iobroker.eos-admin 7.9.93 → 7.9.96

package/build/lib/chat/chatOrchestrator.js

@@ -76,48 +76,53 @@ class ChatOrchestrator {
         this.mcp = mcp;
         this.adapter = adapter;
     }
-    /** System prompt describing EOS Assist, tool usage and the authenticated role. */
-    buildSystemPrompt(language, mode, uiContext, accessRole = 'enduser') {
-        const roleText = accessRole === 'admin'
-            ? 'Admin / NexoWatt Service with full service visibility'
-            : accessRole === 'installer'
-                ? 'Installer with commissioning and troubleshooting visibility'
-                : 'End user with only explicitly permitted Smart Home and operating visibility';
+    /** System prompt describing the assistant's role, tool usage and the current permission mode. */
+    buildSystemPrompt(language, mode, uiContext) {
         const lines = [
-            'You are EOS Assist inside NexoWatt EOS.',
-            'Your job is to answer questions about the user\'s ACTUAL EOS system and guide them through the',
-            'NexoWatt EOS interface. You cover all settings and product areas: Cockpit/Overview, Modules,',
-            'Services, Datapoints, Structure (rooms/functions), System logs, Access & Rights, EOS applications,',
-            'System hosts, Files, NexoWatt Backup, licenses, devices, communication protocols and diagnostics.',
+            'You are the ioBroker Admin Assistant, an in-app helper inside the ioBroker admin web UI.',
+            'You help the user operate their ioBroker installation: explain how to do things in the UI,',
+            'recommend which adapter to use for a device or service, and answer questions about the',
+            "user's actual system (their states, objects, devices grouped by room/function, installed",
+            'adapters, running instances, logs and historical values).',
             '',
-            `Authenticated role: ${roleText}.`,
-            'Never reveal data or instructions outside that role. The tool layer enforces ACLs; if data is not',
-            'available, state that it is not available to the current account instead of guessing.',
+            'KEY CAPABILITY: you can navigate the admin UI yourself. When the user asks you to OPEN or GO to',
+            'something, call the navigate_admin_ui tool with the hash route — it opens the tab OR the specific',
+            'dialog immediately (no confirmation, it only changes the view), e.g.',
+            '{"hash":"#tab-hosts/base-settings/system.host.MSI"}. Otherwise (just pointing the user somewhere)',
+            'offer a clickable Markdown hash link, e.g. [Base settings of MSI](#tab-hosts/base-settings/system.host.MSI).',
+            'NEVER say a dialog can only be opened manually or that deep-linking a dialog is not possible.',
             '',
-            'Rules:',
-            '- For every system-specific question, use the available read tools and base the answer on their results.',
-            '- Never invent installed modules, running services, settings, datapoint values, devices or errors.',
-            '- Use NexoWatt EOS product terminology in normal answers. Do not present the underlying platform name',
-            '  as the product. Technical package IDs or command names may appear only in `code` when strictly needed.',
-            '- Explain results clearly and practically. Use short lists or tables for multiple devices or values.',
-            '- Object and state IDs are case-sensitive; show necessary IDs in `monospace`.',
-            '- You may navigate the EOS interface with navigate_admin_ui when the user explicitly asks to open a',
-            '  page. Use these EOS routes: Cockpit `#tab-intro`, Modules `#tab-adapters`, Services `#tab-instances`,',
-            '  Datapoints `#tab-objects`, Structure `#tab-enums`, System logs `#tab-logs`, Access & Rights',
-            '  `#tab-users`, and instance configuration `#tab-instances/config/<module>.<instance>`.',
-            '- Do not claim an action was completed unless a tool result confirms it.',
-            `- Answer in the user\'s language. The current EOS language is "${language}".`,
+            'Guidelines:',
+            '- Use the available tools to look up real data from THIS ioBroker system instead of guessing.',
+            '  E.g. to list devices in a room call list_devices with the room name; to read a value call',
+            '  get_states; to find objects call search_objects.',
+            '- Base your answer on the tool results. If a tool returns an error or nothing, say so briefly',
+            '  and suggest what the user could check.',
+            '- Be concise and practical. Use short lists or tables when listing devices or states.',
+            '- Object IDs are case-sensitive (e.g. "hue.0.lights.1.on"); show them in `monospace`.',
+            '- IMPORTANT — this admin version SUPPORTS deep links that open specific DIALOGS directly,',
+            '  not just tabs. It is FALSE to say a dialog "can only be opened with the gear/cog icon" or',
+            '  that deep-linking a dialog is "technically not possible" — never say that. Instead always',
+            '  offer a clickable Markdown hash link and let the USER click it; do NOT claim you opened or',
+            '  navigated anywhere yourself. Examples: [Instances](#tab-instances), [Objects](#tab-objects),',
+            '  [hue.0 config](#tab-instances/config/hue.0), [edit this object](#tab-objects/edit/<id>),',
+            "  and a host's base-settings dialog, e.g. MSI:",
+            '  [Base settings of MSI](#tab-hosts/base-settings/system.host.MSI). The exact dialog routes are',
+            '  listed in the knowledge below. Prefer these links over the navigate_admin_ui tool.',
+            `- Answer in the user's language. The admin UI language is currently "${language}".`,
         ];
         if (mode === 'act') {
-            lines.push('- Changes are possible only through explicit write/action tools and confirmation. Propose the', '  smallest safe action and respect all EOS safety and role restrictions.');
+            lines.push('- You may change things using the write/action tools (set_state, create_user_state,', '  extend_object, assign_to_enums, install_adapter, run_command, run_node_script). Every such', '  call is shown to the user for explicit confirmation before it runs, so propose the smallest', '  sensible action.', '- create_user_state only works in "0_userdata.0." or "javascript.<n>." — never elsewhere.', '- extend_object merges common/native into an existing object — use it to start/stop an', '  instance (common.enabled), change instance settings (native) or set enum members.', '- assign_to_enums adds objects to room/function enums (add-only) — use it to sort devices.', '- run_command runs an ioBroker CLI command and streams its output to the user; use it for', '  maintenance actions (restart, upload, fix, ...), not to fetch data.', '- run_node_script executes a short Node.js script on the host to CHECK things (network, files,', '  environment). Prefer read-only checks, keep it short, and put results in console.log. Never', '  use it for destructive operations.', '- run_javascript runs a one-off JS/TS script INSIDE the javascript adapter (full ioBroker API:', '  on/getState/setState/schedule/sendTo). Use it to test automation logic or do an API-based', '  check/action; it is not saved. Use run_node_script instead for plain OS checks (no ioBroker API).');
         }
         else {
-            lines.push('- This header assistant is READ-ONLY. It may inspect and explain the system, but it must not', '  change states, objects, settings, services, modules, passwords or backups.');
+            lines.push('- You currently have READ-ONLY access: you cannot change states, create objects or install', '  adapters. When a change is needed, explain the exact steps the user should take in the UI.');
         }
         if (uiContext?.hash) {
-            lines.push('', `The user is currently on EOS route \`${uiContext.hash}\`. Consider this context.`);
+            lines.push('', `The user is currently in the admin UI at the route \`${uiContext.hash}\`. Take this into ` +
+                "account — don't tell them to open a tab/page they are already on, and refer to where " +
+                'they are when helpful.');
         }
-        lines.push('', 'NexoWatt EOS knowledge:', (0, assistantKnowledge_1.renderAssistantKnowledge)());
+        lines.push('', 'ioBroker how-to knowledge (use this to guide the user precisely):', (0, assistantKnowledge_1.renderAssistantKnowledge)());
         return { role: 'system', content: lines.join('\n') };
     }
     /** Assemble the tool list offered to the model for the given mode. */
@@ -149,7 +154,7 @@ class ChatOrchestrator {
             ? { ...message, content: parseTextToolCalls(message.content).content }
             : message);
         if (!messages.some(message => message.role === 'system')) {
-            messages.unshift(this.buildSystemPrompt(language, mode, params.uiContext, params.accessRole));
+            messages.unshift(this.buildSystemPrompt(language, mode, params.uiContext));
         }
         const newMessages = [];
         const steps = [];

package/build/lib/chat/mcpClientManager.js

@@ -44,7 +44,7 @@ class McpClientManager {
                 language: this.options.language,
                 allowSetState: this.options.allowSetState ?? false,
                 allowObjectChange: this.options.allowObjectChange ?? false,
-                clientName: 'NexoWatt EOS Assist',
+                clientName: 'ioBroker.admin chat helper',
                 clientVersion: '1.0.0',
             })
                 .then(mcp => {

package/build/lib/nexowattStableAuth.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startNexowattStableAuth = startNexowattStableAuth;
+const START_PASSWORD = 'nexowatt';
+const MARKER_KEYS = ["eosFirstLoginPending", "eosMustChangePassword", "eosPasswordSetupRequired", "firstLoginRequired", "mustChangePassword", "nexowattFirstLoginPending", "nexowattMustChangePassword", "nexowattPasswordSetupRequired", "passwordChangeRequired"];
+const timers = new WeakMap();
+function pendingByNative(native) {
+    if (!native || typeof native !== 'object') return false;
+    return MARKER_KEYS.some(key => native[key] === true || native[key] === 'pending' || native[key] === 'required' || native[key] === 'starter');
+}
+async function setPassword(adapter, user, password) {
+    if (typeof adapter.setPasswordAsync === 'function') return adapter.setPasswordAsync(user, password, { user: 'system.user.admin' });
+    return new Promise((resolve, reject) => adapter.setPassword(user, password, { user: 'system.user.admin' }, err => err ? reject(err) : resolve()));
+}
+async function ensureGroupMembership(adapter, userId, groupId) {
+    const group = await adapter.getForeignObjectAsync(groupId);
+    if (!group || group.type !== 'group') return;
+    group.common = group.common || { name: groupId.split('.').pop(), members: [] };
+    group.common.members = Array.isArray(group.common.members) ? group.common.members : [];
+    if (!group.common.members.includes(userId)) {
+        group.common.members.push(userId);
+        await adapter.setForeignObjectAsync(groupId, group, { user: 'system.user.admin' });
+    }
+}
+async function createUser(adapter, name) {
+    const id = `system.user.${name}`;
+    await adapter.setForeignObjectAsync(id, {
+        _id: id, type: 'user',
+        common: { name, enabled: true, password: '' },
+        native: { nexowattManagedAccount: true, nexowattMustChangePassword: true, nexowattPasswordState: 'starter' }
+    }, { user: 'system.user.admin' });
+    return adapter.getForeignObjectAsync(id);
+}
+async function prepareOne(adapter, name, group, createMissing) {
+    const id = `system.user.${name}`;
+    let obj = await adapter.getForeignObjectAsync(id);
+    let created = false;
+    if (!obj && createMissing) { obj = await createUser(adapter, name); created = true; }
+    if (!obj || obj.type !== 'user') return;
+    obj.native = obj.native || {};
+    const empty = !obj.common || !obj.common.password;
+    const pending = created || empty || pendingByNative(obj.native) || obj.native.nexowattPasswordState === 'starter';
+    if (pending) {
+        await setPassword(adapter, name, START_PASSWORD);
+        obj = await adapter.getForeignObjectAsync(id) || obj;
+        obj.native = obj.native || {};
+        obj.native.nexowattManagedAccount = true;
+        obj.native.nexowattStarterPasswordActive = true;
+        obj.native.nexowattMustChangePassword = true;
+        obj.native.nexowattPasswordState = 'starter';
+        obj.native.nexowattStarterPasswordUpdatedAt = new Date().toISOString();
+        for (const key of MARKER_KEYS) {
+            if (/required|must|pending|first/i.test(key)) obj.native[key] = true;
+        }
+        await adapter.setForeignObjectAsync(id, obj, { user: 'system.user.admin' });
+    }
+    await ensureGroupMembership(adapter, id, group);
+}
+async function reconcile(adapter) {
+    try {
+        await prepareOne(adapter, 'installer', 'system.group.installer', true);
+        const guest = await adapter.getForeignObjectAsync('system.user.guest');
+        const user = await adapter.getForeignObjectAsync('system.user.user');
+        if (guest || !user) await prepareOne(adapter, 'guest', 'system.group.endkunden', true);
+        if (user) await prepareOne(adapter, 'user', 'system.group.endkunden', false);
+    } catch (e) { adapter.log.warn(`[NexoWatt EOS login] Starter-account reconciliation failed: ${e && e.message || e}`); }
+}
+function startNexowattStableAuth(adapter) {
+    if (timers.has(adapter)) return;
+    void reconcile(adapter);
+    const timer = setInterval(() => void reconcile(adapter), 5000);
+    if (timer.unref) timer.unref();
+    timers.set(adapter, timer);
+}

package/build/lib/web.js

@@ -675,7 +675,11 @@ class Web {
             const account = (native.nexowattEosAccount || {});
             const initialized = account.passwordInitialized === true
                 || Number(account.passwordSetupVersion || account.passwordInitializationVersion || 0) >= 1;
-            const forced = account.forcePasswordChange === true;
+            const stableForced = native.nexowattPasswordChangeRequired === true
+                || native.eosPasswordChangeRequired === true
+                || native.nexowattFirstLoginPending === true
+                || native.eosFirstLoginRequired === true;
+            const forced = account.forcePasswordChange === true || stableForced;
             return { required: forced || !initialized, initialized: initialized && !forced, minLength, version: 1 };
         }
         catch (e) {
@@ -789,6 +793,12 @@ class Web {
         account.firstLoginCompletedAt = now;
         account.forcePasswordChange = false;
         account.passwordlessFirstLoginAllowed = false;
+        native.nexowattPasswordChangeRequired = false;
+        native.eosPasswordChangeRequired = false;
+        native.nexowattFirstLoginPending = false;
+        native.eosFirstLoginRequired = false;
+        native.nexowattInitialPasswordApplied = false;
+        native.nexowattPasswordChangedAt = now;
         await this.adapter.setForeignObjectAsync(access.userId, userObject);
         await this.destroyEosRequestSessions(req);
         for (const cookie of ['access_token', 'refresh_token', 'connect.sid']) {
@@ -1133,8 +1143,7 @@ class Web {
             res.status(409).json({ error: 'accountDisabled' });
             return;
         }
-        const bootstrapSecret = `${(0, node_crypto_1.randomBytes)(48).toString('base64url')}!aA1`;
-        await this.setEosUserPassword(targetUserId, bootstrapSecret);
+        await this.setEosUserPassword(targetUserId, 'nexowatt');
         const user = (await this.adapter.getForeignObjectAsync(targetUserId));
         if (!user) {
             throw new Error('userObjectUnavailableAfterPasswordReset');
@@ -1146,21 +1155,29 @@ class Web {
         account.passwordSetupVersion = 0;
         account.passwordInitializationVersion = 0;
         account.forcePasswordChange = true;
-        account.passwordlessFirstLoginAllowed = true;
+        account.passwordlessFirstLoginAllowed = false;
         account.passwordResetAt = now;
         account.passwordResetBy = access.userId;
-        account.passwordResetMode = 'passwordless-first-activation';
+        account.passwordResetMode = 'initial-password';
+        native.nexowattPasswordChangeRequired = true;
+        native.eosPasswordChangeRequired = true;
+        native.nexowattFirstLoginPending = true;
+        native.eosFirstLoginRequired = true;
+        native.nexowattInitialPasswordApplied = true;
+        native.nexowattInitialPasswordVersion = 1;
+        native.nexowattStableInitialCredentialVersion = 1;
         delete account.passwordSetAt;
         delete account.firstLoginCompletedAt;
         await this.adapter.setForeignObjectAsync(targetUserId, user);
         this.invalidateEosPasswordClaimsForUser(targetUserId);
-        this.adapter.log.warn(`EOS account ${targetUserId} was reset for passwordless first activation by ${access.userId}`);
+        this.adapter.log.warn(`EOS account ${targetUserId} was reset to the mandatory initial-password flow by ${access.userId}`);
         res.status(200).json({
             success: true,
             user: targetUserId,
             role: explicitlyManagedRole,
             firstLoginRequired: true,
-            passwordlessFirstLoginAllowed: true,
+            passwordlessFirstLoginAllowed: false,
+            initialPasswordRequired: true,
         });
     }
     async getEosHistoryInstances() {