@justin0713/opspilot 1.0.8 → 1.1.0

package/bin/opspilot.js

@@ -214,17 +214,18 @@ function cmdStart(flags) {
   // Detect first run: credentials file doesn't exist yet
   const isFirstRun = !fs.existsSync(CREDENTIALS_FILE);
   let setupMount = '';
+  let firstRunPassword = '';
 
   if (isFirstRun) {
-    const password = generatePassword();
+    firstRunPassword = generatePassword();
 
     // 1. Write to host temp file (chmod 600) — never passed as CLI arg or env var
     fs.mkdirSync(CONFIG_DIR, { recursive: true });
-    fs.writeFileSync(SETUP_TOKEN_FILE, password);
+    fs.writeFileSync(SETUP_TOKEN_FILE, firstRunPassword);
     try { fs.chmodSync(SETUP_TOKEN_FILE, 0o600); } catch (_) {}
 
     // 2. Save to credentials file (chmod 600) for `opspilot password` command
-    writeCredentials(password);
+    writeCredentials(firstRunPassword);
 
     // 3. Mount into container read-only — entrypoint reads & deletes it
     setupMount = `-v "${SETUP_TOKEN_FILE}:/app/.setup_token:ro" `;
@@ -255,11 +256,16 @@ function cmdStart(flags) {
   console.log(`${BOLD}  URL      :${RESET} http://localhost:${port}`);
   console.log(`${BOLD}  Username :${RESET} admin`);
   if (isFirstRun) {
-    console.log(`${BOLD}  Password :${RESET} run ${CYAN}opspilot password${RESET} to reveal`);
+    console.log(`${BOLD}  Password :${RESET} ${BOLD}${firstRunPassword}${RESET}`);
   }
   console.log(`${BOLD}  Data     :${RESET} ${path.isAbsolute(data) ? data : `docker volume '${data}'`}`);
+  if (isFirstRun) {
+    console.log('');
+    console.log(`${YELLOW}  Change your password in Settings after first login.${RESET}`);
+    console.log(`  Password also saved at: ${CREDENTIALS_FILE}`);
+    console.log(`  (run ${CYAN}opspilot password --clear${RESET} after you've changed it)`);
+  }
   console.log('');
-  console.log(`  ${CYAN}opspilot password${RESET}   — show first-run admin password`);
   console.log(`  ${CYAN}opspilot logs -f${RESET}    — tail live logs`);
   console.log(`  ${CYAN}opspilot stop${RESET}        — stop the server`);
   console.log(`  ${CYAN}opspilot update${RESET}      — upgrade to latest`);
@@ -398,6 +404,63 @@ function cmdUninstall(flags) {
   console.log('');
 }
 
+function cmdResetAdmin() {
+  checkDocker();
+
+  const status = tryRun(`docker inspect -f "{{.State.Status}}" ${CONTAINER} 2>/dev/null`);
+  if (status !== 'running') {
+    die(
+      `Container '${CONTAINER}' is not running.\n\n` +
+      `  Start it first:  opspilot start --token <token>\n` +
+      `  Then reset:      opspilot reset-admin`
+    );
+  }
+
+  const newPassword = generatePassword();
+
+  // Python runs INSIDE the container — reads password from stdin (never exposed in ps/docker inspect)
+  const script = [
+    'import sys, os',
+    'sys.path.insert(0, "/app")',
+    'from user_store import hash_password, load_users, save_users',
+    'data_dir = os.environ.get("OPSPILOT_DATA_DIR", "/app/data")',
+    'uf = data_dir + "/users.json"',
+    'pw = sys.stdin.readline().strip()',
+    'ud = load_users(uf)',
+    'ul = ud.get("users", [])',
+    'admin = next((u for u in ul if u.get("role") == "admin"), None)',
+    'assert admin, "ERROR: no admin user found"',
+    'salt, hashed = hash_password(pw)',
+    'admin["password_salt"] = salt',
+    'admin["password_hash"] = hashed',
+    'save_users(uf, ud)',
+    'print("OK:" + admin["username"])',
+  ].join('\n');
+
+  log('Resetting admin password inside container...');
+  const result = spawnSync(
+    'docker', ['exec', '-i', CONTAINER, 'python3', '-c', script],
+    { input: newPassword, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
+  );
+
+  if (result.status !== 0 || (result.stdout || '').startsWith('ERROR') || result.error) {
+    const detail = (result.stderr || result.stdout || String(result.error)).trim();
+    die(`Reset failed: ${detail}\n\nCheck logs: opspilot logs`);
+  }
+
+  // Persist to credentials file (chmod 600) for `opspilot password`
+  writeCredentials(newPassword);
+
+  console.log('');
+  ok('Admin password reset successfully.');
+  console.log(`${BOLD}  Username :${RESET} admin`);
+  console.log(`${BOLD}  Password :${RESET} ${BOLD}${newPassword}${RESET}`);
+  console.log('');
+  console.log(`${YELLOW}Save this password — or retrieve it later with:${RESET}`);
+  console.log(`  ${CYAN}opspilot password${RESET}`);
+  console.log('');
+}
+
 function cmdInstallGuide() {
   const platform = os.platform();
   console.log(`
@@ -457,6 +520,7 @@ ${BOLD}Commands:${RESET}
   ${CYAN}status${RESET}         Show container status
   ${CYAN}config${RESET}         Show saved local config
   ${CYAN}password${RESET}       Show first-run admin password  (--clear to delete after reading)
+  ${CYAN}reset-admin${RESET}    Reset admin password (official recovery if password is lost)
   ${CYAN}uninstall${RESET}      Remove container, image, data volume and local config
   ${CYAN}install-guide${RESET}  Show Docker installation instructions for your platform
 
@@ -499,6 +563,7 @@ switch (cmd) {
     break;
   case 'status':        cmdStatus();       break;
   case 'config':        cmdConfig();       break;
+  case 'reset-admin':   cmdResetAdmin();             break;
   case 'uninstall':     cmdUninstall(parsed.flags); break;
   case 'install-guide': cmdInstallGuide();           break;
   case 'password':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@justin0713/opspilot",
-  "version": "1.0.8",
+  "version": "1.1.0",
   "description": "CLI installer for OpsPilot Local — self-hosted SSH operations platform",
   "license": "MIT",
   "homepage": "https://github.com/Albert0977/ShellShare#readme",