Land the admin password management and managed-interpreter path fix that Dev main already pins and runs.
Why:
Dev main pins modules/backend at b00e192 (Dev PR #606, deployed to 8788/ECS), but that commit only lives on fix/execenv-python-sandbox-path / feature/auth-one-time-password; Backend main never received it. Any Dev pin back to Backend main (next: U8 #210) would silently roll back admin password creation/reset.
No new code: the three commits were reviewed and verified in Dev task feature-auth-password-management and feature-execenv-python-sandbox-path (archived cards on Dev main).
What (relative to merge base ab12fea4):
b8b3493 Enable admin password creation and reset: POST /api/admin/users accepts an optional password or returns a generated initialPassword (Cache-Control: no-store); admin reset returns a random temporaryPassword with mustChangePassword; Store.CreateAdminPasswordAccount writes account, hash and audit in one transaction.
5f65059 Clarify admin reset contract (tests).
b00e192 Execute the managed interpreter through its real path (env doctor resolves the symlink; same intent as #207 already on main, merges cleanly).
Evidence:
git merge-tree main+b00e192 and U8(7b379d2)+b00e192: no conflicts.
Host local verification (SELF) of the combined tree main+U8+this branch: GOWORK=off go build ./... && go vet ./... && go test -count=1 ./... all packages ok (pkg/identity TestDSNFileMode needs umask 022; local umask 0077 makes the 0644 fixture 0600 — environment-only, passes in CI).
Authoritative: this PR's CI.
Impact:
Backend main catches up with what Dev already runs; no behavior change for deployed Dev.
Refs:
Dev PR #606; Backend #210 (U8 r2, merges after this)
Land the admin password management and managed-interpreter path fix that Dev main already pins and runs.
Why:
- Dev main pins `modules/backend` at `b00e192` (Dev PR #606, deployed to 8788/ECS), but that commit only lives on `fix/execenv-python-sandbox-path` / `feature/auth-one-time-password`; Backend main never received it. Any Dev pin back to Backend main (next: U8 #210) would silently roll back admin password creation/reset.
- No new code: the three commits were reviewed and verified in Dev task `feature-auth-password-management` and `feature-execenv-python-sandbox-path` (archived cards on Dev main).
What (relative to merge base `ab12fea4`):
- `b8b3493` Enable admin password creation and reset: `POST /api/admin/users` accepts an optional `password` or returns a generated `initialPassword` (`Cache-Control: no-store`); admin reset returns a random `temporaryPassword` with `mustChangePassword`; `Store.CreateAdminPasswordAccount` writes account, hash and audit in one transaction.
- `5f65059` Clarify admin reset contract (tests).
- `b00e192` Execute the managed interpreter through its real path (`env doctor` resolves the symlink; same intent as #207 already on main, merges cleanly).
Evidence:
- `git merge-tree` main+b00e192 and U8(7b379d2)+b00e192: no conflicts.
- Host local verification (SELF) of the combined tree main+U8+this branch: `GOWORK=off go build ./... && go vet ./... && go test -count=1 ./...` all packages ok (`pkg/identity` TestDSNFileMode needs umask 022; local umask 0077 makes the 0644 fixture 0600 — environment-only, passes in CI).
- Authoritative: this PR's CI.
Impact:
- Backend main catches up with what Dev already runs; no behavior change for deployed Dev.
Refs:
- Dev PR #606; Backend #210 (U8 r2, merges after this)
Why: the sandbox hides /home and only remounts the resolved Python prefix, so executing python/current/bin/python3 failed before the base layer could be imported.
Evidence: go test ./internal/tools/ -run TestResolveInterpreterFollowsManagedSymlink passed, and env doctor against the built base layer printed doctor ok (SELF).
Impact: run_python and env doctor follow the symlink into the mounted prefix or /usr/bin/python3. The layer and the prefix mount stay the same.
Refs: Agent-System-Backend PR 207
Co-authored-by: Cursor <cursoragent@cursor.com>
(cherry picked from commit 28544cfe5d)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Land the admin password management and managed-interpreter path fix that Dev main already pins and runs.
Why:
modules/backendatb00e192(Dev PR #606, deployed to 8788/ECS), but that commit only lives onfix/execenv-python-sandbox-path/feature/auth-one-time-password; Backend main never received it. Any Dev pin back to Backend main (next: U8 #210) would silently roll back admin password creation/reset.feature-auth-password-managementandfeature-execenv-python-sandbox-path(archived cards on Dev main).What (relative to merge base
ab12fea4):b8b3493Enable admin password creation and reset:POST /api/admin/usersaccepts an optionalpasswordor returns a generatedinitialPassword(Cache-Control: no-store); admin reset returns a randomtemporaryPasswordwithmustChangePassword;Store.CreateAdminPasswordAccountwrites account, hash and audit in one transaction.5f65059Clarify admin reset contract (tests).b00e192Execute the managed interpreter through its real path (env doctorresolves the symlink; same intent as #207 already on main, merges cleanly).Evidence:
git merge-treemain+b00e192 and U8(7b379d2)+b00e192: no conflicts.GOWORK=off go build ./... && go vet ./... && go test -count=1 ./...all packages ok (pkg/identityTestDSNFileMode needs umask 022; local umask 0077 makes the 0644 fixture 0600 — environment-only, passes in CI).Impact:
Refs: