@iobroker/mcp-server 1.6.1 → 1.7.1

package/README.md

@@ -177,8 +177,9 @@ Point your MCP client at:
 
 | Tool                        | Description                                                                                                                                                                                                                                          |
 |-----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `get_states`                | Retrieve the current value of one or multiple states; IDs may contain wildcards (e.g. `hue.0.*.brightness`)                                                                                                                                          |
+| `get_states`                | Retrieve the current value of one or multiple states; IDs may contain wildcards (e.g. `hue.0.*.brightness`); an ID without a state is returned with `exists: false` or a hint                                                                      |
 | `get_object`                | Read a single object by its ID                                                                                                                                                                                                                       |
+| `check_permissions`         | Show the user and groups of the MCP session, the rights of its groups and, for given object IDs, whether it may read/write/delete the object and read/write the state                                                                               |
 | `search_objects`            | Search objects/states by keyword (matched against ID and name); optional filters for object `type`, `role`, `room` and source `adapter` instance                                                                                                     |
 | `list_devices`              | List detected devices grouped by room (uses the ioBroker type-detector to expose functional devices with named controls); optional `language` and `room` filter                                                                                      |
 | `list_instances`            | List adapter instances with their status                                                                                                                                                                                                             |
@@ -191,7 +192,7 @@ Point your MCP client at:
 | `read_file`                 | Read a file from an adapter file storage (optional base64); large files are read in chunks via `offset`/`length` (default 512 KiB per call) — the result carries `size`, `truncated` and `nextOffset`; `download: true` returns a download link instead |
 | `list_files`                | List a directory in an adapter file storage                                                                                                                                                                                                          |
 | `file_exists`               | Check whether a file exists in an adapter file storage                                                                                                                                                                                               |
-| `get_logs`                  | Retrieve recent ioBroker log lines; optional filters by `level` (error/warn/info/debug), source `adapter` and start time (`from_ts`)                                                                                                                 |
+| `get_logs`                  | Retrieve recent ioBroker log lines; optional filters by `level` (error/warn/info/debug), source `adapter` and start time (`from_ts`); `logFile` tells the time of the newest line and the file size                                                                                                                 |
 | `write_log`                 | Write a message to the ioBroker log                                                                                                                                                                                                                  |
 | `system_info`               | Get system and js-controller information                                                                                                                                                                                                             |
 | `list_adapter_updates`      | List installed adapters that have a newer version in the active repository                                                                                                                                                                           |
@@ -212,7 +213,7 @@ Point your MCP client at:
 | `rename_file`               | Rename/move a file within the same adapter file storage — requires *Allow object/file changes*                                                                                                                                                       |
 | `mkdir`                     | Create a directory in an adapter file storage — requires *Allow object/file changes*                                                                                                                                                                 |
 | `prepare_upload`            | Get a one-time upload link for a file that is too large for a tool argument (e.g. a `.tgz`), for clients that can run shell commands — requires *Allow download/upload links* and *Allow object/file changes* or *Allow installing packages*           |
-| `install_package`           | Install an adapter package (npm, GitHub, URL, `.tgz` from the file storage, as base64 or uploaded via `prepare_upload`) on a host and restart its enabled instances — requires *Allow installing packages*, developers only                            |
+| `install_package`           | Install an adapter package (npm, GitHub, URL, `.tgz` from the file storage, as base64 or uploaded via `prepare_upload`) on a host, restart its enabled instances and report whether they came up, with their first log lines — requires *Allow installing packages*, developers only |
 | `start_instance`            | Start (enable) an instance — requires *Allow controlling instances*                                                                                                                                                                                  |
 | `stop_instance`             | Stop (disable) an instance — requires *Allow controlling instances*                                                                                                                                                                                  |
 | `restart_instance`          | Restart a running instance — requires *Allow controlling instances*                                                                                                                                                                                  |
@@ -310,6 +311,17 @@ client calls it and its result is verified:
     Placeholder for the next version (at the beginning of the line):
     ### **WORK IN PROGRESS**
 -->
+### 1.7.1 (2026-10-26)
+* (@GermanBluefox) Fixed: `get_logs` always returned `size: null` for the log file, because the host sends the size as a string
+
+### 1.7.0 (2026-10-26)
+* (@GermanBluefox) A confirmation that the client dismissed without an answer is no longer reported as "Cancelled by the user", but explains how to turn off the confirmations for clients that cannot show them
+* (@GermanBluefox) `get_states` returns `exists: false` for an unknown ID instead of a `null` value with the current time
+* (@GermanBluefox) A wrong password is logged with the address and the User-Agent of the client
+* (@GermanBluefox) `get_logs` returns the time of the newest line and the size of the log file, to see when the log is no longer written
+* (@GermanBluefox) Added the `check_permissions` tool: what the user of the MCP session may do with an object
+* (@GermanBluefox) `install_package` reports whether the restarted instances came up again and their first log lines
+
 ### 1.6.1 (2026-10-24)
 * (@GermanBluefox) An upload can only be used by the user that created it with `prepare_upload`
 

package/build/index.d.ts

@@ -96,6 +96,12 @@ export default class McpServer {
      * anything that could not be tied to an authenticated ioBroker user.
      */
     private authGuard;
+    /**
+     * Log the address and the User-Agent of a request with a rejected password (HTTP Basic auth or the
+     * password grant of `POST /oauth/token`), so a client that keeps retrying can be found. Rejected tokens
+     * (e.g. expired ones, which clients refresh) are only logged in debug.
+     */
+    private logFailedLogin;
     /**
      * The actual work behind {@link authGuard}: reject unauthenticated requests, and — when OAuth is
      * enabled — additionally reject tokens that were issued for a different resource.
@@ -216,6 +222,8 @@ export default class McpServer {
     /** Build the result entry for one state. */
     private static stateEntry;
     private getStates;
+    /** Build the result entry for an ID without a state: tell a missing object from a state without a value. */
+    private missingStateEntry;
     /**
      * Write multiple states as one operation: the write permission of every state is verified first, so a
      * batch containing a single state the user may not write fails as a whole and nothing is
@@ -238,6 +246,23 @@ export default class McpServer {
      * @param permissions the merged group permissions of the user
      */
     private isStateWritable;
+    /**
+     * The ACL bit check of js-controller: the owner, owner-group or everyone bits of `bits`, depending on
+     * who the user of the request is.
+     *
+     * @param acl the ACL of the object (owner and owner group)
+     * @param bits the `object` or `state` bits of the ACL
+     * @param flag {@link ACL_READ} or {@link ACL_WRITE} (as the "everyone" bit)
+     * @param permissions the merged group permissions of the user
+     */
+    private aclGrants;
+    /**
+     * What the user of the request may do: the general rights of its groups and, per object, the result of
+     * the ACL checks js-controller runs for reading, writing and deleting the object and its state.
+     *
+     * @param ids object IDs to check
+     */
+    private checkPermissions;
     /**
      * Parse the raw log-file lines returned by the host `getLogs` into structured entries.
      *
@@ -248,6 +273,12 @@ export default class McpServer {
      * without a leading timestamp as continuations (e.g. stack traces) of the previous entry.
      */
     private parseLogLines;
+    /**
+     * Read the tail of the host log file and filter it.
+     *
+     * @returns the matching lines plus the time of the newest line in the read window and the file size, so a
+     *          log file that is no longer written (e.g. the host still reads the one before a rotation) shows
+     */
     private getLogs;
     /**
      * Diagnose whether a network device/service is reachable: an ICMP ping to `host` and, if `port`
@@ -330,6 +361,15 @@ export default class McpServer {
      * ioBroker.admin installs from a custom URL or a .tgz file, and wait for the result.
      */
     private installPackage;
+    /**
+     * Wait until restarted instances report `alive` again, then collect their first log lines since the restart.
+     * Instances that are not daemons (schedule, once, ...) do not stay alive and are not waited for.
+     *
+     * @param ids instance ids like `hue.0`
+     * @param since time of the restart (ms); only an `alive` and log lines after it count
+     * @param timeoutSeconds how long to wait for all instances together
+     */
+    private waitForStart;
     /** Normalize a host name (with or without `system.host.`) and check that the host exists. */
     private resolveHost;
     /**

package/build/index.js

@@ -81,6 +81,16 @@ const DEFAULT_MAX_READ_BYTES = 512 * 1024;
 const DEFAULT_INSTALL_TIMEOUT = 300;
 /** How many output lines of an installation are returned to the client. */
 const INSTALL_OUTPUT_LINES = 100;
+/** Default time `install_package` waits for the restarted instances to come up (seconds). */
+const DEFAULT_START_TIMEOUT = 20;
+/** How many log lines of a restarted instance `install_package` returns. */
+const START_LOG_LINES = 10;
+/** A log whose newest line is older than this (ms) gets a hint that it may no longer be written. */
+const STALE_LOG_AGE = 30 * 60_000;
+/** The "everyone" read bit of an ioBroker ACL; the group and owner bits are shifted by 4 and 8. */
+const ACL_READ = 0x4;
+/** The "everyone" write bit of an ioBroker ACL; the group and owner bits are shifted by 4 and 8. */
+const ACL_WRITE = 0x2;
 /**
  * Maximum size of a tool result. MCP clients (Claude.ai / Claude Desktop / Claude Code) reject results above
  * 1 MiB, measured on the JSON-RPC message, in which the result text is escaped once more.
@@ -384,6 +394,8 @@ class McpServer {
             // The OAuth2 token endpoint (added by createOAuth2Server) needs its request body parsed.
             // Scope the parser to that path so the MCP transport keeps its own body handling.
             app.use('/oauth/token', express_1.default.urlencoded({ extended: false }), express_1.default.json());
+            // The OAuth2 server only logs the user name of a wrong password; tell which client it was
+            app.use(this.logFailedLogin);
             this.oauth2 = (0, webserver_1.createOAuth2Server)(this.adapter, {
                 app,
                 secure: !!this.config.secure,
@@ -485,6 +497,38 @@ class McpServer {
     authGuard = (req, res, next) => {
         void this.checkAuthentication(req, res, next);
     };
+    /**
+     * Log the address and the User-Agent of a request with a rejected password (HTTP Basic auth or the
+     * password grant of `POST /oauth/token`), so a client that keeps retrying can be found. Rejected tokens
+     * (e.g. expired ones, which clients refresh) are only logged in debug.
+     */
+    logFailedLogin = (req, res, next) => {
+        const authorization = req.headers.authorization;
+        const tokenRequest = req.path === '/oauth/token';
+        if (authorization || tokenRequest) {
+            res.on('finish', () => {
+                if (res.statusCode !== 401 && !(tokenRequest && res.statusCode === 400)) {
+                    return;
+                }
+                let username;
+                if (tokenRequest) {
+                    const body = req.body;
+                    username = body?.grant_type === 'password' ? String(body.username) : undefined;
+                }
+                else if (authorization?.startsWith('Basic ')) {
+                    username = Buffer.from(authorization.substring(6), 'base64').toString().split(':')[0];
+                }
+                const client = `${req.ip} (User-Agent: "${req.headers['user-agent'] || 'unknown'}")`;
+                if (username !== undefined) {
+                    this.adapter.log.warn(`Rejected the password of "${username}" from ${client}`);
+                }
+                else {
+                    this.adapter.log.debug(`Rejected credentials from ${client} on ${req.method} ${req.path}`);
+                }
+            });
+        }
+        next();
+    };
     /**
      * The actual work behind {@link authGuard}: reject unauthenticated requests, and — when OAuth is
      * enabled — additionally reject tokens that were issued for a different resource.
@@ -919,26 +963,43 @@ class McpServer {
         // Ask the user before a dangerous action, if the client can (MCP elicitation). Clients without
         // elicitation rely on the destructiveHint of the tool instead.
         const confirm = async (message) => {
-            if (!this.config.confirmDangerous || !server.server.getClientCapabilities()?.elicitation) {
+            if (!this.config.confirmDangerous || !server.server.getClientCapabilities()?.elicitation?.form) {
                 return;
             }
-            const answer = await server.server.elicitInput({
-                message,
-                requestedSchema: {
-                    type: 'object',
-                    properties: { confirm: { type: 'boolean', title: 'Yes, do it' } },
-                    required: ['confirm'],
-                },
-            });
-            if (answer.action !== 'accept' || answer.content?.confirm !== true) {
-                throw new Error('Cancelled by the user');
+            // Some clients announce elicitation but cannot show the request and dismiss it on their own
+            const noDialog = 'If no confirmation dialog appeared, the MCP client cannot show confirmation requests (elicitation): ' +
+                'turn off "Ask for confirmation before dangerous actions" in the settings of the MCP adapter, ' +
+                'or use a client that supports elicitation.';
+            let answer;
+            try {
+                answer = await server.server.elicitInput({
+                    message,
+                    requestedSchema: {
+                        type: 'object',
+                        properties: { confirm: { type: 'boolean', title: 'Yes, do it' } },
+                        required: ['confirm'],
+                    },
+                });
+            }
+            catch (e) {
+                throw new Error(`The confirmation request failed: ${e instanceof Error ? e.message : String(e)}. ${noDialog}`);
             }
+            this.adapter.log.debug(`Confirmation "${message}" answered with "${answer.action}"`);
+            if (answer.action === 'accept' && answer.content?.confirm === true) {
+                return;
+            }
+            if (answer.action === 'cancel') {
+                throw new Error(`The confirmation request was dismissed without an answer. ${noDialog}`);
+            }
+            throw new Error('Cancelled by the user');
         };
         server.registerTool('get_states', {
             title: 'Get state values',
             annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
             description: 'Retrieve the current value of one or multiple states. IDs may contain wildcards, ' +
-                'e.g. "hue.0.*.brightness" expands to all matching states.',
+                'e.g. "hue.0.*.brightness" expands to all matching states. An ID without a state is ' +
+                'returned with exists=false (no such object) or with a hint (the object exists, but ' +
+                'has no value yet or is not a state).',
             inputSchema: {
                 ids: zod_1.z.array(zod_1.z.string()).describe('Array of state IDs (wildcards "*" allowed)'),
                 offset: offsetSchema,
@@ -1020,7 +1081,9 @@ class McpServer {
             description: 'Retrieve recent ioBroker log lines from the host log file. Each entry has {ts, level, ' +
                 'source, message}. Optionally filter by `level` (error/warn/info/debug), by `adapter` ' +
                 '(source, e.g. "hm-rpc.0" or "hm-rpc"), or from `from_ts` (ms). When a level filter is set, ' +
-                'a larger window of the log is scanned so errors/warnings are not hidden behind debug spam.',
+                'a larger window of the log is scanned so errors/warnings are not hidden behind debug spam. ' +
+                '`logFile` tells the time of the newest line in the file and its size: if they do not change ' +
+                'between calls, the host does not see new log lines.',
             inputSchema: {
                 level: zod_1.z.array(zod_1.z.enum(['error', 'warn', 'info', 'debug'])).optional(),
                 from_ts: zod_1.z.number().int().optional(),
@@ -1030,9 +1093,19 @@ class McpServer {
         }, async (args) => {
             try {
                 // Keep the newest lines if not all of them fit
-                const logs = await this.getLogs(args);
+                const { logs, newestTs, fileSize } = await this.getLogs(args);
                 const page = fitItems(logs, 0, true);
-                return ok({ ok: true, data: { logs: page.items, ...pageInfo(page, logs, 'logs.json') } });
+                const logFile = { newestLineTs: newestTs ?? null, size: fileSize ?? null };
+                if (newestTs !== undefined && Date.now() - newestTs > STALE_LOG_AGE) {
+                    logFile.hint =
+                        `The newest line of the log file is ${Math.round((Date.now() - newestTs) / 60_000)} ` +
+                            'minutes old. If newer messages are expected, the host may still read an old log file ' +
+                            '(e.g. the one before the daily rotation).';
+                }
+                return ok({
+                    ok: true,
+                    data: { logs: page.items, logFile, ...pageInfo(page, logs, 'logs.json') },
+                });
             }
             catch (e) {
                 return fail(e);
@@ -1312,6 +1385,24 @@ class McpServer {
                 return fail(e);
             }
         });
+        server.registerTool('check_permissions', {
+            title: 'Check permissions',
+            annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+            description: 'Show what the ioBroker user of this MCP session may do: its user and groups, the general ' +
+                'rights of its groups (object/state/file/users/other) and, for the given object IDs, whether ' +
+                'it may read/write/delete the object and read/write the state (by the ACL of the object). ' +
+                'Use it to find out in advance why an action would fail with a permissionError.',
+            inputSchema: {
+                ids: zod_1.z.array(zod_1.z.string()).max(100).optional().describe('Object IDs to check (no wildcards)'),
+            },
+        }, async ({ ids }) => {
+            try {
+                return ok({ ok: true, data: await this.checkPermissions(ids || []) });
+            }
+            catch (e) {
+                return fail(e);
+            }
+        });
         server.registerTool('read_file', {
             title: 'Read a file',
             annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
@@ -2001,7 +2092,9 @@ class McpServer {
                     '`file_name` + `file_content` - a small .tgz as base64; or `upload_id` - a .tgz uploaded ' +
                     'via prepare_upload (for large files, if you can run shell commands). Waits until the installation is ' +
                     'finished (or `timeout`), returns the exit code and the last output lines. Enabled instances ' +
-                    'of the adapter are restarted afterwards; no new instance is created.',
+                    'of the adapter are restarted afterwards; no new instance is created. `instances` tells for ' +
+                    'each restarted instance whether it came up again (alive) within `start_timeout` and its ' +
+                    'first log lines since the restart.',
                 inputSchema: {
                     source: zod_1.z
                         .string()
@@ -2023,6 +2116,13 @@ class McpServer {
                         .boolean()
                         .optional()
                         .describe('Restart enabled instances of the adapter after installing (default true)'),
+                    start_timeout: zod_1.z
+                        .number()
+                        .int()
+                        .min(0)
+                        .max(300)
+                        .optional()
+                        .describe(`Seconds to wait for the restarted instances to come up (default ${DEFAULT_START_TIMEOUT}, 0 = do not wait)`),
                     timeout: zod_1.z
                         .number()
                         .int()
@@ -2309,9 +2409,6 @@ class McpServer {
     // ---------------------------------------------------------------------
     /** Build the result entry for one state. */
     static stateEntry(id, state) {
-        if (!state) {
-            return { id, value: null, ack: false, ts: Date.now() };
-        }
         const entry = { id, value: state.val, ack: state.ack, ts: state.ts };
         if (state.lc !== state.ts) {
             entry.lc = state.lc;
@@ -2325,27 +2422,38 @@ class McpServer {
                 if (id.includes('*')) {
                     // Wildcard pattern: expand to all matching states.
                     const matches = await this.adapter.getForeignStatesAsync(id, { user: this.user });
-                    for (const matchId of Object.keys(matches || {})) {
-                        states.push(McpServer.stateEntry(matchId, matches[matchId]));
+                    for (const [matchId, state] of Object.entries(matches || {})) {
+                        if (state) {
+                            states.push(McpServer.stateEntry(matchId, state));
+                        }
                     }
                 }
                 else {
                     const state = await this.adapter.getForeignStateAsync(id, { user: this.user });
-                    states.push(McpServer.stateEntry(id, state));
+                    states.push(state ? McpServer.stateEntry(id, state) : await this.missingStateEntry(id));
                 }
             }
             catch (e) {
-                states.push({
-                    id,
-                    value: null,
-                    ack: false,
-                    ts: Date.now(),
-                    error: e instanceof Error ? e.message : String(e),
-                });
+                states.push({ id, value: null, error: e instanceof Error ? e.message : String(e) });
             }
         }
         return states;
     }
+    /** Build the result entry for an ID without a state: tell a missing object from a state without a value. */
+    async missingStateEntry(id) {
+        const obj = await this.adapter.getForeignObjectAsync(id, { user: this.user });
+        if (!obj) {
+            return { id, value: null, exists: false };
+        }
+        return {
+            id,
+            value: null,
+            exists: true,
+            hint: obj.type === 'state'
+                ? 'The object exists, but the state has no value yet'
+                : `"${id}" is a ${obj.type} object, not a state`,
+        };
+    }
     /**
      * Write multiple states as one operation: the write permission of every state is verified first, so a
      * batch containing a single state the user may not write fails as a whole and nothing is
@@ -2419,17 +2527,81 @@ class McpServer {
         if (!acl || !stateAcl) {
             return true;
         }
-        if (!permissions.state?.write) {
-            return false;
-        }
-        let mask = 0x002; // everyone write
+        return !!permissions.state?.write && this.aclGrants(acl, stateAcl, ACL_WRITE, permissions);
+    }
+    /**
+     * The ACL bit check of js-controller: the owner, owner-group or everyone bits of `bits`, depending on
+     * who the user of the request is.
+     *
+     * @param acl the ACL of the object (owner and owner group)
+     * @param bits the `object` or `state` bits of the ACL
+     * @param flag {@link ACL_READ} or {@link ACL_WRITE} (as the "everyone" bit)
+     * @param permissions the merged group permissions of the user
+     */
+    aclGrants(acl, bits, flag, permissions) {
         if (acl.owner === this.user) {
-            mask = 0x200; // owner write
+            return !!(bits & (flag << 8));
         }
-        else if (acl.ownerGroup && permissions.groups?.includes(acl.ownerGroup)) {
-            mask = 0x020; // group write
+        if (acl.ownerGroup && permissions.groups?.includes(acl.ownerGroup)) {
+            return !!(bits & (flag << 4));
         }
-        return !!(stateAcl & mask);
+        return !!(bits & flag);
+    }
+    /**
+     * What the user of the request may do: the general rights of its groups and, per object, the result of
+     * the ACL checks js-controller runs for reading, writing and deleting the object and its state.
+     *
+     * @param ids object IDs to check
+     */
+    async checkPermissions(ids) {
+        const permissions = await this.adapter.calculatePermissionsAsync(this.user, []);
+        const admin = this.user === 'system.user.admin' || !!permissions.groups?.includes('system.group.administrator');
+        const rights = {
+            object: permissions.object,
+            state: permissions.state,
+            file: permissions.file,
+            users: permissions.users,
+            other: permissions.other,
+        };
+        const objects = [];
+        for (const id of ids) {
+            // Read with the rights of the adapter: the ACL of objects the user may not read is needed as well
+            const obj = await this.adapter.getForeignObjectAsync(id);
+            if (!obj) {
+                objects.push({ id, exists: false });
+                continue;
+            }
+            const acl = obj.acl;
+            const allowed = (general, bits, flag) => admin || (!!general && (!acl || bits === undefined || this.aclGrants(acl, bits, flag, permissions)));
+            const entry = {
+                id,
+                exists: true,
+                type: obj.type,
+                object: {
+                    read: allowed(permissions.object?.read, acl?.object, ACL_READ),
+                    write: allowed(permissions.object?.write, acl?.object, ACL_WRITE),
+                    delete: allowed(permissions.object?.delete, acl?.object, ACL_WRITE),
+                },
+            };
+            if (obj.type === 'state') {
+                const stateBits = acl?.state ?? acl?.object;
+                entry.state = {
+                    read: allowed(permissions.state?.read, stateBits, ACL_READ),
+                    write: allowed(permissions.state?.write, stateBits, ACL_WRITE),
+                };
+            }
+            if (acl && (admin || entry.object.read)) {
+                entry.acl = { owner: acl.owner, ownerGroup: acl.ownerGroup, object: acl.object, state: acl.state };
+            }
+            objects.push(entry);
+        }
+        return {
+            user: this.user,
+            groups: permissions.groups || [],
+            admin,
+            rights,
+            ...(ids.length ? { objects } : {}),
+        };
     }
     /**
      * Parse the raw log-file lines returned by the host `getLogs` into structured entries.
@@ -2468,6 +2640,12 @@ class McpServer {
         }
         return entries;
     }
+    /**
+     * Read the tail of the host log file and filter it.
+     *
+     * @returns the matching lines plus the time of the newest line in the read window and the file size, so a
+     *          log file that is no longer written (e.g. the host still reads the one before a rotation) shows
+     */
     getLogs(params) {
         const limit = Math.max(1, params.limit || 200);
         const filtering = !!((params.level && params.level.length) || params.adapter || params.from_ts !== undefined);
@@ -2485,11 +2663,20 @@ class McpServer {
                         reject(new Error(result.error));
                     }
                     else {
-                        resolve([]);
+                        resolve({ logs: [] });
                     }
                     return;
                 }
                 let logs = this.parseLogLines(rawList);
+                const newestTs = logs.length ? logs[logs.length - 1].ts : undefined;
+                // The host appends the size of the log file as the last element: as a string after reading
+                // the file, as a number only if reading failed
+                const last = rawList[rawList.length - 1];
+                const fileSize = typeof last === 'number'
+                    ? last
+                    : typeof last === 'string' && /^\d+$/.test(last)
+                        ? Number(last)
+                        : undefined;
                 if (params.level && params.level.length) {
                     logs = logs.filter(log => params.level.includes(log.level));
                 }
@@ -2504,13 +2691,17 @@ class McpServer {
                 if (logs.length > limit) {
                     logs = logs.slice(logs.length - limit);
                 }
-                resolve(logs.map(log => ({
-                    ts: log.ts,
-                    level: log.level,
-                    source: log.source,
-                    message: log.message,
-                    host: this.adapter.host,
-                })));
+                resolve({
+                    logs: logs.map(log => ({
+                        ts: log.ts,
+                        level: log.level,
+                        source: log.source,
+                        message: log.message,
+                        host: this.adapter.host,
+                    })),
+                    newestTs,
+                    fileSize,
+                });
             });
         });
     }
@@ -3274,10 +3465,70 @@ class McpServer {
             this.removeTransfer(params.upload_id);
         }
         const adapterName = extractAdapterName(params.file_path || params.file_name || upload?.name || params.source || '');
+        const restartTs = Date.now();
         const restarted = result.success && adapterName && params.restart_instances !== false
             ? await this.restartAdapterInstances(adapterName)
             : [];
-        return { ...result, adapter: adapterName, restartedInstances: restarted };
+        const startTimeout = params.start_timeout ?? DEFAULT_START_TIMEOUT;
+        return {
+            ...result,
+            adapter: adapterName,
+            restartedInstances: restarted,
+            ...(restarted.length && startTimeout
+                ? { instances: await this.waitForStart(restarted, restartTs, startTimeout) }
+                : {}),
+        };
+    }
+    /**
+     * Wait until restarted instances report `alive` again, then collect their first log lines since the restart.
+     * Instances that are not daemons (schedule, once, ...) do not stay alive and are not waited for.
+     *
+     * @param ids instance ids like `hue.0`
+     * @param since time of the restart (ms); only an `alive` and log lines after it count
+     * @param timeoutSeconds how long to wait for all instances together
+     */
+    async waitForStart(ids, since, timeoutSeconds) {
+        const results = [];
+        const deadline = since + timeoutSeconds * 1000;
+        for (const id of ids) {
+            const obj = await this.adapter.getForeignObjectAsync(`system.adapter.${id}`, { user: this.user });
+            const mode = obj?.common?.mode;
+            if (mode && mode !== 'daemon') {
+                results.push({ id, mode, note: `Not checked: a ${mode} instance does not stay running` });
+                continue;
+            }
+            let alive = false;
+            for (;;) {
+                const state = await this.adapter.getForeignStateAsync(`system.adapter.${id}.alive`, {
+                    user: this.user,
+                });
+                // `lc`, not `ts`: the heartbeat of the old process refreshes `ts` until it is stopped
+                alive = !!state?.val && (state.lc ?? state.ts) >= since;
+                if (alive || Date.now() >= deadline) {
+                    break;
+                }
+                await new Promise(resolve => setTimeout(resolve, 500));
+            }
+            results.push({ id, alive, ...(alive ? {} : { note: `Not alive after ${timeoutSeconds}s` }) });
+        }
+        // The first lines since the restart show whether the start went well
+        try {
+            for (const entry of results) {
+                if (entry.mode) {
+                    continue;
+                }
+                const { logs } = await this.getLogs({ adapter: entry.id, from_ts: since, limit: 500 });
+                entry.logs = logs.slice(0, START_LOG_LINES).map(log => ({
+                    ts: log.ts,
+                    level: log.level,
+                    message: log.message,
+                }));
+            }
+        }
+        catch (e) {
+            this.adapter.log.debug(`Cannot read the log after the restart: ${e instanceof Error ? e.message : e}`);
+        }
+        return results;
     }
     /** Normalize a host name (with or without `system.host.`) and check that the host exists. */
     async resolveHost(host) {