iobroker.eos-admin 7.9.93 → 7.9.95

package/build/main.js

@@ -164,6 +164,79 @@ let lastRepoUpdate;
 let objects = {};
 const secret = 'Zgfr56gFe87jJOM'; // Will be generated by first start
 let systemLanguage = 'en';
+
+const EOS_STABLE_INITIAL_PASSWORD = 'nexowatt';
+const EOS_STABLE_ACCOUNTS = [
+    { user: 'installer', role: 'installer' },
+    { user: 'guest', role: 'customer' },
+    { user: 'user', role: 'customer' },
+];
+
+async function ensureEosStableGroupMembership(adapter, user, role) {
+    const candidateGroups = role === 'installer'
+        ? ['system.group.installer', 'system.group.installateur', 'system.group.installers']
+        : ['system.group.endkunde', 'system.group.endkunden'];
+    const userId = `system.user.${user}`;
+    for (const groupId of candidateGroups) {
+        const group = await adapter.getForeignObjectAsync(groupId);
+        if (!group) {
+            continue;
+        }
+        const members = Array.isArray(group.common?.members) ? [...group.common.members] : [];
+        if (!members.includes(userId)) {
+            members.push(userId);
+            await adapter.extendForeignObjectAsync(groupId, { common: { members } }, { user: 'system.user.admin' });
+        }
+    }
+}
+
+async function ensureEosStableInitialAccounts(adapter) {
+    for (const account of EOS_STABLE_ACCOUNTS) {
+        const id = `system.user.${account.user}`;
+        let object = await adapter.getForeignObjectAsync(id);
+        let created = false;
+        if (!object) {
+            await adapter.setForeignObjectAsync(id, {
+                type: 'user',
+                common: { name: account.user, enabled: true, password: '' },
+                native: {},
+            }, { user: 'system.user.admin' });
+            object = await adapter.getForeignObjectAsync(id);
+            created = true;
+        }
+        if (!object) {
+            adapter.log.error(`Cannot prepare EOS account ${account.user}`);
+            continue;
+        }
+        const eosNative = object.native || {};
+        const resetRequested = eosNative.nexowattResetRequested === true || eosNative.eosResetRequested === true;
+        const passwordMissing = !object.common?.password;
+        const pendingFirstLogin = eosNative.nexowattPasswordChangeRequired === true || eosNative.eosPasswordChangeRequired === true || eosNative.nexowattFirstLoginPending === true || eosNative.eosFirstLoginRequired === true;
+        const stableCredentialMissing = eosNative.nexowattStableInitialCredentialVersion !== 1;
+        if (created || passwordMissing || resetRequested || (pendingFirstLogin && stableCredentialMissing)) {
+            await adapter.setPasswordAsync(account.user, EOS_STABLE_INITIAL_PASSWORD, { user: 'system.user.admin' });
+            await adapter.extendForeignObjectAsync(id, {
+                native: {
+                    ...eosNative,
+                    nexowattManaged: true,
+                    nexowattRole: account.role,
+                    nexowattPasswordChangeRequired: true,
+                    eosPasswordChangeRequired: true,
+                    nexowattFirstLoginPending: true,
+                    eosFirstLoginRequired: true,
+                    nexowattInitialPasswordApplied: true,
+                    nexowattInitialPasswordVersion: 1,
+                        nexowattStableInitialCredentialVersion: 1,
+                    nexowattResetRequested: false,
+                    eosResetRequested: false,
+                },
+            }, { user: 'system.user.admin' });
+            adapter.log.info(`Prepared EOS ${account.role} account ${account.user} for mandatory first password change`);
+        }
+        await ensureEosStableGroupMembership(adapter, account.user, account.role);
+    }
+}
+
 class Admin extends adapter_core_1.Adapter {
     /** secret used for the socket connection */
     secret;
@@ -174,13 +247,8 @@ class Admin extends adapter_core_1.Adapter {
     timerNews;
     _tasks;
     changedPasswords = [];
-    /** Legacy in-process chat connection kept for compatibility with existing admin messages. */
+    /** In-process ioBroker.mcp connection backing the chat helper. Created on first chat message. */
     mcpChat = null;
-    /** Role-scoped, read-only MCP connections used by the header EOS Assist. */
-    eosAssistMcpChats = new Map();
-    /** Per-user throttling and concurrency guard for provider calls. */
-    eosAssistLastRequestAt = new Map();
-    eosAssistInFlight = new Set();
     /** Periodic guard that keeps EOS safety policy applied even if object events are missed. */
     eosSecurityTimer = null;
     /** Debounce timer for object-change triggered safety checks. */
@@ -287,6 +355,7 @@ class Admin extends adapter_core_1.Adapter {
                 systemLanguage = systemConfig.common.language;
             }
             adapter_core_1.I18n.init(__dirname, systemLanguage).catch(e => this.log.error(`Cannot init i18n: ${e}`));
+            await ensureEosStableInitialAccounts(this);
             if (!systemConfig.native.secret) {
                 (0, node_crypto_1.randomBytes)(24, (_ex, buf) => {
                     this.secret = buf.toString('hex');
@@ -321,300 +390,6 @@ class Admin extends adapter_core_1.Adapter {
         });
         return this.mcpChat;
     }
-    /** Return a read-only MCP connection whose tool calls run under the authenticated user's ACL. */
-    getEosAssistMcp(userId) {
-        const key = `${userId}:${systemLanguage}`;
-        let manager = this.eosAssistMcpChats.get(key);
-        if (!manager) {
-            manager = new mcpClientManager_1.McpClientManager(this, {
-                defaultUser: userId,
-                language: systemLanguage,
-                allowSetState: false,
-                allowObjectChange: false,
-            });
-            this.eosAssistMcpChats.set(key, manager);
-        }
-        return manager;
-    }
-    normalizeEosAssistSettings(value) {
-        const native = value && typeof value === 'object' && !Array.isArray(value)
-            ? value
-            : {};
-        const allowed = ['openai', 'anthropic', 'gemini', 'deepseek', 'custom'];
-        const rawProvider = typeof native.provider === 'string' ? native.provider : 'anthropic';
-        const provider = allowed.includes(rawProvider) ? rawProvider : 'anthropic';
-        return {
-            provider,
-            model: typeof native.model === 'string' ? native.model.trim().substring(0, 200) : '',
-            credentialId: typeof native.credentialId === 'string' ? native.credentialId.trim().substring(0, 300) : '',
-            baseUrl: typeof native.baseUrl === 'string' ? native.baseUrl.trim().replace(/\/+$/, '').substring(0, 500) : '',
-            allowSelfSignedCerts: native.allowSelfSignedCerts === true,
-        };
-    }
-    isEosAssistConfigured(settings) {
-        if (!settings.model) {
-            return false;
-        }
-        return settings.provider === 'custom'
-            ? !!(settings.baseUrl || settings.credentialId)
-            : !!settings.credentialId;
-    }
-    async readEosAssistSettings() {
-        const object = await this.getForeignObjectAsync('system.ai');
-        return this.normalizeEosAssistSettings(object?.native);
-    }
-    sanitizeEosAssistVisibleText(value) {
-        const text = String(value || '');
-        // Preserve technical IDs and commands inside code spans while keeping product prose NexoWatt-only.
-        return text
-            .split(/(```[\s\S]*?```|`[^`\n]*`)/g)
-            .map((part, index) => (index % 2 ? part : part.replace(/\bioBroker\b/gi, 'NexoWatt EOS')))
-            .join('');
-    }
-    normalizeEosAssistMessages(value) {
-        if (!Array.isArray(value)) {
-            return [];
-        }
-        const messages = [];
-        let total = 0;
-        for (const entry of value.slice(-24)) {
-            if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
-                continue;
-            }
-            const record = entry;
-            const role = record.role === 'assistant' ? 'assistant' : record.role === 'user' ? 'user' : null;
-            if (!role || typeof record.content !== 'string') {
-                continue;
-            }
-            const content = record.content.trim().substring(0, 6_000);
-            if (!content) {
-                continue;
-            }
-            total += content.length;
-            if (total > 30_000) {
-                break;
-            }
-            messages.push({ role, content });
-        }
-        return messages;
-    }
-    async getEosAssistStatus(socketClient, callback) {
-        const userId = socketClient?._acl?.user;
-        if (!userId) {
-            callback?.({ error: 'Nicht angemeldet.', code: 'notAuthenticated' });
-            return;
-        }
-        const role = this.getEosCachedRole(userId);
-        if (this.eosPasswordSetupRequired.has(userId)) {
-            callback?.({ error: 'Die persönliche Passwortvergabe muss zuerst abgeschlossen werden.', code: 'passwordSetupRequired' });
-            return;
-        }
-        try {
-            const settings = await this.readEosAssistSettings();
-            const credentials = role === 'admin' ? await (0, credentials_1.listAiCredentials)(this) : [];
-            callback?.({
-                success: true,
-                user: userId.replace(/^system\.user\./, ''),
-                role,
-                configured: this.isEosAssistConfigured(settings),
-                canConfigure: role === 'admin',
-                settings: role === 'admin' ? settings : undefined,
-                credentials,
-            });
-        }
-        catch (error) {
-            callback?.({ error: error instanceof Error ? error.message : String(error), code: 'statusFailed' });
-        }
-    }
-    async saveEosAssistSettings(socketClient, payload, callback) {
-        const userId = socketClient?._acl?.user;
-        if (!userId || this.getEosCachedRole(userId) !== 'admin') {
-            callback?.({ error: 'Diese Einstellung ist nur für Admin / NexoWatt Service verfügbar.', code: 'permissionDenied' });
-            return;
-        }
-        const settings = this.normalizeEosAssistSettings(payload);
-        if (!settings.model) {
-            callback?.({ error: 'Bitte ein Modell eintragen.', code: 'invalidSettings' });
-            return;
-        }
-        if (settings.provider === 'custom') {
-            if (!settings.baseUrl && !settings.credentialId) {
-                callback?.({ error: 'Für einen lokalen/individuellen Anbieter wird eine Basis-URL oder ein Zugang benötigt.', code: 'invalidSettings' });
-                return;
-            }
-            if (settings.baseUrl && !/^https?:\/\//i.test(settings.baseUrl)) {
-                callback?.({ error: 'Die Basis-URL muss mit http:// oder https:// beginnen.', code: 'invalidSettings' });
-                return;
-            }
-        }
-        else if (!settings.credentialId) {
-            callback?.({ error: 'Bitte einen gespeicherten KI-Zugang auswählen.', code: 'invalidSettings' });
-            return;
-        }
-        try {
-            const current = await this.getForeignObjectAsync('system.ai');
-            const next = {
-                ...(current || {}),
-                _id: 'system.ai',
-                type: 'config',
-                common: {
-                    ...(current?.common || {}),
-                    name: 'EOS Assist Einstellungen',
-                    expert: true,
-                },
-                native: {
-                    ...(current?.native || {}),
-                    ...settings,
-                },
-            };
-            await this.setForeignObjectAsync('system.ai', next);
-            callback?.({ success: true, configured: true, settings });
-        }
-        catch (error) {
-            callback?.({ error: error instanceof Error ? error.message : String(error), code: 'saveFailed' });
-        }
-    }
-    async testEosAssistSettings(socketClient, payload, callback) {
-        const userId = socketClient?._acl?.user;
-        if (!userId || this.getEosCachedRole(userId) !== 'admin') {
-            callback?.({ error: 'Der Verbindungstest ist nur für Admin / NexoWatt Service verfügbar.', code: 'permissionDenied' });
-            return;
-        }
-        const settings = this.normalizeEosAssistSettings(payload);
-        if (settings.provider === 'custom' && settings.baseUrl && !/^https?:\/\//i.test(settings.baseUrl)) {
-            callback?.({ error: 'Die Basis-URL muss mit http:// oder https:// beginnen.', code: 'invalidSettings' });
-            return;
-        }
-        try {
-            const apiKey = settings.credentialId ? await (0, credentials_1.resolveAiKey)(this, settings.credentialId) : '';
-            if (settings.provider !== 'custom' && !apiKey) {
-                callback?.({ error: 'Der ausgewählte Zugang enthält keinen verwendbaren API-Schlüssel.', code: 'credentialMissing' });
-                return;
-            }
-            const models = await (0, llmProvider_1.listModels)({
-                provider: settings.provider,
-                apiKey,
-                baseUrl: settings.baseUrl || undefined,
-                allowSelfSignedCerts: settings.allowSelfSignedCerts,
-            });
-            callback?.({ success: true, models, count: models.length });
-        }
-        catch (error) {
-            callback?.({ error: error instanceof Error ? error.message : String(error), code: 'connectionFailed' });
-        }
-    }
-    async processEosAssistSocketRequest(socketClient, payload, callback) {
-        const userId = socketClient?._acl?.user;
-        if (!userId) {
-            callback?.({ error: 'Nicht angemeldet.', code: 'notAuthenticated' });
-            return;
-        }
-        const role = this.getEosCachedRole(userId);
-        if (this.eosPasswordSetupRequired.has(userId)) {
-            callback?.({ error: 'Die persönliche Passwortvergabe muss zuerst abgeschlossen werden.', code: 'passwordSetupRequired' });
-            return;
-        }
-        const now = Date.now();
-        const previous = this.eosAssistLastRequestAt.get(userId) || 0;
-        if (now - previous < 1_500) {
-            callback?.({ error: 'Bitte einen Moment warten, bevor die nächste Frage gesendet wird.', code: 'rateLimited' });
-            return;
-        }
-        if (this.eosAssistInFlight.has(userId)) {
-            callback?.({ error: 'EOS Assist bearbeitet bereits eine Frage.', code: 'busy' });
-            return;
-        }
-        const record = payload && typeof payload === 'object' && !Array.isArray(payload)
-            ? payload
-            : {};
-        const messages = this.normalizeEosAssistMessages(record.messages);
-        if (!messages.some(message => message.role === 'user')) {
-            callback?.({ error: 'Bitte eine Frage eingeben.', code: 'emptyQuestion' });
-            return;
-        }
-        this.eosAssistLastRequestAt.set(userId, now);
-        this.eosAssistInFlight.add(userId);
-        try {
-            const settings = await this.readEosAssistSettings();
-            if (!this.isEosAssistConfigured(settings)) {
-                callback?.({
-                    error: 'EOS Assist ist noch nicht durch Admin / NexoWatt Service konfiguriert.',
-                    code: 'notConfigured',
-                    canConfigure: role === 'admin',
-                    role,
-                });
-                return;
-            }
-            const apiKey = settings.credentialId ? await (0, credentials_1.resolveAiKey)(this, settings.credentialId) : '';
-            if (settings.provider !== 'custom' && !apiKey) {
-                callback?.({
-                    error: 'Der konfigurierte KI-Zugang enthält keinen verwendbaren API-Schlüssel.',
-                    code: 'credentialMissing',
-                    canConfigure: role === 'admin',
-                });
-                return;
-            }
-            const orchestrator = new chatOrchestrator_1.ChatOrchestrator(this.getEosAssistMcp(userId), this);
-            const uiContextRecord = record.uiContext && typeof record.uiContext === 'object' && !Array.isArray(record.uiContext)
-                ? record.uiContext
-                : {};
-            const result = await orchestrator.run({
-                provider: settings.provider,
-                model: settings.model,
-                apiKey,
-                baseUrl: settings.baseUrl || undefined,
-                messages,
-                language: systemLanguage,
-                allowSelfSignedCerts: settings.allowSelfSignedCerts,
-                maxToolRounds: 10,
-                mode: 'read',
-                uiContext: {
-                    hash: typeof uiContextRecord.hash === 'string' ? uiContextRecord.hash.substring(0, 500) : '',
-                },
-                accessRole: role,
-            });
-            const content = this.sanitizeEosAssistVisibleText(result.content);
-            const newMessages = result.newMessages
-                .filter(message => message.role === 'assistant' && typeof message.content === 'string')
-                .map(message => ({ ...message, content: this.sanitizeEosAssistVisibleText(message.content) }));
-            callback?.({
-                success: true,
-                status: 'done',
-                content,
-                newMessages,
-                steps: result.steps.map(step => ({
-                    ...step,
-                    result: this.sanitizeEosAssistVisibleText(step.result),
-                })),
-                clientActions: result.clientActions || [],
-                role,
-            });
-        }
-        catch (error) {
-            callback?.({
-                error: error instanceof Error ? error.message : String(error),
-                code: 'assistFailed',
-                canConfigure: role === 'admin',
-            });
-        }
-        finally {
-            this.eosAssistInFlight.delete(userId);
-        }
-    }
-    installEosAssistSocketCommands(socketAdmin) {
-        socketAdmin.addCommandHandler('eosAssistStatus', (socketClient, _payload, callback) => {
-            void this.getEosAssistStatus(socketClient, callback);
-        });
-        socketAdmin.addCommandHandler('eosAssistSaveSettings', (socketClient, payload, callback) => {
-            void this.saveEosAssistSettings(socketClient, payload, callback);
-        });
-        socketAdmin.addCommandHandler('eosAssistTestSettings', (socketClient, payload, callback) => {
-            void this.testEosAssistSettings(socketClient, payload, callback);
-        });
-        socketAdmin.addCommandHandler('eosAssist', (socketClient, payload, callback) => {
-            void this.processEosAssistSocketRequest(socketClient, payload, callback);
-        });
-    }
     /**
      * Some message was sent to this instance over the message box. Used by email, pushover, text2speech, ...
      * Using this method requires the "common.messagebox" property to be set to true in io-package.json
@@ -708,8 +483,55 @@ class Admin extends adapter_core_1.Adapter {
             });
             return;
         }
+
+        else if (obj.command === 'eos:completeFirstLogin') {
+            const message = obj.message || {};
+            const user = String(message.user || '').replace(/^system\\.user\\./, '').trim().toLowerCase();
+            const password = String(message.password || '');
+            if (!['installer', 'guest', 'user'].includes(user) || !password) {
+                if (obj.callback) {
+                    this.sendTo(obj.from, obj.command, { error: 'Ungültige Anfrage' }, obj.callback);
+                }
+                return;
+            }
+            void this.checkPasswordAsync(user, password)
+                .then(async (result) => {
+                const valid = Array.isArray(result) ? result[0] === true : !!result;
+                if (!valid) {
+                    throw new Error('Das neue Passwort konnte nicht bestätigt werden');
+                }
+                const id = `system.user.${user}`;
+                const account = await this.getForeignObjectAsync(id);
+                if (!account) {
+                    throw new Error('Benutzerkonto nicht gefunden');
+                }
+                const eosNative = account.native || {};
+                await this.extendForeignObjectAsync(id, {
+                    native: {
+                        ...eosNative,
+                        nexowattPasswordChangeRequired: false,
+                        eosPasswordChangeRequired: false,
+                        nexowattFirstLoginPending: false,
+                        eosFirstLoginRequired: false,
+                        nexowattPasswordChangedAt: new Date().toISOString(),
+                    },
+                }, { user: 'system.user.admin' });
+                if (obj.callback) {
+                    this.sendTo(obj.from, obj.command, { success: true }, obj.callback);
+                }
+            })
+                .catch((error) => {
+                if (obj.callback) {
+                    this.sendTo(obj.from, obj.command, { error: error.message }, obj.callback);
+                }
+            });
+            return;
+        }
+
         else if (obj.command.startsWith('chat:')) {
-            this.processChatMessage(obj).catch(error => this.log.error(`Error by chat processing: ${error}`));
+            if (obj.callback) {
+                this.sendTo(obj.from, obj.command, { error: 'EOS Assist ist in dieser Stable-Version vorübergehend deaktiviert.' }, obj.callback);
+            }
             return;
         }
         else if (webServer?.processMessage(obj)) {
@@ -1059,12 +881,6 @@ class Admin extends adapter_core_1.Adapter {
             void this.mcpChat.close();
             this.mcpChat = null;
         }
-        for (const manager of this.eosAssistMcpChats.values()) {
-            void manager.close();
-        }
-        this.eosAssistMcpChats.clear();
-        this.eosAssistLastRequestAt.clear();
-        this.eosAssistInFlight.clear();
         try {
             this.log.info(`terminating http${this.config.secure ? 's' : ''} server on port ${this.config.port}`);
             socket?.close();
@@ -2357,7 +2173,6 @@ class Admin extends adapter_core_1.Adapter {
         }
         socket = new socket_classes_1.SocketAdmin(settings, this, objects);
         this.installEosSocketCommandGuard(socket);
-        this.installEosAssistSocketCommands(socket);
         socket.start(server, ws_server_1.SocketIO, { store, oauth2Only: true, noBasicAuth: this.config.noBasicAuth });
         // subscribe to all object changes
         socket.subscribe('objectChange', '*');

package/io-package.json

@@ -1,7 +1,7 @@
 {
   "common": {
     "name": "eos-admin",
-    "version": "7.9.93",
+    "version": "7.9.95",
     "titleLang": {
       "en": "NexoWatt EOS Admin",
       "de": "NexoWatt EOS Admin",
@@ -18,15 +18,15 @@
     "connectionType": "local",
     "dataSource": "push",
     "news": {
-      "7.9.93": {
-        "de": "Testkandidat 7.9.93 entfernt den unnötigen Scrollbalken aus der kompakten Anmeldung, zeigt in der Modulinstallation NexoWatt als sichtbaren Herausgeber und ersetzt die statischen EOS-Assist-Texte durch einen authentifizierten, rollenabhängigen und schreibgeschützten Systemassistenten. EOS Assist kann – nach einmaliger Konfiguration durch Admin/Service – reale Module, Dienste, Einstellungen, Geräte, Datenpunkte, Struktur, Logs, Historie und Sicherungsstatus über die freigegebenen Systemwerkzeuge prüfen. Technische Paketkennungen bleiben intern kompatibel.",
-        "en": "Test candidate 7.9.93 removes the unnecessary scrollbar from the compact login, shows NexoWatt as the visible publisher in module installation, and replaces static EOS Assist texts with an authenticated, role-aware, read-only system assistant. Once configured by Admin/Service, EOS Assist can inspect real modules, services, settings, devices, datapoints, structure, logs, history and backup status through the permitted system tools. Technical package identifiers remain internally compatible.",
-        "nl": "Testkandidaat 7.9.93 verwijdert de overbodige schuifbalk uit de compacte aanmelding, toont NexoWatt als zichtbare uitgever bij module-installatie en vervangt statische EOS Assist-teksten door een geauthenticeerde, rolafhankelijke en alleen-lezen systeemassistent. Na eenmalige configuratie door Admin/Service kan EOS Assist echte modules, diensten, instellingen, apparaten, datapunten, structuur, logs, historie en back-upstatus controleren via de toegestane systeemtools. Technische pakket-ID’s blijven intern compatibel."
+      "7.9.95": {
+        "de": "Stable 7.9.95 macht den Release-Ordner mergesicher: Die flache Update-ZIP kann direkt über einen bestehenden Arbeitsordner entpackt werden. Vor Paketprüfung und npm-Veröffentlichung werden package.json, io-package.json, beide Lockdateien, die Frontend-Version, Build-Informationen und der aktuelle Repository-Eintrag automatisch auf dieselbe Version gebracht. Dadurch wird insbesondere ein stehen gebliebenes io-package.json aus 7.9.92/7.9.94 automatisch repariert. Die Funktionen aus 7.9.94 bleiben unverändert.",
+        "en": "Stable 7.9.95 makes the release folder merge-safe: the flat update ZIP can be extracted directly over an existing working directory. Before package validation and npm publishing, package.json, io-package.json, both lockfiles, the frontend version, build information and the current repository entry are synchronized automatically. In particular, a stale io-package.json from 7.9.92/7.9.94 is repaired automatically. Functional behavior from 7.9.94 remains unchanged.",
+        "nl": "Stable 7.9.95 maakt de releasemap merge-veilig: de vlakke update-ZIP kan direct over een bestaande werkmap worden uitgepakt. Vóór pakketcontrole en npm-publicatie worden package.json, io-package.json, beide lockbestanden, de frontendversie, buildinformatie en de actuele repositoryvermelding automatisch op dezelfde versie gezet. Een achtergebleven io-package.json uit 7.9.92/7.9.94 wordt daardoor automatisch hersteld. De functies uit 7.9.94 blijven ongewijzigd."
       },
-      "7.9.92": {
-        "de": "Stable 7.9.92 korrigiert die Release-Vorbereitung: Vor Paketprüfung und npm-Veröffentlichung werden die verbindlichen Verkaufsstandardwerte für Authentifizierung, Port 8081 sowie die ausschließlich für Admin/Service sichtbaren internen Admin- und BackItUp-Notfallreserven automatisch normalisiert. Dadurch kann ein gemischter lokaler Arbeitsordner die Sicherheitsprüfung nicht mehr durch einen fehlenden Standardwert abbrechen. Rollen-, Login-, Übersichts- und Dienstefilter aus 7.9.91 bleiben unverändert.",
-        "en": "Stable 7.9.92 hardens release preparation: before package validation and npm publishing, the mandatory sales defaults for authentication, port 8081 and the Admin/Service-only internal admin and BackItUp emergency reserves are normalized automatically. A mixed local working tree can therefore no longer abort the security check merely because a required default value is missing. Role, login, overview and service filtering from 7.9.91 remain unchanged.",
-        "nl": "Stable 7.9.92 verhardt de releasevoorbereiding: vóór pakketcontrole en npm-publicatie worden de verplichte verkoopstandaarden voor authenticatie, poort 8081 en de uitsluitend voor Admin/Service zichtbare interne admin- en BackItUp-noodreserve automatisch genormaliseerd. Een gemengde lokale werkmap kan de veiligheidscontrole daardoor niet meer laten stoppen door een ontbrekende standaardwaarde. Rollen-, login-, overzichts- en dienstenfilters uit 7.9.91 blijven ongewijzigd."
+      "7.9.94": {
+        "de": "Stable-Kandidat 7.9.94: Standardkonten installer, guest und user verwenden bei der Ersteinrichtung das Startpasswort nexowatt und müssen nach der ersten erfolgreichen Anmeldung sofort ein persönliches Passwort vergeben. Die passwortlose Aktivierung ist deaktiviert. Die Login-Karte bleibt auch bei Fehlermeldungen vollständig bedienbar. EOS Assist ist für diese Stable-Version vollständig deaktiviert, bis die neue lesende Systemassistenz separat freigegeben ist. Deutsche Sicherheitstexte und sichtbare Herstellerangaben wurden bereinigt.",
+        "en": "Stable candidate 7.9.94: the standard installer, guest and user accounts use the initial password nexowatt during commissioning and must set a personal password immediately after the first successful sign-in. Passwordless activation is disabled. The login card remains fully usable when an error is shown. EOS Assist is completely disabled in this stable version until the redesigned read-only system assistant is released separately. German security texts and visible publisher information were cleaned up.",
+        "nl": "Stable-kandidaat 7.9.94: de standaardaccounts installer, guest en user gebruiken bij de eerste ingebruikname het startwachtwoord nexowatt en moeten na de eerste succesvolle aanmelding direct een persoonlijk wachtwoord instellen. Activering zonder wachtwoord is uitgeschakeld. De aanmeldkaart blijft ook bij foutmeldingen volledig bedienbaar. EOS Assist is in deze stable-versie volledig uitgeschakeld totdat de vernieuwde alleen-lezen systeemassistent apart is vrijgegeven."
       },
       "7.9.90": {
         "de": "Stable 7.9.90 korrigiert die produktive Rollenoberfläche: Die Übersichtskacheln sind für Installateur und Gast/Endkunde zuverlässig bedienbar. Interner Admin und interne BackItUp-Notfallreserve werden in Dienste auch bei verzögert gerenderten Tabellen ausschließlich für Admin/Service angezeigt. Die Erstanmeldung prüft serverseitig, ob Installer, Guest oder User noch keinen persönlichen Zugang besitzen: Nur dann wird die normale Anmeldeschaltfläche bei leerem Passwort aktiv und öffnet die verpflichtende Passwortvergabe; nach abgeschlossener Aktivierung bleibt sie ohne Passwort gesperrt. NexoWatt Sicherung bleibt für freigegebene Rollen erreichbar, EOS Assist im Header und Standardport 8081 bleiben unverändert.",
@@ -319,7 +319,7 @@
     "icon": "admin.svg",
     "messagebox": true,
     "enabled": true,
-    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.93/admin/admin.svg",
+    "extIcon": "https://unpkg.com/iobroker.eos-admin@7.9.95/admin/admin.svg",
     "keywords": [
       "NexoWatt",
       "EOS",
@@ -330,7 +330,7 @@
       "licensed"
     ],
     "compact": true,
-    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.93/README.md",
+    "readme": "https://unpkg.com/iobroker.eos-admin@7.9.95/README.md",
     "authors": [
       "NexoWatt"
     ],
@@ -398,7 +398,7 @@
     "nondeletable": false,
     "allowAdapterUpdate": true,
     "allowAdapterDelete": false,
-    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.93/io-package.json",
+    "meta": "https://unpkg.com/iobroker.eos-admin@7.9.95/io-package.json",
     "npmPackage": "iobroker.eos-admin",
     "packetName": "iobroker.eos-admin",
     "publisher": "NexoWatt"
@@ -506,7 +506,7 @@
     ],
     "eosAdminOnlyGroup": "system.group.administrator",
     "eosApplyAdminOnlyAclToProtectedAdapters": false,
-    "eosAssistantEnabled": true,
+    "eosAssistantEnabled": false,
     "eosAssistantAdminOnly": false,
     "eosStrictProtectedAdapterAcl": false,
     "eosInstallerGroups": [
@@ -531,11 +531,15 @@
     "eosRequireFirstLoginPassword": true,
     "eosFirstLoginPasswordMinLength": 10,
     "eosAutoAssignDefaultRoleUsers": true,
-    "eosPasswordlessFirstLogin": true,
+    "eosPasswordlessFirstLogin": false,
     "eosPasswordlessFirstLoginPrivateNetworkOnly": true,
     "eosPasswordClaimTtlMinutes": 10,
     "eosHideLegacyBackupFromNonAdmins": true,
-    "nexowattHideLegacyBackupFromNonAdmins": true
+    "nexowattHideLegacyBackupFromNonAdmins": true,
+    "eosAllowPasswordlessFirstLogin": false,
+    "eosRequireFirstLoginPasswordChange": true,
+    "eosAutoAssignStandardAccounts": true,
+    "eosAssistEnabled": false
   },
   "notifications": [
     {
@@ -1103,5 +1107,5 @@
       }
     }
   },
-  "version": "7.9.93"
+  "version": "7.9.95"
 }