubusercontent.com/2233admin/opencli-Razormind/v0.4.0/scripts/install.ps1 -OutFile install.ps1
+Invoke-WebRequest https://raw.githubusercontent.com/2233admin/opencli-Razormind/v0.4.1/scripts/install.ps1 -OutFile install.ps1
 .\install.ps1
 ~~~
 
@@ -55,12 +55,13 @@ Invoke-WebRequest https://raw.githubusercontent.com/2233admin/opencli-Razormind/
 | API 文档 | http://localhost:8031/docs | REST API 与集成调试 |
 | 内置浏览器 | http://localhost:6080 | 扫码或登录需要账号的平台 |
 
-安装完成后，终端会打印：
+安装完成后可以直接使用本地管理员账号登录：
 
-- `BOOTSTRAP_ADMIN_TOKEN`：首次进入管理界面使用；
-- `API_AUTH_TOKEN`：Fleet、Agent、API 和 MCP 访问使用。
+- 用户名：`admin`
+- 密码：`admin`
+- 登录后可在「账户设置」修改密码
 
-两者同时保存在安装目录的 `.env`。不要公开 noVNC、令牌或浏览器调试端口；远程部署建议使用 HTTPS、反向代理或 SSH 隧道。
+`API_AUTH_TOKEN` 仅由 Fleet、Agent、API 和 MCP 传输使用，自动保存在安装目录的 `.env`，不需要填入管理界面。不要公开 API 令牌、noVNC 或浏览器调试端口；远程部署建议使用 HTTPS、反向代理或 SSH 隧道。
 
 ## 正常的研究流程
 
@@ -167,7 +168,7 @@ flowchart LR
 
 ## 从源码开发
 
-前置要求：Python 3.13+、Node.js 26.3.1（见 `.nvmrc`）、uv、pnpm。
+前置要求：Python 3.13+、Node.js 26.5.1（见 `.nvmrc`）、uv、pnpm。
 
 ~~~bash
 git clone https://github.com/2233admin/opencli-Razormind.git
@@ -204,13 +205,13 @@ docker compose -f docker-compose.yml -f docker-compose.build.yml up --build -d
 
 ## 发布镜像
 
-v0.4.0 同时发布 `linux/amd64` 和 `linux/arm64`：
+v0.4.1 同时发布 `linux/amd64` 和 `linux/arm64`：
 
-- `ghcr.io/2233admin/opencli-admin-api:0.4.0`
-- `ghcr.io/2233admin/opencli-admin-frontend:0.4.0`
-- `ghcr.io/2233admin/opencli-admin-chrome:0.4.0`
-- `ghcr.io/2233admin/opencli-admin-agent:0.4.0`
-- `ghcr.io/2233admin/opencli-admin-agent:0.4.0-chrome`
+- `ghcr.io/2233admin/opencli-admin-api:0.4.1`
+- `ghcr.io/2233admin/opencli-admin-frontend:0.4.1`
+- `ghcr.io/2233admin/opencli-admin-chrome:0.4.1`
+- `ghcr.io/2233admin/opencli-admin-agent:0.4.1`
+- `ghcr.io/2233admin/opencli-admin-agent:0.4.1-chrome`
 
 查看 [最新 Release](https://github.com/2233admin/opencli-Razormind/releases/latest)。
 

agent/Dockerfile

@@ -4,7 +4,7 @@ FROM ${REGISTRY}python:3.13-slim
 # Base system deps (always installed)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl ca-certificates git procps \
-    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && curl -fsSL https://deb.nodesource.com/setup_26.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && rm -rf /var/lib/apt/lists/*
 
@@ -21,9 +21,12 @@ RUN if [ "$INSTALL_CHROME" = "true" ]; then \
 fi
 
 # Install opencli globally — available as 'opencli' on PATH
-ARG OPENCLI_VERSION=1.8.5
+ARG OPENCLI_VERSION=1.8.6
+ARG PI_VERSION=0.83.0
 COPY scripts/patch-opencli.js /tmp/patch-opencli.js
-RUN npm install -g @jackwener/opencli@${OPENCLI_VERSION} \
+RUN npm install -g \
+        @jackwener/opencli@${OPENCLI_VERSION} \
+        @earendil-works/pi-coding-agent@${PI_VERSION} \
     && node /tmp/patch-opencli.js \
     && rm /tmp/patch-opencli.js \
     && rm -rf /root/.npm

backend/acquisition/registry.py

@@ -4,7 +4,7 @@
 
 OHMYOPENCLI_COMMIT = "73cc60c83586ef2c95469b3b70d6cfc80fa5bc53"
 OFFICIAL_SITE_CAPABILITY_COMMIT = "73cc60c83586ef2c95469b3b70d6cfc80fa5bc53"
-OPENCLI_VERSION = "1.8.5"
+OPENCLI_VERSION = "1.8.6"
 
 
 @dataclass(frozen=True)

backend/agent_server.py

@@ -546,7 +546,7 @@ async def lifespan(app: FastAPI):
             pass
 
 
-app = FastAPI(title="OpenCLI Agent Server", version="0.4.0", lifespan=lifespan)
+app = FastAPI(title="OpenCLI Agent Server", version="0.4.1", lifespan=lifespan)
 
 
 class CollectRequest(BaseModel):

backend/api/v1/identity.py

@@ -1,15 +1,72 @@
-"""Request identity endpoint."""
+"""Local administrator and request identity endpoints."""
 
 from typing import Annotated
 
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel, Field
 
+from backend.config import get_settings
 from backend.schemas.common import ApiResponse
 from backend.security.identity import RequestIdentity, get_request_identity
+from backend.security.local_auth import (
+    hash_password,
+    issue_local_token,
+    load_password_hash,
+    persist_password_hash,
+    verify_password,
+)
+
+
+class LocalLoginRequest(BaseModel):
+    username: str = Field(min_length=1, max_length=255)
+    password: str = Field(min_length=1, max_length=255)
+
+
+class ChangePasswordRequest(BaseModel):
+    current_password: str = Field(min_length=1, max_length=255)
+    new_password: str = Field(min_length=6, max_length=255)
+
 
 router = APIRouter(prefix="/auth", tags=["auth"])
 
 
+@router.post("/login", response_model=ApiResponse[dict])
+async def local_login(body: LocalLoginRequest) -> ApiResponse:
+    settings = get_settings()
+    password_hash = load_password_hash(
+        settings.local_admin_password_hash_file, settings.local_admin_password_hash
+    )
+    if body.username != settings.local_admin_username or not verify_password(
+        body.password, password_hash
+    ):
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "用户名或密码错误")
+    return ApiResponse.ok(
+        {
+            "access_token": issue_local_token(settings.local_admin_username, settings.secret_key),
+            "token_type": "bearer",
+            "using_default_password": verify_password("admin", password_hash),
+        }
+    )
+
+
+@router.post("/password", response_model=ApiResponse[dict])
+async def change_local_password(
+    body: ChangePasswordRequest,
+    identity: Annotated[RequestIdentity, Depends(get_request_identity)],
+) -> ApiResponse:
+    if identity.auth_method != "local":
+        raise HTTPException(status.HTTP_403_FORBIDDEN, "仅本地管理员可以修改本地密码")
+    settings = get_settings()
+    password_hash = load_password_hash(
+        settings.local_admin_password_hash_file, settings.local_admin_password_hash
+    )
+    if not verify_password(body.current_password, password_hash):
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, "当前密码错误")
+    persist_password_hash(hash_password(body.new_password))
+    get_settings.cache_clear()
+    return ApiResponse.ok({"message": "密码已更新"})
+
+
 @router.get("/me", response_model=ApiResponse[dict])
 async def read_identity(
     identity: Annotated[RequestIdentity, Depends(get_request_identity)],

backend/api/v1/nodes.py

@@ -381,7 +381,7 @@ async def delete_node(node_id: str, db: AsyncSession = Depends(get_db)) -> ApiRe
 
 @router.get("/install/patch-opencli.js", response_class=PlainTextResponse)
 async def get_opencli_runtime_patch() -> PlainTextResponse:
-    """Serve the pinned OpenCLI 1.8.5 managed-CDP routing patch."""
+    """Serve the pinned OpenCLI 1.8.6 managed-CDP routing patch."""
     candidates = [
         Path(__file__).parent.parent.parent.parent / "scripts" / "patch-opencli.js",
         Path("/app/scripts/patch-opencli.js"),

backend/api/v1/system.py

@@ -1,16 +1,20 @@
-"""System configuration endpoint."""
+"""System-level configuration and deployment status endpoints."""
+
+from __future__ import annotations
 
 import os
 import re
+from typing import Literal
 
-from fastapi import APIRouter, HTTPException
-from pydantic import BaseModel
+from fastapi import APIRouter
+from pydantic import BaseModel, Field
 
 from backend.config import get_settings
 from backend.schemas.common import ApiResponse
 
 router = APIRouter(prefix="/system", tags=["system"])
 
+
 def _resolve_env_path() -> str:
     if explicit := os.environ.get("ENV_FILE_PATH"):
         return explicit
@@ -20,15 +24,14 @@ def _resolve_env_path() -> str:
     ]:
         if os.path.exists(candidate):
             return candidate
-    # Fallback: project root .env (will be created if missing)
     return os.path.join(os.path.dirname(__file__), "..", "..", "..", ".env")
 
 
 def _update_env_file(key: str, value: str) -> None:
     path = _resolve_env_path()
     try:
-        with open(path) as f:
-            content = f.read()
+        with open(path, encoding="utf-8") as env_file:
+            content = env_file.read()
     except FileNotFoundError:
         content = ""
     new_line = f"{key}={value}"
@@ -37,44 +40,72 @@ def _update_env_file(key: str, value: str) -> None:
         content = re.sub(pattern, new_line, content, flags=re.MULTILINE)
     else:
         content = content.rstrip("\n") + f"\n{new_line}\n"
-    with open(path, "w") as f:
-        f.write(content)
+    with open(path, "w", encoding="utf-8") as env_file:
+        env_file.write(content)
 
 
 class ConfigPatch(BaseModel):
-    collection_mode: str | None = None
+    collection_mode: Literal["local", "agent"] | None = None
+    collection_orchestrator: Literal["admin", "iii"] | None = None
+    local_max_concurrent_pipelines: int | None = Field(default=None, ge=1, le=64)
+    opencli_timeout: int | None = Field(default=None, ge=1, le=3600)
+    default_timezone: str | None = Field(default=None, min_length=1, max_length=64)
+    public_url: str | None = Field(default=None, max_length=2048)
+    fleet_network_provider: Literal["lan", "netbird", "wireguard", "ssh", "custom"] | None = None
+    netbird_mode: Literal["off", "host", "docker"] | None = None
+    opencli_cdp_endpoint: str | None = Field(default=None, min_length=1, max_length=2048)
+    agent_pool_endpoints: str | None = Field(default=None, max_length=8192)
+    llm_request_timeout_seconds: int | None = Field(default=None, ge=1, le=3600)
+    llm_max_concurrency: int | None = Field(default=None, ge=1, le=64)
+    control_mode: Literal["advisory", "automatic"] | None = None
+    control_kill_switch: bool | None = None
+
+
+def _system_payload() -> dict:
+    settings = get_settings()
+    return {
+        "app_name": settings.app_name,
+        "app_env": settings.app_env,
+        "debug": settings.debug,
+        "collection_mode": settings.collection_mode,
+        "collection_orchestrator": settings.collection_orchestrator,
+        "task_executor": settings.task_executor,
+        "local_max_concurrent_pipelines": settings.local_max_concurrent_pipelines,
+        "opencli_timeout": settings.opencli_timeout,
+        "default_timezone": settings.default_timezone,
+        "public_url": settings.public_url,
+        "fleet_network_provider": settings.fleet_network_provider,
+        "netbird_mode": settings.netbird_mode,
+        "opencli_cdp_endpoint": settings.opencli_cdp_endpoint,
+        "agent_pool_endpoints": settings.cdp_endpoints,
+        "llm_request_timeout_seconds": settings.llm_request_timeout_seconds,
+        "llm_max_concurrency": settings.llm_max_concurrency,
+        "control_mode": settings.control_mode,
+        "control_kill_switch": settings.control_kill_switch,
+        "image_tag": settings.image_tag,
+        "database_kind": "sqlite" if settings.is_sqlite else "postgresql",
+        "api_auth_configured": bool(settings.api_auth_token),
+        "oidc_configured": bool(os.getenv("OIDC_ISSUER") and os.getenv("OIDC_AUDIENCE")),
+        "smtp_configured": bool(settings.smtp_host and settings.smtp_from),
+        "credential_encryption_configured": bool(settings.credential_encryption_key),
+    }
 
 
 @router.get("/config", response_model=ApiResponse[dict])
 async def get_config() -> ApiResponse:
-    s = get_settings()
-    return ApiResponse.ok(
-        {
-            "collection_mode": s.collection_mode,
-            "task_executor": s.task_executor,
-            "image_tag": s.image_tag,
-        }
-    )
+    return ApiResponse.ok(_system_payload())
 
 
 @router.patch("/config", response_model=ApiResponse[dict])
 async def update_config(body: ConfigPatch) -> ApiResponse:
-    if body.collection_mode is not None:
-        if body.collection_mode not in ("local", "agent"):
-            raise HTTPException(
-                status_code=400, detail="collection_mode must be 'local' or 'agent'"
-            )
-        _update_env_file("COLLECTION_MODE", body.collection_mode)
-        # Also update the process env var so pydantic-settings picks up the new value
-        # (env vars take priority over .env file in pydantic-settings v2)
-        os.environ["COLLECTION_MODE"] = body.collection_mode
-        get_settings.cache_clear()
-
-    s = get_settings()
-    return ApiResponse.ok(
-        {
-            "collection_mode": s.collection_mode,
-            "task_executor": s.task_executor,
-            "image_tag": s.image_tag,
-        }
-    )
+    updates = body.model_dump(exclude_none=True)
+    if not updates:
+        return ApiResponse.ok(_system_payload())
+
+    for key, value in updates.items():
+        env_key = key.upper()
+        env_value = str(value).lower() if isinstance(value, bool) else str(value)
+        _update_env_file(env_key, env_value)
+        os.environ[env_key] = env_value
+    get_settings.cache_clear()
+    return ApiResponse.ok(_system_payload())