iobroker.eos-admin 7.9.96 → 7.9.98

package/tools/nexowatt-account-password-flow-selftest.cjs

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+
+const root = path.resolve(__dirname, '..');
+const built = fs.readFileSync(path.join(root, 'build/lib/web.js'), 'utf8');
+const accountUi = fs.readFileSync(path.join(root, 'adminWww/js/eos-account-management.js'), 'utf8');
+const firstLoginUi = fs.readFileSync(path.join(root, 'adminWww/js/eos-role-bootstrap.js'), 'utf8');
+
+function methodSlice(startMarker, endMarker) {
+    const start = built.indexOf(startMarker);
+    const end = built.indexOf(endMarker, start + startMarker.length);
+    assert(start >= 0 && end > start, `method block not found: ${startMarker}`);
+    return built.slice(start, end);
+}
+
+const methods = [
+    methodSlice('    normalizeEosUserId(value) {', '    normalizeEosAdapterName(value) {'),
+    methodSlice('    async readEosCurrentUser(req) {', '    getEosConfiguredRoleGroups(...keys) {'),
+    methodSlice('    async getEosRequestAccess(req) {', '    getEosRoleCapabilities(role) {'),
+    methodSlice('    validateEosFirstLoginPassword(password, passwordRepeat, userId) {', '    getEosPasswordUserName(userId) {'),
+    methodSlice('    getEosPasswordUserName(userId) {', '    async destroyEosRequestSessions(req) {'),
+    methodSlice('    async saveEosFirstLoginPassword(req, res) {', '    isEosPasswordlessFirstLoginEnabled() {'),
+    methodSlice('    async resetEosAccountPassword(req, res) {', '    async getEosHistoryInstances() {'),
+    methodSlice('    isEosSameOriginWrite(req) {', '    async saveEosBasicSettings(req, res) {'),
+].join('\n');
+
+const sandbox = { module: { exports: null }, URL, Set, console, EOS_PASSWORD_SERVICE_USER: 'system.user.admin' };
+vm.runInNewContext(`module.exports = class Harness {\n${methods}\n}`, sandbox);
+const Harness = sandbox.module.exports;
+
+function responseMock() {
+    return {
+        statusCode: 200,
+        payload: null,
+        headers: {},
+        clearedCookies: [],
+        setHeader(name, value) { this.headers[String(name).toLowerCase()] = value; },
+        status(code) { this.statusCode = code; return this; },
+        json(value) { this.payload = value; return this; },
+        clearCookie(name) { this.clearedCookies.push(name); },
+    };
+}
+
+function requestMock(body = {}, headers = {}) {
+    return {
+        body,
+        headers: {
+            host: '192.168.10.124:8081',
+            origin: 'http://192.168.10.124:8081',
+            'sec-fetch-site': 'same-origin',
+            ...headers,
+        },
+        query: {},
+        socket: { remoteAddress: '192.168.10.50' },
+    };
+}
+
+async function resetScenario(requesterRole, targetRole, targetGroups) {
+    const harness = new Harness();
+    const writes = [];
+    const metadata = {};
+    harness.getEosRequestAccess = async () => ({ userId: requesterRole === 'admin' ? 'system.user.admin' : 'system.user.installer', role: requesterRole });
+    harness.normalizeEosUserId = value => String(value || '').startsWith('system.user.') ? String(value) : `system.user.${value}`;
+    harness.getEosAccessForUserId = async () => ({ role: targetRole, groups: targetGroups });
+    harness.getEosInstallerGroups = () => ['system.group.installer', 'system.group.installateur'];
+    harness.getEosEndUserGroups = () => ['system.group.endkunde', 'system.group.user'];
+    harness.adapter = {
+        setPasswordAsync: async (user, password) => writes.push([`system.user.${user}`, password]),
+        checkPasswordAsync: async (user, password) => [password === 'nexowatt', `system.user.${user}`],
+        getForeignObjectAsync: async id => ({ _id: id, common: { enabled: true, password: '$hash' }, native: { keep: true, nexowattEosAccount: {} } }),
+        extendForeignObjectAsync: async (id, patch) => {
+            metadata.id = id;
+            metadata.native = patch.native;
+        },
+        log: { warn: () => undefined, info: () => undefined },
+    };
+    harness.invalidateEosPasswordClaimsForUser = () => undefined;
+    const res = responseMock();
+    await harness.resetEosAccountPassword(
+        requestMock({ user: targetRole === 'installer' ? 'system.user.installer-target' : 'system.user.user' }, { 'x-nexowatt-eos-account-reset': '1' }),
+        res,
+    );
+    return { res, writes, metadata };
+}
+
+(async () => {
+    // Authenticated request identities are normalized to the real ioBroker user object id.
+    const accessHarness = new Harness();
+    accessHarness.getEosAccessForUserId = async userId => ({ userId, role: userId === 'system.user.admin' ? 'admin' : 'enduser' });
+    const directAdmin = await accessHarness.getEosRequestAccess({ user: 'admin' });
+    assert.equal(directAdmin.userId, 'system.user.admin');
+    assert.equal(directAdmin.role, 'admin');
+    const objectAdmin = await accessHarness.getEosRequestAccess({ user: { id: 'system.user.admin' } });
+    assert.equal(objectAdmin.userId, 'system.user.admin');
+    assert.equal(objectAdmin.role, 'admin');
+
+    // Admin/Service can reset an explicitly managed End User and Installer account.
+    const adminEndUser = await resetScenario('admin', 'enduser', ['system.group.endkunde']);
+    assert.equal(adminEndUser.res.statusCode, 200);
+    assert.deepEqual(adminEndUser.writes, [['system.user.user', 'nexowatt']]);
+    assert.equal(adminEndUser.metadata.native.nexowattEosAccount.forcePasswordChange, true);
+    assert.equal(adminEndUser.metadata.native.nexowattEosAccount.passwordResetMode, 'initial-password');
+    assert.equal(adminEndUser.metadata.native.nexowattPasswordChangeRequired, true);
+
+    const adminInstaller = await resetScenario('admin', 'installer', ['system.group.installer']);
+    assert.equal(adminInstaller.res.statusCode, 200);
+    assert.deepEqual(adminInstaller.writes, [['system.user.installer-target', 'nexowatt']]);
+
+    // Installer may never reset another installer account.
+    const installerDenied = await resetScenario('installer', 'installer', ['system.group.installer']);
+    assert.equal(installerDenied.res.statusCode, 403);
+    assert.equal(installerDenied.res.payload.error, 'permissionError');
+    assert.equal(installerDenied.writes.length, 0);
+
+    // First-login password save must write the real account and clear every force-change flag.
+    const harness = new Harness();
+    const passwordWrites = [];
+    let metadata;
+    let sessionsDestroyed = false;
+    harness.getEosRequestAccess = async () => ({ userId: 'system.user.user', role: 'enduser' });
+    harness.getEosFirstLoginPasswordState = async () => ({ required: true, initialized: false, minLength: 10, version: 1 });
+    harness.getEosFirstLoginPasswordMinLength = () => 10;
+    harness.destroyEosRequestSessions = async () => { sessionsDestroyed = true; };
+    harness.adapter = {
+        setPasswordAsync: async (user, password) => passwordWrites.push([`system.user.${user}`, password]),
+        checkPasswordAsync: async (user, password) => [password === 'NexoWatt2025!', `system.user.${user}`],
+        getForeignObjectAsync: async id => ({ _id: id, common: { enabled: true, password: '$hash' }, native: { nexowattEosAccount: {} } }),
+        extendForeignObjectAsync: async (id, patch) => { metadata = { id, native: patch.native }; },
+        log: { info: () => undefined },
+    };
+    const acceptedPassword = harness.validateEosFirstLoginPassword(
+        'NexoWatt2025!',
+        'NexoWatt2025!',
+        'system.user.user',
+    );
+    assert.equal(acceptedPassword.valid, true);
+    assert.equal(acceptedPassword.password, 'NexoWatt2025!');
+    const saveRes = responseMock();
+    await harness.saveEosFirstLoginPassword(
+        requestMock(
+            { password: 'NexoWatt2025!', passwordRepeat: 'NexoWatt2025!' },
+            { 'x-nexowatt-eos-first-login': '1' },
+        ),
+        saveRes,
+    );
+    assert.equal(saveRes.statusCode, 200);
+    assert.equal(saveRes.payload.success, true);
+    assert.equal(saveRes.payload.logoutRequired, true);
+    assert.deepEqual(passwordWrites, [['system.user.user', 'NexoWatt2025!']]);
+    assert.equal(metadata.native.nexowattEosAccount.passwordInitialized, true);
+    assert.equal(metadata.native.nexowattEosAccount.forcePasswordChange, false);
+    assert.equal(metadata.native.nexowattPasswordChangeRequired, false);
+    assert.equal(metadata.native.eosFirstLoginRequired, false);
+    assert.equal(sessionsDestroyed, true);
+    assert.deepEqual(saveRes.clearedCookies.sort(), ['access_token', 'connect.sid', 'refresh_token'].sort());
+
+    // Same-origin logic must support direct access and a reverse proxy without accepting cross-site writes.
+    const originHarness = new Harness();
+    assert.equal(originHarness.isEosSameOriginWrite(requestMock()), true);
+    assert.equal(originHarness.isEosSameOriginWrite(requestMock({}, {
+        host: '127.0.0.1:8081',
+        origin: 'https://eos.example.test',
+        'x-forwarded-host': 'eos.example.test',
+        'sec-fetch-site': 'same-origin',
+    })), true);
+    assert.equal(originHarness.isEosSameOriginWrite(requestMock({}, {
+        origin: 'https://attacker.example',
+        'sec-fetch-site': 'cross-site',
+    })), false);
+
+    // Browser writes must preserve the authenticated session cookie.
+    assert.match(accountUi, /nexowatt\/account\/reset/);
+    assert.match(accountUi, /method:\s*'POST',\s*credentials:\s*'include'/);
+    assert.match(firstLoginUi, /nexowatt\/account\/first-password/);
+    assert.match(firstLoginUi, /method:\s*'POST',\s*credentials:\s*'include'/);
+
+    console.log('[NexoWatt EOS account password flow] OK: Admin/Installer permissions, initial password reset, personal password save, session and origin checks verified.');
+})().catch(error => {
+    console.error(error && error.stack ? error.stack : error);
+    process.exit(1);
+});

package/tools/nexowatt-clean-legacy-runtime.cjs

@@ -36,6 +36,24 @@ function runtimeNumber(root) {
   return value;
 }
 
+function shellNumber(root) {
+  const info = readJson(path.join(root, 'NEXOWATT_EOS_BUILD_INFO.json'));
+  const candidates = [info.shellCacheVersion, info.shellCacheTag, info.label];
+  for (const candidate of candidates) {
+    const value = Number(String(candidate ?? '').replace(/^v/i, ''));
+    if (Number.isFinite(value) && value > 0) return value;
+  }
+  try {
+    const pkg = readJson(path.join(root, 'package.json'));
+    const patch = Number(String(pkg.version || '').split('.')[2]);
+    if (Number.isFinite(patch) && patch > 0) return patch;
+  } catch (_) {
+    // The build info remains the canonical source. The package fallback is
+    // only used for isolated cleanup fixtures.
+  }
+  throw new Error('Invalid shellCacheVersion in NEXOWATT_EOS_BUILD_INFO.json');
+}
+
 function walkFiles(dir) {
   if (!fs.existsSync(dir)) return [];
   const result = [];
@@ -51,12 +69,14 @@ function walkFiles(dir) {
   return result;
 }
 
-function isLegacyVersionedRuntime(file, activeRuntime) {
+function isLegacyVersionedRuntime(file, activeRuntime, activeShell) {
   const name = path.basename(file);
-  // Stable product overlays use the release number in their filename, not the
-  // compiled React runtime number. They are release assets and must not be
-  // deleted merely because runtimeEntry remains on the validated v84 bundle.
-  if (/^nexowatt-stable-v\d+\.js$/i.test(name)) return false;
+  // Stable product overlays use the product release number in their filename,
+  // while the compiled React runtime can intentionally remain on v84. Keep
+  // only the active stable overlay and remove stale release assets left behind
+  // by a flat ZIP update (for example v96 when installing v97).
+  const stableMatch = name.match(/^nexowatt-stable-v(\d+)\.js$/i);
+  if (stableMatch) return Number(stableMatch[1]) !== activeShell;
   const versionMatch = name.match(/-v(\d+)\.(?:js|js\.map|css|css\.map)$/i);
   if (versionMatch) return Number(versionMatch[1]) !== activeRuntime;
   const remoteMatch = name.match(/^remoteEntry-v(\d+)\.(?:js|js\.map)$/i);
@@ -69,23 +89,25 @@ function isLegacyVersionedRuntime(file, activeRuntime) {
 
 function collectLegacyRuntimeFiles(root = DEFAULT_ROOT) {
   const activeRuntime = runtimeNumber(root);
+  const activeShell = shellNumber(root);
   const scanRoots = [
     path.join(root, 'adminWww', 'assets'),
     path.join(root, 'adminWww'),
     path.join(root, 'src-admin', 'build', 'assets'),
     path.join(root, 'src-admin', 'build'),
+    path.join(root, 'src-admin', 'public'),
   ];
   const files = new Set();
   for (const scanRoot of scanRoots) {
     for (const file of walkFiles(scanRoot)) {
-      if (isLegacyVersionedRuntime(file, activeRuntime)) files.add(file);
+      if (isLegacyVersionedRuntime(file, activeRuntime, activeShell)) files.add(file);
     }
   }
   for (const rel of LEGACY_OVERLAYS) {
     const file = path.join(root, rel);
     if (fs.existsSync(file)) files.add(file);
   }
-  return { activeRuntime, files: [...files].sort() };
+  return { activeRuntime, activeShell, files: [...files].sort() };
 }
 
 function cleanLegacyRuntime(options = {}) {
@@ -93,7 +115,7 @@ function cleanLegacyRuntime(options = {}) {
   const dryRun = options.dryRun === true;
   const quiet = options.quiet === true;
   const silent = options.silent === true;
-  const { activeRuntime, files } = collectLegacyRuntimeFiles(root);
+  const { activeRuntime, activeShell, files } = collectLegacyRuntimeFiles(root);
   const removed = [];
   const failed = [];
 
@@ -125,13 +147,13 @@ function cleanLegacyRuntime(options = {}) {
 
   if (!silent) {
     if (!quiet) {
-      console.log(`[NexoWatt EOS runtime cleanup] OK (runtime v${activeRuntime}, removed ${removed.length} legacy file${removed.length === 1 ? '' : 's'})`);
+      console.log(`[NexoWatt EOS runtime cleanup] OK (runtime v${activeRuntime}, shell v${activeShell}, removed ${removed.length} legacy file${removed.length === 1 ? '' : 's'})`);
     } else if (removed.length) {
       console.log(`[NexoWatt EOS runtime cleanup] removed ${removed.length} legacy runtime files before validation`);
     }
   }
 
-  return { activeRuntime, removed };
+  return { activeRuntime, activeShell, removed };
 }
 
 if (require.main === module) {
@@ -148,4 +170,5 @@ module.exports = {
   collectLegacyRuntimeFiles,
   cleanLegacyRuntime,
   isLegacyVersionedRuntime,
+  shellNumber,
 };

package/tools/nexowatt-login-layout-selftest.cjs

@@ -1,83 +1,14 @@
 #!/usr/bin/env node
 'use strict';
-
-const fs = require('fs');
-const path = require('path');
-
-const root = path.resolve(__dirname, '..');
-const read = rel => fs.readFileSync(path.join(root, rel), 'utf8');
-let bad = false;
-const fail = message => {
-    console.error(`[NexoWatt EOS login layout] ${message}`);
-    bad = true;
-};
-
-const css = read('adminWww/css/nexowatt-native-shell.css');
-const sourceCss = read('src-admin/public/css/nexowatt-native-shell.css');
-const login = read('src-admin/src/login/Login.tsx');
-const bootstrap = read('adminWww/js/eos-role-bootstrap.js');
-const index = read('adminWww/index.html');
-const buildInfo = JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));
-const shellTag = String(buildInfo.shellCacheTag || buildInfo.shellCacheVersion || '');
-
-if (css !== sourceCss) fail('login CSS source/build drift');
-if (!css.includes('outer frame is decorative only')) fail('decorative compact-frame contract is missing');
-if (css.includes('html.eos-login .MuiPaper-root:has(#username)')) {
-    fail('broad :has selector still styles the outer login Paper');
-}
-
-const outer = css.match(/html\.eos-login main\.MuiPaper-root\s*\{([\s\S]*?)\n\}/)?.[1] || '';
-for (const marker of [
-    'position: relative',
-    'width: 100%',
-    'min-height: 100vh',
-    'place-items: center',
-    'background: transparent !important',
-    'box-shadow: none !important',
-]) {
-    if (!outer.includes(marker)) fail(`transparent viewport host rule missing: ${marker}`);
-}
-
-const decorative = css.match(/html\.eos-login main\.MuiPaper-root::before\s*\{([\s\S]*?)\n\}/)?.[1] || '';
-for (const marker of [
-    "content: ''",
-    'width: min(520px, calc(100vw - 24px)) !important',
-    'height: min(640px, calc(100dvh - 24px)) !important',
-    'transform: translate(-50%, -50%)',
-    'pointer-events: none',
-]) {
-    if (!decorative.includes(marker)) fail(`decorative rear frame rule missing: ${marker}`);
-}
-
-for (const marker of [
-    'html.eos-login main.MuiPaper-root > .eos-login-card-modern',
-    'html.eos-login main.MuiPaper-root > .MuiPaper-root:has(#username)',
-    'html.eos-login main.MuiPaper-root > .MuiPaper-root:has(#password)',
-    'width: min(460px, calc(100vw - 56px)) !important',
-    'min-height: 540px !important',
-    'height: auto !important',
-    'overflow: visible !important',
-    'max-height: none !important',
-]) {
-    if (!css.includes(marker)) fail(`inner compact card rule missing: ${marker}`);
-}
-if (!css.includes('.eos-login-first-status:empty { display: none; min-height: 0; margin: 0; }')) {
-    fail('empty first-login status still reserves vertical space');
-}
-
-if (!login.includes('Keep the familiar compact login page')) fail('native Login source lacks spacious-page contract');
-if (login.includes('eos-login-role-selector-native') || login.includes('data-eos-account=')) {
-    fail('native Login source still renders role-selector buttons');
-}
-if (!bootstrap.includes('compact normal-login first activation')) fail('runtime compact first-login contract missing');
-if (!bootstrap.includes("card.querySelectorAll('.eos-login-role-selector').forEach(element => element.remove())")) {
-    fail('runtime does not remove stale role-selector surfaces');
-}
-if (/data-eos-account=|selector\.innerHTML/.test(bootstrap)) fail('runtime still injects a second role-selector panel');
-
-if (!shellTag || !index.includes(`nexowatt-native-shell.css?v=${shellTag}`)) {
-    fail('login CSS cache key is not aligned with build information');
-}
-
-if (bad) process.exit(1);
-console.log('[NexoWatt EOS login layout] OK');
+const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');
+const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');let bad=false;const fail=msg=>{console.error(`[NexoWatt EOS login layout] ${msg}`);bad=true;};
+const css=read('adminWww/css/nexowatt-native-shell.css');const sourceCss=read('src-admin/public/css/nexowatt-native-shell.css');const login=read('src-admin/src/login/Login.tsx');const stableLogin=read('adminWww/static/js/nexowatt-stable-login.js');const stable=read('adminWww/static/js/nexowatt-stable-v98.js');const index=read('adminWww/index.html');const info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json'));const bootstrap=read('adminWww/assets/bootstrap-COulQZax-v84.js');
+if(css!==sourceCss)fail('login CSS source/build drift');
+for(const marker of ['NexoWatt EOS 7.9.98 – stable scrolling','html.eos-app body','overflow: hidden !important','overflow-y: auto !important','width: min(456px','width: min(400px','min-height: 0 !important','overflow: visible !important','.MuiInputLabel-root { display: none !important; }','.MuiOutlinedInput-input::placeholder','margin-top: 28px !important'])if(!css.includes(marker))fail(`login marker missing: ${marker}`);
+if(!login.includes("minHeight: 0")||!login.includes("maxWidth: 400")||!login.includes('placeholder={`${I18n.t(\'enterLogin\')} *`}')||!login.includes('placeholder={`${I18n.t(\'enterPassword\')} *`}'))fail('native Login source does not use clean v98 placeholders');
+if(!bootstrap.includes('placeholder:')||!bootstrap.includes('I18n.t("enterLogin")+" *"')||!bootstrap.includes('I18n.t("enterPassword")+" *"'))fail('productive login bundle does not use placeholders');
+if(/label:.*I18n\.t\("enterLogin"\)|label:.*I18n\.t\("enterPassword"\)/.test(bootstrap.slice(1335000,1340500)))fail('productive login bundle still uses floating labels');
+if(/data-nw-login-card|data-nw-login-shell|min-height:590px|width:min\(460px|createElement\(['"]style/.test(stableLogin))fail('stable-login runtime mutates geometry');
+if(/width:min\(460px|min-height:540px|createElement\(['"]style/.test(stable))fail('stable v98 runtime injects geometry');
+if(!index.includes(`nexowatt-native-shell.css?v=${info.shellCacheTag}`)||!index.includes('nexowatt-stable-v98.js?v=98'))fail('v98 login assets not active');
+if(bad)process.exit(1);console.log('[NexoWatt EOS login layout] OK');

package/tools/nexowatt-merge-update-selftest.cjs

@@ -16,7 +16,7 @@ for (const file of [
     'MERGE_UPDATE.ps1',
     'MERGE_UPDATE.cmd',
     'MERGE_UPDATE.sh',
-    'MERGE_UPDATE_README_V7.9.96.md',
+    'MERGE_UPDATE_README_V7.9.98.md',
     'tools/nexowatt-apply-ems-overview.cjs',
     'tools/nexowatt-sync-release-version.cjs',
     'tools/nexowatt-version-sync-selftest.cjs',
@@ -29,6 +29,7 @@ for (const marker of [
     '$PSScriptRoot',
     'nexowatt-apply-ems-overview.cjs',
     'nexowatt-sync-release-version.cjs',
+    'npm run clean:eos-runtime',
     'npm run check:eos-package',
     'npm run check:eos-stability',
     'npm pack --dry-run',
@@ -47,6 +48,7 @@ for (const marker of [
     'set -euo pipefail',
     'nexowatt-apply-ems-overview.cjs',
     'npm run sync:eos-version',
+    'npm run clean:eos-runtime',
     'npm run check:eos-package',
     'npm run check:eos-stability',
     'npm pack --dry-run',

package/tools/nexowatt-modern-ui-selftest.cjs

@@ -19,7 +19,7 @@ for (const marker of [
   '--nx-shadow-soft', '--nx-shadow-float', 'backdrop-filter: blur', '#app-paper', '.MuiDialog-paper',
   '.MuiButton-root', '.MuiTableRow-root', ':focus-visible', 'border-radius: 24px', 'linear-gradient',
   '@media (max-width: 720px)', '.eos-activation-steps', '.eos-account-row:hover',
-  'main.MuiPaper-root::before', 'width: min(460px, calc(100vw - 56px)) !important', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
+  'main.MuiPaper-root::before', 'width: min(400px, calc(100vw - 48px)) !important', '.eos-assist-header-root', '.eos-overview-hero', '.eos-overview-grid',
   '.eos-account-management-entry', 'pointer-events: auto !important', 'touch-action: manipulation', 'overflow: visible',
 ]) if (!css.includes(marker)) fail(`modern styling marker missing: ${marker}`);
 if (sourceCss !== css) fail('modern CSS source/build drift');
@@ -29,7 +29,7 @@ for (const marker of ['eos-account-management.js','nexowatt-native-shell.css','e
 for (const marker of ['NexoWatt EOS', 'Zugänge & Rollen', 'Endkunden-Zugänge', 'ensureEntrySurface']) {
   if (!accountUi.includes(marker)) fail(`modern account surface missing label: ${marker}`);
 }
-for (const marker of ['installIntegratedFirstLogin','v96 compact normal-login first activation','eos-passwordless-card','Idempotent writes are essential here']) {
+for (const marker of ['installIntegratedFirstLogin','v98 compact normal-login first activation','eos-passwordless-card','Idempotent writes are essential here']) {
   if (!bootstrap.includes(marker)) fail(`integrated first-activation surface missing: ${marker}`);
 }
 if (/data-eos-account=|selector\.innerHTML/.test(bootstrap)) fail('compact login still injects role buttons or a second panel');

package/tools/nexowatt-password-write-selftest.cjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+'use strict';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const root = path.resolve(__dirname, '..');
+const built = fs.readFileSync(path.join(root, 'build/lib/web.js'), 'utf8');
+const source = fs.readFileSync(path.join(root, 'src/lib/web.ts'), 'utf8');
+const begin = built.indexOf('    getEosPasswordUserName(userId) {');
+const end = built.indexOf('    async destroyEosRequestSessions', begin);
+assert(begin >= 0 && end > begin, 'password methods not found in built backend');
+const methods = built.slice(begin, end);
+const sandbox = { module: { exports: null }, EOS_PASSWORD_SERVICE_USER: 'system.user.admin' };
+vm.runInNewContext(`module.exports = class Harness {\nconstructor(adapter){this.adapter=adapter;}\n${methods}\n}`, sandbox);
+const Harness = sandbox.module.exports;
+(async () => {
+  const calls = [];
+  const userObject = { _id: 'system.user.user', common: { password: '$2b$hash' }, native: { keep: true } };
+  const adapter = {
+    setPasswordAsync: async (user, password, options) => calls.push(['set', user, password, options]),
+    checkPasswordAsync: async (user, password, options) => { calls.push(['check', user, password, options]); return [true, `system.user.${user}`]; },
+    getForeignObjectAsync: async id => { calls.push(['get', id]); return JSON.parse(JSON.stringify(userObject)); },
+    extendForeignObjectAsync: async (id, patch, options) => calls.push(['extend', id, patch, options]),
+    setForeignObjectAsync: async () => { throw new Error('full user object replacement must not be used'); },
+  };
+  const harness = new Harness(adapter);
+  await harness.setEosUserPassword('system.user.user', 'NexoWatt2025!');
+  assert.deepEqual(calls[0].slice(0, 3), ['set', 'user', 'NexoWatt2025!']);
+  assert.deepEqual(calls[1].slice(0, 3), ['check', 'user', 'NexoWatt2025!']);
+  await harness.updateEosAccountMetadata('system.user.user', (native, account) => {
+    account.passwordInitialized = true;
+    native.nexowattPasswordChangeRequired = false;
+  });
+  const extend = calls.find(row => row[0] === 'extend');
+  assert(extend, 'native metadata was not extended');
+  assert.equal(extend[1], 'system.user.user');
+  assert.equal(extend[2].native.keep, true);
+  assert.equal(extend[2].native.nexowattEosAccount.passwordInitialized, true);
+  assert(!Object.prototype.hasOwnProperty.call(extend[2], 'common'), 'password/common must not be overwritten by metadata update');
+  for (const code of [source, built]) {
+    assert.match(code, /setPasswordAsync\(userName, password/);
+    assert.match(code, /checkPasswordAsync\(userName, password/);
+    assert.match(code, /extendForeignObjectAsync/);
+    assert.match(code, /passwordVerificationFailed/);
+  }
+  console.log('[NexoWatt EOS password write] OK: real account name, verified password API and metadata-only update');
+})().catch(error => { console.error(error.stack || error); process.exit(1); });

package/tools/nexowatt-runtime-cleanup-selftest.cjs

@@ -13,13 +13,18 @@ try {
   fs.mkdirSync(path.join(temp, 'adminWww', 'js'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'adminWww', 'css'), { recursive: true });
   fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'js'), { recursive: true });
-  fs.writeFileSync(path.join(temp, 'NEXOWATT_EOS_BUILD_INFO.json'), JSON.stringify({ runtimeEntry: 'v82' }));
+  fs.mkdirSync(path.join(temp, 'src-admin', 'public', 'static', 'js'), { recursive: true });
+  fs.mkdirSync(path.join(temp, 'adminWww', 'static', 'js'), { recursive: true });
+  fs.writeFileSync(path.join(temp, 'NEXOWATT_EOS_BUILD_INFO.json'), JSON.stringify({ runtimeEntry: 'v82', shellCacheVersion: 98 }));
 
   const keep = [
     'adminWww/assets/bootstrap-current-v82.js',
     'adminWww/assets/Objects-current-v82.js',
     'adminWww/remoteEntry-v82.js',
     'adminWww/remoteEntry.js',
+    'adminWww/static/js/nexowatt-stable-v98.js',
+    'src-admin/public/static/js/nexowatt-stable-v98.js',
+    'adminWww/static/js/nexowatt-stable-login.js',
   ];
   const remove = [
     'adminWww/assets/bootstrap-old-v54.js',
@@ -29,6 +34,8 @@ try {
     'adminWww/js/eos-branding.js',
     'adminWww/css/eos-branding.css',
     'src-admin/public/js/eos-security-ui.js',
+    'adminWww/static/js/nexowatt-stable-v97.js',
+    'src-admin/public/static/js/nexowatt-stable-v95.js',
   ];
   for (const rel of [...keep, ...remove]) {
     const file = path.join(temp, rel);
@@ -38,6 +45,7 @@ try {
 
   const result = cleanLegacyRuntime({ root: temp, quiet: true, silent: true });
   assert.strictEqual(result.activeRuntime, 82);
+  assert.strictEqual(result.activeShell, 98);
   assert.strictEqual(result.removed.length, remove.length);
   for (const rel of keep) assert.ok(fs.existsSync(path.join(temp, rel)), `current runtime removed: ${rel}`);
   for (const rel of remove) assert.ok(!fs.existsSync(path.join(temp, rel)), `legacy file remained: ${rel}`);

package/tools/nexowatt-stable-v98-selftest.cjs

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+'use strict';
+const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const must=(ok,msg)=>{if(!ok){console.error(`[NexoWatt EOS stable v98] ${msg}`);process.exit(1)}};
+const pkg=JSON.parse(read('package.json')),io=JSON.parse(read('io-package.json')),info=JSON.parse(read('NEXOWATT_EOS_BUILD_INFO.json')),css=read('adminWww/css/nexowatt-native-shell.css'),stable=read('adminWww/static/js/nexowatt-stable-v98.js'),login=read('adminWww/static/js/nexowatt-stable-login.js'),index=read('adminWww/index.html'),web=read('src/lib/web.ts'),built=read('build/lib/web.js'),account=read('adminWww/js/eos-account-management.js'),bootstrap=read('adminWww/assets/bootstrap-COulQZax-v84.js'),ems=read('adminWww/js/eos-ems-overview.js');
+must(pkg.version==='7.9.98'&&io.version==='7.9.98'&&io.common.version==='7.9.98'&&info.version==='7.9.98','version drift');
+must(info.shellCacheVersion===98&&info.shellCacheTag==='98','shell cache not v98');
+must(css.includes('overflow-y: auto !important')&&css.includes('scrollbar-color: rgba(0, 229, 138'),'cockpit vertical scrollbar missing');
+must(css.includes('.MuiInputLabel-root { display: none !important; }')&&bootstrap.includes('I18n.t("enterLogin")+" *"'),'clean login field contract missing');
+must(stable.includes("VERSION = 'v98-scroll-login-password-write'")&&!login.includes('data-nw-login-card'),'stable runtime incorrect');
+must(index.includes('nexowatt-stable-v98.js?v=98')&&index.includes('nexowatt-native-shell.css?v=98'),'v98 assets not loaded');
+for(const code of [web,built])for(const marker of ['getEosPasswordUserName','setPasswordAsync(userName, password','checkPasswordAsync(userName, password','passwordVerificationFailed','updateEosAccountMetadata','extendForeignObjectAsync'])must(code.includes(marker),`password marker missing: ${marker}`);
+must(account.includes('Startpasswort „nexowatt“')&&account.includes('credentials: \'include\''),'reset UI does not describe/use stable initial password flow');
+must(ems.includes("REQUIRED_UI_VERSION = '0.8.198'")&&ems.includes('readUiAdapterInfo'),'working EMS diagnosis was lost');
+console.log('[NexoWatt EOS stable v98] OK');

package/tools/nexowatt-sync-release-version.cjs

@@ -19,6 +19,14 @@ function setValue(changes, label, object, key, value) {
     }
 }
 
+function setJsonValue(changes, label, object, key, value) {
+    const previous = object[key];
+    if (JSON.stringify(previous) !== JSON.stringify(value)) {
+        changes.push({ label, previous, value });
+        object[key] = value === undefined ? undefined : JSON.parse(JSON.stringify(value));
+    }
+}
+
 function syncReleaseVersion(rootDir) {
     const root = path.resolve(rootDir);
     const packageFile = path.join(root, 'package.json');
@@ -62,7 +70,40 @@ function syncReleaseVersion(rootDir) {
             update(json) {
                 setValue(changes, 'package-lock.json version', json, 'version', version);
                 if (json.packages?.['']) {
-                    setValue(changes, 'package-lock.json packages[""] version', json.packages[''], 'version', version);
+                    const rootPackage = json.packages[''];
+                    setValue(changes, 'package-lock.json packages[""] version', rootPackage, 'version', version);
+                    // A merge archive can update package.json while leaving stale release scripts,
+                    // files and policy metadata in package-lock.json. npm reads the lock root during
+                    // packaging, so keep every release-critical root field canonical as well.
+                    for (const key of [
+                        'name',
+                        'description',
+                        'license',
+                        'author',
+                        'private',
+                        'engines',
+                        'main',
+                        'files',
+                        'scripts',
+                        'dependencies',
+                        'devDependencies',
+                        'overrides',
+                        'keywords',
+                        'publishConfig',
+                        'nexowattReleasePolicy',
+                        'publisher',
+                        'copyright',
+                    ]) {
+                        if (Object.prototype.hasOwnProperty.call(pkg, key)) {
+                            setJsonValue(
+                                changes,
+                                `package-lock.json packages[""] ${key}`,
+                                rootPackage,
+                                key,
+                                pkg[key],
+                            );
+                        }
+                    }
                 }
             },
         },

package/tools/nexowatt-ui-overview-runtime-selftest.cjs

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 'use strict';
-const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');
-const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const fail=msg=>{console.error(`[NexoWatt EOS UI overview runtime] ${msg}`);process.exit(1)};
-const runtime=read('adminWww/js/eos-ems-overview.js');const source=read('src-admin/public/js/eos-ems-overview.js');const css=read('adminWww/css/eos-ems-overview.css');const index=read('adminWww/index.html');const role=read('adminWww/js/eos-role-ui.js');const shell=read('adminWww/js/nexowatt-native-shell.js');const intro=read('src-admin/src/tabs/Intro.tsx');const app=read('src-admin/src/App.tsx');const bundle=read('adminWww/assets/index-D2ymscJA-v84.js');
+const fs=require('node:fs');const path=require('node:path');const root=path.resolve(__dirname,'..');const read=rel=>fs.readFileSync(path.join(root,rel),'utf8');const fail=msg=>{console.error(`[NexoWatt EOS UI overview runtime] ${msg}`);process.exit(1)};
+const runtime=read('adminWww/js/eos-ems-overview.js');const source=read('src-admin/public/js/eos-ems-overview.js');const css=read('adminWww/css/eos-ems-overview.css');const index=read('adminWww/index.html');const role=read('adminWww/js/eos-role-ui.js');const shell=read('adminWww/js/nexowatt-native-shell.js');const intro=read('src-admin/src/tabs/Intro.tsx');const introBundle=read('adminWww/assets/Intro-DkwRiz1n-v84.js');const bootstrap=read('adminWww/assets/bootstrap-COulQZax-v84.js');const generic=read('adminWww/assets/index-D2ymscJA-v84.js');
 if(runtime!==source)fail('runtime source/build drift');
-for(const marker of ['nexowatt-ems-overview-v1','nexowatt-ui.*.info.adminOverview.*','system.adapter.nexowatt-ui.*.alive','POLL_MS = 5000','STALE_MS = 20000','getForeignStates','Keine Kachel besitzt Schreibhoheit','currentDecisions','§14a-Fallback'])if(!runtime.includes(marker))fail(`runtime marker missing: ${marker}`);
+for(const marker of ['nexowatt-ems-overview-v1','nexowatt-ui.*.info.adminOverview.*','system.adapter.nexowatt-ui.*.alive','POLL_MS = 5000','STALE_MS = 20000',"REQUIRED_UI_VERSION = '0.8.198'",'getForeignStates','Keine Kachel besitzt Schreibhoheit','currentDecisions','§14a-Fallback','nexowatt-eos-admin-socket-ready','readUiAdapterInfo','socketFromReact'])if(!runtime.includes(marker))fail(`runtime marker missing: ${marker}`);
 for(const forbidden of ['setForeignState','setState(','sendToHost','writeFile','extendObject'])if(runtime.includes(forbidden))fail(`read-only runtime contains ${forbidden}`);
-for(const marker of ['eos-ems-overview.css?v=96','eos-ems-overview.js?v=96','nexowatt-stable-v96.js?v=96'])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
-if(!css.includes('#eos-ems-overview-runtime')||!css.includes('.eos-ems-overview-metrics'))fail('EMS card CSS incomplete');
-if(role.includes("overview.innerHTML = `")||!role.includes('never cover the real Admin Intro'))fail('obsolete role overview still active');
-if(!shell.includes("label: 'Installateur'")||!shell.includes("label: 'Endkunde'"))fail('native hero is not role-aware');
-if(!intro.includes('<NexoWattEmsOverview')||!intro.includes('getOverviewRoleConfig')||!intro.includes('admin ? this.getButtons() : null'))fail('React Intro integration incomplete');
-if(!app.includes('NEXOWATT_EOS_ADMIN_SOCKET = new Connection'))fail('source socket exposure missing');
-if(!bundle.includes('window.NEXOWATT_EOS_ADMIN_SOCKET=new M({'))fail('prebuilt socket exposure missing');
+for(const marker of ['eos-ems-overview.css?v=98','eos-ems-overview.js?v=98','nexowatt-stable-v98.js?v=98'])if(!index.includes(marker))fail(`index marker missing: ${marker}`);
+if(!css.includes('#eos-ems-overview-runtime')||!css.includes('.eos-ems-overview-metrics')||!css.includes('startup and compatibility messages stay compact'))fail('EMS card CSS incomplete');
+if(role.includes('overview.innerHTML = `')||!role.includes('never cover the real Admin Intro'))fail('obsolete role overview still active');
+if(!shell.includes("label: 'Installateur'")||!shell.includes("label: 'Endkunde'")||!shell.includes('eosNativeReactOverview'))fail('native overview role bridge incomplete');
+if(!intro.includes('NEXOWATT_EOS_ADMIN_SOCKET')||!intro.includes('nexowatt-eos-admin-socket-ready'))fail('source Intro socket bridge missing');
+if(!introBundle.includes('NEXOWATT_EOS_ADMIN_SOCKET')||!introBundle.includes('nexowatt-eos-admin-socket-ready'))fail('productive Intro socket bridge missing');
+if(!bootstrap.includes('window.NEXOWATT_EOS_ADMIN_SOCKET=window.NEXOWATT_EOS_SOCKET=new AdminConnection'))fail('productive main AdminConnection exposure missing');
+if(generic.includes('this.socket=window.NEXOWATT_EOS_ADMIN_SOCKET=new M({'))fail('generic adapter helper still overwrites main AdminConnection');
 console.log('[NexoWatt EOS UI overview runtime] OK');