Add files via upload

cmd/server/main.go

@@ -4,7 +4,9 @@ import (
 	"context"
 	"cyberstrike-ai/internal/app"
 	"cyberstrike-ai/internal/config"
+	"cyberstrike-ai/internal/database"
 	"cyberstrike-ai/internal/logger"
+	"cyberstrike-ai/internal/security"
 	"cyberstrike-ai/internal/termout"
 	"flag"
 	"fmt"
@@ -12,17 +14,21 @@ import (
 	"os/signal"
 	"strings"
 	"syscall"
+
+	"go.uber.org/zap"
+	"golang.org/x/term"
 )
 
 func main() {
-	var configPath = flag.String("config", "config.yaml", "配置文件路径")
-	var httpsBootstrap = flag.Bool("https", false, "启用主站 HTTPS：未配置 tls_cert_path/tls_key_path 时使用内存自签证书（本地测试）；与 run.sh 默认行为一致")
-	var httpBootstrap = flag.Bool("http", false, "强制主站使用明文 HTTP：覆盖配置文件中的 tls_enabled/tls_auto_self_sign/tls_cert_path/tls_key_path")
+	var configPath = flag.String("config", "config.yaml", "Path to the configuration file")
+	var httpsBootstrap = flag.Bool("https", false, "Enable HTTPS for the main site; uses an in-memory self-signed certificate when no cert/key is configured")
+	var httpBootstrap = flag.Bool("http", false, "Force plain HTTP for the main site, overriding TLS settings in the configuration file")
+	var resetAdminPassword = flag.Bool("reset-admin-password", false, "Interactively reset the built-in admin password and exit")
 	flag.Parse()
 
 	// 环境变量兼容（便于 systemd/docker 等不传参场景）
 	if *httpsBootstrap && *httpBootstrap {
-		fmt.Fprintln(os.Stderr, "--http 与 --https 不能同时使用")
+		fmt.Fprintln(os.Stderr, "--http and --https cannot be used together")
 		os.Exit(2)
 	}
 	if !*httpsBootstrap && !*httpBootstrap {
@@ -38,24 +44,32 @@ func main() {
 		cp = "config.yaml"
 	}
 	if strings.HasPrefix(cp, "-") {
-		fmt.Fprintf(os.Stderr, "无效的 -config 路径 %q。\n若同时需要 HTTPS，请写成: ./cyberstrike-ai --https -config config.yaml（-config 后必须是 yaml 文件路径）。\n", cp)
+		fmt.Fprintf(os.Stderr, "Invalid -config path %q.\nIf HTTPS is also needed, use: ./cyberstrike-ai --https -config config.yaml (-config must be followed by a yaml file path).\n", cp)
 		os.Exit(2)
 	}
 	localConfig, err := config.EnsureLocalConfig(cp)
 	if err != nil {
-		fmt.Printf("加载配置失败: %v\n", err)
+		fmt.Printf("Failed to load config: %v\n", err)
 		return
 	}
 
 	cfg, err := config.Load(cp)
 	if err != nil {
-		fmt.Printf("加载配置失败: %v\n", err)
+		fmt.Printf("Failed to load config: %v\n", err)
 		return
 	}
 	if localConfig.Created {
 		termout.PrintConfigCreated()
 	}
 
+	if *resetAdminPassword {
+		if err := runResetAdminPassword(cfg); err != nil {
+			fmt.Fprintf(os.Stderr, "Failed to reset admin password: %v\n", err)
+			os.Exit(1)
+		}
+		return
+	}
+
 	if *httpBootstrap {
 		config.ApplyPlainHTTPBootstrap(cfg)
 	} else if *httpsBootstrap {
@@ -79,7 +93,7 @@ func main() {
 
 	// MCP 启用且 auth_header_value 为空时，自动生成随机密钥并写回配置
 	if err := config.EnsureMCPAuth(cp, cfg); err != nil {
-		fmt.Printf("MCP 鉴权配置失败: %v\n", err)
+		fmt.Printf("Failed to configure MCP authentication: %v\n", err)
 		return
 	}
 	if cfg.MCP.Enabled {
@@ -121,3 +135,72 @@ func main() {
 		}
 	}
 }
+
+func runResetAdminPassword(cfg *config.Config) error {
+	dbPath := strings.TrimSpace(cfg.Database.Path)
+	if dbPath == "" {
+		dbPath = "data/conversations.db"
+	}
+	if _, err := os.Stat(dbPath); err != nil {
+		if os.IsNotExist(err) {
+			return fmt.Errorf("database does not exist: %s; start the service once to initialize it first", dbPath)
+		}
+		return err
+	}
+
+	fmt.Println("Reset built-in admin password")
+	fmt.Println()
+
+	password, err := readHiddenPassword("New admin password: ")
+	if err != nil {
+		return err
+	}
+	password = strings.TrimSpace(password)
+	if len(password) < 8 {
+		return fmt.Errorf("new password must be at least 8 characters")
+	}
+	confirm, err := readHiddenPassword("Confirm new password: ")
+	if err != nil {
+		return err
+	}
+	if password != strings.TrimSpace(confirm) {
+		return fmt.Errorf("passwords do not match")
+	}
+
+	hash, err := security.HashPassword(password)
+	if err != nil {
+		return err
+	}
+
+	db, err := database.NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		return err
+	}
+	defer func() { _ = db.Close() }()
+
+	admin, err := db.GetRBACUserByUsername("admin")
+	if err != nil {
+		return fmt.Errorf("built-in admin account was not found; start the service once to initialize it first: %w", err)
+	}
+	if !admin.IsBuiltin {
+		return fmt.Errorf("admin account is not built in; refusing to reset it")
+	}
+	if err := db.UpdateRBACAdminPassword(hash); err != nil {
+		return err
+	}
+
+	fmt.Println()
+	fmt.Println("Admin password has been reset.")
+	fmt.Println("If the service is running, existing login sessions remain valid until the service restarts or the sessions expire.")
+	return nil
+}
+
+func readHiddenPassword(prompt string) (string, error) {
+	fmt.Fprint(os.Stderr, prompt)
+	password, err := term.ReadPassword(int(os.Stdin.Fd()))
+	fmt.Fprintln(os.Stderr)
+	if err != nil {
+		return "", err
+	}
+	return string(password), nil
+}

docs/en-US/troubleshooting.md

@@ -46,13 +46,21 @@ Login fails:
 
 If another administrator with `rbac:write` is available, reset the password under **Platform permissions → User management**.
 
-If no administrator session is available, the built-in `admin` account can be recovered on the server. Stop CyberStrikeAI, back up the database, change to the project root, and run the command below. Enter and confirm the new password when prompted:
+If no administrator session is available, the built-in `admin` account can be recovered on the server. Change to the project root and run:
+
+```bash
+./run.sh --reset-admin-password
+```
+
+Enter and confirm the new password when prompted. The script hides input and stores a bcrypt hash. If the service is running, restart it afterward to invalidate existing login sessions.
+
+If `run.sh` is not available, run the command below manually. Enter and confirm the new password when prompted:
 
 ```bash
 HASH=$(htpasswd -nBC 10 '' | cut -d: -f2 | tr -d '\n') && sqlite3 data/conversations.db "UPDATE rbac_users SET password_hash='$HASH', updated_at=CURRENT_TIMESTAMP WHERE id='admin' AND username='admin' AND is_builtin=1; SELECT changes();"
 ```
 
-Output `1` means that the row was updated. The command requires `sqlite3` and `htpasswd`. If `database.path` in `config.yaml` is not the default, replace `data/conversations.db`. Password input is hidden, is not written to shell history, and is stored as a bcrypt hash. Restart the service afterward to invalidate existing login sessions.
+Output `1` means that the row was updated. The command requires `sqlite3` and `htpasswd`. If `database.path` in `config.yaml` is not the default, replace `data/conversations.db`. Password input is hidden and is not written to shell history.
 
 Model fails:
 

docs/zh-CN/troubleshooting.md

@@ -32,13 +32,21 @@ https://127.0.0.1:8080/
 
 如果仍有其他具备 `rbac:write` 权限的管理员账号，优先在 **平台权限 → 用户管理** 中重置密码。
 
-如果没有可用的管理员会话，可在服务器上紧急重置内置 `admin` 账号。先停止 CyberStrikeAI 服务并备份数据库，然后在项目根目录执行以下命令，按提示输入并确认新密码：
+如果没有可用的管理员会话，可在服务器上紧急重置内置 `admin` 账号。在项目根目录执行：
+
+```bash
+./run.sh --reset-admin-password
+```
+
+按提示输入并确认新密码。脚本会隐藏输入并写入 bcrypt 哈希。如果服务正在运行，完成后重新启动服务，使原有登录会话失效。
+
+如果无法使用 `run.sh`，也可以手动执行以下命令，按提示输入并确认新密码：
 
 ```bash
 HASH=$(htpasswd -nBC 10 '' | cut -d: -f2 | tr -d '\n') && sqlite3 data/conversations.db "UPDATE rbac_users SET password_hash='$HASH', updated_at=CURRENT_TIMESTAMP WHERE id='admin' AND username='admin' AND is_builtin=1; SELECT changes();"
 ```
 
-输出 `1` 表示修改成功。该命令需要 `sqlite3` 和 `htpasswd`；如果 `config.yaml` 中的 `database.path` 不是默认值，请替换 `data/conversations.db`。密码输入不会显示，也不会写入 Shell 历史，并以 bcrypt 哈希保存。完成后重新启动服务，使原有登录会话失效。
+输出 `1` 表示修改成功。该命令需要 `sqlite3` 和 `htpasswd`；如果 `config.yaml` 中的 `database.path` 不是默认值，请替换 `data/conversations.db`。密码输入不会显示，也不会写入 Shell 历史。
 
 ## 模型无响应
 

go.mod

@@ -37,6 +37,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.34.0
 	go.uber.org/zap v1.26.0
 	golang.org/x/net v0.35.0
+	golang.org/x/term v0.32.0
 	golang.org/x/text v0.26.0
 	golang.org/x/time v0.14.0
 	gopkg.in/yaml.v3 v3.0.1

run.sh

@@ -61,25 +61,30 @@ show_progress() {
     printf "\r"
 }
 
-echo ""
-echo "=========================================="
-echo "  CyberStrikeAI Deploy & Start Script"
-echo "  (HTTPS with self-signed cert by default; plain HTTP: $0 --http)"
-echo "=========================================="
-echo ""
+print_banner() {
+    local show_mirrors="${1:-1}"
+    echo ""
+    echo "=========================================="
+    echo "  CyberStrikeAI Deploy & Start Script"
+    echo "  (HTTPS with self-signed cert by default; plain HTTP: $0 --http)"
+    echo "=========================================="
+    echo ""
 
-# Show temporary mirror/proxy info
-echo ""
-warning "Note: this script uses temporary mirrors to speed up downloads"
-echo ""
-info "Python pip temporary mirror:"
-echo "  ${PIP_INDEX_URL}"
-info "Go temporary proxy:"
-echo "  ${GOPROXY}"
-echo ""
-note "These settings apply only while this script runs and do not change system config"
-echo ""
-sleep 1
+    if [ "$show_mirrors" -eq 1 ]; then
+        # Show temporary mirror/proxy info
+        echo ""
+        warning "Note: this script uses temporary mirrors to speed up downloads"
+        echo ""
+        info "Python pip temporary mirror:"
+        echo "  ${PIP_INDEX_URL}"
+        info "Go temporary proxy:"
+        echo "  ${GOPROXY}"
+        echo ""
+        note "These settings apply only while this script runs and do not change system config"
+        echo ""
+        sleep 1
+    fi
+}
 
 CONFIG_FILE="$ROOT_DIR/config.yaml"
 EXAMPLE_CONFIG_FILE="$ROOT_DIR/config.example.yaml"
@@ -136,6 +141,28 @@ check_go() {
     success "Go check passed: $(go version)"
 }
 
+check_go_quiet() {
+    if ! command -v go >/dev/null 2>&1; then
+        error "Go not found"
+        echo ""
+        info "Install Go 1.21 or later first:"
+        echo "  macOS:   brew install go"
+        echo "  Ubuntu:  sudo apt-get install golang-go"
+        echo "  CentOS:  sudo yum install golang"
+        echo "  Or visit: https://go.dev/dl/"
+        exit 1
+    fi
+
+    GO_VERSION=$(go version | awk '{print $3}' | sed 's/go//')
+    GO_MAJOR=$(echo "$GO_VERSION" | cut -d. -f1)
+    GO_MINOR=$(echo "$GO_VERSION" | cut -d. -f2)
+
+    if [ "$GO_MAJOR" -lt 1 ] || ([ "$GO_MAJOR" -eq 1 ] && [ "$GO_MINOR" -lt 21 ]); then
+        error "Go version too old: $GO_VERSION (requires 1.21+)"
+        exit 1
+    fi
+}
+
 # Set up Python virtual environment
 setup_python_env() {
     if [ ! -d "$VENV_DIR" ]; then
@@ -331,6 +358,34 @@ build_go_project() {
     fi
 }
 
+build_go_project_quiet() {
+    info "Building $BINARY_NAME..."
+
+    GO_DOWNLOAD_LOG=$(mktemp)
+    if ! GOPROXY="$GOPROXY" go mod download >"$GO_DOWNLOAD_LOG" 2>&1; then
+        error "Go dependency download failed"
+        echo ""
+        info "Download error details:"
+        cat "$GO_DOWNLOAD_LOG" | sed 's/^/  /'
+        echo ""
+        rm -f "$GO_DOWNLOAD_LOG"
+        exit 1
+    fi
+    rm -f "$GO_DOWNLOAD_LOG"
+
+    GO_BUILD_LOG=$(mktemp)
+    if ! GOPROXY="$GOPROXY" go build -o "$BINARY_NAME" cmd/server/main.go >"$GO_BUILD_LOG" 2>&1; then
+        error "Build failed"
+        echo ""
+        info "Build error details:"
+        cat "$GO_BUILD_LOG" | sed 's/^/  /'
+        echo ""
+        rm -f "$GO_BUILD_LOG"
+        exit 1
+    fi
+    rm -f "$GO_BUILD_LOG"
+}
+
 # Check whether a rebuild is needed
 need_rebuild() {
     if [ ! -f "$BINARY_NAME" ]; then
@@ -351,6 +406,7 @@ need_rebuild() {
 # Default: HTTPS (--https passed to binary); --http forces plain HTTP even if config.yaml enables TLS.
 main() {
     USE_HTTPS=1
+    RESET_ADMIN_PASSWORD=0
     FORWARD_ARGS=()
     for arg in "$@"; do
         if [ "$arg" = "--http" ]; then
@@ -361,9 +417,33 @@ main() {
             USE_HTTPS=1
             continue
         fi
+        if [ "$arg" = "--reset-admin-password" ]; then
+            RESET_ADMIN_PASSWORD=1
+            continue
+        fi
         FORWARD_ARGS+=("$arg")
     done
 
+    if [ "$RESET_ADMIN_PASSWORD" -eq 1 ]; then
+        if [ ! -f "$CONFIG_FILE" ] && [ ! -f "$EXAMPLE_CONFIG_FILE" ]; then
+            error "config.yaml not found, and config.example.yaml is missing"
+            info "The server binary creates config.yaml from config.example.yaml on first start"
+            exit 1
+        fi
+        check_go_quiet
+        if need_rebuild; then
+            build_go_project_quiet
+            echo ""
+        fi
+        if [ "${#FORWARD_ARGS[@]}" -gt 0 ]; then
+            exec "./$BINARY_NAME" -config "$CONFIG_FILE" --reset-admin-password "${FORWARD_ARGS[@]}"
+        else
+            exec "./$BINARY_NAME" -config "$CONFIG_FILE" --reset-admin-password
+        fi
+    fi
+
+    print_banner 1
+
     # Environment checks
     info "Checking runtime environment..."
     check_python
@@ -417,5 +497,5 @@ main() {
     fi
 }
 
-# Run main (supports args, e.g. ./run.sh --http)
+# Run main (supports args, e.g. ./run.sh --http, ./run.sh --reset-admin-password)
 main "$@"