6 Commits
Author SHA1 Message Date
风月 e8c7ae2098 fix(docker): skip octop init on restart for external database backends (#1866)
The entrypoint guard only looked for ~/.octop/octop.db, which PostgreSQL
(and other external) backends never create in the data volume, so every
container restart re-ran `octop init`. The unconditional admin INSERT
then aborted the container with UniqueViolation on users_username_key.

- docker/docker-entrypoint.sh: write a backend-agnostic marker
  (~/.octop/.initialized) after a successful `octop init`; skip the
  bootstrap block on restarts when the marker or octop.db exists. When
  init reports the admin already exists (upgrade of a pre-marker
  deployment), keep the existing credential card instead of writing a
  password that was never applied; also mention external DBs in the
  generic init-failure hint.
- src/octop/cli/commands/init.py: make the admin bootstrap idempotent —
  when the username already exists, skip creation with an explicit
  message (the entrypoint greps for it) instead of hitting
  UNIQUE(username).

Tests: entrypoint tests run the real script with a stub `octop` on PATH
(first boot + restart for an external backend, sqlite regression guard,
credential preservation, failed-init retry); a CLI test covers rerunning
`octop init` when the DB lives outside ~/.octop.

Fixes #1866

Signed-off-by: fengyue-xve <1759519137@qq.com>
2026-10-10 16:05:56 +08:00
e9deb58206 fix: harden Docker bootstrap, Bridge sessions, and desktop/provider UX (#1825)
Avoid silent random admin passwords, keep Bridge links alive under load,
and stop custom providers from sending stream_options that MindIE rejects.

Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-09 07:04:56 +08:00
28b64af9db feat(fnos): harden App Center install and native startup (#1539)
Keep the Docker/native wizards on an account-only flow, fail native start
when 8089 never comes up, and vendor harness storage_errors so current
Octop can boot against PyPI harness 1.0.0.

Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-03 17:43:54 +08:00
veenyi cf9d700d61 fix(fnos): 安装向导接管管理员密码,根治 Octop123 被弱密码黑名单拒绝导致 FPK 无法启动 (issue #502)
根因:应用密码策略(src/octop/infra/users/password.py)的常见弱密码黑名单包含 octop123,
而 FnOS FPK 把初始密码写死为 Octop123,首次启动 octop init 报 "password is too common"
直接退出("Octop process exited early"),全新安装的 native / docker FPK 均无法启动。

修复内容:
- 安装向导(wizard/install,native + docker)提供两种密码方式:
  ① 自己输入密码:install_init / install_callback 按应用侧策略预校验(≥8 位、
     含字母和数字、不在常见弱密码黑名单),无效密码在安装阶段直接拦截并中文提示;
  ② 自动生成随机密码(推荐):octop_generate_password 生成 16 位强密码。
- 随机/自定义密码双通道送达:
  ① 应用「设置」窗口(wizard/config)顶部直接显示当前账号与密码(安装/改密时
     由回调渲染占位符模板),用户免翻文件;
  ② 数据目录 octop-login.txt 回落备份,永久保留、随改密同步更新。
- 启动器与容器入口三重兜底:.env 无密码时自动生成;init 因密码策略被拒时
  自动改用随机密码重试一次,并回写 .env 保持一致 —— 存量坏 .env(Octop123)
  升级后首次启动即被救活,不再依赖用户手工清理。
- 应用「设置」窗口支持改密:保持不变 / 随机生成 / 自定义(config_init 前置校验),
  本地版走官方 CLI `octop user passwd` 离线改密(停服→改密→启服防写库冲突),
  Docker 版走 `docker exec octop octop user passwd`;凭据三处同步(.env /
  octop-login.txt / 设置窗口显示)。
- 官方 CLI 管理保障:安装回调注册 octop / octop-cli 到 PATH 并做 `octop version`
  冒烟验证(结果写入安装日志)。
- docker/docker-entrypoint.sh:未设置 OCTOP_DEFAULT_PASSWORD 时自动生成随机密码,
  指定密码被策略拒绝时自动回退随机;credential.txt 增加访问地址行。
- compose / .env.example / README / user-guide 移除 Octop123 默认值与宣传文案。

本地验证:19 个 shell 脚本 bash -n 全过;7 个向导 JSON 全部合法;密码生成 300/300
通过字符集/长度/首字母/末位数字断言;octop_validate_password 与官方
validate_password_policy 对拍 19/19 一致、黑名单 14 项逐字一致;渲染链端到端模拟
(生成→校验→回落保存→设置窗口渲染→JSON 复检)通过。
2026-09-12 08:15:24 +08:00
jubaoliangandCursor b5d46ebfbf feat: enforce password policy and polish account/subagent UX
Require stronger passwords end-to-end (setup, Docker bootstrap, change-password), split password settings into a dedicated panel, and replace subagent file editing with a create/edit drawer.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-11 14:03:47 +08:00
jubaoliang 30b17554e3 Fix CI pipeline and make the test suite pass; rename project to Octop
CI:
- Drop Python 3.11 from the test matrix (package requires >=3.12); the
  3.11 jobs failed at `uv sync`. Linux and Windows now test Python 3.12.
- Rename tests/unit/infra/setup/tls/test_store.py -> test_tls_store.py to
  fix the pytest import collision (duplicate basename) that aborted
  collection on the 3.12 job.

Source bugs uncovered by the suite:
- Move ACTOR_SYSTEM to a runtime import in infra/cron/job.py (was wrongly
  placed under TYPE_CHECKING, causing NameError at runtime).
- Add missing users-table columns (login_failed_count, login_locked_until,
  preferences_json) in infra/db/migrate.py for legacy schema repair.
- Make auth.update_me honor explicit nulls via model_dump(exclude_unset=True).
- Relax skills hub endpoints to existence/ownership checks (require_agent_row)
  instead of requiring the agent to be running.
- Marshal WebSocket frames onto the owning event loop in chat/ws.py so the
  starlette TestClient portal does not deadlock.
- Include error details in the browser session 503 response.

Tests:
- Update tests to match current source APIs (harness async create/remove/
  rebuild, FakeHarnessAgent skill methods, workspace nested layout, JWT
  middleware, CLI surface, proactive config defaults, general-assistant
  template manifest).
- Migrate WebSocket tests to starlette TestClient(...).websocket_connect
  (httpx 0.28 removed AsyncClient.websocket_connect).
- Skip memory API tests when the optional harness_memory dependency is absent
  via pytest.importorskip.
- Remove the invalid diagnostic test tests/integration/test_diag_e2e.py
  (no assertions; inspected private internals only).

Also includes the pre-existing uncommitted orca -> Octop rename across docs,
README, LICENSE, Dockerfile and docker assets, as requested.
2026-07-10 00:40:24 +00:00