sync: update from private repo (2336949a)

docker-compose.yml

@@ -12,13 +12,15 @@ services:
     shm_size: "1gb"
     ports:
       # Published on ALL host interfaces so a Docker host is reachable from your
-      # LAN out of the box (the common case for a headless server). This means a
-      # fresh instance is exposed: the agent API includes the Bash tool, so an
-      # UNAUTHENTICATED instance on the network is effectively remote code
-      # execution. Before leaving it up on a shared/untrusted network, enable
-      # auth (`auth` in config.yaml), `safety.bash_sandbox: always`, and TLS —
-      # see docs/docker.md "Going beyond localhost". To keep it local-only
-      # instead, change this to "127.0.0.1:9876:9876".
+      # LAN out of the box (the common case for a headless server). Because the
+      # agent API includes the Bash tool, an UNAUTHENTICATED instance on the
+      # network is effectively remote code execution — so a FRESH install that
+      # binds a non-loopback interface now boots WITH a login: it generates an
+      # admin account and prints the password at startup (#1024, see
+      # src/bridge/initial-admin.ts and docs/docker.md "Quick start"). That is
+      # the floor, not a finished setup: also set `safety.bash_sandbox: always`
+      # and terminate TLS before a shared/untrusted network. To keep it
+      # local-only instead, change this to "127.0.0.1:9876:9876".
       - "9876:9876"
     extra_hosts:
       - "host.docker.internal:host-gateway"
@@ -43,6 +45,9 @@ services:
       - maestro-workspaces:/workspaces
       # config.yaml をホストから永続化したい場合は bind-mount (書き込み可)。
       # Settings UI / npm run setup で書き換えるなら :ro は付けないこと。
+      # :ro を付けた新規インストールは、認証設定を書けないため起動を拒否する
+      # (#1024)。bind-mount しない場合、コンテナを作り直すと config.yaml は
+      # イメージの初期状態に戻る。認証だけは起動時に自動で復旧する。
       # - ./config.yaml:/app/config.yaml
     healthcheck:
       test: ["CMD", "node", "-e", "fetch('http://localhost:9876/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]