iobroker.eos-admin 7.10.4 → 7.10.5

package/tools/nexowatt-modern-ui-selftest.cjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 'use strict';
 const fs=require('node:fs'),path=require('node:path');const root=path.resolve(__dirname,'..');const read=r=>fs.readFileSync(path.join(root,r),'utf8');const fail=m=>{console.error('[NexoWatt EOS modern UI] '+m);process.exit(1)};const must=(v,m)=>{if(!v)fail(m)};
-const css=read('adminWww/css/nexowatt-native-shell.css'),sourceCss=read('src-admin/public/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),boot=read('adminWww/js/eos-role-bootstrap.js'),shell=read('adminWww/js/nexowatt-native-shell.js'),role=read('adminWww/js/eos-role-ui.js'),assist=read('adminWww/js/eos-assistant.js');
+const info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json')),shellTag=String(info.shellCacheTag||info.shellCacheVersion);const css=read('adminWww/css/nexowatt-native-shell.css'),sourceCss=read('src-admin/public/css/nexowatt-native-shell.css'),index=read('adminWww/index.html'),boot=read('adminWww/js/eos-role-bootstrap.js'),shell=read('adminWww/js/nexowatt-native-shell.js'),role=read('adminWww/js/eos-role-ui.js'),assist=read('adminWww/js/eos-assistant.js');
 must(css===sourceCss,'CSS source/build drift');
 for(const marker of ['#app-paper','.MuiDialog-paper','.MuiButton-root',':focus-visible','persistent native overview scrolling','eos-overview-edit-controls'])must(css.includes(marker),`CSS marker missing: ${marker}`);
-for(const marker of ['nexowatt-native-shell.css','eos-role-bootstrap.js','eos-auto-update.js','nexowatt-stable-v7101.js'])must(index.includes(marker),`active asset missing: ${marker}`);
+for(const marker of ['nexowatt-native-shell.css','eos-role-bootstrap.js','eos-auto-update.js',`nexowatt-stable-v${shellTag}.js`])must(index.includes(marker),`active asset missing: ${marker}`);
 must(!index.includes('eos-account-management.js'),'custom reset asset active');
 must(boot.includes('NEXOWATT_EOS_STANDARD_PASSWORD_MODE')&&!boot.includes('installIntegratedFirstLogin(base);'),'standard login mode missing');
 must(shell.includes('ensureModernOverview'),'modern overview missing');

package/tools/nexowatt-role-security-selftest.cjs

@@ -1,43 +1,131 @@
-"use strict";
-const assert = require("node:assert/strict");
-const fs = require("node:fs");
-const path = require("node:path");
-const root = path.resolve(__dirname, "..");
-const securityFile = path.join(root, "build", "lib", "eosRoleSecurity.js");
-assert.ok(fs.existsSync(securityFile), "build/lib/eosRoleSecurity.js is missing");
-const security = require(securityFile);
-assert.equal(security.classifyRole("admin"), "admin");
-assert.equal(security.classifyRole("Administrator"), "admin");
-assert.equal(security.classifyRole("installer"), "installer");
-assert.equal(security.classifyRole("Gast / Endkunde"), "customer");
-assert.equal(security.isAdminOnlyPath("/#/app-center"), true);
-assert.equal(security.isAdminOnlyPath("/license"), true);
-assert.equal(security.isAdminOnlyPath("/simulation"), true);
-assert.equal(security.isAdminOnlyPath("/cockpit"), false);
-assert.equal(security.isRightsPath("/#/users-and-groups"), true);
-assert.equal(security.isRightsPath("/cockpit"), false);
-const htmlFiles = [];
-(function walk(dir) {
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    if (entry.name === "node_modules" || entry.name === ".git") continue;
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) walk(full);
-    else if (entry.name === "index.html") htmlFiles.push(full);
-  }
-})(root);
-const runtimeHtml = htmlFiles.filter(file => /<script[^>]+(?:assets\/|src=)/i.test(fs.readFileSync(file, "utf8")));
-assert.ok(runtimeHtml.length > 0, "No runtime index.html was found");
-for (const file of runtimeHtml) {
-  const html = fs.readFileSync(file, "utf8");
-  assert.match(html, /nexowatt-role-security\.js\?v=7104/, `Role guard missing in ${path.relative(root, file)}`);
-  assert.ok(fs.existsSync(path.join(path.dirname(file), "nexowatt-role-security.js")), `Client guard missing next to ${path.relative(root, file)}`);
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const root = path.resolve(__dirname, '..');
+const read = relative => fs.readFileSync(path.join(root, relative), 'utf8');
+const json = relative => JSON.parse(read(relative));
+
+const index = read('adminWww/index.html');
+const sourceIndex = read('src-admin/index.html');
+const bootstrap = read('adminWww/js/eos-role-bootstrap.js');
+const roleUi = read('adminWww/js/eos-role-ui.js');
+const sourceRoleUi = read('src-admin/public/js/eos-role-ui.js');
+const sourceMain = read('src/main.ts');
+const builtMain = read('build/main.js');
+const appSource = read('src-admin/src/App.tsx');
+const objectsSource = read('src-admin/src/tabs/Objects.tsx');
+const introSource = read('src-admin/src/tabs/Intro.tsx');
+const drawerSource = read('src-admin/src/components/Drawer.tsx');
+const bootstrapBundle = read('adminWww/assets/bootstrap-COulQZax-v84.js');
+const objectsBundle = read('adminWww/assets/Objects-DPan0bzw-v84.js');
+const introBundle = read('adminWww/assets/Intro-DkwRiz1n-v84.js');
+const io = json('io-package.json');
+const cleanupSource = read('tools/nexowatt-clean-legacy-runtime.cjs');
+
+// The removed DOM-text heuristic classified a real administrator as end user when the
+// visible header happened to contain "user". Only authenticated backend policy may define the role.
+for (const html of [index, sourceIndex]) {
+    assert.doesNotMatch(html, /nexowatt-role-security\.js/i, 'legacy heuristic role guard is still loaded');
+    assert.match(html, /eos-role-bootstrap\.js\?v=7105/, 'authoritative role bootstrap cache tag is missing');
+    assert.match(html, /eos-policy-client\.js\?v=7105/, 'authoritative policy client cache tag is missing');
+    assert.match(html, /eos-role-ui\.js\?v=7105/, 'authoritative role UI cache tag is missing');
 }
-const main = fs.readFileSync(path.join(root, "build", "main.js"), "utf8");
-assert.match(main, /eosRoleSecurity/);
-assert.match(main, /installHttpGuard/);
-assert.match(main, /enforceRoleAcls/);
-const client = runtimeHtml.length ? fs.readFileSync(path.join(path.dirname(runtimeHtml[0]), "nexowatt-role-security.js"), "utf8") : "";
-for (const token of ["app-center", "lizenz", "simulation", "expertenmodus", "xterm", "Nur-Lesezugriff", "backupActive"]) {
-  assert.ok(client.toLowerCase().includes(token.toLowerCase()), `Client guard is missing ${token}`);
+assert.equal(fs.existsSync(path.join(root, 'adminWww/nexowatt-role-security.js')), false, 'legacy runtime still exists');
+assert.equal(fs.existsSync(path.join(root, 'build/lib/eosRoleSecurity.js')), false, 'legacy backend heuristic still exists');
+assert.doesNotMatch(builtMain, /eosRoleSecurity|installHttpGuard|enforceRoleAcls/);
+for (const obsolete of [
+    'adminWww/nexowatt-role-security.js',
+    'src-admin/nexowatt-role-security.js',
+    'build/lib/eosRoleSecurity.js',
+]) {
+    assert.ok(cleanupSource.includes(`'${obsolete}'`), `runtime cleanup must remove stale ${obsolete}`);
 }
-console.log("[NexoWatt EOS role security] OK");
+for (const code of [bootstrap, roleUi, sourceRoleUi]) {
+    assert.match(code, /policy\?\.user === 'system\.user\.admin'/, 'system.user.admin is not explicitly authoritative');
+    assert.match(code, /policy\?\.isAdministrator/, 'backend administrator capability is not honored');
+}
+
+// Admin is the unconditional full-rights bypass. Restrictions below this branch must never run for Admin.
+for (const code of [sourceMain, builtMain]) {
+    const bypass = code.indexOf("if (role === 'admin')");
+    const endUserWriteDeny = code.indexOf('end-user datapoints are read-only in EOS Admin');
+    assert.ok(bypass >= 0 && endUserWriteDeny > bypass, 'Admin socket bypass must precede all restricted-role rules');
+    assert.match(code, /password administration is Service-only/);
+    assert.match(code, /\.info\.uiTabsVisible/);
+}
+
+// Expert mode is an Admin-only control, but the administrator can freely toggle both directions.
+assert.match(appSource, /const isEosAdministrator = \(\): boolean => \['admin', 'service'\]\.includes/);
+assert.match(appSource, /newState\.expertMode = isEosAdministrator\(\)/);
+assert.match(appSource, /data-eos-expert-control="1"/);
+assert.match(appSource, /this\.setState\(\{ expertMode: !this\.state\.expertMode \}\)/);
+assert.match(bootstrapBundle, /"data-eos-expert-control":"1"/);
+assert.match(bootstrapBundle, /l\.expertMode=\["admin","service"\]\.includes\(String\(window\.NEXOWATT_EOS_ACCESS_ROLE/);
+assert.match(bootstrapBundle, /c\?jsxRuntimeExports\.jsx\(IsVisible,\{name:"admin\.appBar\.expertMode"/);
+assert.match(bootstrapBundle, /:null,c&&this\.state\.expertMode\?jsxRuntimeExports\.jsx/);
+assert.match(roleUi, /if \(state\.role === 'admin'\) return false;/, 'Admin expert-mode cleanup must be a no-op');
+assert.match(roleUi, /if \(state\.role === 'admin' \|\| state\.role === 'unknown'\) return;/, 'Admin click handling must not be intercepted');
+
+// Datapoints: Admin/Installer retain native write support; only End User is read-only.
+assert.match(objectsSource, /const readOnly = eosRole === 'enduser'/);
+for (const marker of [
+    'enableStateValueEdit={!readOnly}',
+    'objectEditBoolean={!readOnly}',
+    'objectAddBoolean={!readOnly}',
+    'objectImportExport={!readOnly}',
+    'objectEditOfAccessControl={!readOnly}',
+]) assert.ok(objectsSource.includes(marker), `Objects source missing ${marker}`);
+assert.match(objectsBundle, /_eosReadOnly=_eosRole==="enduser"/);
+for (const marker of [
+    'enableStateValueEdit:!_eosReadOnly',
+    'objectEditBoolean:!_eosReadOnly',
+    'objectAddBoolean:!_eosReadOnly',
+    'objectImportExport:!_eosReadOnly',
+    'objectEditOfAccessControl:!_eosReadOnly',
+]) assert.ok(objectsBundle.includes(marker), `Objects runtime missing ${marker}`);
+assert.match(bootstrap, /route === 'tab-objects'/, 'End User datapoint route is not released');
+assert.match(roleUi, /clean === 'tab-objects'/, 'End User datapoint route is not released in runtime UI policy');
+
+// The Admin and XTerm cards stay visible for Admin and are removed only for non-admin roles.
+assert.match(introSource, /if \(!isAdministrator && \/\^\(\?:admin\|xterm\)/);
+assert.match(introSource, /forceVisibleAdminCard = isAdministrator/);
+assert.match(introBundle, /if\(!_eosAdmin&&\/\^\(\?:admin\|xterm\)/);
+assert.match(introBundle, /_forceAdmin=_eosAdmin/);
+assert.doesNotMatch(introSource, /NEXOWATT_EOS_ACCESS_ROLE \|\| 'admin'/, 'Intro source must fail closed while role is unresolved');
+assert.doesNotMatch(introBundle, /NEXOWATT_EOS_ACCESS_ROLE\|\|"admin"/, 'Intro runtime must fail closed while role is unresolved');
+
+// App Center, License, Simulation and normal account administration are not available to Installer/End User.
+for (const token of ['app center', 'app-center', 'appcenter', 'simulation', 'simulator', 'lizenz', 'license']) {
+    assert.ok(roleUi.toLowerCase().includes(token), `role UI is missing protected action ${token}`);
+}
+assert.match(roleUi, /applyPrivilegedIframePolicy/);
+assert.match(roleUi, /:8188\/logout\?/);
+assert.match(roleUi, /route !== 'tab-users'/);
+assert.match(bootstrap, /tab-users\|tab-hosts\|tab-files/);
+
+// Pencil/menu edits must not touch system.config (which restarts the running adapter).
+const drawerMethod = drawerSource.slice(
+    drawerSource.indexOf('async getTabs(update?: boolean)'),
+    drawerSource.indexOf('getNavigationItems(): JSX.Element[]'),
+);
+assert.match(drawerSource, /info\.uiTabsVisible/);
+assert.match(drawerMethod, /socket\.setState/);
+assert.doesNotMatch(drawerMethod, /setSystemConfig|getSystemConfig\(/);
+const builtDrawer = bootstrapBundle.slice(
+    bootstrapBundle.indexOf('async getTabs(e){'),
+    bootstrapBundle.indexOf('getNavigationItems(){', bootstrapBundle.indexOf('async getTabs(e){')),
+);
+assert.match(builtDrawer, /info\.uiTabsVisible/);
+assert.match(builtDrawer, /socket\.setState/);
+assert.doesNotMatch(builtDrawer, /setSystemConfig|getSystemConfig\(/);
+assert.ok((io.instanceObjects || []).some(object => object?._id === 'info.uiTabsVisible'), 'navigation state object missing');
+
+// Backup navigation is emitted only for an actually enabled instance.
+assert.match(drawerSource, /backupAdapters\.has\(adapterName\) && instance\.enabled !== true/);
+assert.match(builtDrawer, /o\.has\(A\)&&d\.enabled!==!0/);
+
+console.log('[NexoWatt EOS role security] OK (authoritative Admin rights, End User read-only datapoints, protected tools, restart-safe menu storage)');

package/tools/nexowatt-runtime-cleanup-selftest.cjs

@@ -15,6 +15,7 @@ try {
   fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'js'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'static', 'js'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'adminWww', 'static', 'js'), { recursive: true });
+  fs.mkdirSync(path.join(temp, 'build', 'lib'), { recursive: true });
   fs.writeFileSync(path.join(temp, 'NEXOWATT_EOS_BUILD_INFO.json'), JSON.stringify({ runtimeEntry: 'v82', shellCacheVersion: 98 }));
 
   const keep = [
@@ -36,6 +37,9 @@ try {
     'src-admin/public/js/eos-security-ui.js',
     'adminWww/static/js/nexowatt-stable-v97.js',
     'src-admin/public/static/js/nexowatt-stable-v95.js',
+    'adminWww/nexowatt-role-security.js',
+    'src-admin/nexowatt-role-security.js',
+    'build/lib/eosRoleSecurity.js',
   ];
   for (const rel of [...keep, ...remove]) {
     const file = path.join(temp, rel);

package/tools/nexowatt-stable-v7103-selftest.cjs

@@ -25,18 +25,18 @@ const index = read('adminWww/index.html');
 const ems = read('adminWww/js/eos-ems-overview.js');
 const intro = read('src-admin/src/tabs/Intro.tsx');
 const bundle = read('adminWww/assets/Intro-DkwRiz1n-v84.js');
-const stable = read('adminWww/static/js/nexowatt-stable-v7101.js');
+const stable = read(`adminWww/static/js/nexowatt-stable-v${String(info.shellCacheTag || info.shellCacheVersion)}.js`);
 const autoBackend = read('src/lib/eosAutoUpdate.ts');
 const autoUi = read('adminWww/js/eos-auto-update.js');
 const autoCss = read('adminWww/css/eos-auto-update.css');
 const autoTag = String(info.autoUpdateCacheTag || info.autoUpdateCacheVersion || info.shellCacheTag || info.shellCacheVersion);
 
-must(pkg.version === '7.10.4' && io.version === '7.10.4' && io.common.version === '7.10.4' && info.version === '7.10.4', 'version drift');
+must(pkg.version === '7.10.5' && io.version === '7.10.5' && io.common.version === '7.10.5' && info.version === '7.10.5', 'version drift');
 must(io.native.eosRequireFirstLoginPassword === false && io.native.eosRequireFirstLoginPasswordChange === false, 'forced first password still enabled');
 must(!index.includes('eos-account-management.js'), 'custom reset UI still loaded');
 must(!boot.includes('installIntegratedFirstLogin(base);') && !boot.includes('showFirstLoginPassword(resolved, base);'), 'forced first-login UI still active');
 must(main.includes('standardPasswordMode: true') && main.includes('nexowattPasswordChangeRequired: false'), 'account migration missing');
-must(role.includes("route === 'tab-users'") && main.includes("command === 'changePassword'"), 'role-aware native password editing missing');
+must(role.includes("route !== 'tab-users'") && main.includes("command === 'changePassword'") && main.includes('password administration is Service-only'), 'non-admin account/password administration guard missing');
 must(css.includes('persistent native overview scrolling') && stable.includes("overflow-y','scroll"), 'persistent scroll missing');
 must(intro.includes('eos-overview-edit-controls') && bundle.includes('eos-overview-edit-controls'), 'edit control not in bottom grid');
 must(!ems.includes('Vollständige EMS-Diagnose öffnen'), 'unsupported EMS link remains');
@@ -49,7 +49,7 @@ must(!autoBackend.includes('extendForeignObjectAsync(this.instanceId'), 'runtime
 must(web.includes('this.nexowattStableUpdateManager?.stop();'), 'auto-update manager is not stopped with the web server');
 must(fs.existsSync(path.join(root, 'build/lib/eosRequestSecurity.js')), 'eosRequestSecurity runtime module missing');
 
-// 7.10.4 placement acceptance: System Settings only.
+// 7.10.4 placement acceptance remains mandatory in 7.10.5: System Settings only.
 must(index.includes(`eos-auto-update.js?v=${autoTag}`), 'auto-update JavaScript cache key missing');
 must(index.includes(`eos-auto-update.css?v=${autoTag}`), 'auto-update CSS cache key missing');
 must(autoUi.includes('[role="dialog"][aria-labelledby="system-settings-dialog-title"]'), 'System Settings selector missing');

package/tools/nexowatt-ui-overview-runtime-selftest.cjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 'use strict';
 const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const fail=msg=>{console.error(`[NexoWatt EOS UI overview runtime] ${msg}`);process.exit(1)};
-const runtime=read('adminWww/js/eos-ems-overview.js');const source=read('src-admin/public/js/eos-ems-overview.js');const css=read('adminWww/css/eos-ems-overview.css');const index=read('adminWww/index.html');const role=read('adminWww/js/eos-role-ui.js');const shell=read('adminWww/js/nexowatt-native-shell.js');const intro=read('src-admin/src/tabs/Intro.tsx');const introBundle=read('adminWww/assets/Intro-DkwRiz1n-v84.js');const bootstrap=read('adminWww/assets/bootstrap-COulQZax-v84.js');const generic=read('adminWww/assets/index-D2ymscJA-v84.js');
+const info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json')),shellTag=String(info.shellCacheTag||info.shellCacheVersion);const runtime=read('adminWww/js/eos-ems-overview.js');const source=read('src-admin/public/js/eos-ems-overview.js');const css=read('adminWww/css/eos-ems-overview.css');const index=read('adminWww/index.html');const role=read('adminWww/js/eos-role-ui.js');const shell=read('adminWww/js/nexowatt-native-shell.js');const intro=read('src-admin/src/tabs/Intro.tsx');const introBundle=read('adminWww/assets/Intro-DkwRiz1n-v84.js');const bootstrap=read('adminWww/assets/bootstrap-COulQZax-v84.js');const generic=read('adminWww/assets/index-D2ymscJA-v84.js');
 if(runtime!==source)fail('runtime source/build drift');
 if(runtime.includes('Vollständige EMS-Diagnose öffnen'))fail('unsupported EMS link remains');
 for(const marker of ['nexowatt-ems-overview-v1','nexowatt-ui.*.info.adminOverview.*','system.adapter.nexowatt-ui.*.alive','POLL_MS = 5000','STALE_MS = 20000',"REQUIRED_UI_VERSION = '0.8.198'",'getForeignStates','Keine Kachel besitzt Schreibhoheit','currentDecisions','§14a-Fallback','nexowatt-eos-admin-socket-ready','readUiAdapterInfo','socketFromReact'])if(!runtime.includes(marker))fail(`runtime marker missing: ${marker}`);
 for(const forbidden of ['setForeignState','setState(','sendToHost','writeFile','extendObject'])if(runtime.includes(forbidden))fail(`read-only runtime contains ${forbidden}`);
-for(const marker of ['eos-ems-overview.css?v=7101','eos-ems-overview.js?v=7101','nexowatt-stable-v7101.js?v=7101'])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
+for(const marker of [`eos-ems-overview.css?v=${shellTag}`,`eos-ems-overview.js?v=${shellTag}`,`nexowatt-stable-v${shellTag}.js?v=${shellTag}`])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
 if(!css.includes('#eos-ems-overview-runtime')||!css.includes('.eos-ems-overview-metrics')||!css.includes('startup and compatibility messages stay compact'))fail('EMS card CSS incomplete');
 if(role.includes('overview.innerHTML = `')||!role.includes('never cover the real Admin Intro'))fail('obsolete role overview still active');
 if(!shell.includes("label: 'Installateur'")||!shell.includes("label: 'Endkunde'")||!shell.includes('eosNativeReactOverview'))fail('native overview role bridge incomplete');

package/tools/nexowatt-validate-package.cjs

@@ -68,6 +68,7 @@ if (io.native?.nexowattHideLegacyBackupFromNonAdmins !== true) fail('NexoWatt ba
 const instanceObjectIds = new Set((io.instanceObjects || []).map(object => object?._id));
 if (!instanceObjectIds.has('info.nexowattStableUpdatesEnabled')) fail('restart-safe auto-update enabled state is missing');
 if (!instanceObjectIds.has('info.nexowattStableUpdatesState')) fail('restart-safe auto-update runtime state is missing');
+if (!instanceObjectIds.has('info.uiTabsVisible')) fail('restart-safe navigation state info.uiTabsVisible is missing');
 for (const key of ['description', 'files', 'scripts', 'nexowattReleasePolicy']) {
   if (JSON.stringify(pkgLock.packages?.['']?.[key]) !== JSON.stringify(pkg[key])) {
     fail(`package-lock root ${key} must match package.json`);
@@ -133,14 +134,14 @@ for (const file of [
   'LICENSE',
   'NEXOWATT_PROPRIETARY_LICENSE.md',
   'THIRD_PARTY_NOTICES.md',
-  'README_STABILITY_V7.10.4.md',
-  'RELEASE_NOTES_V7.10.4.md',
-  'PUBLISH_STABLE_V7.10.4.md',
-  'INSTALL_TEST_V7.10.4.md',
-  'RELEASE_ACCEPTANCE_V7.10.4.md',
+  'README_STABILITY_V7.10.5.md',
+  'RELEASE_NOTES_V7.10.5.md',
+  'PUBLISH_STABLE_V7.10.5.md',
+  'INSTALL_TEST_V7.10.5.md',
+  'RELEASE_ACCEPTANCE_V7.10.5.md',
   'MERGE_UPDATE.ps1',
   'MERGE_UPDATE.cmd',
-  'MERGE_UPDATE_README_V7.10.4.md',
+  'MERGE_UPDATE_README_V7.10.5.md',
   'tools/nexowatt-patch-built-frontend.cjs',
   'tools/nexowatt-native-shell-selftest.cjs',
   'tools/nexowatt-clean-legacy-runtime.cjs',
@@ -173,7 +174,7 @@ for (const file of [
   'tools/nexowatt-ui-overview-runtime-selftest.cjs',
   'adminWww/js/eos-ems-overview.js',
   'adminWww/css/eos-ems-overview.css',
-  'adminWww/static/js/nexowatt-stable-v7101.js',
+  'adminWww/static/js/nexowatt-stable-v7105.js',
   'src-admin/src/components/Intro/NexoWattEmsOverview.tsx',
   'tools/nexowatt-publish-channel-guard.cjs',
   'tools/nexowatt-publish-channel-selftest.cjs',
@@ -219,7 +220,7 @@ if (!index.includes(`eos-auto-update.css?v=${autoUpdateTag}`)) fail('auto-update
 if (!index.includes(`eos-assistant.js?v=${shellTag}`)) fail('EOS Assist cache key mismatch');
 if (!index.includes(`eos-ems-overview.js?v=${shellTag}`)) fail('EMS overview cache key mismatch');
 if (!index.includes(`eos-ems-overview.css?v=${shellTag}`)) fail('EMS overview CSS cache key mismatch');
-if (!index.includes(`nexowatt-stable-v7101.js?v=${shellTag}`)) fail('stable v98 cache key mismatch');
+if (!index.includes(`nexowatt-stable-v${shellTag}.js?v=${shellTag}`)) fail('stable shell overlay cache key mismatch');
 if (index.indexOf(`eos-manual-write-policy.js?v=${shellTag}`) > index.indexOf(`hostInit-${runtime}.js?v=${runtimeNumber}`)) fail('manual-write policy must load before the React runtime');
 if (!index.includes('class="eos-native-shell"')) fail('native NexoWatt shell class missing');
 for (const legacy of ['eos-branding.js', 'eos-security-ui.js', 'eos-console-quiet.js', 'eos-objects-state-tools.js']) {

package/INSTALL_TEST_V7.10.4.md

@@ -1,9 +0,0 @@
-# Installationstest 7.10.4
-
-1. Version 7.10.4 in einem neuen Arbeitsordner veröffentlichen bzw. installieren.
-2. EOS Admin mindestens 60 Sekunden ohne Start-/Stop-Schleife beobachten.
-3. Als Administrator App-Center, Lizenz, Simulation, Benutzer/Rechte, Expertenmodus, ioBroker Admin und XTerm prüfen.
-4. Als Installateur müssen diese Bereiche vollständig fehlen bzw. bei direktem Aufruf gesperrt sein.
-5. Als Endkunde müssen Datenpunkte sichtbar, aber nicht beschreibbar sein; Benutzer/Rechte und Passwortverwaltung dürfen nicht erreichbar sein.
-6. Backup-Instanz deaktivieren: der Navigationspunkt Sicherung muss verschwinden. Backup-Instanz aktivieren: der Punkt muss wieder erscheinen.
-7. Systemeinstellungen öffnen: die Karte Automatische Adapter-Updates darf nur dort sichtbar sein.

package/MERGE_UPDATE_README_V7.10.4.md

@@ -1,3 +0,0 @@
-# Merge-/Update-Hinweis 7.10.4
-
-Den bisherigen Arbeitsordner vollständig ersetzen oder die Repository-ZIP in einen leeren Ordner entpacken. Nicht über eine ältere Version kopieren, weil veraltete Browser-Bundles, Rollen-Skripte oder Paket-Lifecycle-Einträge sonst bestehen bleiben können. Danach zuerst `npm publish --dry-run` ausführen.

package/PUBLISH_STABLE_V7.10.4.md

@@ -1,10 +0,0 @@
-# NPM-Veröffentlichung 7.10.4
-
-Aus einer frisch entpackten Repository-ZIP ausführen:
-
-```powershell
-npm publish --dry-run
-npm publish
-```
-
-Der Publish-Workflow ist dependency-frei und darf weder `tsc`, `tsx`, `npm install` noch einen verschachtelten `npm pack`-Prozess verlangen.

package/README_STABILITY_V7.10.4.md

@@ -1,12 +0,0 @@
-# NexoWatt EOS Admin 7.10.4 – Stabilitäts- und Sicherheitsstand
-
-Version 7.10.4 baut auf dem absturz- und publish-sicheren Stand 7.10.3 auf. Die automatische Update-Karte bleibt ausschließlich in den Systemeinstellungen hinter dem Schraubenschlüssel.
-
-Zusätzlich gilt eine rollenbasierte Sicherheitsgrenze:
-
-- Administrator: vollständiger Zugriff einschließlich App-Center, Lizenz, Simulation, Expertenmodus, Benutzer/Rechte, ioBroker Admin und XTerm.
-- Installateur: technische Bedienoberfläche ohne App-Center, Lizenz, Simulation, Expertenmodus, Benutzer/Rechte, ioBroker Admin und XTerm.
-- Endkunde: Cockpit, Smart Home und Datenpunkte mit Nur-Lesezugriff; keine Schreib-, Rechte-, Passwort- oder Expertenfunktionen.
-- Sicherung: Navigation nur bei installierter und aktivierter Backup-Instanz.
-
-Die Sperren werden nicht nur optisch, sondern zusätzlich im EOS-HTTP-Guard und über die Endkunden-ACLs durchgesetzt.

package/RELEASE_ACCEPTANCE_V7.10.4.md

@@ -1,3 +0,0 @@
-# Release Acceptance 7.10.4
-
-Akzeptiert, wenn Paketvalidierung, Stabilitätstests, Prebuilt-Manifest, Backend-Runtime, Rollen-Selbsttest und `npm publish --dry-run` erfolgreich sind. Zusätzlich müssen Administrator-, Installateur- und Endkundenrechte im Feldtest der dokumentierten Rollenmatrix entsprechen.

package/RELEASE_NOTES_V7.10.4.md

@@ -1,11 +0,0 @@
-# Release Notes 7.10.4
-
-- App-Center, Lizenzverwaltung und Simulation auf Administratoren begrenzt.
-- Expertenmodus und Expertenkopf für Installateur und Endkunde entfernt.
-- Benutzer-, Gruppen-, Rechte- und Passwortverwaltung für Nicht-Administratoren gesperrt.
-- ioBroker Admin und XTerm für Installateur und Endkunde ausgeblendet und serverseitig abgefangen.
-- Endkunden-Datenpunkte sichtbar, aber nur lesbar; Schreibaufrufe werden blockiert.
-- Sicherungsnavigation nur bei aktiver Backup-Instanz.
-- Bereits bestehende privilegierte UI-Sitzungen werden bei Nicht-Administratoren nicht weiterverwendet.
-- Update-Karte weiterhin ausschließlich unter Systemeinstellungen.
-- Absturz-, Runtime- und dependency-freier NPM-Publish-Schutz aus 7.10.2/7.10.3 beibehalten.