What causes "reset-password returned no new_password" in iOfficeAI/AionUi?

Log/inspect payload to see the actual response shape

reset-password returned no new_password

Error message

reset-password returned no new_password

What it means

Thrown by the reset-password CLI when the backend returns 2xx for the reset request but the JSON payload lacks data.new_password, so no new credential can be printed to the user.

Source

Thrown at packages/desktop/src/process/utils/resetPasswordCLI.ts:60

export async function resetPasswordCLI(username: string): Promise<void> {
  log.info(`Target user: ${username} (advisory — operates on system_default_user)`);
  const port = (globalThis as typeof globalThis & { __backendPort?: number }).__backendPort;
  if (!port) {
    log.error('Backend did not start — cannot reset password');
    process.exit(1);
  }
  try {
    const res = await fetch(`http://127.0.0.1:${port}/api/webui/reset-password`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
    });
    if (!res.ok) {
      const body = await res.text();
      throw new Error(`reset-password failed (${res.status}): ${body}`);
    }
    const payload = (await res.json()) as { data?: { new_password?: string } };
    const newPassword = payload.data?.new_password;
    if (!newPassword) throw new Error('reset-password returned no new_password');
    log.success('Password reset successfully.');
    log.info('New password:');
    log.highlight(newPassword);
    log.info('');
    log.warning('Please change this password after next login.');
  } catch (error) {
    log.error(error instanceof Error ? error.message : 'Password reset failed');
    process.exit(1);
  }
}

View on GitHub (pinned to 711aa0550e)

Solutions

Log/inspect payload to see the actual response shape
Update the CLI to read the current field name used by the backend
Keep CLI and backend versions in lockstep; add a schema check on the backend side
If the backend wraps errors in 200 responses, fix the backend to use proper status codes

Defensive patterns

Strategy: type-guard

Validate before calling

const payload = await res.json();
if (!payload?.data?.new_password) { console.error('Unexpected payload:', payload); /* abort cleanly */ }

Type guard

function hasPasswordPayload(v: unknown): v is { data: { new_password: string } } {
  return typeof (v as never)?.data?.new_password === 'string';
}

Try / catch

catch (err) { console.error('reset-password schema mismatch:', err.message); process.exit(1); }

Prevention

Share API types between CLI and backend
Add response-schema smoke tests
Never print passwords in logs — only mismatch diagnostics

When it happens

Trigger: Backend responds 200 with a payload where payload.data is missing or new_password is absent/renamed.

Common situations: Backend version drift changing the response schema, or an error object returned with HTTP 200.

Related errors

AI-assisted analysis of iOfficeAI/AionUi@711aa0550e (2026-08-28). Data as JSON: /api/errors/730b54608861c0d1. Report an issue: GitHub.