Add first-run local administrator onboarding

.github/workflows/ci.yml

@@ -144,13 +144,14 @@ jobs:
         with:
           python-version-file: ".python-version"
 
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install -e .[dev]
+        run: uv sync --extra dev
 
       - name: Backend syntax check
-        run: python -m compileall backend
+        run: uv run python -m compileall backend
 
       # Coverage visibility, not a gate: pyproject.toml bakes in
       # `--cov-fail-under=80` via [tool.pytest.ini_options].addopts, but the
@@ -167,7 +168,7 @@ jobs:
       # The upstream oracle stays opt-in (DATAFLOW_RUN_UPSTREAM_ORACLE=1) and
       # self-skips in this job.
       - name: Backend tests (with coverage report)
-        run: python -m pytest tests/unit tests/compat tests/integration -m "not live" --cov=backend --cov-report=term-missing --cov-fail-under=0
+        run: uv run pytest tests/unit tests/compat tests/integration -m "not live" --cov=backend --cov-report=term-missing --cov-fail-under=0
 
   frontend-workflow-checks:
     runs-on: ubuntu-latest
@@ -237,28 +238,29 @@ jobs:
         with:
           python-version-file: ".python-version"
 
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install -e .[dev]
+        run: uv sync --extra dev
 
       - name: Wait for Postgres
-        run: python -c "import time; time.sleep(2)"
+        run: uv run python -c "import time; time.sleep(2)"
 
       - name: alembic upgrade head
-        run: alembic upgrade head
+        run: uv run alembic upgrade head
 
       # Catches broken downgrade() bodies / non-reversible migrations before
       # merge: a chain that only ever gets tested via upgrade() can silently
       # rot (dropped columns with no re-add, wrong op order, etc.).
       - name: alembic downgrade/upgrade smoke test
         run: |
-          alembic downgrade -1
-          alembic upgrade head
+          uv run alembic downgrade -1
+          uv run alembic upgrade head
 
       - name: Native intelligence and event spine PostgreSQL conformance
         run: >-
-          pytest tests/integration/test_intelligence_session_store.py
+          uv run pytest tests/integration/test_intelligence_session_store.py
           tests/integration/test_intelligence_session_migration.py
           tests/unit/test_workflow_run_events.py
           tests/integration/test_workflow_event_spine_migrations.py
@@ -274,7 +276,7 @@ jobs:
       # is caught. --no-cov: this is a targeted single-test step, not a coverage
       # run (pyproject's addopts would otherwise fail it under the 80% gate).
       - name: cursor FOR UPDATE locking (Postgres)
-        run: python -m pytest tests/unit/pipeline/test_db_cursor_store.py -k postgres --no-cov -p no:cacheprovider
+        run: uv run pytest tests/unit/pipeline/test_db_cursor_store.py -k postgres --no-cov -p no:cacheprovider
 
   cargo:
     runs-on: ubuntu-latest

.nvmrc

@@ -1 +1 @@
-26.3.1
+24

DESIGN.md

@@ -1,3 +1,7 @@
+---
+name: OpenCLI Admin design system
+---
+
 # Design
 
 ## Source of truth
@@ -400,3 +404,36 @@
 - [ ] Workflow UX / `manifest.presentation` 的 experience descriptor 首版字段名和版本如何定义，使内建专用编辑器可声明但不把任意插件前端带入平台？
 - [ ] Workflow UX / 跨工作流复制首版是否仅支持同一 OpenCLI 实例，还是同时定义跨实例剪贴板格式与兼容性报告？
 - [ ] Workbench engines / Perspective + DuckDB-Wasm 与 OpenTelemetry + Langfuse 的首个生产适配器边界、数据量阈值和许可证复核何时进入 ADR？当前页面只验证 OpenCLI 内的信息架构与真实数据交互。
+
+## Product Context
+
+OpenCLI Admin 是面向自托管操作者的研究、采集和工作流控制台。界面必须优先表达真实状态、明确权限边界，并为失败提供可执行的恢复路径。
+
+## Overview
+
+产品采用桌面优先、信息密集、渐进披露的控制台体验。首次部署必须能够完成安全初始化，后续高频操作不暴露底层部署凭据。
+
+## Colors
+
+沿用 `docs/DESIGN_SYSTEM.md` 与 `frontend/app/globals.css` 的语义色；橙色用于主要操作和品牌信号，状态不能只依赖颜色表达。
+
+## Typography
+
+正文使用现有界面字体栈，运行标识、端口和令牌类内容使用等宽字体。紧凑布局不得牺牲标签、错误信息和正文可读性。
+
+## Layout
+
+控制台保持现有侧栏、内容区和检查器边界。认证界面在窄屏采用单列，在桌面保留产品背景与固定宽度表单，并保证表单顺序稳定。
+
+## Do's and Don'ts
+
+- Do：先显示用户要完成的任务，再按需揭示实现细节和恢复入口。
+- Do：为加载、空、错误、阻塞和成功状态提供明确文案与下一步。
+- Don't：把环境变量、OIDC 术语或 Fleet Token 当作新用户必须理解的产品概念。
+- Don't：使用装饰动画遮盖状态变化，或把不可用能力表现为可执行。
+
+## Source Decisions
+
+- Adopted：现有 Dark Ops Console 视觉体系、shadcn 组件、渐进披露和可恢复状态原则。
+- Rejected：要求首次用户先配置外部身份提供方或从 `.env` 中寻找日常登录凭据的流程。
+- Active change：`openspec/changes/local-admin-onboarding`。

MOTION.md

@@ -0,0 +1,41 @@
+---
+schema: design-pipeline.motion-foundation.v0.1
+name: OpenCLI operator motion language
+posture: minimal
+primitiveRegistry: design-pipeline.motion-primitives.v1
+---
+
+## Motion Thesis
+
+Motion confirms a completed operator action or a changed system state. It never delays access to credentials, recovery, or operational data.
+
+## Motion Principles
+
+- Keep authentication transitions short, interruptible, and secondary to the active form state.
+- Never move focused controls or change their order while the user is typing.
+- Prefer opacity and color feedback over layout movement for repeated operational use.
+
+## Motion Vocabulary
+
+- primitive: reveal.trim-line
+  - Use only for a non-blocking transition between login states.
+
+## Procedural Motion
+
+No procedural motion is used for authentication or recovery surfaces.
+
+## Runtime Policy
+
+CSS transitions are the default adapter for small state changes. The existing Motion React adapter may preserve the selected primitive where it is already loaded; no new animation runtime is introduced.
+
+## Reduced Motion
+
+When `prefers-reduced-motion` is enabled, state changes use immediate opacity changes and do not animate position, scale, or background effects.
+
+Fallback: every animated confirmation has an immediate static state change with the same text and focus result.
+
+## Source Decisions
+
+- Adopted: the existing login surface's short, non-blocking confirmation transitions; this keeps the new authentication states consistent with repeated console use.
+- Rejected: decorative background and position animation for password and recovery states; these make an access-critical form less legible and are not required for the operator workflow.
+- Authored for `openspec/changes/local-admin-onboarding`; no external motion implementation or visual reference is adopted.

README.md

@@ -57,10 +57,10 @@ Invoke-WebRequest https://raw.githubusercontent.com/2233admin/opencli-Razormind/
 
 安装完成后，终端会打印：
 
-- `BOOTSTRAP_ADMIN_TOKEN`：首次进入管理界面使用；
+- `BOOTSTRAP_ADMIN_TOKEN`：首次创建本地管理员及紧急恢复时使用；
 - `API_AUTH_TOKEN`：Fleet、Agent、API 和 MCP 访问使用。
 
-两者同时保存在安装目录的 `.env`。不要公开 noVNC、令牌或浏览器调试端口；远程部署建议使用 HTTPS、反向代理或 SSH 隧道。
+首次进入控制台时设置本地管理员密码并输入一次 `BOOTSTRAP_ADMIN_TOKEN`；后续直接使用管理员密码登录。令牌同时保存在安装目录的 `.env`，仅供恢复使用。不要公开 noVNC、令牌或浏览器调试端口；远程部署建议使用 HTTPS、反向代理或 SSH 隧道。
 
 ## 正常的研究流程
 
@@ -167,39 +167,44 @@ flowchart LR
 
 ## 从源码开发
 
-前置要求：Python 3.13+、Node.js 26.3.1（见 `.nvmrc`）、uv、pnpm。
+前置要求：Python 3.13+、Node.js 24（见 `.nvmrc`）、uv、pnpm。
 
 ~~~bash
 git clone https://github.com/2233admin/opencli-Razormind.git
 cd opencli-Razormind
 
-uv sync
-uv run uvicorn backend.main:app --host 127.0.0.1 --port 8031
+uv sync --extra dev
+npm run doctor
+npm run dev:backend
 ~~~
 
 另开终端：
 
 ~~~bash
-cd frontend
-pnpm install
-pnpm dev --hostname 127.0.0.1 --port 3010
+npm run dev:frontend
 ~~~
 
 常用验证：
 
 ~~~bash
-npm run lint:frontend
-npm run typecheck:frontend
-npm run build:frontend
-uv run pytest
+npm run check
+npm run test:backend
 ~~~
 
+可选能力在启动前使用同一套环境预检：`npm run doctor:agent`、
+`npm run doctor:celery`、`npm run doctor:ai`、`npm run doctor:dify`、
+`npm run doctor:kats`、`npm run doctor:image-studio`。对应 Docker 入口为
+`npm run docker:agent|docker:celery|docker:dify|docker:kats|docker:image-studio`。
+`CHROME_SUFFIX` 在默认栈中应为空；
+启用远程 Agent 的内置 Chrome 镜像时必须设为 `-chrome`，并运行
+`node scripts/dev-environment.mjs --profiles=agent,embedded-chrome`。预检只报告变量名，不输出密钥值。
+
 从源码构建完整 Docker 栈：
 
 ~~~bash
 cp .env.docker.example .env
 # 设置 API_AUTH_TOKEN、BOOTSTRAP_ADMIN_TOKEN、SECRET_KEY、CREDENTIAL_ENCRYPTION_KEY
-docker compose -f docker-compose.yml -f docker-compose.build.yml up --build -d
+npm run docker:up
 ~~~
 
 ## 发布镜像

backend/api/v1/__init__.py

@@ -16,6 +16,7 @@
     geo_acquisition,
     identity,
     image_studio,
+    local_auth,
     model_defaults,
     nodes,
     notifications,
@@ -80,6 +81,7 @@
 v1_router.include_router(dashboard.router)
 v1_router.include_router(system.router)
 v1_router.include_router(identity.router)
+v1_router.include_router(local_auth.router)
 v1_router.include_router(workspaces.router)
 v1_router.include_router(workspace_sources.router)
 v1_router.include_router(project_source_bindings.router)