feat: P0 commercial readiness — password security, legal, account management

Backend changes for Phase A of v1.0 commercial launch: P0-3: Password Security - Remove hardcoded admin/123456 defaults from 34+ bootstrap scripts - Add PLATFORM_USERNAME/PLATFORM_PASSWORD env vars to config - Add PUT /api/v1/auth/change-password endpoint (requires old password) P0-1: User Agreement & Privacy Policy - Add agreed_terms/agreed_terms_version/agreed_terms_at to User model - New GET /api/v1/legal/privacy and GET /api/v1/legal/terms endpoints - New POST /api/v1/legal/agree endpoint to record consent - Register endpoint now validates agreed_terms must be True P0-6: Account Management - Add phone/status/is_email_verified to User model - Add DELETE /api/v1/auth/account for account deletion (with password confirmation) - Add PUT /api/v1/auth/phone for phone binding - Reject authentication for deleted accounts (status=deleted) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-07-01 22:01:54 +08:00
parent 96394c4b9f
commit 41ffd31923
46 changed files with 379 additions and 87 deletions
--- a/backend/scripts/bootstrap_scene_templates.py
+++ b/backend/scripts/bootstrap_scene_templates.py
@@ -22,8 +22,8 @@ from typing import Any, Dict, List, Optional, Tuple
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 TEMPLATES: List[Tuple[str, str, str]] = [
    ("模板-客服标准", "知你客服14号", "场景模板：标准客服 + 全量工具基线"),
--- a/backend/scripts/compare_homework_agents.py
+++ b/backend/scripts/compare_homework_agents.py
@@ -16,8 +16,8 @@ from typing import Any, Dict, List, Optional
 import requests

 BACKEND = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 NAMES = ["学生作业管理助手", "学生作业管理助手2号"]

--- a/backend/scripts/create_ai_learning_assistant.py
+++ b/backend/scripts/create_ai_learning_assistant.py
@@ -25,8 +25,8 @@ from typing import Any, Dict, Optional
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 AGENT_NAME = os.getenv("AGENT_NAME", "AI学习助手")
 MODEL = os.getenv("MODEL", "deepseek-v4-flash")
 PROVIDER = os.getenv("PROVIDER", "deepseek")
--- a/backend/scripts/create_complex_enterprise_agent.py
+++ b/backend/scripts/create_complex_enterprise_agent.py
@@ -159,8 +159,8 @@ def _via_requests() -> int:
    import requests

    base = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-    user = os.getenv("PLATFORM_USERNAME", "admin")
-    pwd = os.getenv("PLATFORM_PASSWORD", "123456")
+    user = os.getenv("PLATFORM_USERNAME")
+    pwd = os.getenv("PLATFORM_PASSWORD")
    wf = build_complex_workflow()
    _validate_local(wf)

@@ -250,8 +250,8 @@ def _via_testclient() -> int:
    lr = c.post(
        "/api/v1/auth/login",
        data={
-            "username": os.getenv("PLATFORM_USERNAME", "admin"),
-            "password": os.getenv("PLATFORM_PASSWORD", "123456"),
+            "username": os.getenv("PLATFORM_USERNAME"),
+            "password": os.getenv("PLATFORM_PASSWORD"),
        },
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
--- a/backend/scripts/create_education_agents_batch.py
+++ b/backend/scripts/create_education_agents_batch.py
@@ -31,8 +31,8 @@ if BACKEND_DIR not in sys.path:
    sys.path.insert(0, BACKEND_DIR)

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 PROVIDER = os.getenv(
    "EDU_LLM_PROVIDER",
--- a/backend/scripts/create_enterprise_scenario_agents.py
+++ b/backend/scripts/create_enterprise_scenario_agents.py
@@ -506,8 +506,8 @@ def main(argv: Optional[List[str]] = None) -> int:
        lr = c.post(
            "/api/v1/auth/login",
            data={
-                "username": os.getenv("PLATFORM_USERNAME", "admin"),
-                "password": os.getenv("PLATFORM_PASSWORD", "123456"),
+                "username": os.getenv("PLATFORM_USERNAME"),
+                "password": os.getenv("PLATFORM_PASSWORD"),
            },
            headers={"Content-Type": "application/x-www-form-urlencoded"},
        )
@@ -534,8 +534,8 @@ def main(argv: Optional[List[str]] = None) -> int:
        lr = requests.post(
            f"{base}/api/v1/auth/login",
            data={
-                "username": os.getenv("PLATFORM_USERNAME", "admin"),
-                "password": os.getenv("PLATFORM_PASSWORD", "123456"),
+                "username": os.getenv("PLATFORM_USERNAME"),
+                "password": os.getenv("PLATFORM_PASSWORD"),
            },
            headers={"Content-Type": "application/x-www-form-urlencoded"},
            timeout=20,
--- a/backend/scripts/create_gov_media_agents_batch.py
+++ b/backend/scripts/create_gov_media_agents_batch.py
@@ -30,8 +30,8 @@ if BACKEND_DIR not in sys.path:
    sys.path.insert(0, BACKEND_DIR)

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 PROVIDER = os.getenv(
    "CROSS_LLM_PROVIDER",
--- a/backend/scripts/create_homework_manager_agent.py
+++ b/backend/scripts/create_homework_manager_agent.py
@@ -34,8 +34,8 @@ if BACKEND_DIR not in sys.path:
    sys.path.insert(0, BACKEND_DIR)

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 AGENT_NAME = os.getenv("AGENT_NAME", "学生作业管理助手")
 FAST_PROFILE = "2号" in AGENT_NAME or os.getenv("HOMEWORK_FAST_AGENT", "").strip().lower() in (
    "1",
--- a/backend/scripts/create_intelligent_tutor_agent.py
+++ b/backend/scripts/create_intelligent_tutor_agent.py
@@ -24,8 +24,8 @@ if BACKEND_DIR not in sys.path:
    sys.path.insert(0, BACKEND_DIR)

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 AGENT_NAME = os.getenv("AGENT_NAME", "智能助教")

 PROVIDER = os.getenv("TUTOR_LLM_PROVIDER", os.getenv("ENTERPRISE_LLM_PROVIDER", "deepseek"))
--- a/backend/scripts/create_learning_assistant_agent.py
+++ b/backend/scripts/create_learning_assistant_agent.py
@@ -29,8 +29,8 @@ from typing import Any, Dict, List, Optional
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 AGENT_NAME = os.getenv("AGENT_NAME", "智能学习助手(KG+RAG)")
 SUBJECT = os.getenv("SUBJECT", "通用")
 LEVEL = os.getenv("LEVEL", "中级")
--- a/backend/scripts/create_learning_assistant_agent_v1.py
+++ b/backend/scripts/create_learning_assistant_agent_v1.py
@@ -33,8 +33,8 @@ from typing import Any, Dict, Optional
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 AGENT_NAME = os.getenv("AGENT_NAME", "智能学习助手1号")
 SUBJECT = os.getenv("SUBJECT", "通用")
 LEVEL = os.getenv("LEVEL", "中级")
--- a/backend/scripts/create_main_agent.py
+++ b/backend/scripts/create_main_agent.py
@@ -23,8 +23,8 @@ from typing import Any, Dict, Optional
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 SOURCE_NAME = os.getenv("SOURCE_AGENT_NAME", "知你客服14号")
 TARGET_NAME = os.getenv("TARGET_NAME", "主控台Main Agent")

--- a/backend/scripts/create_router_invoke_demo_agent.py
+++ b/backend/scripts/create_router_invoke_demo_agent.py
@@ -29,8 +29,8 @@ from typing import Any, Dict, List, Optional
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 CHILD_AGENT_NAME = os.getenv("CHILD_AGENT_NAME", "知你客服16号")
 DEMO_AGENT_NAME = os.getenv("DEMO_AGENT_NAME", "演示-主链路委派invoke")

--- a/backend/scripts/create_zhini_kefu_10.py
+++ b/backend/scripts/create_zhini_kefu_10.py
@@ -20,8 +20,8 @@ import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
 SOURCE_AGENT_ID = os.getenv("ZHINI_9_AGENT_ID", "de5932d6-3c05-4b27-ab08-f6cb403ce4b9")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 NEW_NAME = "知你客服10号"
 NEW_DESC = (
--- a/backend/scripts/create_zhini_kefu_11.py
+++ b/backend/scripts/create_zhini_kefu_11.py
@@ -16,8 +16,8 @@ import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
 SOURCE_AGENT_ID = os.getenv("ZHINI_10_AGENT_ID", "c853482b-d298-44e4-9862-c84318f71abb")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 NEW_NAME = "知你客服11号"
 NEW_DESC = (
--- a/backend/scripts/create_zhini_kefu_12.py
+++ b/backend/scripts/create_zhini_kefu_12.py
@@ -16,8 +16,8 @@ import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
 SOURCE_AGENT_ID = os.getenv("ZHINI_11_AGENT_ID", "d39748ad-277f-48ac-9eb5-168ad2f1b470")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 NEW_NAME = "知你客服12号"
 NEW_DESC = (
--- a/backend/scripts/create_zhini_kefu_13.py
+++ b/backend/scripts/create_zhini_kefu_13.py
@@ -27,8 +27,8 @@ from typing import Any, Dict, List, Optional, Tuple
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 SOURCE_NAME = os.getenv("SOURCE_AGENT_NAME", "知你客服12号")
 TARGET_NAME = os.getenv("TARGET_NAME", "知你客服13号")

--- a/backend/scripts/create_zhini_kefu_14.py
+++ b/backend/scripts/create_zhini_kefu_14.py
@@ -27,8 +27,8 @@ from typing import Any, Dict, List, Optional, Tuple
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 SOURCE_NAME = os.getenv("SOURCE_AGENT_NAME", "知你客服13号")
 TARGET_NAME = os.getenv("TARGET_NAME", "知你客服14号")

--- a/backend/scripts/create_zhini_kefu_15.py
+++ b/backend/scripts/create_zhini_kefu_15.py
@@ -26,8 +26,8 @@ from typing import Any, Dict, List, Optional, Tuple
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 SOURCE_NAME = os.getenv("SOURCE_AGENT_NAME", "知你客服14号")
 TARGET_NAME = os.getenv("TARGET_NAME", "知你客服15号")

--- a/backend/scripts/create_zhini_kefu_16.py
+++ b/backend/scripts/create_zhini_kefu_16.py
@@ -29,8 +29,8 @@ from typing import Any, Dict, List, Optional, Tuple
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 SOURCE_NAME = os.getenv("SOURCE_AGENT_NAME", "知你客服15号")
 TARGET_NAME = os.getenv("TARGET_NAME", "知你客服16号")

--- a/backend/scripts/create_zhini_kefu_17.py
+++ b/backend/scripts/create_zhini_kefu_17.py
@@ -24,8 +24,8 @@ from typing import Any, Dict, List, Optional, Tuple
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 SOURCE_NAME = os.getenv("SOURCE_AGENT_NAME", "知你客服15号")
 TARGET_NAME = os.getenv("TARGET_NAME", "知你客服17号")

--- a/backend/scripts/create_zhini_kefu_7.py
+++ b/backend/scripts/create_zhini_kefu_7.py
@@ -17,8 +17,8 @@ import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
 SOURCE_AGENT_ID = os.getenv("ZHINI_6_AGENT_ID", "2acc84d5-814b-4d61-9703-94a4b117375f")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 NEW_NAME = "知你客服7号"
 NEW_DESC = (
--- a/backend/scripts/create_zhini_kefu_8.py
+++ b/backend/scripts/create_zhini_kefu_8.py
@@ -19,8 +19,8 @@ import requests
 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
 # 默认从 7 号复制；也可通过环境变量指定
 SOURCE_AGENT_ID = os.getenv("ZHINI_7_AGENT_ID", "688c2c41-dcd1-4285-b193-6bed00c485c2")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 NEW_NAME = "知你客服8号"
 NEW_DESC = (
--- a/backend/scripts/create_zhini_kefu_9.py
+++ b/backend/scripts/create_zhini_kefu_9.py
@@ -20,8 +20,8 @@ import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
 SOURCE_AGENT_ID = os.getenv("ZHINI_8_AGENT_ID", "d7b64bf6-c8e3-4dc7-befc-03a98d5ff741")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 NEW_NAME = "知你客服9号"
 NEW_DESC = (
--- a/backend/scripts/debug_cache_query.py
+++ b/backend/scripts/debug_cache_query.py
@@ -1,3 +1,4 @@
+import os
 """单次执行后打印 cache-query 与 llm-unified 输出，用于排查记忆。"""
 import json
 import requests
@@ -9,7 +10,7 @@ MSG = "我叫李小红"

 r = requests.post(
    B + "/api/v1/auth/login",
-    data={"username": "admin", "password": "123456"},
+    data={"username": os.getenv("PLATFORM_USERNAME"), "password": os.getenv("PLATFORM_PASSWORD")},
    headers={"Content-Type": "application/x-www-form-urlencoded"},
    timeout=15,
 )
--- a/backend/scripts/e2e_enterprise_multilane_agent.py
+++ b/backend/scripts/e2e_enterprise_multilane_agent.py
@@ -42,8 +42,8 @@ def _login_requests(base: str) -> Dict[str, str]:
    r = requests.post(
        f"{base}/api/v1/auth/login",
        data={
-            "username": os.getenv("PLATFORM_USERNAME", "admin"),
-            "password": os.getenv("PLATFORM_PASSWORD", "123456"),
+            "username": os.getenv("PLATFORM_USERNAME"),
+            "password": os.getenv("PLATFORM_PASSWORD"),
        },
        headers={"Content-Type": "application/x-www-form-urlencoded"},
        timeout=20,
@@ -189,8 +189,8 @@ def _run_testclient() -> int:
    r = c.post(
        "/api/v1/auth/login",
        data={
-            "username": os.getenv("PLATFORM_USERNAME", "admin"),
-            "password": os.getenv("PLATFORM_PASSWORD", "123456"),
+            "username": os.getenv("PLATFORM_USERNAME"),
+            "password": os.getenv("PLATFORM_PASSWORD"),
        },
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
--- a/backend/scripts/e2e_platform_capability_smoke.py
+++ b/backend/scripts/e2e_platform_capability_smoke.py
@@ -26,8 +26,8 @@ from typing import Any, Dict
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")


 def _h() -> Dict[str, str]:
--- a/backend/scripts/e2e_platform_capability_smoke_testclient.py
+++ b/backend/scripts/e2e_platform_capability_smoke_testclient.py
@@ -23,7 +23,7 @@ def main() -> int:
    c = TestClient(app)
    r = c.post(
        "/api/v1/auth/login",
-        data={"username": os.getenv("PLATFORM_USERNAME", "admin"), "password": os.getenv("PLATFORM_PASSWORD", "123456")},
+        data={"username": os.getenv("PLATFORM_USERNAME"), "password": os.getenv("PLATFORM_PASSWORD")},
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    if r.status_code != 200:
--- a/backend/scripts/e2e_router_invoke_demo.py
+++ b/backend/scripts/e2e_router_invoke_demo.py
@@ -19,8 +19,8 @@ from typing import Any, Dict, Optional
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")
 DEMO_AGENT_NAME = os.getenv("DEMO_AGENT_NAME", "演示-主链路委派invoke")


--- a/backend/scripts/e2e_subworkflow_chain.py
+++ b/backend/scripts/e2e_subworkflow_chain.py
@@ -14,8 +14,8 @@ from typing import Any, Dict, Optional
 import requests

 BASE = os.getenv("PLATFORM_BASE_URL", "http://127.0.0.1:8037").rstrip("/")
-USER = os.getenv("PLATFORM_USERNAME", "admin")
-PWD = os.getenv("PLATFORM_PASSWORD", "123456")
+USER = os.getenv("PLATFORM_USERNAME")
+PWD = os.getenv("PLATFORM_PASSWORD")

 CHILD_NAME = "E2E-Subworkflow-Child"
 PARENT_NAME = "E2E-Subworkflow-Parent"
--- a/backend/scripts/generate_android_agent.py
+++ b/backend/scripts/generate_android_agent.py
@@ -15,7 +15,7 @@ from datetime import datetime
 import uuid


-def generate_android_agent(db: Session, username: str = "admin"):
+def generate_android_agent(db: Session, username: str | None = None):
    """生成Android应用开发助手Agent"""
    print("=" * 60)
    print("生成Android应用开发助手Agent")
@@ -385,7 +385,7 @@ def main():
    """主函数"""
    db = SessionLocal()
    try:
-        generate_android_agent(db, username="admin")
+        generate_android_agent(db, username=os.getenv("PLATFORM_USERNAME"))
    finally:
        db.close()

--- a/backend/scripts/generate_batch_agents.py
+++ b/backend/scripts/generate_batch_agents.py
@@ -524,7 +524,7 @@ def generate_creative_writing_agent(db: Session, user: User):
    }


-def generate_batch_agents(db: Session, username: str = "admin"):
+def generate_batch_agents(db: Session, username: str | None = None):
    """批量生成Agent"""
    print("=" * 60)
    print("批量生成Agent")
@@ -617,7 +617,7 @@ def main():
    """主函数"""
    db = SessionLocal()
    try:
-        generate_batch_agents(db, username="admin")
+        generate_batch_agents(db, username=os.getenv("PLATFORM_USERNAME"))
    finally:
        db.close()

--- a/backend/scripts/generate_chat_agent.py
+++ b/backend/scripts/generate_chat_agent.py
@@ -490,7 +490,7 @@ def main():
    db = SessionLocal()
    try:
        # 获取或创建测试用户
-        user = db.query(User).filter(User.username == "admin").first()
+        user = db.query(User).filter(User.username == os.getenv("PLATFORM_USERNAME")).first()
        if not user:
            print("请先创建admin用户")
            return
--- a/backend/scripts/generate_complex_agent.py
+++ b/backend/scripts/generate_complex_agent.py
@@ -15,7 +15,7 @@ from datetime import datetime
 import uuid


-def generate_complex_agent_with_templates(db: Session, username: str = "admin"):
+def generate_complex_agent_with_templates(db: Session, username: str | None = None):
    """生成包含多个节点模板的复杂Agent"""
    print("=" * 60)
    print("生成复杂Agent（包含多个节点模板）")
@@ -292,7 +292,7 @@ if __name__ == "__main__":
    parser.add_argument(
        "--username",
        type=str,
-        default="admin",
+        default=None,
        help="创建Agent的用户名（默认: admin）"
    )
    
--- a/backend/scripts/generate_content_agent.py
+++ b/backend/scripts/generate_content_agent.py
@@ -17,7 +17,7 @@ import uuid
 import json


-def generate_content_agent(db: Session, username: str = "admin"):
+def generate_content_agent(db: Session, username: str | None = None):
    """生成内容生成助手Agent"""
    print("=" * 60)
    print("生成内容生成助手Agent")
@@ -479,7 +479,7 @@ if __name__ == "__main__":
    import argparse
    
    parser = argparse.ArgumentParser(description="生成内容生成助手Agent")
-    parser.add_argument("--username", type=str, default="admin", help="用户名")
+    parser.add_argument("--username", type=str, default=None, help="用户名")
    
    args = parser.parse_args()
    
--- a/backend/scripts/generate_fake_agents.py
+++ b/backend/scripts/generate_fake_agents.py
@@ -227,7 +227,7 @@ def generate_workflow_config(agent_type: str) -> dict:
        return base_configs["默认"]


-def generate_fake_agents(db: Session, username: str = "admin", count: int = None):
+def generate_fake_agents(db: Session, username: str | None = None, count: int = None):
    """生成假数据"""
    print("=" * 60)
    print("生成Agent假数据")
@@ -316,7 +316,7 @@ if __name__ == "__main__":
    parser.add_argument(
        "--username",
        type=str,
-        default="admin",
+        default=None,
        help="创建Agent的用户名（默认: admin）"
    )
    parser.add_argument(
--- a/backend/scripts/generate_smart_agent.py
+++ b/backend/scripts/generate_smart_agent.py
@@ -17,7 +17,7 @@ import uuid
 import json


-def generate_smart_agent(db: Session, username: str = "admin"):
+def generate_smart_agent(db: Session, username: str | None = None):
    """生成智能需求分析与解决方案生成Agent"""
    print("=" * 60)
    print("生成智能需求分析与解决方案生成Agent")
@@ -451,7 +451,7 @@ if __name__ == "__main__":
    parser.add_argument(
        "--username",
        type=str,
-        default="admin",
+        default=None,
        help="创建Agent的用户名（默认: admin）"
    )
    
--- a/backend/scripts/generate_test_agent.py
+++ b/backend/scripts/generate_test_agent.py
@@ -15,7 +15,7 @@ from datetime import datetime
 import uuid


-def generate_test_agent(db: Session, username: str = "admin"):
+def generate_test_agent(db: Session, username: str | None = None):
    """生成测试Agent（左右连接）"""
    print("=" * 60)
    print("生成测试Agent（左右连接演示）")
@@ -224,7 +224,7 @@ def main():
    """主函数"""
    db = SessionLocal()
    try:
-        generate_test_agent(db, username="admin")
+        generate_test_agent(db, username=os.getenv("PLATFORM_USERNAME"))
    finally:
        db.close()

--- a/backend/scripts/set_admin.py
+++ b/backend/scripts/set_admin.py
@@ -19,8 +19,12 @@ def set_admin():
        print("=" * 60)
        print()
        
-        # 查找admin用户
-        admin_user = db.query(User).filter(User.username == "admin").first()
+        target_username = os.getenv("PLATFORM_USERNAME")
+        if not target_username:
+            print("❌ 请设置 PLATFORM_USERNAME 环境变量指定要提升为管理员的用户名")
+            return
+        # 查找目标用户
+        admin_user = db.query(User).filter(User.username == target_username).first()
        
        if not admin_user:
            print("❌ 未找到admin用户，请先创建admin用户")
--- a/backend/scripts/test_homework_agent_hello.py
+++ b/backend/scripts/test_homework_agent_hello.py
@@ -22,8 +22,8 @@ import requests
 def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(description="测试学生作业管理助手发送“你好”")
    parser.add_argument("--base-url", default="http://127.0.0.1:8037", help="后端地址")
-    parser.add_argument("--username", default="admin", help="登录用户名")
-    parser.add_argument("--password", default="123456", help="登录密码")
+    parser.add_argument("--username", default=None, help="登录用户名")
+    parser.add_argument("--password", default=None, help="登录密码")
    parser.add_argument("--agent-name", default="学生作业管理助手", help="目标 Agent 名称")
    parser.add_argument("--message", default="你好", help="发送内容")
    parser.add_argument("--timeout-seconds", type=int, default=90, help="轮询超时秒数")
--- a/backend/scripts/update_zhini7_prompt.py
+++ b/backend/scripts/update_zhini7_prompt.py
@@ -1,3 +1,4 @@
+import os
 import re
 import requests

@@ -10,7 +11,7 @@ prompt = m.group(1).strip()

 r = requests.post(
    f"{BASE}/api/v1/auth/login",
-    data={"username": "admin", "password": "123456"},
+    data={"username": os.getenv("PLATFORM_USERNAME"), "password": os.getenv("PLATFORM_PASSWORD")},
    headers={"Content-Type": "application/x-www-form-urlencoded"},
    timeout=15,
 )