Fix --dev failing config validation

[usehoplite]

Problem

boxbox --dev, the documented way to run locally without logging in, exits at startup:

Failed to load configuration error="password for user \"dev\" must be a bcrypt hash ($2a$, $2b$, or $2y$)"

--dev creates a placeholder user so that config validation passes, and it hashed that password with bcrypt.MinCost (4). Validation only accepts hashes of cost 10 or more (bcrypt.DefaultCost). It fails on master and on staging/main, and bun run dev:test and docs/development.md both depend on it.

Change

• Hash the placeholder with bcrypt.DefaultCost. Startup takes about 50 ms longer.
• Move the dev credential setup from main() into setDevCredentials() in cmd/server/devmode.go, so a test can call it.
• Add devmode_test.go, which sets the dev credentials and loads a config through the real config.Load.

Verification

• The test unsets every BOXBOX_*, FM_* and CONFIG_PATH variable first and restores them afterwards, so a developer's own settings cannot change the result. With BOXBOX_TRUSTED_PROXIES=proxy.local set, it fails without that step and passes with it.
• The test fails with the old cost (password for user "dev" must be a bcrypt hash) and passes with the fix.
• Ran the built binary with --dev and a config that says host: 0.0.0.0. It logged DEVELOPMENT MODE: authentication disabled; listening on loopback only and bound 127.0.0.1:18096. GET /api/v1/files/list/media returned 200 with no token. In a real browser, / opened /browse with the folder listing and no login, and there were no page errors.
• go vet ./cmd/... and gofmt are clean.
• Not tested: bun run dev:test (scripts/local-test.ts), and --dev on non-Linux.

Targets staging/main.

---

Written by anthropic/claude-sonnet-5-5 in the Hoplite agent harness.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
box-box	Ready	Preview	Oct 1, 2026 8:30am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9460e989-61a1-4f87-9870-5fc78fb9929a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}