Merge remote-tracking branch 'origin/main' into SecurityBugFix

Author: githuuuuub

deploy/DEPLOYMENT.md

@@ -141,4 +141,4 @@ Hook scripts are located in the `hooks/post_ready.d/` directory and can be execu
 ### How to Skip Partial Initialization
 
 - Interactive mode: The script provides skip options
-- Non-interactive mode: Control via environment variables, e.g., `SKIP_MCP_INIT=true`
+- Non-interactive mode: Control via environment variables, e.g., `SKIP_AI_MODEL_INIT=true`

deploy/DEPLOYMENT_zh.md

@@ -141,4 +141,4 @@ cat ~/himarket-install.log
 ### 如何跳过部分初始化
 
 - 交互模式：脚本会提供跳过选项
-- 非交互模式：通过环境变量控制，如 `SKIP_MCP_INIT=true`
+- 非交互模式：通过环境变量控制，如 `SKIP_AI_MODEL_INIT=true`

deploy/docker/.env.example

@@ -17,24 +17,22 @@ REDIS_IMAGE=higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/redis-stack-ser
 SANDBOX_IMAGE=opensource-registry.cn-hangzhou.cr.aliyuncs.com/higress-group/sandbox:latest
 
 # ========== 数据库密码 ==========
-# 必须固定，否则重装时本地数据与新密码不匹配
-MYSQL_ROOT_PASSWORD=himarket_root_2024
-MYSQL_PASSWORD=himarket_app_2024
+# 首次安装时由 install.sh 自动生成随机值，升级时沿用已有值
+# 如需自定义，取消注释并填写
+# MYSQL_ROOT_PASSWORD=
+# MYSQL_PASSWORD=
 
 # ========== 服务凭证 ==========
-NACOS_ADMIN_PASSWORD=nacos
-HIGRESS_USERNAME=admin
-HIGRESS_PASSWORD=admin
+# 首次安装时由 install.sh 自动生成随机值，升级时沿用已有值
+# NACOS_ADMIN_PASSWORD=
+# HIGRESS_USERNAME=admin
+# HIGRESS_PASSWORD=
 
 # ========== 默认用户 ==========
 ADMIN_USERNAME=admin
-ADMIN_PASSWORD=admin
+# ADMIN_PASSWORD=
 FRONT_USERNAME=user
-FRONT_PASSWORD=123456
-
-# ========== 初始化选项 ==========
-SKIP_MCP_INIT=false
-SKIP_SKILL_INIT=false
+# FRONT_PASSWORD=
 
 # ========== AI 模型配置（可选）==========
 SKIP_AI_MODEL_INIT=true