fix: persist WebUI credentials + auto-setup on startup

- Symlink ~/.hermes-webui/ to /data/hermes/webui/ for persistence
- Auto-migrate existing credentials to persistent storage
- Auto-setup credentials after BFF starts if not configured
- Default: admin / Hermes2026 (configurable via env vars)

start.sh

@@ -21,6 +21,23 @@ done
 
 echo "Persistent storage ready."
 
+# ── Persist WebUI credentials across rebuilds ──
+WEBUI_HOME="/root/.hermes-web-ui"
+WEBUI_DATA="/data/hermes/webui"
+mkdir -p "$WEBUI_DATA"
+if [ ! -L "$WEBUI_HOME" ] && [ -d "$WEBUI_HOME" ]; then
+    # Migrate existing credentials to persistent storage
+    if [ -f "$WEBUI_HOME/.credentials" ] && [ ! -f "$WEBUI_DATA/.credentials" ]; then
+        cp "$WEBUI_HOME/.credentials" "$WEBUI_DATA/.credentials"
+        echo "Migrated WebUI credentials to persistent storage"
+    fi
+    rm -rf "$WEBUI_HOME"
+fi
+if [ ! -L "$WEBUI_HOME" ]; then
+    ln -sf "$WEBUI_DATA" "$WEBUI_HOME"
+    echo "Symlink: hermes-web-ui -> $WEBUI_DATA"
+fi
+
 # ── Clean up stale PID/lock files from previous crash ──
 echo "Cleaning up stale state..."
 rm -f "$HERMES_HOME/gateway.pid" 2>/dev/null
@@ -88,6 +105,28 @@ for i in $(seq 1 15); do
     sleep 2
 done
 
+# ── Auto-setup WebUI credentials if not configured ──
+AUTH_TOKEN="${AUTH_TOKEN:-hermes-bot-2026}"
+WEBUI_USER="${WEBUI_USERNAME:-admin}"
+WEBUI_PASS="${WEBUI_PASSWORD:-Hermes2026}"
+AUTH_STATUS=$(curl -s http://127.0.0.1:6060/api/auth/status 2>/dev/null)
+HAS_PW=$(echo "$AUTH_STATUS" | python3 -c "import json,sys; print(json.load(sys.stdin).get('hasPasswordLogin',False))" 2>/dev/null)
+if [ "$HAS_PW" = "False" ]; then
+    echo "[$(date)] WebUI: No credentials configured, auto-setting up..."
+    SETUP_RESULT=$(curl -s -w "\n%{http_code}" -X POST http://127.0.0.1:6060/api/auth/setup \
+        -H "Content-Type: application/json" \
+        -H "Authorization: Bearer $AUTH_TOKEN" \
+        -d "{\"username\":\"$WEBUI_USER\",\"password\":\"$WEBUI_PASS\"}" 2>/dev/null)
+    SETUP_CODE=$(echo "$SETUP_RESULT" | tail -1)
+    if [ "$SETUP_CODE" = "200" ]; then
+        echo "[$(date)] WebUI: Credentials auto-configured (user: $WEBUI_USER)"
+    else
+        echo "[$(date)] WebUI: Auto-setup failed: $SETUP_RESULT"
+    fi
+else
+    echo "[$(date)] WebUI: Credentials already configured"
+fi
+
 echo ""
 echo "=== All services started ==="
 echo "  Gateway:  http://127.0.0.1:8642 (with Python watchdog in entry.py)"