@homebridge-plugins/homebridge-ewelink 12.11.1-beta.0 → 12.11.2-beta.0

package/CHANGELOG.md

@@ -2,7 +2,55 @@
 
 All notable changes to `@homebridge-plugins/homebridge-ewelink` will be documented in this file.
 
-## v12.11.1 (Pending Release)
+## v12.11.2 (Pending Release)
+
+### Changed
+
+- fix: replace `Math.random()` nonce generation with `crypto.randomBytes()`
+- fix: filter glitched sensor readings
+- fix: LAN packet parse errors
+- fix: ws 406 auth re-login with backoff
+- fix: ws dispatch fallback hosts
+- fix: ws command timeout and retry
+- fix: LAN retry on `ECONNRESET`
+- perf: LAN commands bypass queue
+- feat: add new device UIIDs
+- fix: POWR3 `operSide` parameter
+- fix: dimmer brightness requires switch on
+- feat: curtain mid-movement stop
+- feat: `offlineAsOff` for switches and outlets
+- fix: RF button `ConfiguredName` display
+- fix: LAN `operSide` passthrough
+- fix: zigbee multi-channel send all channels
+- fix: button event deduplication via `trigTime`
+- fix: ws minimum interval between messages
+- fix: MINI-DIM brightness params
+- fix: ws unmatched response device updates
+- fix: skip stale zigbee `subDevRssi` updates
+- fix: zigbee motion reset on bridge offline
+- fix: TRVZB firmware type coercion
+- fix: UIID 104 `ltype` undefined in params
+- fix: ws reconnection exponential backoff
+- perf: in-memory temperature cache for simulations
+- feat: LAN discovery summary logging
+- fix: cover position boundary clamping
+- fix: HTTP 401 automatic token refresh
+- fix: clean stale services on category change
+- feat: `sledonline` LAN power monitoring trick
+- feat: T5 (UIID 211) cover motor mode
+- fix: clear command queue on shutdown
+- fix: switches array bounds checking
+- fix: guard `accessory.control` access
+- fix: async forEach to for...of loop
+- fix: `getHost()` unbounded recursion limit
+- fix: cap energy readings array size
+- refactor: replace per-device shutdown listeners with `destroy()`
+- fix: revert UIID 52 from `lightCCT`
+- fix: simulation switches array bounds
+- fix: audit fixes from code review
+- chore: dependency updates
+
+## v12.11.1 (2026-04-05)
 
 ### Changed
 

package/lib/connection/http.js

@@ -1,5 +1,5 @@
 import { Buffer } from 'node:buffer'
-import { createHmac } from 'node:crypto'
+import { createHmac, randomBytes } from 'node:crypto'
 
 import axios from 'axios'
 
@@ -28,6 +28,26 @@ export default class {
       .map(el => el.sensorId)
     this.triedBase64 = false
     this.username = platform.config.username
+
+    // Set up axios interceptor for automatic 401 token refresh
+    this.axiosClient = axios.create()
+    this.axiosClient.interceptors.response.use(
+      res => res,
+      async (err) => {
+        if (err.response?.status === 401 && !err.config._retried) {
+          err.config._retried = true
+          try {
+            const authData = await this.login()
+            this.aToken = authData.aToken
+            err.config.headers.Authorization = `Bearer ${this.aToken}`
+            return this.axiosClient(err.config)
+          } catch (loginErr) {
+            throw err
+          }
+        }
+        throw err
+      },
+    )
   }
 
   async login() {
@@ -61,9 +81,7 @@ export default class {
           'Authorization': `Sign ${dataToSign}`,
           'Content-Type': 'application/json',
           'X-CK-Appid': this.appId,
-          'X-CK-Nonce': Math.random()
-            .toString(36)
-            .substring(2, 10),
+          'X-CK-Nonce': randomBytes(4).toString('hex'),
         },
       })
 
@@ -149,14 +167,12 @@ export default class {
     // Used to get a user's home list
     try {
       // Send the request
-      const res = await axios.get(`https://${this.httpHost}/v2/family`, {
+      const res = await this.axiosClient.get(`https://${this.httpHost}/v2/family`, {
         headers: {
           'Authorization': `Bearer ${this.aToken}`,
           'Content-Type': 'application/json',
           'X-CK-Appid': this.appId,
-          'X-CK-Nonce': Math.random()
-            .toString(36)
-            .substring(2, 10),
+          'X-CK-Nonce': randomBytes(4).toString('hex'),
         },
       })
 
@@ -201,7 +217,7 @@ export default class {
       const fullDeviceList = []
 
       for (const homeId of this.homeList) {
-        const res = await axios.get(`https://${this.httpHost}/v2/device/thing`, {
+        const res = await this.axiosClient.get(`https://${this.httpHost}/v2/device/thing`, {
           headers: {
             'Authorization': `Bearer ${this.aToken}`,
             'Content-Type': 'application/json',
@@ -278,7 +294,7 @@ export default class {
 
   async updateGroup(groupId, params) {
     // Used to get info about a specific device
-    const res = await axios.post(
+    const res = await this.axiosClient.post(
       `https://${this.httpHost}/v2/device/thing/status`,
       {
         type: 2,
@@ -290,9 +306,7 @@ export default class {
           'Authorization': `Bearer ${this.aToken}`,
           'Content-Type': 'application/json',
           'X-CK-Appid': this.appId,
-          'X-CK-Nonce': Math.random()
-            .toString(36)
-            .substring(2, 10),
+          'X-CK-Nonce': randomBytes(4).toString('hex'),
         },
       },
     )

package/lib/connection/lan.js

@@ -11,7 +11,7 @@ import axios from 'axios'
 
 import dnsSd from '../node-dns-sd/lib/dns-sd.js'
 import platformConsts from '../utils/constants.js'
-import { hasProperty, parseError } from '../utils/functions.js'
+import { hasProperty, parseError, sleep } from '../utils/functions.js'
 
 const emitter = new events()
 
@@ -113,7 +113,10 @@ export default class {
             // Parse the deconstructed information from the packet
             let params
             try {
-              params = JSON.parse(pText)
+              // Fix RF Bridge malformed JSON and strip trailing garbage bytes
+              // eslint-disable-next-line no-control-regex
+              const cleanText = pText.replace(/"\s*=\s*"/g, '":"').replace(/[\x00-\x1F]+$/g, '')
+              params = JSON.parse(cleanText)
             } catch (err) {
               this.log.warn(
                 '[%s] %s %s:\n%s',
@@ -154,9 +157,16 @@ export default class {
     // Start the DNS packet monitoring
     await dnsSd.startMonitoring()
     this.log('%s.', this.lang.lanMonitor)
+
+    // Log LAN discovery summary after 10 seconds
+    setTimeout(() => {
+      const total = this.deviceMap.size
+      const withIp = [...this.deviceMap.values()].filter(d => d.ip).length
+      this.log('LAN discovery: %s/%s devices found locally.', withIp, total)
+    }, 10000)
   }
 
-  async sendUpdate(json) {
+  async sendUpdate(json, retries = 0) {
     try {
       // Check this device exists in the map
       if (!this.deviceMap.has(json.deviceid)) {
@@ -217,6 +227,9 @@ export default class {
           }
         } else {
           params.switches = json.params.switches
+          if (json.params.operSide !== undefined) {
+            params.operSide = json.params.operSide
+          }
           suffix = 'switches'
         }
       } else if (json.params.switch) {
@@ -239,6 +252,9 @@ export default class {
         // Use hasProperty has location can be INT 0
         params.location = json.params.location
         suffix = 'location'
+      } else if (hasProperty(json.params, 'sledOnline')) {
+        params.sledOnline = json.params.sledOnline ? 'on' : 'off'
+        suffix = 'switch'
       } else if (json.params.uiActive && deviceInfo.uiid === 32) {
         params.uiActive = json.params.uiActive
         suffix = 'monitor'
@@ -297,6 +313,11 @@ export default class {
       // This ok is needed by the plugin
       return 'ok'
     } catch (err) {
+      // Retry on ECONNRESET (device web server is single-threaded)
+      if (err.code === 'ECONNRESET' && retries < 10) {
+        await sleep(100)
+        return this.sendUpdate(json, retries + 1)
+      }
       return parseError(err)
     }
   }

package/lib/connection/ws.js

@@ -1,3 +1,4 @@
+import { randomBytes } from 'node:crypto'
 import events from 'node:events'
 
 import axios from 'axios'
@@ -27,7 +28,7 @@ export default class {
     this.wsIsConnected = false
   }
 
-  async getHost() {
+  async getHost(attempt = 0) {
     // Used to get the web socket host
     try {
       // Send the HTTP request to get the web socket host
@@ -40,9 +41,7 @@ export default class {
         },
         data: {
           appid: this.appId,
-          nonce: Math.random()
-            .toString(36)
-            .substring(2, 10),
+          nonce: randomBytes(4).toString('hex'),
           ts: Math.floor(Date.now() / 1000),
           version: 8,
         },
@@ -66,15 +65,18 @@ export default class {
       return body.domain
     } catch (err) {
       // Check to see if it's a eWeLink server problem, and we can retry
-      if (err.code && platformConsts.httpRetryCodes.includes(err.code)) {
-        // Retry if another attempt could be successful
+      if (err.code && platformConsts.httpRetryCodes.includes(err.code) && attempt < 3) {
         this.log.warn('%s [getHost() - %s].', this.lang.httpRetry, err.code)
         await sleep(30000)
-        return this.getHost()
+        return this.getHost(attempt + 1)
       }
-      // It's not a eWeLink problem so report the error back
-      this.log.warn('%s.', this.lang.errGetHost)
-      throw err
+
+      // Fall back to static pconnect hosts
+      const region = this.httpHost.split('-')[0]
+      const suffix = region === 'cn' ? 'coolkit.cn' : 'coolkit.cc'
+      const fallback = `${region}-pconnect3.${suffix}`
+      this.log.warn('%s [%s].', this.lang.errGetHost, fallback)
+      return fallback
     }
   }
 
@@ -107,6 +109,7 @@ export default class {
           data = data.toString()
           return data === 'pong' ? data : JSON.parse(data)
         },
+        timeout: 20000,
       })
 
       // Add a listener to authenticate when a web socket connection is opened
@@ -119,9 +122,7 @@ export default class {
           apikey: this.apiKey,
           appid: this.appId,
           at: this.aToken,
-          nonce: Math.random()
-            .toString(36)
-            .substring(2, 10),
+          nonce: randomBytes(4).toString('hex'),
           sequence,
           ts: Math.floor(new Date() / 1000),
           userAgent: 'app',
@@ -159,12 +160,19 @@ export default class {
             }, (res.config.hbInterval + 7) * 1000)
 
             // Login was successful and log if appropriate
+            this.authRetries = 0
             if (this.debug) {
               this.log('%s.', this.lang.wsLoginSuccess)
             }
           } else if (res.error === 406) {
-            // There was a problem with the authentication response
+            // Token invalidated (e.g. concurrent session), re-authenticate with backoff
             this.log.warn(this.lang.wsLogin406)
+            const delay = Math.min(5000 * 2 ** (this.authRetries || 0), 300000)
+            this.authRetries = (this.authRetries || 0) + 1
+            if (this.authRetries <= 10) {
+              await sleep(delay)
+              await this.login()
+            }
           } else {
             // There was a problem with the authentication response
             const str = JSON.stringify(res, null, 2)
@@ -209,6 +217,12 @@ export default class {
                 onlineStatus = msg.params.online
               }
 
+              // Skip updates that only contain subDevRssi (stale Zigbee data)
+              const paramKeys = Object.keys(msg.params).filter(k => k !== 'online')
+              if (paramKeys.length === 1 && paramKeys[0] === 'subDevRssi') {
+                break
+              }
+
               // Loop through the device parameters received
               Object.keys(msg.params).forEach((param) => {
                 // Remove any params that the plugin doesn't need
@@ -247,7 +261,12 @@ export default class {
             }
           }
         } else if (hasProperty(msg, 'error') && msg.error === 0) {
-          // Safe to ignore these messages
+          // Process device params from unmatched responses (e.g. query results)
+          if (msg.deviceid && msg.params) {
+            msg.params.online = true
+            msg.params.updateSource = 'WS'
+            emitter.emit('update', { deviceid: msg.deviceid, params: msg.params })
+          }
         } else {
           // WS message received has an unknown action
           this.log.warn('%s.\n%s', this.lang.wsUnkCmd, JSON.stringify(msg, null, 2))
@@ -261,45 +280,49 @@ export default class {
           return
         }
 
-        // Log that the web socket has closed if appropriate
         if (this.debug) {
           this.log.warn('%s [%s].', this.lang.wsReconnectError, e)
         }
 
-        // Wait for 4 seconds and try to re-establish the web socket connection
-        await sleep(4000)
+        // Reconnect with exponential backoff
+        this.reconnectAttempts = (this.reconnectAttempts || 0) + 1
+        const delay = Math.min(5000 * 2 ** (this.reconnectAttempts - 1), 300000)
+        await sleep(delay)
         await this.login()
       })
 
       // Add a listener for when the web socket throws an error
       this.wsClient.onError.addListener(async (e) => {
-        // Log that the web socket has closed if appropriate
         if (this.debug) {
           this.log.warn('%s [%s].', this.lang.wsReconnectClose, e)
         }
 
-        // Wait for 6 seconds and try to re-establish the web socket connection
-        await sleep(6000)
+        this.reconnectAttempts = (this.reconnectAttempts || 0) + 1
+        const delay = Math.min(5000 * 2 ** (this.reconnectAttempts - 1), 300000)
+        await sleep(delay)
         await this.login()
       })
 
       // Open the web socket connection
       await this.wsClient.open()
+
+      // Reset reconnect counter on successful connection
+      this.reconnectAttempts = 0
     } catch (err) {
       const errToShow = parseError(err)
 
-      // Log the error if appropriate (debug on)
       if (this.debug) {
         this.log('%s: %s.', this.lang.wsLoginErrRecon, errToShow)
       }
 
-      // Wait for 5 seconds and try to re-establish the web socket connection
-      await sleep(5000)
+      this.reconnectAttempts = (this.reconnectAttempts || 0) + 1
+      const delay = Math.min(5000 * 2 ** (this.reconnectAttempts - 1), 300000)
+      await sleep(delay)
       await this.login()
     }
   }
 
-  async sendUpdate(json) {
+  async sendUpdate(json, retries = 0) {
     // Generate the payload to send
     const toSend = {
       ...json,
@@ -309,6 +332,13 @@ export default class {
       userAgent: 'app',
     }
 
+    // Enforce minimum 100ms between cloud messages
+    const now = Date.now()
+    if (this.lastSendTime && now - this.lastSendTime < 100) {
+      await sleep(100 - (now - this.lastSendTime))
+    }
+    this.lastSendTime = Date.now()
+
     // Check the web socket is open
     if (this.wsClient && this.wsIsConnected) {
       try {
@@ -338,8 +368,13 @@ export default class {
             throw new Error(`${this.lang.wsUnkRes} [${res.error}]`)
         }
       } catch (err) {
-        // Catch any errors sending the device update
-        throw new Error(parseError(err))
+        // Retry up to 3 times on timeout errors only
+        const errMsg = parseError(err)
+        if (retries < 3 && (errMsg.includes('504') || errMsg.includes('timeout') || errMsg.includes('Timeout'))) {
+          await sleep(1000)
+          return this.sendUpdate(json, retries + 1)
+        }
+        throw new Error(errMsg)
       }
     } else {
       // The web socket isn't currently open so log this

package/lib/device/curtain.js

@@ -170,6 +170,22 @@ export default class {
       // Create the params object to send
       const params = {}
 
+      // Mid-movement stop: if target is within 5% of current, send stop
+      if (Math.abs(value - this.cachePos) <= 5 && value !== 0 && value !== 100) {
+        switch (this.accessory.context.eweUIID) {
+          case 11:
+            params.switch = 'pause'
+            break
+          case 67:
+            params.op = 2
+            break
+          default:
+            return
+        }
+        await this.platform.sendDeviceUpdate(this.accessory, params)
+        return
+      }
+
       switch (this.accessory.context.eweUIID) {
         case 11:
           // If we are to fully open/close the curtain we can use the switch param
@@ -299,7 +315,8 @@ export default class {
             return
         }
 
-        // Update HomeKit with the provided value
+        // Clamp and update HomeKit with the provided value
+        newPos = Math.max(Math.min(newPos, 100), 0)
         this.service.updateCharacteristic(this.hapChar.TargetPosition, newPos)
         this.service.updateCharacteristic(this.hapChar.CurrentPosition, newPos)
         this.service.updateCharacteristic(this.hapChar.PositionState, 2)

package/lib/device/fan.js

@@ -270,7 +270,7 @@ export default class {
             return
         }
       }
-      if (!params.switches) {
+      if (!params.switches || !params.switches[1] || !params.switches[2] || !params.switches[3]) {
         return
       }
       if (params.switches[1].switch !== this.cacheState) {

package/lib/device/group.js

@@ -82,7 +82,7 @@ export default class {
           this.log('[%s] %s [%s].', this.name, this.lang.curState, this.cacheState)
         }
       }
-      if (this.isSCM && params.switches && params.switches[0].switch !== this.cacheState) {
+      if (this.isSCM && params.switches?.[0] && params.switches[0].switch !== this.cacheState) {
         this.cacheState = params.switches[0].switch
         this.service.updateCharacteristic(this.hapChar.On, this.cacheState === 'on')
         this.accessory.eveService.addEntry({ status: this.cacheState === 'on' ? 1 : 0 })

package/lib/device/light-dimmer.js

@@ -145,6 +145,11 @@ export default class {
           params.brightness = value
           // D1 eWeLink scale matches HomeKit scale of 0-100
           params.mode = 0
+          params.switch = 'on'
+          break
+        case 277:
+          params.brightness = Math.max(value, 1)
+          params.switch = 'on'
           break
         case 57:
           params.channel0 = Math.round((value * 23) / 10 + 25).toString()

package/lib/device/light-rgb-cct.js

@@ -343,10 +343,9 @@ export default class {
             colorB: rgb[2],
           }
           break
-        case 104:
+        case 104: {
           // B02-B-A60, B05-B-A60, GTLC104
           params = {
-            ltype: this.cacheMode === 'color' ? undefined : 'color',
             color: {
               br: this.cacheBright,
               r: rgb[0],
@@ -354,7 +353,11 @@ export default class {
               b: rgb[2],
             },
           }
+          if (this.cacheMode !== 'color') {
+            params.ltype = 'color'
+          }
           break
+        }
         case 135:
         case 136:
           params = {
@@ -443,17 +446,20 @@ export default class {
           }
           break
         }
-        case 104:
+        case 104: {
           // B02-B-A60, B05-B-A60, GTLC104
           scaledCT = Math.round(((mToK - 2700) / 3800) * 255)
           params = {
-            ltype: this.cacheMode === 'white' ? undefined : 'white',
             white: {
               br: this.cacheBright,
               ct: scaledCT,
             },
           }
+          if (this.cacheMode !== 'white') {
+            params.ltype = 'white'
+          }
           break
+        }
         case 135:
         case 136:
           scaledCT = Math.round(((mToK - 2700) / 3800) * 100)

package/lib/device/motor.js

@@ -165,9 +165,6 @@ export default class {
         this.internalUIUpdate()
         this.intervalPoll = setInterval(() => this.internalUIUpdate(), 120000)
       }, 5000)
-
-      // Stop the intervals on Homebridge shutdown
-      platform.api.on('shutdown', () => clearInterval(this.intervalPoll))
     }
 
     // Output the customised options to the log
@@ -190,7 +187,9 @@ export default class {
       if (updateKey !== this.updateKey) {
         return
       }
-      const params = { location: value }
+      const params = this.accessory.context.eweUIID === 211
+        ? { percentageControl: 100 - value }
+        : { location: value }
       await this.platform.sendDeviceUpdate(this.accessory, params)
       this.cacheTarg = value
       if (this.enableLogging) {
@@ -211,7 +210,9 @@ export default class {
       // 0 for open, 1 for closed
       // this.cachePos is 0 for closed and >0 for open
 
-      const params = { location: value === 1 ? 0 : 100 }
+      const params = this.accessory.context.eweUIID === 211
+        ? { electromotor: value === 1 ? 2 : 0 }
+        : { location: value === 1 ? 0 : 100 }
       await this.platform.sendDeviceUpdate(this.accessory, params)
       this.cacheTarg = value === 1 ? 0 : 100
       if (this.enableLogging) {
@@ -245,11 +246,27 @@ export default class {
     try {
       let locationParams = false
 
+      // T5 cover uses percentageControl (inverted: 0=open, 100=closed)
+      if (hasProperty(params, 'percentageControl') && params.calibState) {
+        locationParams = true
+        const newPos = Math.max(Math.min(100 - params.percentageControl, 100), 0)
+        if (newPos !== this.cachePos) {
+          this.cachePos = newPos
+          if (!this.isGarage) {
+            this.service.updateCharacteristic(this.hapChar.CurrentPosition, this.cachePos)
+            this.service.updateCharacteristic(this.hapChar.TargetPosition, this.cachePos)
+          }
+          if (params.updateSource && this.enableLogging) {
+            this.log('[%s] %s [%s%].', this.name, this.lang.curPos, this.cachePos)
+          }
+        }
+      }
+
       // currLocation is the current position of the motor
       if (hasProperty(params, 'currLocation')) {
         locationParams = true
         if (params.currLocation !== this.cachePos) {
-          this.cachePos = params.currLocation
+          this.cachePos = Math.max(Math.min(params.currLocation, 100), 0)
           if (!this.isGarage) {
             this.service.updateCharacteristic(this.hapChar.CurrentPosition, this.cachePos)
           }
@@ -357,6 +374,10 @@ export default class {
     }
   }
 
+  destroy() {
+    clearInterval(this.intervalPoll)
+  }
+
   markStatus(isOnline) {
     this.isOnline = isOnline
   }