@@ -0,0 +1,7 @@
+---
+"ftw": minor
+---
+
+Connecting an assistant no longer needs a terminal. When the box has no house password, Settings → Access asks you to choose one right above the assistant's code, and choosing it signs that browser in. Any browser that reaches the box may set the first one, also through a Docker port or on the box itself. A new box asks for it on the setup wizard's last step. Any password will do: a short one gets a warning, not a refusal. The Home Assistant app still needs none.
+
+The password, not the address, now proves the owner: a browser on the box itself can let an assistant in once it is signed in. Settings → System calls it the house password and explains it without developer words. If you forget it, or someone else set it first, run `ftw password reset` on the box (`docker compose exec ftw /app/ftw password reset` on Docker), then choose a new one on the box's page. On a native box whose `ftw` command predates this release, run `/opt/ftw/releases/<release>/ftw password reset` instead.
@@ -22,10 +22,10 @@
 #     In config.yaml set the MQTT host to `mosquitto` (port 1883), NOT
 #     `localhost` / `127.0.0.1`. There is no host networking to make
 #     localhost mean "the broker".
-#   - First enable of the house password (api.lan_auth) is loopback-only
-#     inside the container. A Mac curl to http://127.0.0.1:8080 arrives as
-#     the bridge gateway. Use `docker compose -f docker-compose.macos.yml
-#     exec ftw` and then curl http://127.0.0.1:8080 from there.
+#   - A Mac browser on http://127.0.0.1:8080 arrives as the bridge
+#     gateway, not loopback. Set the house password in the page as usual.
+#     To reset a forgotten one: `docker compose -f docker-compose.macos.yml
+#     exec ftw /app/ftw password reset`.
 #   - mDNS (`zap.local`) and UDP broadcast device discovery do NOT cross
 #     the Docker Desktop VM boundary. Configure every driver with an
 #     EXPLICIT IP address. Outbound unicast TCP (Modbus TCP to a known
 
@@ -628,7 +628,7 @@ above and its approval key, and an agent can never reach them.
 | `GET /api/agents` | A client on the LAN. Rows, requests and keys, the box's facts and the registry's agent ops |
 | `GET /api/agents/audit?before=&n=` | A client on the LAN |
 | `POST /api/agents/offer {offer}` | A client on the LAN. The offer as the box reads it; grants nothing |
-| `POST /api/agents {offer, scopes, ops, caps, ttlS}` | A LAN client signed in with the house password |
+| `POST /api/agents {offer, scopes, ops, caps, ttlS}` | A browser signed in with the house password, on the LAN or on the box |
 | `POST /api/agents/{id}/widen {epoch, scopes, ops, caps, ttlS}` | The same |
 | `POST /api/agent-requests/{reqId} {approve: true}` | The same |
 | `POST /api/agents/approval-key {deviceId, pub}` | The same: a phone that lost its key |
@@ -672,13 +672,14 @@ above and its approval key, and an agent can never reach them.
   replace the offer's when given. Without `ttlS` the grant lasts 30 days, or
   the offer's length if shorter. A `ttlS` past the role's longest grant is
   `E_CAP_EXCEEDED {cap: "expiresAtMs", max}`.
-- **Every route that widens access needs another device on the home
-  network, signed in with the house password.** The box never reads the
-  sign-in from loopback, so a browser on the box, or one through an SSH
-  tunnel to it, cannot widen access with or without the password: a
-  driver's Lua and the session passthrough can both reach the box from
-  inside it. `box.widen` in `GET /api/agents` says whether this request
-  would pass, so the page stops before a code is spent.
+- **Every route that widens access needs a browser signed in with the
+  house password,** on another device or on the box itself. The password,
+  not the address, proves the owner. Loopback stays an owner for settings
+  without it, so it could replace the password and then sign in: it is not
+  a wall against programs on the box. A driver cannot reach the API
+  (below), and the session passthrough is refused. `box.widen` in
+  `GET /api/agents` says whether this request would pass, so the page stops
+  before a code is spent.
 - **Drivers never reach the box's API.** A driver's HTTP, TCP or WebSocket
   connection to a port the API listens on is refused, whether it goes to a
   loopback address or to an address of the box. The check runs on the
@@ -691,16 +692,25 @@ above and its approval key, and an agent can never reach them.
 
 What the sign-in is worth today:
 
-- **Off by default.** With `api.lan_auth` off, which is the default, every
-  client on the home network is an owner with no sign-in. Granting a remote
-  agent from there would let any device on the Wi-Fi give the outside world
-  a way in, so those routes refuse with 403 until the house password is on.
-- **With the house password on.** The password has at least 10 characters
-  and is stored as argon2id (64 MiB, 3 passes). Five wrong guesses lock every
-  sign-in for 30 seconds, box-wide. A sign-in sets a random 32-byte cookie,
-  `HttpOnly` and `SameSite=Strict`, that lasts 12 hours and dies with a
-  restart. Browser requests from other sites are refused by Origin and
-  `Sec-Fetch-Site` checks.
+- **Off until someone chooses it.** A new box asks for it during setup; an
+  older box may still have it off. With `api.lan_auth` off every client on
+  the home network is an owner with no sign-in. Granting a remote agent
+  from there would let any device on the Wi-Fi give the outside world a way
+  in, so those routes refuse with 403 until the house password is on. The
+  Access page asks for it right above the code: any browser that reaches
+  the box may choose the first one, which signs that browser in. While the
+  lock is off that browser is already an owner, so choosing it grants
+  nothing new (Fredrik, 25 October 2026). An owner locked out by someone
+  else's password, or who forgot it, runs `ftw password reset` on the box;
+  see [operations.md](operations.md#house-password).
+- **With the house password on.** Its length is the owner's choice: the
+  page warns below 8 characters but takes any password that is not empty
+  (Fredrik, 25 October 2026). It is stored as argon2id (64 MiB, 3
+  passes). Five wrong guesses lock every sign-in for 30 seconds, box-wide.
+  A sign-in sets a random 32-byte cookie,
+  `HttpOnly` and `SameSite=Strict`, that lasts 30 days, survives a restart
+  and ends when the password changes. Browser requests from other sites are
+  refused by Origin and `Sec-Fetch-Site` checks.
 - **What it lacks.** The page is plain HTTP, so anyone who can read the home
   network's traffic can read the password and the cookie. There is one
   shared password and no person behind it, so the audit row names the
@@ -756,8 +766,8 @@ receipts for current agents, plus 32 old receipts, with a 128-row storage
 bound. No expired or cancelled record can reopen a valid code after pruning.
 
 The local routes are `GET/POST /api/agent-invites` and
-`DELETE /api/agent-invites/{id}`. POST uses the same house-password and
-non-loopback LAN gate as an ordinary grant. Signed app messages allow an
+`DELETE /api/agent-invites/{id}`. POST uses the same house-password gate
+as an ordinary grant. Signed app messages allow an
 owner to share access away from home. The recipient connects FTW from its
 own assistant, selects **I have an invitation code** on the consent page and
 pastes the code there. Core must be online. The normal signed-roster,
 
@@ -185,31 +185,62 @@ mutations remain locked.
 remote access; remote access is the FTW app. See
 [architecture.md](architecture.md#remote-access-boundary).
 
-`api.lan_auth` is off by default. Turn it on from loopback inside the
-process: `http://127.0.0.1:8080` Settings → System on the machine, or `curl`
-to `127.0.0.1`. When on, protected LAN routes need the house password or
-`FTW_API_TOKEN`. `curl` sends `Authorization: Bearer <house-password>` or
-`Authorization: Bearer <FTW_API_TOKEN>`. The browser login form sets a
-session cookie (`ftw_lan`, 12 hours). Loopback (`127.0.0.1` / `::1`) never
-asks. Live status stays readable without the password; a viewer caller is
-minted for those reads. The two secrets do not share a lockout: retrying the
-API token cannot lock the household out of Settings. A first enable from
-another LAN address is refused, so a visitor cannot set the password.
-`POST /api/config` cannot flip the flag.
-
-On an older Docker install under Docker Desktop (`docker-compose.macos.yml`),
-a host curl to localhost arrives as the bridge gateway, not loopback, so
-Settings and host curl get 403. Desktop SNAT uses that same peer for every
-published-port client, including LAN visitors, so it must not count as
-loopback. Enable from inside the container:
+### House password
+
+The house password (`api.lan_auth`) keeps other devices on the home network
+out of Settings and stops them letting an assistant in. Live status stays
+readable without it; a viewer caller is minted for those reads.
+
+- **A new box** asks for it on the setup wizard's last step and on the
+  assistant setup path. The Home Assistant app asks for none: Home
+  Assistant signs its users in. A script that posts first-run settings
+  without `house_password` leaves the lock off.
+- **A running box without one** asks for it where it is needed: Settings →
+  System → House password, or Settings → Access, right above the
+  assistant's code. Any browser that reaches the box may set the first
+  one. While the lock is off that browser is already an owner, so setting
+  it grants nothing new; it closes the door behind it. Choosing it signs
+  that browser in. `POST /api/config` cannot flip the flag.
+- **Any password** is accepted, however short. The page warns below 8
+  characters; the choice is the owner's.
+- **When it is on**, protected LAN routes need the password, a browser
+  session, or `FTW_API_TOKEN`. Scripts send `Authorization: Bearer
+  <house-password>` or `Authorization: Bearer <FTW_API_TOKEN>`. The browser
+  sign-in sets an `HttpOnly` session cookie (`ftw_lan`, 30 days). Five
+  wrong passwords lock every sign-in for 30 seconds; retrying the API
+  token never counts. From another device, changing or turning off the
+  password needs it.
+- **The box itself** (`127.0.0.1` / `::1`) needs no password for settings,
+  so `ftw` commands keep working and `ftw password reset` can turn it off.
+  A browser on the box signs in like any other before it lets an
+  assistant in. Drivers cannot reach the API at all; anything else that
+  runs on the box can already change every setting.
+
+**Forgot it**, or someone else set it first: turn it off on the box, then
+choose a new one on the box's page.
 
 ```bash
-docker compose -f docker-compose.macos.yml exec ftw \
-  wget -qO- --header='Content-Type: application/json' \
-  --post-data='{"enabled":true,"password":"ETT-LANGT-LOSEN"}' \
-  http://127.0.0.1:8080/api/auth/password
+ftw password reset
 ```
 
+The `ftw` command moves with `install.sh --refresh`, not with `ftw update`.
+If it answers `unknown command password`, run the same step with Core's own
+binary for the release `ftw status` names:
+
+```bash
+/opt/ftw/releases/v0.X.Y/ftw password reset
+```
+
+On Docker, run the box's own binary in its container (add
+`-f docker-compose.macos.yml` on Docker Desktop):
+
+```bash
+docker compose exec ftw /app/ftw password reset
+```
+
+Either signs every browser out. Without shell access to the box, the
+password cannot be reset.
+
 An owner pairing QR is minted only from loopback or with the house
 password. Promoting a paired phone to owner uses the same gate. The
 first pairing on an empty box is an owner whatever the code said, so
@@ -218,9 +249,6 @@ LAN once an owner exists.
 
 The FTW app and Home Assistant MQTT are unchanged.
 
-Recovery: `curl` to `127.0.0.1`, or set `api.lan_auth: false` in
-`config.yaml` and restart Core.
-
 ### "remote access to protected API routes is disabled"
 
 The full message is `remote access to protected API routes is disabled;
 
@@ -102,7 +102,19 @@ func runBootstrap(configPath, webDir, driverDir string) {
 		}
 		writeBootstrapJSON(w, http.StatusOK, chargers)
 	})
-	mux.HandleFunc("POST /api/config", func(w http.ResponseWriter, r *http.Request) {
+	mux.HandleFunc("POST /api/config", bootstrapConfig(configPath, saveInitial, func() error { return execCurrentProcess(nil) }))
+
+	srv := newHTTPServer(":8080", secureBootstrapMutations(mux))
+	if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		slog.Error("bootstrap server", "err", err)
+		os.Exit(1)
+	}
+}
+
+// bootstrapConfig saves the wizard's settings, with the house password it
+// asked for, then restarts into the normal server.
+func bootstrapConfig(configPath string, save func(*config.Config) error, restart func() error) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
 		body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
 		r.Body.Close()
 		if err != nil {
@@ -118,23 +130,21 @@ func runBootstrap(configPath, webDir, driverDir string) {
 			writeBootstrapJSON(w, http.StatusUnprocessableEntity, map[string]string{"error": err.Error()})
 			return
 		}
-		if err := saveInitial(&cfg); err != nil {
+		if err := applyInitialHousePassword(r, body, &cfg); err != nil {
+			writeBootstrapJSON(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+			return
+		}
+		if err := save(&cfg); err != nil {
 			writeBootstrapJSON(w, http.StatusInternalServerError, map[string]string{"error": "write config: " + err.Error()})
 			return
 		}
 		slog.Info("config written by setup wizard — restarting", "path", configPath)
 		writeBootstrapJSON(w, http.StatusOK, map[string]string{"status": "ok", "restart": "true"})
 		go func() {
-			if err := execCurrentProcess(nil); err != nil {
+			if err := restart(); err != nil {
 				slog.Error("bootstrap re-exec failed", "err", err)
 			}
 		}()
-	})
-
-	srv := newHTTPServer(":8080", secureBootstrapMutations(mux))
-	if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-		slog.Error("bootstrap server", "err", err)
-		os.Exit(1)
 	}
 }
 
@@ -165,7 +175,7 @@ func bootstrapAssistant(save func(*config.Config) error, restart func() error) h
 			Confirmed bool   `json:"confirmed"`
 			Password  string `json:"password"`
 		}
-		dec := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1024))
+		dec := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4096))
 		dec.DisallowUnknownFields()
 		if err := dec.Decode(&q); err != nil || !q.Confirmed {
 			writeBootstrapJSON(w, http.StatusBadRequest, map[string]string{"error": "confirm starting an empty measurement installation"})
@@ -199,6 +209,25 @@ func bootstrapAssistant(save func(*config.Config) error, restart func() error) h
 	}
 }
 
+// applyInitialHousePassword locks a new box with the house password the
+// wizard asked for, beside its settings. Home Assistant signs its users in
+// itself and sends none. A script that posts settings without one leaves the
+// lock off, as before; the page asks for a password later.
+func applyInitialHousePassword(r *http.Request, body []byte, cfg *config.Config) error {
+	var q struct {
+		HousePassword string `json:"house_password"`
+	}
+	if err := json.Unmarshal(body, &q); err != nil || q.HousePassword == "" || api.HomeAssistantIngress(r) {
+		return nil
+	}
+	hash, err := api.HashInitialLANPassword(q.HousePassword)
+	if err != nil {
+		return err
+	}
+	cfg.API.LANAuth, cfg.LANPasswordHash = true, hash
+	return nil
+}
+
 // Bootstrap needs the same country/zone choices before any config exists.
 func bootstrapPriceZones(w http.ResponseWriter, _ *http.Request) {
 	zones := prices.Zones()
 
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"encoding/json"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
@@ -133,3 +134,80 @@ func TestHomeAssistantBootstrapNeedsNoSecondPassword(t *testing.T) {
 		t.Fatal("HA setup invented a password or equipment")
 	}
 }
+
+// The wizard's own settings save carries the house password it asked for,
+// so a new box starts locked. Home Assistant signs its users in itself, and
+// a script that sends none keeps the lock off as before.
+func TestBootstrapWizardSavesTheHousePassword(t *testing.T) {
+	t.Setenv("FTW_API_TOKEN", "")
+	const settings = `"site":{"name":"Home","control_interval_s":5,"grid_tolerance_w":42,"watchdog_timeout_s":60,"smoothing_alpha":0.3,"gain":0.5,"slew_rate_w":500,"min_dispatch_interval_s":5},"fuse":{"max_amps":16,"phases":3,"voltage":230},"drivers":[],"api":{"port":8080}`
+	for _, tc := range []struct {
+		name, body string
+		want       int
+		locked     bool
+	}{
+		{"with a password", `{` + settings + `,"house_password":"first-owner-password"}`, 200, true},
+		{"a short one, the owner's choice", `{` + settings + `,"house_password":"1234"}`, 200, true},
+		{"too long", `{` + settings + `,"house_password":"` + strings.Repeat("x", 513) + `"}`, 400, false},
+		{"from a script without one", `{` + settings + `}`, 200, false},
+		{"through Home Assistant", `{` + settings + `,"house_password":"first-owner-password"}`, 200, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "config.yaml")
+			restarted := make(chan struct{}, 1)
+			handler := secureBootstrapMutations(bootstrapConfig(path, func(cfg *config.Config) error { return saveInitialConfig(path, cfg) },
+				func() error { restarted <- struct{}{}; return nil }))
+			req := httptest.NewRequest("POST", "http://box.local/api/config", strings.NewReader(tc.body))
+			req.RemoteAddr = "192.168.1.12:1234"
+			req.Header.Set("Content-Type", "application/json")
+			req.Header.Set("Origin", "http://box.local")
+			if tc.name == "through Home Assistant" {
+				handler = api.WithHomeAssistantIngress(handler)
+				req.RemoteAddr = "172.30.32.2:1234"
+				req.Header.Del("Origin")
+				req.Header.Set("X-Ingress-Path", "/api/hassio_ingress/test")
+				req.Header.Set("X-Remote-User-Id", "owner")
+			}
+			w := httptest.NewRecorder()
+			handler.ServeHTTP(w, req)
+			if w.Code != tc.want {
+				t.Fatalf("%d %s", w.Code, w.Body.String())
+			}
+			if tc.want != 200 {
+				if _, err := os.Stat(path); !os.IsNotExist(err) {
+					t.Fatal("a refused save wrote settings")
+				}
+				return
+			}
+			<-restarted
+			cfg, err := config.Load(path)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if cfg.API.LANAuth != tc.locked || (cfg.LANPasswordHash != "") != tc.locked {
+				t.Fatalf("lan_auth %v, hash set %v; want %v", cfg.API.LANAuth, cfg.LANPasswordHash != "", tc.locked)
+			}
+			raw, _ := os.ReadFile(path)
+			if strings.Contains(string(raw), "first-owner-password") {
+				t.Fatal("the locator holds the house password")
+			}
+			var sent struct {
+				HousePassword string `json:"house_password"`
+			}
+			_ = json.Unmarshal([]byte(tc.body), &sent)
+			if tc.locked && !api.VerifyStoredLANSecret(mustOpenState(t, cfg.ConfigDatabase), sent.HousePassword) {
+				t.Fatal("the stored hash does not match the password the wizard sent")
+			}
+		})
+	}
+}
+
+func mustOpenState(t *testing.T, path string) *state.Store {
+	t.Helper()
+	st, err := state.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = st.Close() })
+	return st
+}
@@ -54,6 +54,7 @@ import (
 	"github.com/srcfl/ftw/go/internal/drivers"
 	"github.com/srcfl/ftw/go/internal/events"
 	"github.com/srcfl/ftw/go/internal/forecast"
+	"github.com/srcfl/ftw/go/internal/ftwcli"
 	"github.com/srcfl/ftw/go/internal/gatewayidentity"
 	"github.com/srcfl/ftw/go/internal/ha"
 	"github.com/srcfl/ftw/go/internal/loadmodel"
@@ -325,6 +326,12 @@ func main() {
 			// Shift os.Args so the subcommand's flag.FlagSet sees its own flags.
 			runNovaClaim(os.Args[2:])
 			return
+		case "password":
+			// A container has no separate ftw command, so Core's own binary
+			// resets the house password: docker compose exec ftw /app/ftw
+			// password reset. It asks the running Core on loopback.
+			exitCode = ftwcli.Run(os.Args[1:], os.Stdout, os.Stderr)
+			return
 		}
 	}