chore(dev): enable password registration in local dev

scripts/dev.mjs

@@ -958,16 +958,11 @@ class DevRunner {
   async startApiServer(service) {
     await this.ensureApiServerSpacetimeToken();
 
-    const mergedEnv = {
-      ...this.baseEnv,
-      GENARRATIVE_API_HOST: this.options.apiHost,
-      GENARRATIVE_API_PORT: String(this.options.apiPort),
-      GENARRATIVE_API_LOG: this.options.apiLog,
-      GENARRATIVE_SPACETIME_SERVER_URL: this.state.spacetimeServer,
-      GENARRATIVE_SPACETIME_DATABASE: this.options.database,
-      GENARRATIVE_SPACETIME_TOKEN:
-        this.baseEnv.GENARRATIVE_SPACETIME_TOKEN || '',
-    };
+    const mergedEnv = buildApiServerProcessEnv({
+      baseEnv: this.baseEnv,
+      options: this.options,
+      state: this.state,
+    });
 
     const logFile = resolveApiServerLogFile(repoRoot, mergedEnv);
     ensureParentDir(logFile);
@@ -1717,10 +1712,25 @@ function isSpacetimePublishPermissionError(error) {
   );
 }
 
+function buildApiServerProcessEnv({baseEnv, options, state}) {
+  return {
+    ...baseEnv,
+    // 本地 dev 允许密码入口直接创建账号，生产默认仍由 api-server 配置保持关闭。
+    GENARRATIVE_DEV_PASSWORD_ENTRY_AUTO_REGISTER_ENABLED: 'true',
+    GENARRATIVE_API_HOST: options.apiHost,
+    GENARRATIVE_API_PORT: String(options.apiPort),
+    GENARRATIVE_API_LOG: options.apiLog,
+    GENARRATIVE_SPACETIME_SERVER_URL: state.spacetimeServer,
+    GENARRATIVE_SPACETIME_DATABASE: options.database,
+    GENARRATIVE_SPACETIME_TOKEN: baseEnv.GENARRATIVE_SPACETIME_TOKEN || '',
+  };
+}
+
 export {
   DevRunner,
   assertReusableSpacetimeProcessVersionMatchesWorkspace,
   assertSpacetimeToolVersionMatchesWorkspace,
+  buildApiServerProcessEnv,
   buildSpacetimePublishArgs,
   createDevServerSpawnOptions,
   createWatchConfigs,

scripts/dev.test.ts

@@ -8,6 +8,7 @@ import {
   DevRunner,
   assertReusableSpacetimeProcessVersionMatchesWorkspace,
   assertSpacetimeToolVersionMatchesWorkspace,
+  buildApiServerProcessEnv,
   buildSpacetimePublishArgs,
   createDevServerSpawnOptions,
   createWatchConfigs,
@@ -89,6 +90,21 @@ describe('dev scheduler argument routing', () => {
   });
 });
 
+describe('dev scheduler api-server env', () => {
+  test('dev 脚本默认打开密码入口自动注册', () => {
+    const {options} = parseArgs(['api-server', '--api-port', '9091'], {});
+    const env = buildApiServerProcessEnv({
+      baseEnv: {},
+      options,
+      state: {spacetimeServer: 'http://127.0.0.1:3199'},
+    });
+
+    expect(env.GENARRATIVE_DEV_PASSWORD_ENTRY_AUTO_REGISTER_ENABLED).toBe('true');
+    expect(env.GENARRATIVE_API_PORT).toBe('9091');
+    expect(env.GENARRATIVE_SPACETIME_SERVER_URL).toBe('http://127.0.0.1:3199');
+  });
+});
+
 describe('dev scheduler spacetime reuse guard', () => {
   test('记录 URL 可 ping 但没有 spacetime.pid 时不复用宿主', async () => {
     const tempDir = mkdtempSync(join(tmpdir(), 'genarrative-spacetime-reuse-'));