feat: adopt passkey-first bootstrap and opencoder defaults

Author: pRizz

README.md

@@ -155,7 +155,8 @@ occ start
 ```
 
 If this is the first startup with no configured users, the container logs will print an **Initial One-Time Password (IOTP)**.
-Open the login page, use the first-time setup panel, and create your first account. The IOTP is invalidated after successful signup.
+Open the login page, use the first-time setup panel, and enroll a passkey for the default `opencoder` account.
+The IOTP is invalidated after successful passkey enrollment.
 
 Quick IOTP extraction from logs:
 
@@ -266,7 +267,7 @@ occ mount clean --force
 occ mount clean --purge --force
 
 # Mount a local project into the workspace
-occ mount add /Users/<username>/Desktop/opencode:/home/opencode/workspace
+occ mount add /Users/<username>/Desktop/opencode:/home/opencoder/workspace
 
 # Apply mount changes (you may be prompted to recreate the container)
 occ restart
@@ -276,21 +277,21 @@ occ reset host --force
 
 ### Workspace Mounts
 
-Use `/home/opencode/workspace` when you want your host project folder to appear in the
+Use `/home/opencoder/workspace` when you want your host project folder to appear in the
 web UI's project picker and inside the container workspace.
 
 Important behavior:
-- `/home/opencode/workspace` is a single mount target.
+- `/home/opencoder/workspace` is a single mount target.
 - Adding a new mount to this same target replaces the previous mount entry.
 
 Recommended workflow:
 ```bash
-occ mount add /Users/<username>/Desktop/opencode:/home/opencode/workspace
+occ mount add /Users/<username>/Desktop/opencode:/home/opencoder/workspace
 occ restart
 ```
 
 Verify the mount:
-1. Run `occ status` and check `Mounts` -> `Bind mounts` includes your host path mapped to `/home/opencode/workspace`.
+1. Run `occ status` and check `Mounts` -> `Bind mounts` includes your host path mapped to `/home/opencoder/workspace`.
 2. In the web UI, open the project picker and confirm your project files appear under `~/workspace`.
 
 ### Container Mode
@@ -321,7 +322,7 @@ to request an update.
 
 Default paths (with default bind mounts enabled):
 - Host: `~/.local/state/opencode/opencode-cloud/commands/update-command.json`
-- Container: `/home/opencode/.local/state/opencode/opencode-cloud/commands/update-command.json`
+- Container: `/home/opencoder/.local/state/opencode/opencode-cloud/commands/update-command.json`
 
 Example payload:
 ```json
@@ -353,12 +354,17 @@ First boot path:
 - If no users are configured, startup logs print an Initial One-Time Password (IOTP).
 - Extract only the IOTP quickly: `occ logs | grep -F "INITIAL ONE-TIME PASSWORD (IOTP): " | tail -n1 | sed 's/.*INITIAL ONE-TIME PASSWORD (IOTP): //'`
 - Enter that IOTP in the web login page first-time setup panel.
-- Complete signup (username + password) to create the first Linux user account in the container.
-- The IOTP is deleted after the first successful signup.
+- Enroll a passkey for the default `opencoder` account.
+- The IOTP is deleted after successful passkey enrollment.
 
 Admin path:
 - You can always create/manage users directly via `occ user add`, `occ user passwd`, and related user commands.
 
+Login UX:
+- Passkey sign-in is the primary option on the login page.
+- Username/password sign-in remains available as fallback.
+- 2FA setup/management is available from the upper-right session menu after login.
+
 ### Creating Users
 
 Create a user with a password:

docs/deploy/digitalocean-droplet.md

@@ -70,7 +70,7 @@ Pull and start the sandbox image:
 occ start --pull-sandbox-image
 ```
 
-### 6) Complete first-time signup with Initial One-Time Password (IOTP)
+### 6) Complete first-time setup with Initial One-Time Password (IOTP)
 
 After `occ start`, check logs for the IOTP:
 
@@ -86,10 +86,10 @@ occ logs | grep -F "INITIAL ONE-TIME PASSWORD (IOTP): " | tail -n1 | sed 's/.*IN
 
 Open the web login page through your SSH tunnel and use the first-time setup panel:
 - Enter the IOTP from logs
-- Choose username + password
-- Submit signup (this creates the first Linux user inside the container)
+- Continue to passkey setup
+- Enroll a passkey for the default `opencoder` account
 
-The IOTP is invalidated after successful signup.
+The IOTP is invalidated after successful passkey enrollment.
 
 Admin fallback:
 
@@ -247,11 +247,11 @@ docker volume create opencode-users
 docker run -d --name opencode-cloud-sandbox \
   --restart unless-stopped \
   -p 127.0.0.1:3000:3000 \
-  -v opencode-data:/home/opencode/.local/share/opencode \
-  -v opencode-state:/home/opencode/.local/state/opencode \
-  -v opencode-cache:/home/opencode/.cache/opencode \
-  -v opencode-workspace:/home/opencode/workspace \
-  -v opencode-config:/home/opencode/.config/opencode \
+  -v opencode-data:/home/opencoder/.local/share/opencode \
+  -v opencode-state:/home/opencoder/.local/state/opencode \
+  -v opencode-cache:/home/opencoder/.cache/opencode \
+  -v opencode-workspace:/home/opencoder/workspace \
+  -v opencode-config:/home/opencoder/.config/opencode \
   -v opencode-users:/var/lib/opencode-users \
   prizz/opencode-cloud-sandbox:15.2.0
 ```
@@ -283,7 +283,7 @@ Extract only the IOTP value:
 docker logs opencode-cloud-sandbox 2>&1 | grep -F "INITIAL ONE-TIME PASSWORD (IOTP): " | tail -n1 | sed 's/.*INITIAL ONE-TIME PASSWORD (IOTP): //'
 ```
 
-Use the login page first-time setup panel with that IOTP, then create your username/password.
+Use the login page first-time setup panel with that IOTP, then enroll a passkey for `opencoder`.
 
 ### 5) Expose publicly (optional)
 

docs/update-flow.md

@@ -37,14 +37,14 @@ processed. Ensure the service is installed and running.
 The command file lives under the state bind mount. With default mounts, the paths are:
 
 - Host: `~/.local/state/opencode/opencode-cloud/commands/update-command.json`
-- Container: `/home/opencode/.local/state/opencode/opencode-cloud/commands/update-command.json`
+- Container: `/home/opencoder/.local/state/opencode/opencode-cloud/commands/update-command.json`
 - Result file (host): `~/.local/state/opencode/opencode-cloud/commands/update-command.result.json`
-- Result file (container): `/home/opencode/.local/state/opencode/opencode-cloud/commands/update-command.result.json`
+- Result file (container): `/home/opencoder/.local/state/opencode/opencode-cloud/commands/update-command.result.json`
 
 If you customize mounts, the container path is still under:
 
 ```
-/home/opencode/.local/state/opencode/opencode-cloud/commands/
+/home/opencoder/.local/state/opencode/opencode-cloud/commands/
 ```
 
 ## Command File Contract

packages/cli-rust/src/commands/container/users.rs

@@ -18,7 +18,7 @@ use std::path::Path;
 use std::process::Command;
 
 const USERS_STORE_DIR: &str = MOUNT_USERS;
-const PROTECTED_USER: &str = "opencode";
+const PROTECTED_USER: &str = "opencoder";
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 struct PersistedUserRecord {
@@ -60,7 +60,7 @@ async fn cmd_user_add_container(args: &UserAddArgs, quiet: bool, _verbose: u8) -
     } else {
         Input::new()
             .with_prompt("Username")
-            .default("opencode".to_string())
+            .default("admin".to_string())
             .validate_with(|input: &String| validate_username(input))
             .interact_text()?
     };

packages/cli-rust/src/commands/mount/add.rs

@@ -184,13 +184,13 @@ mod tests {
     #[test]
     fn upsert_mount_by_target_exact_same_is_noop() {
         let existing = vec![
-            "/host/a:/home/opencode/workspace".to_string(),
-            "/host/b:/home/opencode/.cache/opencode".to_string(),
+            "/host/a:/home/opencoder/workspace".to_string(),
+            "/host/b:/home/opencoder/.cache/opencode".to_string(),
         ];
-        let parsed = ParsedMount::parse("/host/a:/home/opencode/workspace").unwrap();
+        let parsed = ParsedMount::parse("/host/a:/home/opencoder/workspace").unwrap();
 
         let (updated, outcome) =
-            upsert_mount_by_target(&existing, "/host/a:/home/opencode/workspace", &parsed);
+            upsert_mount_by_target(&existing, "/host/a:/home/opencoder/workspace", &parsed);
 
         assert_eq!(updated, existing);
         assert_eq!(outcome, MountUpsertOutcome::AlreadyConfigured);
@@ -199,26 +199,26 @@ mod tests {
     #[test]
     fn upsert_mount_by_target_replaces_same_target_with_new_host() {
         let existing = vec![
-            "/host/old:/home/opencode/workspace".to_string(),
-            "/host/cache:/home/opencode/.cache/opencode".to_string(),
+            "/host/old:/home/opencoder/workspace".to_string(),
+            "/host/cache:/home/opencoder/.cache/opencode".to_string(),
         ];
-        let parsed = ParsedMount::parse("/host/new:/home/opencode/workspace").unwrap();
+        let parsed = ParsedMount::parse("/host/new:/home/opencoder/workspace").unwrap();
 
         let (updated, outcome) =
-            upsert_mount_by_target(&existing, "/host/new:/home/opencode/workspace", &parsed);
+            upsert_mount_by_target(&existing, "/host/new:/home/opencoder/workspace", &parsed);
 
         assert_eq!(
             updated,
             vec![
-                "/host/cache:/home/opencode/.cache/opencode".to_string(),
-                "/host/new:/home/opencode/workspace".to_string(),
+                "/host/cache:/home/opencoder/.cache/opencode".to_string(),
+                "/host/new:/home/opencoder/workspace".to_string(),
             ]
         );
         assert_eq!(
             outcome,
             MountUpsertOutcome::Replaced {
                 replaced_mounts: vec![
-                    ParsedMount::parse("/host/old:/home/opencode/workspace").unwrap(),
+                    ParsedMount::parse("/host/old:/home/opencoder/workspace").unwrap(),
                 ],
             }
         );
@@ -227,28 +227,28 @@ mod tests {
     #[test]
     fn upsert_mount_by_target_replaces_multiple_stale_targets() {
         let existing = vec![
-            "/host/old1:/home/opencode/workspace".to_string(),
-            "/host/cache:/home/opencode/.cache/opencode".to_string(),
-            "/host/old2:/home/opencode/workspace:ro".to_string(),
+            "/host/old1:/home/opencoder/workspace".to_string(),
+            "/host/cache:/home/opencoder/.cache/opencode".to_string(),
+            "/host/old2:/home/opencoder/workspace:ro".to_string(),
         ];
-        let parsed = ParsedMount::parse("/host/new:/home/opencode/workspace").unwrap();
+        let parsed = ParsedMount::parse("/host/new:/home/opencoder/workspace").unwrap();
 
         let (updated, outcome) =
-            upsert_mount_by_target(&existing, "/host/new:/home/opencode/workspace", &parsed);
+            upsert_mount_by_target(&existing, "/host/new:/home/opencoder/workspace", &parsed);
 
         assert_eq!(
             updated,
             vec![
-                "/host/cache:/home/opencode/.cache/opencode".to_string(),
-                "/host/new:/home/opencode/workspace".to_string(),
+                "/host/cache:/home/opencoder/.cache/opencode".to_string(),
+                "/host/new:/home/opencoder/workspace".to_string(),
             ]
         );
         assert_eq!(
             outcome,
             MountUpsertOutcome::Replaced {
                 replaced_mounts: vec![
-                    ParsedMount::parse("/host/old1:/home/opencode/workspace").unwrap(),
-                    ParsedMount::parse("/host/old2:/home/opencode/workspace:ro").unwrap(),
+                    ParsedMount::parse("/host/old1:/home/opencoder/workspace").unwrap(),
+                    ParsedMount::parse("/host/old2:/home/opencoder/workspace:ro").unwrap(),
                 ],
             }
         );

packages/cli-rust/src/commands/restart.rs

@@ -287,24 +287,24 @@ mod tests {
 
     #[test]
     fn resolve_mount_mismatch_action_mismatch_quiet_returns_error() {
-        let current = vec![current_mount("/old", "/home/opencode/workspace")];
-        let configured = vec![parsed_mount("/new", "/home/opencode/workspace")];
+        let current = vec![current_mount("/old", "/home/opencoder/workspace")];
+        let configured = vec![parsed_mount("/new", "/home/opencoder/workspace")];
         let action = resolve_mount_mismatch_action(&current, &configured, true);
         assert!(matches!(action, MountMismatchAction::QuietError(_)));
     }
 
     #[test]
     fn resolve_mount_mismatch_action_mismatch_non_quiet_prompts_recreate() {
-        let current = vec![current_mount("/old", "/home/opencode/workspace")];
-        let configured = vec![parsed_mount("/new", "/home/opencode/workspace")];
+        let current = vec![current_mount("/old", "/home/opencoder/workspace")];
+        let configured = vec![parsed_mount("/new", "/home/opencoder/workspace")];
         let action = resolve_mount_mismatch_action(&current, &configured, false);
         assert_eq!(action, MountMismatchAction::PromptRecreate);
     }
 
     #[test]
     fn resolve_mount_mismatch_action_no_mismatch() {
-        let current = vec![current_mount("/same", "/home/opencode/workspace")];
-        let configured = vec![parsed_mount("/same", "/home/opencode/workspace")];
+        let current = vec![current_mount("/same", "/home/opencoder/workspace")];
+        let configured = vec![parsed_mount("/same", "/home/opencoder/workspace")];
         let action = resolve_mount_mismatch_action(&current, &configured, false);
         assert_eq!(action, MountMismatchAction::NoMismatch);
     }

packages/cli-rust/src/commands/update.rs

@@ -1540,15 +1540,15 @@ git fetch --depth 1 origin "$OPENCODE_REF"
 
 mkdir -p /opt/opencode
 git rev-parse HEAD > /opt/opencode/COMMIT
-chown opencode:opencode /opt/opencode/COMMIT
+chown opencoder:opencoder /opt/opencode/COMMIT
 
-runuser -u opencode -- bash -lc 'export PATH="/home/opencode/.bun/bin:$PATH"; cd /tmp/opencode-repo; bun install --frozen-lockfile; cd packages/opencode; bun run build-single-ui'
-runuser -u opencode -- bash -lc '. /home/opencode/.cargo/env; cd /tmp/opencode-repo/packages/opencode-broker; cargo build --release'
+runuser -u opencoder -- bash -lc 'export PATH="/home/opencoder/.bun/bin:$PATH"; cd /tmp/opencode-repo; bun install --frozen-lockfile; cd packages/opencode; bun run build-single-ui'
+runuser -u opencoder -- bash -lc '. /home/opencoder/.cargo/env; cd /tmp/opencode-repo/packages/opencode-broker; cargo build --release'
 
 mkdir -p /opt/opencode/bin /opt/opencode/ui
 cp /tmp/opencode-repo/packages/opencode/dist/opencode-*/bin/opencode /opt/opencode/bin/opencode
 cp -R /tmp/opencode-repo/packages/opencode/dist/opencode-*/ui/. /opt/opencode/ui/
-chown -R opencode:opencode /opt/opencode
+chown -R opencoder:opencoder /opt/opencode
 chmod +x /opt/opencode/bin/opencode
 cp /tmp/opencode-repo/packages/opencode-broker/target/release/opencode-broker /usr/local/bin/opencode-broker
 chmod 4755 /usr/local/bin/opencode-broker

packages/cli-rust/src/commands/user/add.rs

@@ -18,7 +18,7 @@ use opencode_cloud_core::{load_config_or_default, save_config};
     after_help = "Tip: Press Enter at the password prompt to auto-generate and display a secure password, or use --generate (-g) for non-interactive use."
 )]
 pub struct UserAddArgs {
-    /// Username to create (default: opencode if not provided)
+    /// Username to create (default: admin if not provided)
     pub username: Option<String>,
 
     /// Generate a random secure password instead of prompting
@@ -68,7 +68,7 @@ pub async fn cmd_user_add(
     } else {
         Input::new()
             .with_prompt("Username")
-            .default("opencode".to_string())
+            .default("admin".to_string())
             .validate_with(|input: &String| validate_username(input))
             .interact_text()?
     };

packages/cli-rust/src/commands/user/remove.rs

@@ -23,7 +23,7 @@ pub struct UserRemoveArgs {
 }
 
 /// System user that cannot be removed (container depends on it)
-const PROTECTED_USER: &str = "opencode";
+const PROTECTED_USER: &str = "opencoder";
 
 /// Remove a user from the container
 pub async fn cmd_user_remove(