Update app.py

app.py

@@ -57,7 +57,14 @@ except Exception as e:
 
 app = Flask(__name__)
 CORS(app, supports_credentials=True)
-app.config['SECRET_KEY'] = os.environ.get("SECRET_KEY", "nexa-ai-secret-key-2026")
+app.config['SECRET_KEY'] = os.environ.get("SECRET_KEY")
+if not app.config['SECRET_KEY']:
+    # Generate a random key so the app still runs locally/in dev, but this
+    # invalidates all existing JWTs on every restart. Set SECRET_KEY in your
+    # environment for any deployment where sessions need to persist or where
+    # the app is reachable outside your own machine.
+    app.config['SECRET_KEY'] = os.urandom(32).hex()
+    logger.warning("SECRET_KEY not set in environment — using a random ephemeral key. Set SECRET_KEY for production.")
 
 # --- Database Setup ---
 DB_PATH = "nexa_ai.db"
@@ -107,26 +114,27 @@ def init_db():
         # FIXED: Ensure a default admin account exists and has the correct password
         try:
             admin_user = conn.execute('SELECT * FROM users WHERE username = ?', ('admin',)).fetchone()
-            admin_pass_hash = pwd_context.hash("admin123")
             if not admin_user:
+                # Use ADMIN_PASSWORD from the environment if set; otherwise
+                # generate a random one-time password and print it once so
+                # it isn't a fixed, guessable credential baked into the code.
+                admin_password = os.environ.get("ADMIN_PASSWORD")
+                generated = admin_password is None
+                if generated:
+                    admin_password = uuid.uuid4().hex
+                admin_pass_hash = pwd_context.hash(admin_password)
                 conn.execute(
                     'INSERT INTO users (username, email, password_hash) VALUES (?, ?, ?)',
-                    ('admin', 'admin@nexa.ai', admin_pass_hash)
-                )
-                logger.info(f"Default admin account created: admin / admin123 (Hash: {admin_pass_hash[:10]}...)")
-            else:
-                # Force update password hash to ensure it matches admin123
-                conn.execute(
-                    'UPDATE users SET password_hash = ?, email = ? WHERE username = ?',
-                    (admin_pass_hash, 'admin@nexa.ai', 'admin')
+                    ('admin', os.environ.get("ADMIN_EMAIL", "admin@nexa.ai"), admin_pass_hash)
                 )
-                logger.info(f"Default admin account password reset to: admin123 (Hash: {admin_pass_hash[:10]}...)")
-                
-            # Self-verification check
-            test_verify = pwd_context.verify("admin123", admin_pass_hash)
-            logger.info(f"Admin self-verification test: {'PASSED' if test_verify else 'FAILED'}")
+                if generated:
+                    logger.warning(f"Default admin account created with a GENERATED password (shown once): {admin_password} — log in and change it, or set ADMIN_PASSWORD in your environment.")
+                else:
+                    logger.info("Default admin account created using ADMIN_PASSWORD from environment.")
+            # If the admin account already exists, leave its password alone —
+            # do not overwrite it on every restart.
         except Exception as e:
-            logger.error(f"Error creating/resetting default admin: {e}")
+            logger.error(f"Error creating default admin: {e}")
             
         conn.commit()
 
@@ -193,18 +201,23 @@ try:
 except Exception as e:
     logger.error(f"Failed to load Phi-3-mini model: {e}")
 
-SYSTEM_PROMPT = """You are Nexa AI, a professional technical execution engine. 
+SYSTEM_PROMPT = """You are Nexa AI, a professional technical execution engine built for direct, competent help across research, coding, writing, and file/media generation.
+### **SCOPE & HONESTY**:
+1. You have real tools (web search, file parsing, image/video generation, code execution) — only claim to have done something (searched, generated a file, run code) if the corresponding tool actually ran and returned a result this turn.
+2. If a tool is unavailable or fails, say so plainly rather than fabricating output. Never invent URLs, citations, file contents, or search results.
+3. If a request is ambiguous, make a reasonable assumption, state it briefly, and proceed — don't stall on clarifying questions unless genuinely necessary.
 ### **WRITING PRINCIPLES**:
 1. Match response depth and length to the question. A simple question gets a short, direct answer in plain prose — no headers, no bullet template. A complex technical request can use structure (headers, numbered steps, tables, code blocks) where it genuinely improves clarity.
 2. Write in clear, natural language. Avoid filler words ("just", "really", "very", "basically") but do not strip the response down to unnatural telegraphic phrasing either.
 3. Never simulate dialogue, never include "AI:"/"User:" labels, never narrate what you're about to do — just answer.
 4. Don't force emoji, bold labels, or section headers onto every message. Use them only when they add real value (e.g., a multi-step technical walkthrough, a comparison table).
-5. If the user asks for code, give clean, correct, runnable code with only as much explanation as is useful — don't pad it with restating what the code obviously does.
+5. If the user asks for code, give clean, correct, runnable code with only as much explanation as is useful — don't pad it with restating what the code obviously does. Decline requests to write malware, exploits, or credential-stealing code.
 6. Be honest about uncertainty instead of inventing confident-sounding details.
 ### **WHEN WEB RESULTS ARE PROVIDED**:
 - Synthesize the sources into your own words; cite specific claims with [N] tied to the source list.
 - End with a short **Reference** section listing each [N] as a markdown link.
 - Never cite Wikipedia.
+- Never reproduce more than a short phrase verbatim from any single source.
 ### **WHEN A TOOL FAILS**:
 Briefly state what failed and what you'll try next (or what the user can do), in one or two sentences — no need for a formatted alert block.
 Current Date: {date}