Add dashboard username/password login

[Jurij89]

Summary

• Adds a lightweight single-user dashboard username/password login on top of PR Replace Node UI token bootstrap with dashboard sessions #1428's HttpOnly dashboard-session model.
• Stores dashboard credentials as a local scrypt hash under DKG_HOME, creates the first credential from dkg init, and adds dkg auth dashboard reset-password plus safe auth status metadata.
• Ensures dkg mcp setup, dkg hermes setup, and dkg openclaw setup create missing dashboard credentials, print generated credentials once, and leave existing credentials untouched on reruns.
• Updates Node UI to show a username/password sign-in gate, while preserving API-token exchange for automation/devnet and keeping the browser from receiving the backing API token.
• Adds trusted-origin enforcement, login failure throttling, credential-fingerprint invalidation, and adversarial-review hardening for first-run credential races and setup/UX edge cases.

Related

• Follow-up to Replace Node UI token bootstrap with dashboard sessions #1428.
• Stacked on codex/node-ui-auth-bootstrap-session; target base is that PR branch, not main.
• Plan: agent-docs/dashboard-login-followup-plan.md.

Files changed

File	What
agent-docs/dashboard-login-followup-plan.md	Team/adversarial plan for the follow-up login work.
packages/cli/src/daemon/dashboard-credentials.ts	Hash-only dashboard credential generation, verification, reset, summaries, fingerprinting, and atomic first-run creation.
packages/cli/src/dashboard-credential-setup.ts	CLI-only setup helper that prints generated credentials once, skips explicit auth-disabled configs, and gives DKG_HOME-aware reset guidance.
packages/cli/src/mcp-setup.ts, packages/cli/src/*setup.ts	Wires dashboard credential creation into MCP, Hermes, and OpenClaw setup entry points.
packages/adapter-hermes/src/setup.ts, packages/adapter-openclaw/src/setup.ts	Adds optional injected credential setup hooks while keeping daemon/UI adapter calls quiet by default.
packages/cli/src/daemon/dashboard-session*.ts	Username/password exchange handling, login throttling, login session source, and reset invalidation hooks.
packages/cli/src/daemon/lifecycle.ts	Wires credential verifier, safe daemon status logging, node-admin token selection, and fingerprint checks.
packages/cli/src/commands/auth.ts, packages/cli/src/commands/init.ts	Adds reset/status/init operator flows for dashboard credentials and labels generated output as secret-bearing.
packages/node-ui/src/ui/**	Replaces token unlock gate with dashboard sign-in and DKG_HOME-aware reset guidance; keeps token exchange helper for automation.
packages/cli/test/**, packages/node-ui/test/**, packages/adapter-*/test/**	Covers credential storage, login security behavior, reset invalidation, UI/client flow changes, setup hook behavior, and adversarial review gaps.

Adversarial ready review

• Ran parallel security, setup-flow, CI/readiness, and UX reviews before marking the PR ready.
• No unresolved critical/high security blocker remains after the follow-up hardening commit.
• Concrete issues addressed in the final hardening round:
  • first-run credential creation is no-overwrite/atomic, so parallel setup runs cannot print a losing generated password;
  • setup skips dashboard credentials when persisted API auth is explicitly disabled;
  • generated-password CLI output is explicitly marked as secret-bearing and refers to the credential file, not a credential hash;
  • daemon/UI reset guidance tells operators to run reset on the node host with the daemon's DKG_HOME;
  • Hermes setup writes dashboard credentials into the daemon-url-resolved DKG home without breaking existing config/state/token lookup behavior;
  • pure setup/credential tests are included in the CLI no-Hardhat unit lane.

Test plan

• cd packages/cli && pnpm vitest run test/dashboard-credentials.test.ts test/dashboard-session.test.ts --reporter=dot
• cd packages/cli && pnpm exec tsc --noEmit --pretty false
• cd packages/node-ui && pnpm vitest run test/dashboard-session-client.test.ts test/dashboard-session-gate.test.ts --reporter=dot
• cd packages/node-ui && pnpm build
• cd packages/node-ui && pnpm build:ui (passed; existing Vite warning about MOCK_SUBGRAPHS remains unrelated)
• cd packages/cli && PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/mnt/c/Users/jurij/AppData/Local/fnm_multishells/39480_1783200367143 /mnt/c/Users/jurij/AppData/Local/fnm_multishells/39480_1783200367143/pnpm vitest run test/mcp-setup.test.ts test/hermes-setup-orchestration.test.ts test/openclaw-setup-cli-args.test.ts test/hermes-setup-cli-args.test.ts test/dashboard-credential-setup.test.ts (WSL run with Windows interop discovery neutralized)
• cd packages/cli && pnpm vitest run test/dashboard-credentials.test.ts test/dashboard-credential-setup.test.ts
• cd packages/adapter-openclaw && pnpm vitest run test/setup.part-26.test.ts
• cd packages/adapter-hermes && pnpm vitest run test/hermes-adapter.part-07.test.ts
• cd packages/adapter-openclaw && pnpm exec tsc --noEmit --pretty false
• cd packages/adapter-hermes && pnpm exec tsc --noEmit --pretty false
• git diff --check
• cd packages/adapter-hermes && pnpm vitest run test/hermes-adapter.part-07.test.ts (19 tests, final hardening)
• cd packages/cli && pnpm exec vitest run --config vitest.unit.config.ts test/dashboard-credentials.test.ts test/dashboard-credential-setup.test.ts test/dashboard-session.test.ts --reporter=dot (65 tests, final hardening)
• cd packages/cli && PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/mnt/c/Users/jurij/AppData/Local/fnm_multishells/50508_1783202234549 /mnt/c/Users/jurij/AppData/Local/fnm_multishells/50508_1783202234549/pnpm exec vitest run --config vitest.unit.config.ts test/mcp-setup.test.ts test/hermes-setup-orchestration.test.ts test/openclaw-setup-cli-args.test.ts test/hermes-setup-cli-args.test.ts test/dashboard-credential-setup.test.ts --reporter=dot (136 tests, final hardening)
• cd packages/node-ui && pnpm vitest run test/dashboard-session-gate.test.ts test/dashboard-session-client.test.ts --reporter=dot (10 tests, final hardening)
• cd packages/node-ui && pnpm exec tsc --noEmit --pretty false
• pnpm --filter @origintrail-official/dkg-node-ui run build