v2.3.0: Secure Admin Bootstrap System

Features

Secure Admin Bootstrap System

• New src/admin_bootstrap.py that solves the chicken-egg problem of needing credentials to access the vault that stores credentials
• ChaCha20-Poly1305 encryption for credential storage
• bcrypt password hashing for admin authentication
• Bootstrap key system for disaster recovery
• Credentials displayed only once during first-run initialization

Security Improvements

• Removed all hardcoded credentials (admin123, demo passwords, etc.)
• Vault-based authentication for admin panel
• JWT tokens generated using secure secrets from vault
• Admin credentials now stored encrypted in data/admin_credentials.db

API Enhancements

• New /api/v1/vault/unlock endpoint for vault.html compatibility
• New /api/v1/vault/credentials endpoints (GET, POST, PUT, DELETE)
• Admin setup endpoints for first-run initialization

Bug Fixes

• Fixed duplicate authenticatedFetch declaration in admin UI
• Fixed JavaScript errors in dashboard stats loading

Breaking Changes

• Admin panel now requires initialization on first run
• Old hardcoded credentials will no longer work
• Run the server and navigate to /admin/ to initialize the system

Upgrading

After upgrading, the admin system will require initialization:

1. Start the server: python src/remote_mcp_server.py
2. Navigate to http://localhost:8900/admin/
3. If first run, you'll see initialization prompts
4. Save the displayed credentials - they are shown only once!

If you have an existing installation with initialized credentials, the system will use those automatically.