npm - coxpit - Versions diffs - 4.7.0 → 5.0.0 - Mend

coxpit 4.7.0 → 5.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/src/icons.ts ADDED Viewed

@@ -0,0 +1,46 @@
+// Lucide 아이콘 스프라이트(ISC 라이선스 · CDN 0 · 인라인). currentColor 상속.
+// board.ts / login.ts 가 공유한다. 경로는 전부 진짜 Lucide SVG(licenses/lucide.txt).
+// 사용: 정적 <svg class="ic"><use href="#i-…"/></svg> · 클라이언트 동적은 ic('name') 헬퍼.
+/** 숨김 <symbol> 스프라이트. <body> 최상단에 1벌 인라인. */
+export const ICON_SPRITE = `<svg style="position:absolute;width:0;height:0" aria-hidden="true">
+  <symbol id="i-lock" viewBox="0 0 24 24"><rect width="18" height="11" x="3" y="11" rx="2" ry="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/></symbol>
+  <symbol id="i-unlock" viewBox="0 0 24 24"><rect width="18" height="11" x="3" y="11" rx="2" ry="2"/><path d="M7 11V7a5 5 0 0 1 9.9-1"/></symbol>
+  <symbol id="i-terminal" viewBox="0 0 24 24"><path d="m4 17 6-6-6-6"/><path d="M12 19h8"/></symbol>
+  <symbol id="i-folder" viewBox="0 0 24 24"><path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/></symbol>
+  <symbol id="i-branch" viewBox="0 0 24 24"><line x1="6" x2="6" y1="3" y2="15"/><circle cx="18" cy="6" r="3"/><circle cx="6" cy="18" r="3"/><path d="M18 9a9 9 0 0 1-9 9"/></symbol>
+  <symbol id="i-merge" viewBox="0 0 24 24"><circle cx="18" cy="18" r="3"/><circle cx="6" cy="6" r="3"/><path d="M6 21V9a9 9 0 0 0 9 9"/></symbol>
+  <symbol id="i-play" viewBox="0 0 24 24"><polygon points="6 3 20 12 6 21 6 3"/></symbol>
+  <symbol id="i-check" viewBox="0 0 24 24"><path d="M20 6 9 17l-5-5"/></symbol>
+  <symbol id="i-x" viewBox="0 0 24 24"><path d="M18 6 6 18"/><path d="m6 6 12 12"/></symbol>
+  <symbol id="i-refresh" viewBox="0 0 24 24"><path d="M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8"/><path d="M21 3v5h-5"/><path d="M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16"/><path d="M8 16H3v5"/></symbol>
+  <symbol id="i-file" viewBox="0 0 24 24"><path d="M15 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V7z"/><path d="M14 2v4a2 2 0 0 0 2 2h4"/><path d="M16 13H8"/><path d="M16 17H8"/><path d="M10 9H8"/></symbol>
+  <symbol id="i-code" viewBox="0 0 24 24"><path d="m16 18 6-6-6-6"/><path d="m8 6-6 6 6 6"/></symbol>
+  <symbol id="i-image" viewBox="0 0 24 24"><rect width="18" height="18" x="3" y="3" rx="2" ry="2"/><circle cx="9" cy="9" r="2"/><path d="m21 15-3.09-3.09a2 2 0 0 0-2.82 0L6 21"/></symbol>
+  <symbol id="i-message" viewBox="0 0 24 24"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/></symbol>
+  <symbol id="i-chevron" viewBox="0 0 24 24"><path d="m9 18 6-6-6-6"/></symbol>
+  <symbol id="i-plus" viewBox="0 0 24 24"><path d="M5 12h14"/><path d="M12 5v14"/></symbol>
+  <symbol id="i-pencil" viewBox="0 0 24 24"><path d="M21.174 6.812a1 1 0 0 0-3.986-3.987L3.842 16.174a2 2 0 0 0-.5.83l-1.321 4.352a.5.5 0 0 0 .623.622l4.353-1.32a2 2 0 0 0 .83-.497z"/></symbol>
+  <symbol id="i-trash" viewBox="0 0 24 24"><path d="M3 6h18"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6"/><path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/></symbol>
+  <symbol id="i-recycle" viewBox="0 0 24 24"><path d="M7 19H4.815a1.83 1.83 0 0 1-1.57-.881 1.785 1.785 0 0 1-.004-1.784L7.196 9.5"/><path d="M11 19h8.203a1.83 1.83 0 0 0 1.556-.89 1.784 1.784 0 0 0 0-1.775l-1.226-2.12"/><path d="m14 16-3 3 3 3"/><path d="M8.293 13.596 4.875 9.5 1.5 13.5"/><path d="m9 12 3-3-3-3"/><path d="M13.5 3.5 17 9.5l-3.5 2"/></symbol>
+  <symbol id="i-settings" viewBox="0 0 24 24"><path d="M12.22 2h-.44a2 2 0 0 0-2 2v.18a2 2 0 0 1-1 1.73l-.43.25a2 2 0 0 1-2 0l-.15-.08a2 2 0 0 0-2.73.73l-.22.38a2 2 0 0 0 .73 2.73l.15.1a2 2 0 0 1 1 1.72v.51a2 2 0 0 1-1 1.74l-.15.09a2 2 0 0 0-.73 2.73l.22.38a2 2 0 0 0 2.73.73l.15-.08a2 2 0 0 1 2 0l.43.25a2 2 0 0 1 1 1.73V20a2 2 0 0 0 2 2h.44a2 2 0 0 0 2-2v-.18a2 2 0 0 1 1-1.73l.43-.25a2 2 0 0 1 2 0l.15.08a2 2 0 0 0 2.73-.73l.22-.39a2 2 0 0 0-.73-2.73l-.15-.08a2 2 0 0 1-1-1.74v-.5a2 2 0 0 1 1-1.74l.15-.09a2 2 0 0 0 .73-2.73l-.22-.38a2 2 0 0 0-2.73-.73l-.15.08a2 2 0 0 1-2 0l-.43-.25a2 2 0 0 1-1-1.73V4a2 2 0 0 0-2-2z"/><circle cx="12" cy="12" r="3"/></symbol>
+  <symbol id="i-external-link" viewBox="0 0 24 24"><path d="M15 3h6v6"/><path d="M10 14 21 3"/><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/></symbol>
+  <symbol id="i-eye" viewBox="0 0 24 24"><path d="M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0"/><circle cx="12" cy="12" r="3"/></symbol>
+  <symbol id="i-alert-triangle" viewBox="0 0 24 24"><path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4"/><path d="M12 17h.01"/></symbol>
+  <symbol id="i-bell" viewBox="0 0 24 24"><path d="M10.268 21a2 2 0 0 0 3.464 0"/><path d="M3.262 15.326A1 1 0 0 0 4 17h16a1 1 0 0 0 .74-1.673C19.41 13.956 18 12.499 18 8A6 6 0 0 0 6 8c0 4.499-1.411 5.956-2.738 7.326"/></symbol>
+  <symbol id="i-bell-off" viewBox="0 0 24 24"><path d="M10.268 21a2 2 0 0 0 3.464 0"/><path d="M17 17H4a1 1 0 0 1-.74-1.673C4.59 13.956 6 12.499 6 8a6 6 0 0 1 .258-1.742"/><path d="m2 2 20 20"/><path d="M8.668 3.01A6 6 0 0 1 18 8c0 2.687.77 4.653 1.707 6.05"/></symbol>
+  <symbol id="i-download" viewBox="0 0 24 24"><path d="M12 15V3"/><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><path d="m7 10 5 5 5-5"/></symbol>
+  <symbol id="i-circle" viewBox="0 0 24 24"><circle cx="12" cy="12" r="10"/></symbol>
+  <symbol id="i-server" viewBox="0 0 24 24"><rect width="20" height="8" x="2" y="2" rx="2"/><rect width="20" height="8" x="2" y="14" rx="2"/><path d="M6 6h.01"/><path d="M6 18h.01"/></symbol>
+  <symbol id="i-layers" viewBox="0 0 24 24"><path d="M12.83 2.18a2 2 0 0 0-1.66 0L2.6 6.08a1 1 0 0 0 0 1.83l8.58 3.91a2 2 0 0 0 1.66 0l8.58-3.9a1 1 0 0 0 0-1.83Z"/><path d="m22 17.65-9.17 4.16a2 2 0 0 1-1.66 0L2 17.65"/><path d="m22 12.65-9.17 4.16a2 2 0 0 1-1.66 0L2 12.65"/></symbol>
+  <symbol id="i-target" viewBox="0 0 24 24"><circle cx="12" cy="12" r="10"/><circle cx="12" cy="12" r="6"/><circle cx="12" cy="12" r="2"/></symbol>
+  <symbol id="i-archive" viewBox="0 0 24 24"><rect width="20" height="5" x="2" y="3" rx="1"/><path d="M4 8v11a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8"/><path d="M10 12h4"/></symbol>
+</svg>`;
+/** .ic 아이콘 스타일(1em·currentColor 상속·stroke). board/login 공통. */
+export const ICON_CSS =
+  `.ic{width:1em;height:1em;stroke:currentColor;fill:none;stroke-width:2;stroke-linecap:round;stroke-linejoin:round;vertical-align:-.125em;flex:none}`;
+// 클라이언트에서 동적 HTML 문자열을 만들 때 쓰는 헬퍼 소스(보드 스크립트에 그대로 삽입).
+// ic('x') => '<svg class="ic"><use href="#i-x"/></svg>'
+export const ICON_JS_HELPER = `function ic(n){ return '<svg class="ic"><use href="#i-'+n+'"/></svg>'; }`;

package/src/index.ts CHANGED Viewed

@@ -1,4 +1,5 @@
 import { config } from './config';
+import { authMode, ensureSetupToken, isExposedBind } from './authkey';
 import { db, ensureSchema } from './db';
 import { machines } from './db/schema';
 import { acquireDaemonLock } from './lock';
@@ -40,10 +41,25 @@ try {
   throw e;
 }
-// 인증 켜졌는데 비번이 비면 fail-closed(전 요청 401) — 첫 실행자가 401 보고 당황하지 않게 명시.
-if (!config.auth.disabled && config.auth.pass === '') {
-  console.warn(
-    '[coxpit] auth is ON but COXPIT_AUTH_PASS is empty — every request will be rejected (401).\n' +
-    '[coxpit] Set COXPIT_AUTH_PASS to a password, or COXPIT_AUTH_DISABLED=1 for local dev.',
-  );
+// 접근키 인증 상태 안내. 첫 실행(키 미설정)이면 브랜디드 셋업 페이지 + 1회용 셋업 토큰을 찍는다.
+// (토큰 = Jupyter 스타일: 로그 접근자 = 머신 소유자. 터널/타넷/로컬 어디서 붙어도 이 토큰으로 셋업 가능.)
+{
+  const m = authMode();
+  if (m.mode === 'disabled') {
+    if (config.auth.disabled) {
+      console.warn('[coxpit] auth is DISABLED (COXPIT_AUTH_DISABLED=1) — every request is allowed. Front it with your own gateway if exposed.');
+    } else if (!isExposedBind()) {
+      console.log(`[coxpit] loopback-only bind (${config.host}) — trusted local, no login required. Bind to 0.0.0.0 to require an access key.`);
+    }
+  } else if (m.mode === 'setup') {
+    const token = ensureSetupToken();
+    console.log(
+      '[coxpit] no access key configured yet — open the board to set one (first-run setup).\n' +
+      `[coxpit] one-time setup token (needed unless you visit http://127.0.0.1:${config.port} directly): ${token}`,
+    );
+  } else if (m.mode === 'env') {
+    console.log('[coxpit] access-key auth ON (COXPIT_AUTH_PASS) — the branded unlock page asks for that key.');
+  } else {
+    console.log('[coxpit] access-key auth ON (stored key) — the branded unlock page asks for your key.');
+  }
 }

package/src/login.ts ADDED Viewed

@@ -0,0 +1,131 @@
+// 브랜디드 접근키 언락/셋업 페이지(단일 자가완결 HTML — 빌드 0, 보드 토큰 매치).
+// 브라우저 basic-auth 팝업을 대체한다.
+// ── Safari 쿠키 레이스 수정(v5.0) ──
+// 폼은 real navigation POST(urlencoded, hidden nav=1)로 /api/auth/{unlock,setup} 에 제출한다.
+// 서버는 성공 시 303 → GET /(브라우저가 그 응답의 Set-Cookie 를 커밋한 뒤 이동)로 답하므로,
+// fetch-then-location.replace 가 겪던 "쿠키 미커밋 → 다시 로그인" 레이스가 사라진다.
+// 실패는 서버가 이 페이지를 error 와 함께 다시 렌더한다(JS 없이도 동작). JSON API 는 그대로 유지.
+// setup=true → 첫 실행(키 설정, confirm 필드+토큰 힌트), false → 언락(키 1개).
+import { ICON_SPRITE, ICON_CSS } from './icons.js';
+/** HTML 속성 값 이스케이프(서버 렌더 에러 문자열 안전 주입용). */
+function escA(s: string): string {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+export interface LoginOpts { error?: string }
+/** login/setup 페이지 HTML. setup 이면 셋업(키+확인), 아니면 언락. opts.error 는 서버가 재렌더 시 주입. */
+export function loginPageHTML(setup: boolean, opts: LoginOpts = {}): string {
+  const title = setup ? 'set an access key' : 'unlock';
+  const initialErr = opts.error ? escA(opts.error) : '';
+  const action = setup ? '/api/auth/setup' : '/api/auth/unlock';
+  return /* html */ `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+<title>coxpit · ${title}</title>
+<style>
+  :root{
+    --bg:#0b0d12; --surface:#12151c; --surface2:#171b24; --line:#222835; --line-hi:#2f3648;
+    --ink:#dee4ec; --muted:#8792a2; --faint:#5c6675;
+    --brand:#4ec9b0; --brand-ink:#062822; --brand-dim:rgba(78,201,176,.13);
+    --s-failed:#e25b67; --s-preparing:#d6a249;
+    --mono:ui-monospace,'SF Mono',SFMono-Regular,Menlo,Consolas,monospace;
+    --sans:-apple-system,BlinkMacSystemFont,'Segoe UI',system-ui,Roboto,sans-serif;
+    --r-card:10px; --r-ctl:8px; --shadow:0 8px 28px rgba(0,0,0,.35);
+  }
+  *{box-sizing:border-box}
+  [hidden]{display:none !important}
+  html,body{height:100%}
+  html{overscroll-behavior:none}
+  body{margin:0;background:var(--bg);color:var(--ink);font-family:var(--sans);font-size:14px;line-height:1.5;
+    -webkit-font-smoothing:antialiased;display:flex;align-items:center;justify-content:center;
+    padding:24px;padding:max(24px,env(safe-area-inset-top)) max(24px,env(safe-area-inset-right)) max(24px,env(safe-area-inset-bottom)) max(24px,env(safe-area-inset-left));
+    overflow-x:hidden}
+  ::selection{background:var(--brand-dim)}
+  .card{width:100%;max-width:380px;background:var(--surface);border:1px solid var(--line);
+    border-radius:var(--r-card);box-shadow:var(--shadow);padding:26px 24px 22px}
+  .mark{font-family:var(--mono);font-weight:700;color:var(--brand);font-size:17px;letter-spacing:.02em;
+    display:flex;align-items:center;gap:9px}
+  .glyph{font-size:18px;line-height:1}
+  h1{font-size:15px;font-weight:600;margin:16px 0 4px;color:var(--ink)}
+  .sub{color:var(--muted);font-size:12.5px;margin:0 0 18px;line-height:1.5}
+  .flabel{display:block;font-family:var(--mono);font-size:10px;text-transform:uppercase;letter-spacing:.12em;
+    color:var(--faint);margin:0 0 6px}
+  input[type=password]{width:100%;background:#0e1118;border:1px solid var(--line);border-radius:var(--r-ctl);
+    color:var(--ink);font-family:var(--mono);font-size:16px;padding:10px 12px;outline:none}
+  input[type=password]:focus{border-color:var(--brand)}
+  input::placeholder{color:var(--faint)}
+  .fld{margin-bottom:14px}
+  .row{display:flex;align-items:center;gap:8px;margin:2px 0 16px;color:var(--muted);font-size:12.5px;user-select:none;cursor:pointer}
+  .row input{accent-color:var(--brand);width:15px;height:15px}
+  .btn{width:100%;background:var(--brand);color:var(--brand-ink);border:0;border-radius:var(--r-ctl);
+    font-family:var(--sans);font-weight:600;font-size:14px;padding:11px;cursor:pointer;
+    display:flex;align-items:center;justify-content:center;gap:8px}
+  .btn:disabled{opacity:.55;cursor:default}
+  .err{color:var(--s-failed);font-size:12.5px;min-height:17px;margin:0 0 12px;font-family:var(--mono)}
+  .hint{background:var(--surface2);border:1px solid var(--line);border-radius:var(--r-ctl);
+    padding:9px 11px;color:var(--muted);font-size:11.5px;line-height:1.55;margin:0 0 16px}
+  .hint code{font-family:var(--mono);color:var(--brand);font-size:11px}
+  .ft{margin-top:18px;padding-top:14px;border-top:1px solid var(--line);text-align:center}
+  .ft a{color:var(--faint);text-decoration:none;font-size:11.5px}
+  .ft a:hover{color:var(--muted)}
+  ${ICON_CSS}
+  .mark .ic{width:18px;height:18px}
+  .btn .ic{width:16px;height:16px}
+</style>
+</head>
+<body>
+${ICON_SPRITE}
+  <form class="card" id="f" method="post" action="${action}" autocomplete="off">
+    <input type="hidden" name="nav" value="1">
+    <div class="mark"><svg class="ic"><use href="#i-lock"/></svg><span>coxpit</span></div>
+    <h1>${setup ? 'Protect this coxpit' : 'Unlock this coxpit'}</h1>
+    <p class="sub">${setup
+      ? 'Set an access key. You&#39;ll enter it once per device — no accounts, no username.'
+      : 'Enter your access key. One key, one owner — no username.'}</p>
+    ${setup ? `<div class="hint">To prove you own this machine, this first-time setup needs the one-time
+      <code>setup token</code> printed in the daemon log &mdash; unless you&#39;re on
+      <code>http://127.0.0.1</code> directly. Paste it below if asked.</div>` : ''}
+    <div class="err" id="err">${initialErr}</div>
+    ${setup ? `<div class="fld"><label class="flabel" for="tok">setup token (from the daemon log)</label>
+      <input id="tok" name="token" type="password" placeholder="paste if not on localhost" autocomplete="off"
+        autocapitalize="none" autocorrect="off" spellcheck="false"></div>` : ''}
+    <div class="fld"><label class="flabel" for="key">access key</label>
+      <input id="key" name="key" type="password" placeholder="&#8226;&#8226;&#8226;&#8226;&#8226;&#8226;&#8226;&#8226;"
+        autocomplete="${setup ? 'new-password' : 'current-password'}"
+        autocapitalize="none" autocorrect="off" spellcheck="false" autofocus></div>
+    ${setup ? `<div class="fld"><label class="flabel" for="key2">confirm access key</label>
+      <input id="key2" type="password" placeholder="&#8226;&#8226;&#8226;&#8226;&#8226;&#8226;&#8226;&#8226;"
+        autocomplete="new-password" autocapitalize="none" autocorrect="off" spellcheck="false"></div>` : ''}
+    <label class="row"><input id="rem" name="remember" type="checkbox" value="on"${setup ? ' checked' : ''}><span>Remember this device</span></label>
+    <button class="btn" id="go" type="submit"><svg class="ic"><use href="#i-${setup ? 'lock' : 'unlock'}"/></svg><span>${setup ? 'Set key &amp; enter' : 'Unlock'}</span></button>
+    <div class="ft"><a href="https://github.com/hanmariyang/coxpit-oss#remote-access" target="_blank" rel="noopener">Fronting with Cloudflare Access / Tailscale? &rarr;</a></div>
+  </form>
+<script>
+(function(){
+  var SETUP = ${setup ? 'true' : 'false'};
+  var f = document.getElementById('f');
+  var err = document.getElementById('err');
+  var go = document.getElementById('go');
+  function show(m){ err.textContent = m || ''; }
+  // 폼은 native navigation POST 로 제출된다(Safari 가 응답의 Set-Cookie 를 커밋 → 303 GET /).
+  // 여기서는 클라이언트 사전검증만: 비면 막고, setup 이면 confirm/길이 확인. 통과 시 native 제출 진행.
+  f.addEventListener('submit', function(ev){
+    var key = document.getElementById('key').value;
+    if (!key){ ev.preventDefault(); show('access key required'); return; }
+    if (SETUP){
+      var key2 = document.getElementById('key2').value;
+      if (key !== key2){ ev.preventDefault(); show('keys do not match'); return; }
+      if (key.length < 6){ ev.preventDefault(); show('use at least 6 characters'); return; }
+    }
+    show('');
+    go.disabled = true;           // 네비게이션 진행 중 중복 제출 방지(네이티브 제출은 계속)
+  });
+})();
+</script>
+</body>
+</html>`;
+}

package/src/server.ts CHANGED Viewed

@@ -4,10 +4,15 @@ import { homedir } from 'node:os';
 import { resolve as presolve, dirname as pdirname, join as pjoin, sep as psep } from 'node:path';
 import { createRequire } from 'node:module';
 import { randomBytes } from 'node:crypto';
-import Fastify, { type FastifyInstance } from 'fastify';
+import Fastify, { type FastifyInstance, type FastifyReply } from 'fastify';
 import websocket from '@fastify/websocket';
 import { eq, inArray, and, like, desc } from 'drizzle-orm';
 import { authGate } from './auth';
+import { loginPageHTML } from './login';
+import {
+  authMode, authIsOpen, verifyKey, storeKey, signSession, SESSION_COOKIE,
+  clientKey, rateCheck, rateFail, rateReset, setupAllowed,
+} from './authkey';
 import { config } from './config';
 import { db } from './db';
 import { machines, repos, tasks, agentRuns, agentEvents, designCaptures, shareLinks, taskGroups } from './db/schema';
@@ -175,14 +180,126 @@ function sharePageHTML(
 export async function buildServer(): Promise<FastifyInstance> {
   const app = Fastify({ logger: true });
   await app.register(websocket);
+  // urlencoded 본문 파서(deps 0) — login/setup 폼이 real navigation POST 를 보내면
+  // 브라우저가 그 응답의 Set-Cookie 를 확정 커밋한다(Safari fetch-then-replace 레이스 회피).
+  app.addContentTypeParser(
+    'application/x-www-form-urlencoded',
+    { parseAs: 'string' },
+    (_req, body, done) => {
+      try {
+        const out: Record<string, string> = {};
+        const p = new URLSearchParams(body as string);
+        for (const [k, v] of p.entries()) out[k] = v;
+        done(null, out);
+      } catch (e) { done(e as Error, undefined); }
+    },
+  );
   app.addHook('onRequest', authGate);
   // 무인증 헬스(외부 감시용)
   app.get('/api/health', async () => ({ ok: true, name: 'coxpit', version: config.version }));
-  // 플릿 보드(단일 페이지). 인증 게이트 적용됨.
+  // 플릿 보드(단일 페이지). 인증 게이트 적용됨(무인증 요청은 게이트가 login/setup 페이지로 응답).
   app.get('/', async (_req, reply) => reply.type('text/html').send(BOARD_HTML));
+  // ─── 접근키 인증(access-key) ────────────────────────────────────
+  // 요청이 tunnel/https 를 탔나 — Secure 쿠키 여부 결정용.
+  const isSecureReq = (req: { headers: Record<string, unknown> }): boolean => {
+    const proto = String(req.headers['x-forwarded-proto'] ?? '');
+    return proto.split(',')[0]!.trim() === 'https' || req.headers['cf-connecting-ip'] != null;
+  };
+  const REMEMBER_MS = 30 * 24 * 60 * 60 * 1000; // 30d
+  // 세션 쿠키 헤더 조립(라이브러리 없이). remember → Max-Age 30d, else 세션 쿠키.
+  const setSessionCookie = (
+    reply: FastifyReply, req: { headers: Record<string, unknown> }, remember: boolean,
+  ): void => {
+    const expiry = remember ? Date.now() + REMEMBER_MS : 0;
+    const value = signSession(expiry);
+    const parts = [
+      `${SESSION_COOKIE}=${encodeURIComponent(value)}`,
+      'Path=/', 'HttpOnly', 'SameSite=Lax',
+    ];
+    if (remember) parts.push(`Max-Age=${Math.floor(REMEMBER_MS / 1000)}`);
+    if (isSecureReq(req)) parts.push('Secure');
+    reply.header('set-cookie', parts.join('; '));
+  };
+  const socketIp = (req: { socket?: { remoteAddress?: string } }): string =>
+    String(req.socket?.remoteAddress ?? '');
+  // real form navigation POST(urlencoded + nav flag) 인가 — 그러면 JSON 대신 303/HTML 로 답한다.
+  // 이 경로는 브라우저가 응답의 Set-Cookie 를 커밋한 뒤 GET / 로 이동하므로 Safari 쿠키 레이스가 없다.
+  const isFormNav = (req: { body?: unknown; headers: Record<string, unknown> }): boolean => {
+    const ct = String(req.headers['content-type'] ?? '');
+    const b = (req.body ?? {}) as { nav?: unknown };
+    return ct.includes('application/x-www-form-urlencoded') || b.nav != null;
+  };
+  const truthy = (v: unknown): boolean =>
+    v === true || v === 'true' || v === 'on' || v === '1' || v === 1;
+  // 첫 실행 셋업(anti-claim) — 셋업 토큰 일치 OR 진짜 로컬(loopback+no-fwd)만 허용.
+  // 키가 이미 있으면 409(단발). 성공 시 해시 저장 + 세션 쿠키.
+  app.post('/api/auth/setup', async (req, reply) => {
+    const nav = isFormNav(req);
+    // form-nav 실패는 로그인 페이지를 에러와 함께 다시 렌더(JSON 자동화는 아래처럼 JSON 유지).
+    const fail = (code: number, detail: string): FastifyReply => {
+      if (nav) return reply.type('text/html').code(code).send(loginPageHTML(true, { error: detail }));
+      return reply.code(code).send({ error: 'setup', detail });
+    };
+    if (authMode().mode !== 'setup') return fail(409, 'already configured');
+    const b = (req.body ?? {}) as { key?: string; token?: string; remember?: unknown };
+    const key = String(b.key ?? '');
+    if (key.length < 6) return fail(400, 'use at least 6 characters');
+    const gate = setupAllowed(req.headers as Record<string, unknown>, socketIp(req), String(b.token ?? ''));
+    if (!gate.ok) {
+      return fail(403, 'paste the one-time setup token from the daemon log (this request is not local)');
+    }
+    storeKey(key); // 평문 키는 절대 로그하지 않음
+    setSessionCookie(reply, req, truthy(b.remember));
+    // form-nav → 303 redirect to /(브라우저가 Set-Cookie 커밋 후 이동). JSON → 201.
+    if (nav) return reply.code(303).header('location', '/').send();
+    return reply.code(201).send({ ok: true });
+  });
+  // 언락 — 상수시간 검증 + per-client 레이트리밋(백오프). 성공 시 세션 쿠키.
+  app.post('/api/auth/unlock', async (req, reply) => {
+    const nav = isFormNav(req);
+    const fail = (code: number, detail: string): FastifyReply => {
+      if (nav) return reply.type('text/html').code(code).send(loginPageHTML(false, { error: detail }));
+      return reply.code(code).send({ error: 'unlock', detail });
+    };
+    const m = authMode();
+    if (m.mode === 'disabled') {
+      if (nav) return reply.code(303).header('location', '/').send();
+      return reply.send({ ok: true });
+    }
+    if (m.mode === 'setup') return fail(409, 'set an access key first');
+    const id = clientKey(req.headers as Record<string, unknown>, socketIp(req));
+    const rc = rateCheck(id);
+    if (rc.blocked) {
+      const secs = Math.ceil(rc.retryMs / 1000);
+      return fail(429, `too many attempts — try again in ${secs}s`);
+    }
+    const b = (req.body ?? {}) as { key?: string; remember?: unknown };
+    if (verifyKey(String(b.key ?? ''), m)) {
+      rateReset(id);
+      setSessionCookie(reply, req, truthy(b.remember));
+      if (nav) return reply.code(303).header('location', '/').send();
+      return reply.send({ ok: true });
+    }
+    const after = rateFail(id);
+    const detail = after.retryMs > 0
+      ? `wrong key — try again in ${Math.ceil(after.retryMs / 1000)}s`
+      : `wrong key — ${after.attemptsLeft} attempt(s) left`;
+    return fail(401, detail);
+  });
+  // 로그아웃 — 쿠키 제거(Max-Age=0).
+  app.post('/api/auth/logout', async (req, reply) => {
+    const parts = [`${SESSION_COOKIE}=`, 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=0'];
+    if (isSecureReq(req)) parts.push('Secure');
+    reply.header('set-cookie', parts.join('; '));
+    return reply.send({ ok: true });
+  });
   // 보드 하이드레이션 — machines/repos/tasks/runs(+events)/captures 한 방에.
   // 기본 view=active: 닫힌 태스크·그 run·이벤트 전량을 내리지 않는다(수백 run 시 페이로드 폭발 방지).
   // 이벤트는 활성 run 당 최근 40개만(카드는 8, 모달은 전량 refetch). view=all 은 구버전 전량.
@@ -219,7 +336,8 @@ export async function buildServer(): Promise<FastifyInstance> {
       // authOpen = 비밀번호 미설정 → Funnel(공개) 가드가 켜져야 함(원격접근 카드용)
       daemon: {
         version: config.version, pid: process.pid, port: config.port, dbPath: config.dbPath,
-        authOpen: config.auth.disabled || config.auth.pass === '',
+        // authOpen = 인증이 실질 열려있음(disabled 또는 아직 키 미설정) → Funnel 가드 켜져야 함
+        authOpen: authIsOpen(),
       },
       providers: listProviders(),
     };
@@ -537,8 +655,12 @@ export async function buildServer(): Promise<FastifyInstance> {
   // ─── Design Mode ───────────────────────────────────────────────
   // 캡처 키: 인증 off 면 자유, on 이면 ?k=<COXPIT_AUTH_PASS> (북마클릿은 basic 헤더 불가)
   const captureKeyOk = (req: { query?: unknown }): boolean => {
-    if (config.auth.disabled || config.auth.pass === '') return config.auth.disabled;
-    return ((req.query ?? {}) as { k?: string }).k === config.auth.pass;
+    const m = authMode();
+    // 인증 꺼짐 → 자유. 아직 키 미설정(setup) → 캡처 불가(키가 없으니 증명 수단 없음).
+    if (m.mode === 'disabled') return true;
+    if (m.mode === 'setup') return false;
+    const k = ((req.query ?? {}) as { k?: string }).k ?? '';
+    return verifyKey(k, m);
   };
   const cors = (reply: { header: (k: string, v: string) => unknown }) => {
     reply.header('access-control-allow-origin', '*');
@@ -591,8 +713,8 @@ export async function buildServer(): Promise<FastifyInstance> {
   // Funnel has no Tailscale-side auth, so coxpit's basic auth is the only gate.
   app.post('/api/remote/funnel', async (req, reply) => {
     const b = (req.body ?? {}) as { on?: boolean };
-    if (b.on === true && (config.auth.disabled || config.auth.pass === '')) {
-      return reply.code(409).send({ error: 'set a password first', code: 'NO_AUTH' });
+    if (b.on === true && authIsOpen()) {
+      return reply.code(409).send({ error: 'set an access key first', code: 'NO_AUTH' });
     }
     return setFunnel(config.port, b.on === true);
   });