diff --git a/admin-auth.test.js b/admin-auth.test.js
new file mode 100644
index 0000000..2b82dee
--- /dev/null
+++ b/admin-auth.test.js
@@ -0,0 +1,93 @@
+// Integration test for the minimal admin auth gate on /api/admin/*
+// (dev-plan.md T6). Spawns server.js on a throwaway port, same isolation
+// approach as uploads-route.test.js.
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const { spawn } = require("node:child_process");
+
+const PORT = 19934 + Math.floor(Math.random() * 1000);
+const BASE = `http://localhost:${PORT}`;
+const ADMIN_PASSWORD = "test-password-only-for-this-run";
+
+function waitForServer(url, timeoutMs = 10000) {
+  const deadline = Date.now() + timeoutMs;
+  return (async function poll() {
+    while (Date.now() < deadline) {
+      try {
+        await fetch(url);
+        return;
+      } catch {
+        await new Promise((r) => setTimeout(r, 100));
+      }
+    }
+    throw new Error("server did not come up in time");
+  })();
+}
+
+function sessionCookie(loginRes) {
+  const setCookie = loginRes.headers.get("set-cookie") || "";
+  return setCookie.split(";")[0];
+}
+
+let child;
+test.before(async () => {
+  child = spawn(process.execPath, ["server.js"], {
+    cwd: __dirname,
+    env: { ...process.env, PORT: String(PORT), H3_CONSOLE_BASE: "", H3_CONSOLE_TOKEN: "", ADMIN_PASSWORD },
+    stdio: "pipe",
+  });
+  await waitForServer(BASE);
+});
+
+test.after(() => child.kill());
+
+test("any /api/admin/* route returns 401 without a session cookie", async () => {
+  const res = await fetch(`${BASE}/api/admin/library`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ prompt: "x", videoUrl: "http://example.com/x.mp4" }),
+  });
+  assert.equal(res.status, 401);
+});
+
+test("logging in with the wrong password is rejected and sets no cookie", async () => {
+  const res = await fetch(`${BASE}/api/admin/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ password: "definitely-wrong" }),
+  });
+  assert.equal(res.status, 401);
+  assert.equal(res.headers.get("set-cookie"), null);
+});
+
+test("logging in with the right password grants a session that unlocks /api/admin/*, and logout revokes it", async () => {
+  const loginRes = await fetch(`${BASE}/api/admin/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ password: ADMIN_PASSWORD }),
+  });
+  assert.equal(loginRes.status, 200);
+  const cookie = sessionCookie(loginRes);
+  assert.match(cookie, /^admin_session=.+/);
+
+  const authedRes = await fetch(`${BASE}/api/admin/library`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Cookie: cookie },
+    body: JSON.stringify({ prompt: "authed test entry", videoUrl: "http://example.com/x.mp4" }),
+  });
+  assert.equal(authedRes.status, 200);
+  const created = await authedRes.json();
+
+  // clean up the entry this test created in the real library.json
+  await fetch(`${BASE}/api/admin/library/${created.id}`, { method: "DELETE", headers: { Cookie: cookie } });
+
+  const logoutRes = await fetch(`${BASE}/api/admin/logout`, { method: "POST", headers: { Cookie: cookie } });
+  assert.equal(logoutRes.status, 200);
+
+  const afterLogout = await fetch(`${BASE}/api/admin/library`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Cookie: cookie },
+    body: JSON.stringify({ prompt: "should be rejected", videoUrl: "http://example.com/x.mp4" }),
+  });
+  assert.equal(afterLogout.status, 401);
+});
diff --git a/admin-login.html b/admin-login.html
new file mode 100644
index 0000000..8114dc2
--- /dev/null
+++ b/admin-login.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8" />
+<title>管理员登录</title>
+<link rel="stylesheet" href="style.css" />
+<style>
+  .login-wrap { max-width: 360px; margin: 15vh auto; padding: 24px; }
+  .login-wrap h1 { font-size: 18px; margin-bottom: 16px; }
+  .login-wrap input { width: 100%; margin-bottom: 12px; }
+  .login-wrap .err { color: #c0392b; font-size: 13px; min-height: 18px; margin-bottom: 8px; }
+</style>
+</head>
+<body>
+<div class="login-wrap">
+  <h1>管理员登录</h1>
+  <input type="password" id="password" placeholder="管理员口令" autofocus />
+  <div class="err" id="err"></div>
+  <button id="loginBtn">登录</button>
+</div>
+<script>
+  const params = new URLSearchParams(location.search);
+  const next = params.get("next") || "/admin.html";
+
+  async function login() {
+    const password = document.getElementById("password").value;
+    const errBox = document.getElementById("err");
+    errBox.textContent = "";
+    try {
+      const res = await fetch("/api/admin/login", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ password }),
+      });
+      if (!res.ok) {
+        errBox.textContent = "口令错误";
+        return;
+      }
+      location.href = next;
+    } catch (e) {
+      errBox.textContent = "登录请求失败: " + e.message;
+    }
+  }
+
+  document.getElementById("loginBtn").onclick = login;
+  document.getElementById("password").addEventListener("keydown", (e) => {
+    if (e.key === "Enter") login();
+  });
+</script>
+</body>
+</html>
diff --git a/admin.html b/admin.html
index 56a85f5..36bf5e8 100644
--- a/admin.html
+++ b/admin.html
@@ -80,6 +80,17 @@
 </main>
 
 <script>
+// Redirect to login whenever any /api/admin/* call comes back 401 (T6 auth
+// gate) — a single interceptor instead of touching every fetch call site.
+const _fetch = window.fetch;
+window.fetch = async (...args) => {
+  const res = await _fetch(...args);
+  if (res.status === 401 && String(args[0]).startsWith("/api/admin/") && !String(args[0]).includes("/login")) {
+    location.href = "/admin-login.html?next=" + encodeURIComponent(location.pathname);
+  }
+  return res;
+};
+
 let library = [];
 let editingId = null;
 let sortKey = "createdAt";
diff --git a/server.js b/server.js
index 67b1cc8..4417008 100644
--- a/server.js
+++ b/server.js
@@ -6,6 +6,7 @@ const http = require("http");
 const https = require("https");
 const fs = require("fs");
 const path = require("path");
+const crypto = require("crypto");
 
 try {
   process.loadEnvFile(path.join(__dirname, ".env"));
@@ -90,6 +91,37 @@ function readJsonBody(req) {
   });
 }
 
+// Minimal admin auth (dev-plan.md T6): one shared password from .env, an
+// HttpOnly session cookie, no accounts/roles/DB — the account system in
+// MVCP M.1/M.10 supersedes this in period 3. Sessions are in-memory only,
+// so a process restart logs everyone out (acceptable for this stopgap).
+const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || "";
+const ADMIN_SESSION_COOKIE = "admin_session";
+const ADMIN_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days, matches MVCP M.10's session TTL
+const adminSessions = new Map(); // token -> expiresAt
+
+function parseCookies(req) {
+  const header = req.headers.cookie || "";
+  const cookies = {};
+  for (const pair of header.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    cookies[pair.slice(0, idx).trim()] = decodeURIComponent(pair.slice(idx + 1).trim());
+  }
+  return cookies;
+}
+
+function isAdminAuthed(req) {
+  const token = parseCookies(req)[ADMIN_SESSION_COOKIE];
+  if (!token) return false;
+  const expiresAt = adminSessions.get(token);
+  if (!expiresAt || expiresAt < Date.now()) {
+    adminSessions.delete(token);
+    return false;
+  }
+  return true;
+}
+
 function h3ConsoleFetch(pathAndQuery, options) {
   return new Promise((resolve, reject) => {
     const proxyReq = http.request(
@@ -469,6 +501,46 @@ http
 
     const pathname = req.url.split("?")[0];
 
+    if (pathname === "/api/admin/login" && req.method === "POST") {
+      readJsonBody(req)
+        .then((body) => {
+          if (!ADMIN_PASSWORD || body.password !== ADMIN_PASSWORD) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "invalid password" }));
+            return;
+          }
+          const token = crypto.randomUUID();
+          adminSessions.set(token, Date.now() + ADMIN_SESSION_TTL_MS);
+          res.writeHead(200, {
+            "Content-Type": "application/json",
+            "Set-Cookie": `${ADMIN_SESSION_COOKIE}=${token}; HttpOnly; Path=/; Max-Age=${Math.floor(ADMIN_SESSION_TTL_MS / 1000)}; SameSite=Lax`,
+          });
+          res.end(JSON.stringify({ ok: true }));
+        })
+        .catch(() => {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "invalid JSON body" }));
+        });
+      return;
+    }
+
+    if (pathname === "/api/admin/logout" && req.method === "POST") {
+      const token = parseCookies(req)[ADMIN_SESSION_COOKIE];
+      if (token) adminSessions.delete(token);
+      res.writeHead(200, {
+        "Content-Type": "application/json",
+        "Set-Cookie": `${ADMIN_SESSION_COOKIE}=; HttpOnly; Path=/; Max-Age=0`,
+      });
+      res.end(JSON.stringify({ ok: true }));
+      return;
+    }
+
+    if (pathname.startsWith("/api/admin/") && !isAdminAuthed(req)) {
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "unauthorized" }));
+      return;
+    }
+
     if (pathname === "/api/library") {
       const sort = new URL(req.url, "http://x").searchParams.get("sort") || "newest";
       const lib = getLibrary().slice();
diff --git a/uploads-route.test.js b/uploads-route.test.js
index a021dc5..cedb6a1 100644
--- a/uploads-route.test.js
+++ b/uploads-route.test.js
@@ -18,6 +18,8 @@ const TINY_VALID_PNG = Buffer.from(
 
 const PORT = 18934 + Math.floor(Math.random() * 1000);
 const BASE = `http://localhost:${PORT}`;
+const ADMIN_PASSWORD = "test-password-only-for-this-run";
+let cookie;
 
 function waitForServer(url, timeoutMs = 10000) {
   const deadline = Date.now() + timeoutMs;
@@ -41,10 +43,17 @@ test.before(async () => {
     // H3_CONSOLE_BASE cleared: this test only exercises the upload route,
     // no need for the spawned copy to also hit the real H3 Console /
     // race the live pm2 instance on library.json's periodic sync.
-    env: { ...process.env, PORT: String(PORT), H3_CONSOLE_BASE: "", H3_CONSOLE_TOKEN: "" },
+    env: { ...process.env, PORT: String(PORT), H3_CONSOLE_BASE: "", H3_CONSOLE_TOKEN: "", ADMIN_PASSWORD },
     stdio: "pipe",
   });
   await waitForServer(BASE);
+
+  const loginRes = await fetch(`${BASE}/api/admin/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ password: ADMIN_PASSWORD }),
+  });
+  cookie = (loginRes.headers.get("set-cookie") || "").split(";")[0];
 });
 
 test.after(() => {
@@ -59,7 +68,7 @@ test("uploading a real PNG returns a URL that GET /uploads/* serves back with th
   const fd = new FormData();
   fd.append("file", new Blob([TINY_VALID_PNG], { type: "image/png" }), "photo.png");
 
-  const uploadRes = await fetch(`${BASE}/api/admin/upload`, { method: "POST", body: fd });
+  const uploadRes = await fetch(`${BASE}/api/admin/upload`, { method: "POST", headers: { Cookie: cookie }, body: fd });
   assert.equal(uploadRes.status, 200);
   const { url } = await uploadRes.json();
   assert.match(url, /^\/uploads\/\d{6}\/[0-9a-f-]+\.png$/);
@@ -74,7 +83,7 @@ test("a zip disguised as .jpg is rejected regardless of filename/content-type cl
   const fd = new FormData();
   fd.append("file", new Blob([zipMagic], { type: "image/jpeg" }), "totally-a-photo.jpg");
 
-  const res = await fetch(`${BASE}/api/admin/upload`, { method: "POST", body: fd });
+  const res = await fetch(`${BASE}/api/admin/upload`, { method: "POST", headers: { Cookie: cookie }, body: fd });
   assert.equal(res.status, 400);
 });
 
@@ -89,7 +98,7 @@ test("a file over 8MB is rejected", async () => {
   fd.append("file", new Blob([oversized], { type: "image/jpeg" }), "huge.jpg");
 
   await assert.rejects(
-    () => fetch(`${BASE}/api/admin/upload`, { method: "POST", body: fd }),
+    () => fetch(`${BASE}/api/admin/upload`, { method: "POST", headers: { Cookie: cookie }, body: fd }),
     /fetch failed|ECONNRESET|terminated/i
   );
 });