Skip to content

Add command-free first-run WebUI setup - #3

Merged
BenCodez merged 14 commits into
mainfrom
codex/command-free-web-setup
Aug 29, 2026
Merged

BenCodez merged 14 commits into
mainfrom
codex/command-free-web-setup

Conversation

@BenCodez

@BenCodez BenCodez commented Aug 29, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • replace mandatory server-side setup commands with a one-time first-run WebUI flow
  • create a permission-restricted control/data/web-setup-code.txt whose raw code is consumed and deleted after the first password is committed
  • allow secure first-run setup when Control binds outside loopback, including 0.0.0.0 inside containers
  • add authenticated WebUI/API controls to create, rotate, list, and revoke node credentials
  • keep the existing owner CLI commands as an offline recovery path
  • document the Pterodactyl/container setup path and add credential/API tests

This is intentionally separate from VotingPlugin PR #1581.

Security properties

  • the setup code is 256-bit random; only its SHA-256 verifier is stored in credentials.json
  • the raw code file is owner-only where POSIX permissions are available
  • setup attempts reuse the bounded authentication admission and failure limiters
  • setup atomically installs the PBKDF2 password verifier before invalidating and deleting the code
  • enrollment secrets are returned once and never persisted in plaintext by Control
  • all enrollment management requires an admin token or password-authenticated WebUI session, with CSRF on writes

Validation

  • Java CI with Maven: passed (run 74)
  • Codex code review: completed with no open findings on bcb4e70

AI disclosure: This pull request was created with assistance from OpenAI Codex and reviewed by BenCodez.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for security reviews. Please try again later.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 29, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-08-29T16:16:16.409762Z bcb4e70 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 11d1937de6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/main/resources/web/app.js Resolved
Comment thread src/main/resources/web/index.html Resolved

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 769a3d7c5a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a816bbcd18

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/main/resources/web/app.js Resolved

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ea1bc542d6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b8c503d5b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@BenCodez
BenCodez merged commit 131f51e into main Aug 29, 2026
1 check passed
@BenCodez
BenCodez deleted the codex/command-free-web-setup branch August 29, 2026 17:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant