@switchbot/openapi-cli 2.5.0 → 2.6.0

package/dist/commands/events.js

@@ -1,7 +1,9 @@
 import http from 'node:http';
 import crypto from 'node:crypto';
 import { printJson, isJsonMode, handleError, UsageError } from '../utils/output.js';
-import { intArg, stringArg } from '../utils/arg-parsers.js';
+import { intArg, stringArg, durationArg } from '../utils/arg-parsers.js';
+import { parseDurationToMs } from '../utils/flags.js';
+import { parseFilterExpr, matchClause, FilterSyntaxError } from '../utils/filter.js';
 import { SwitchBotMqttClient } from '../mqtt/client.js';
 import { fetchMqttCredential } from '../mqtt/credential.js';
 import { tryLoadConfig } from '../config.js';
@@ -28,45 +30,42 @@ function extractEventId(parsed) {
         return ctx.eventId;
     return null;
 }
-function matchFilter(body, filter) {
-    if (!filter)
+function matchFilter(body, clauses) {
+    if (!clauses || clauses.length === 0)
         return true;
     if (!body || typeof body !== 'object')
         return false;
     const b = body;
     const ctx = (b.context ?? b);
-    if (filter.deviceId && ctx.deviceMac !== filter.deviceId && ctx.deviceId !== filter.deviceId) {
-        return false;
-    }
-    if (filter.type && ctx.deviceType !== filter.type) {
-        return false;
+    for (const c of clauses) {
+        let candidate;
+        if (c.key === 'deviceId') {
+            const mac = ctx.deviceMac;
+            const id = ctx.deviceId;
+            candidate = String(typeof mac === 'string' && mac ? mac : typeof id === 'string' ? id : '');
+        }
+        else {
+            const t = ctx.deviceType;
+            candidate = typeof t === 'string' ? t : '';
+        }
+        if (!matchClause(candidate, c))
+            return false;
     }
     return true;
 }
+const EVENT_FILTER_KEYS = ['deviceId', 'type'];
 function parseFilter(flag) {
     if (!flag)
         return null;
-    const allowed = new Set(['deviceId', 'type']);
-    const out = {};
-    for (const pair of flag.split(',')) {
-        const eq = pair.indexOf('=');
-        if (eq === -1 || eq === 0) {
-            throw new UsageError(`Invalid --filter pair "${pair.trim()}". Expected "key=value". Supported keys: deviceId, type.`);
-        }
-        const k = pair.slice(0, eq).trim();
-        const v = pair.slice(eq + 1).trim();
-        if (!v) {
-            throw new UsageError(`Empty value for --filter key "${k}". Expected "key=value". Supported keys: deviceId, type.`);
-        }
-        if (!allowed.has(k)) {
-            throw new UsageError(`Unknown --filter key "${k}". Supported keys: deviceId, type.`);
+    try {
+        return parseFilterExpr(flag, EVENT_FILTER_KEYS);
+    }
+    catch (e) {
+        if (e instanceof FilterSyntaxError) {
+            throw new UsageError(e.message);
         }
-        if (k === 'deviceId')
-            out.deviceId = v;
-        else if (k === 'type')
-            out.type = v;
+        throw e;
     }
-    return out;
 }
 export function startReceiver(port, pathMatch, filter, onEvent) {
     const server = http.createServer((req, res) => {
@@ -133,8 +132,9 @@ export function registerEventsCommand(program) {
         .description('Run a local HTTP receiver and print incoming webhook events as JSONL')
         .option('--port <n>', `Local port to listen on (default ${DEFAULT_PORT})`, intArg('--port', { min: 1, max: 65535 }), String(DEFAULT_PORT))
         .option('--path <p>', `HTTP path to match (default "${DEFAULT_PATH}"; use "*" for all paths)`, stringArg('--path'), DEFAULT_PATH)
-        .option('--filter <expr>', 'Filter events, e.g. "deviceId=ABC123" or "type=Bot" (comma-separated)', stringArg('--filter'))
+        .option('--filter <expr>', 'Filter events by deviceId / type. Grammar: "key=value" (substring), "key~value" (substring), "key=/regex/" (regex). Comma-separated clauses are AND-ed.', stringArg('--filter'))
         .option('--max <n>', 'Stop after N matching events (default: run until Ctrl-C)', intArg('--max', { min: 1 }))
+        .option('--for <dur>', 'Stop after elapsed time (e.g. "5m", "30s"). Combines with --max: first limit wins.', durationArg('--for'))
         .addHelpText('after', `
 SwitchBot posts events to a single webhook URL configured via:
   $ switchbot webhook setup https://<your-public-host>/<path>
@@ -147,14 +147,20 @@ Output (JSONL, one event per line):
   { "t": "<ISO>", "remote": "<ip:port>", "path": "/",
     "body": <parsed JSON or raw string>, "matched": true }
 
-Filter grammar: comma-separated "key=value" pairs. Supported keys:
-  deviceId=<id>    match by context.deviceMac / context.deviceId
-  type=<type>      match by context.deviceType (e.g. "Bot", "WoMeter")
+Filter grammar: comma-separated clauses (AND-ed). Each clause is one of
+  key=value     — case-insensitive substring
+  key~value     — explicit case-insensitive substring
+  key=/regex/   — case-insensitive regex
+
+Supported keys:
+  deviceId    match by context.deviceMac / context.deviceId
+  type        match by context.deviceType (e.g. "Bot", "WoMeter")
 
 Examples:
   $ switchbot events tail --port 3000
   $ switchbot events tail --port 3000 --filter deviceId=ABC123
-  $ switchbot events tail --filter 'type=WoMeter' --max 5 --json
+  $ switchbot events tail --filter 'type~Meter' --max 5 --json
+  $ switchbot events tail --filter 'type=/Bot|Meter/'
 `)
         .action(async (options) => {
         try {
@@ -166,9 +172,13 @@ Examples:
             if (maxMatched !== null && (!Number.isFinite(maxMatched) || maxMatched < 1)) {
                 throw new UsageError(`Invalid --max "${options.max}". Must be a positive integer.`);
             }
+            const forMs = options.for ? parseDurationToMs(options.for) : null;
             const filter = parseFilter(options.filter);
             let matchedCount = 0;
             const ac = new AbortController();
+            const forTimer = forMs !== null && forMs > 0
+                ? setTimeout(() => ac.abort(), forMs)
+                : null;
             await new Promise((resolve, reject) => {
                 let server = null;
                 try {
@@ -197,6 +207,8 @@ Examples:
                 if (!isJsonMode())
                     console.error(startMsg);
                 const cleanup = () => {
+                    if (forTimer)
+                        clearTimeout(forTimer);
                     server?.close();
                     resolve();
                 };
@@ -214,6 +226,7 @@ Examples:
         .description('Subscribe to SwitchBot MQTT shadow events and stream them as JSONL')
         .option('--topic <pattern>', 'MQTT topic filter (default: SwitchBot shadow topic from credential)', stringArg('--topic'))
         .option('--max <n>', 'Stop after N events (default: run until Ctrl-C)', intArg('--max', { min: 1 }))
+        .option('--for <dur>', 'Stop after elapsed time (e.g. "5m", "30s"). Combines with --max: first limit wins.', durationArg('--for'))
         .option('--sink <type>', 'Output sink: stdout (default), file, webhook, openclaw, telegram, homeassistant (repeatable)', (val, prev) => [...prev, val], [])
         .option('--sink-file <path>', 'File path for file sink', stringArg('--sink-file'))
         .option('--webhook-url <url>', 'Webhook URL for webhook sink', stringArg('--webhook-url'))
@@ -235,6 +248,7 @@ Output (JSONL, one event per line):
   { "t": "<ISO>", "eventId": "<uuid>", "topic": "<mqtt-topic>", "payload": <parsed JSON or raw string> }
 
 Control records (interleaved, no "payload" field — use type-prefix to filter):
+  { "type": "__session_start", "at": "<ISO>", "eventId": "<uuid>", "state": "connecting" }  before credential fetch (JSON mode only)
   { "type": "__connect",     "at": "<ISO>", "eventId": "<uuid>" }   first successful connect
   { "type": "__reconnect",   "at": "<ISO>", "eventId": "<uuid>" }   connect after a disconnect
   { "type": "__disconnect",  "at": "<ISO>", "eventId": "<uuid>" }   reconnecting or failed
@@ -272,6 +286,7 @@ Examples:
             if (maxEvents !== null && (!Number.isInteger(maxEvents) || maxEvents < 1)) {
                 throw new UsageError(`Invalid --max "${options.max}". Must be a positive integer.`);
             }
+            const forMs = options.for ? parseDurationToMs(options.for) : null;
             const loaded = tryLoadConfig();
             if (!loaded) {
                 throw new UsageError('No credentials found. Run \'switchbot config set-token\' or set SWITCHBOT_TOKEN and SWITCHBOT_SECRET.');
@@ -331,10 +346,24 @@ Examples:
             if (!isJsonMode()) {
                 console.error('Fetching MQTT credentials from SwitchBot service…');
             }
+            // Emit a __session_start envelope immediately (before any credential
+            // fetch) so JSON consumers can distinguish "connecting" from "never
+            // connected" even when mqtt-tail exits before the broker connects.
+            if (isJsonMode()) {
+                printJson({
+                    type: '__session_start',
+                    at: new Date().toISOString(),
+                    eventId: crypto.randomUUID(),
+                    state: 'connecting',
+                });
+            }
             const credential = await fetchMqttCredential(loaded.token, loaded.secret);
             const topic = options.topic ?? credential.topics.status;
             let eventCount = 0;
             const ac = new AbortController();
+            const forTimer = forMs !== null && forMs > 0
+                ? setTimeout(() => ac.abort(), forMs)
+                : null;
             const client = new SwitchBotMqttClient(credential, () => fetchMqttCredential(loaded.token, loaded.secret));
             const unsub = client.onMessage((msgTopic, payload) => {
                 let parsed;
@@ -420,6 +449,8 @@ Examples:
             }
             await new Promise((resolve) => {
                 const cleanup = () => {
+                    if (forTimer)
+                        clearTimeout(forTimer);
                     process.removeListener('SIGINT', cleanup);
                     process.removeListener('SIGTERM', cleanup);
                     unsub();

package/dist/commands/expand.js

@@ -1,5 +1,5 @@
 import { intArg, stringArg } from '../utils/arg-parsers.js';
-import { handleError, isJsonMode, printJson, UsageError } from '../utils/output.js';
+import { handleError, isJsonMode, printJson, UsageError, emitJsonError } from '../utils/output.js';
 import { getCachedDevice } from '../devices/cache.js';
 import { executeCommand, isDestructiveCommand, getDestructiveReason } from '../lib/devices.js';
 import { isDryRun } from '../utils/flags.js';
@@ -93,10 +93,12 @@ Examples:
             if (!options.yes && !isDryRun() && isDestructiveCommand(deviceType, command, 'command')) {
                 const reason = getDestructiveReason(deviceType, command, 'command');
                 if (isJsonMode()) {
-                    console.error(JSON.stringify({ error: { code: 2, kind: 'guard',
-                            message: `"${command}" on ${deviceType || 'device'} is destructive and requires --yes.`,
-                            hint: reason ? `Re-run with --yes. Reason: ${reason}` : 'Re-run with --yes to confirm.',
-                        } }));
+                    emitJsonError({
+                        code: 2,
+                        kind: 'guard',
+                        message: `"${command}" on ${deviceType || 'device'} is destructive and requires --yes.`,
+                        hint: reason ? `Re-run with --yes. Reason: ${reason}` : 'Re-run with --yes to confirm.',
+                    });
                 }
                 else {
                     console.error(`Refusing to run destructive command "${command}" without --yes.`);

package/dist/commands/history.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import os from 'node:os';
 import { intArg, stringArg } from '../utils/arg-parsers.js';
-import { printJson, isJsonMode, handleError, UsageError } from '../utils/output.js';
+import { printJson, isJsonMode, handleError, UsageError, emitJsonError } from '../utils/output.js';
 import { readAudit, verifyAudit } from '../utils/audit.js';
 import { executeCommand } from '../lib/devices.js';
 import { queryDeviceHistory, queryDeviceHistoryStats, } from '../devices/history-query.js';
@@ -72,7 +72,7 @@ Examples:
         if (!Number.isInteger(idx) || idx < 1 || idx > entries.length) {
             const msg = `Invalid index ${indexArg}. Log has ${entries.length} entries.`;
             if (isJsonMode()) {
-                console.error(JSON.stringify({ error: { code: 2, kind: 'usage', message: msg } }));
+                emitJsonError({ code: 2, kind: 'usage', message: msg });
             }
             else {
                 console.error(msg);
@@ -83,7 +83,7 @@ Examples:
         if (entry.kind !== 'command') {
             const msg = `Entry ${idx} is not a command (kind=${entry.kind}).`;
             if (isJsonMode()) {
-                console.error(JSON.stringify({ error: { code: 2, kind: 'usage', message: msg } }));
+                emitJsonError({ code: 2, kind: 'usage', message: msg });
             }
             else {
                 console.error(msg);
@@ -258,15 +258,12 @@ Examples:
         .option('--since <duration>', 'Relative window ending now, e.g. "1h", "7d" (mutually exclusive with --from/--to)', stringArg('--since'))
         .option('--from <iso>', 'Range start (ISO-8601)', stringArg('--from'))
         .option('--to <iso>', 'Range end (ISO-8601)', stringArg('--to'))
-        .option('--metric <name>', 'Payload field to aggregate (repeat for multiple)', (v, acc = []) => acc.concat(v), [])
+        .requiredOption('--metric <name>', 'Payload field to aggregate (repeat for multiple; required)', (v, acc = []) => acc.concat(v))
         .option('--agg <csv>', 'Comma-separated aggregation functions (count,min,max,avg,sum,p50,p95)', stringArg('--agg'))
         .option('--bucket <duration>', 'Bucket width, e.g. "15m", "1h", "1d"', stringArg('--bucket'))
         .option('--max-bucket-samples <n>', 'Max samples per bucket for quantiles (1–100000)', intArg('--max-bucket-samples', { min: 1, max: 100_000 }))
         .action(async (deviceId, options) => {
         const metrics = options.metric ?? [];
-        if (metrics.length === 0) {
-            handleError(new UsageError('at least one --metric is required.'));
-        }
         if (options.since && (options.from || options.to)) {
             handleError(new UsageError('--since is mutually exclusive with --from/--to.'));
         }

package/dist/commands/mcp.js

@@ -3,7 +3,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { z } from 'zod';
 import { intArg, stringArg } from '../utils/arg-parsers.js';
-import { handleError, isJsonMode } from '../utils/output.js';
+import { handleError, isJsonMode, buildErrorPayload, emitJsonError } from '../utils/output.js';
 import { VERSION } from '../version.js';
 import { fetchDeviceList, fetchDeviceStatus, executeCommand, describeDevice, validateCommand, isDestructiveCommand, getDestructiveReason, searchCatalog, DeviceNotFoundError, toMcpDescribeShape, toMcpDeviceListShape, toMcpIrDeviceShape, } from '../lib/devices.js';
 import { fetchScenes, executeScene } from '../lib/scenes.js';
@@ -26,11 +26,36 @@ function mcpError(kind, code, message, options) {
         obj.retryable = true;
     if (options?.context)
         obj.context = options.context;
+    if (options?.subKind !== undefined)
+        obj.subKind = options.subKind;
+    if (options?.errorClass !== undefined)
+        obj.errorClass = options.errorClass;
+    if (options?.transient !== undefined)
+        obj.transient = options.transient;
+    if (options?.retryAfterMs !== undefined)
+        obj.retryAfterMs = options.retryAfterMs;
     return {
         isError: true,
         content: [{ type: 'text', text: JSON.stringify({ error: obj }, null, 2) }],
+        structuredContent: { error: obj },
     };
 }
+/**
+ * Convert any thrown error into a structured MCP tool-error response,
+ * preserving all ErrorPayload fields (subKind, transient, hint, etc.).
+ */
+function apiErrorToMcpError(err) {
+    const payload = buildErrorPayload(err);
+    return mcpError(payload.kind, payload.code, payload.message, {
+        hint: payload.hint,
+        retryable: payload.retryable,
+        context: payload.context,
+        subKind: payload.subKind,
+        errorClass: payload.errorClass,
+        transient: payload.transient,
+        retryAfterMs: payload.retryAfterMs,
+    });
+}
 export function createSwitchBotMcpServer(options) {
     const eventManager = options?.eventManager;
     const server = new McpServer({
@@ -248,8 +273,19 @@ API docs: https://github.com/OpenWonderLabs/SwitchBotAPI`,
         },
     }, async ({ deviceId, command, parameter, commandType, confirm, idempotencyKey, dryRun }) => {
         const effectiveType = commandType ?? 'command';
-        // dryRun early-return — no API call, no validation against live device list
+        // dryRun early-return — no API call. We still preflight the deviceId
+        // against the local cache so fabricated IDs don't silently pass
+        // validation (bug #SYS-3). Dry-run is meant to catch bad inputs; a
+        // dry-run that accepts anything is worse than no dry-run at all.
         if (dryRun) {
+            const cached = getCachedDevice(deviceId);
+            if (!cached) {
+                return mcpError('usage', 2, `Device "${deviceId}" not found in local cache.`, {
+                    subKind: 'device-not-found',
+                    hint: "Run 'list_devices' first to warm the cache, then retry with dryRun:true.",
+                    context: { deviceId },
+                });
+            }
             const wouldSend = {
                 deviceId,
                 command,
@@ -319,7 +355,7 @@ API docs: https://github.com/OpenWonderLabs/SwitchBotAPI`,
                     },
                 });
             }
-            throw err;
+            return apiErrorToMcpError(err);
         }
         const isIr = getCachedDevice(deviceId)?.category === 'ir';
         const structured = { ok: true, command, deviceId, result };
@@ -364,7 +400,12 @@ API docs: https://github.com/OpenWonderLabs/SwitchBotAPI`,
                 structuredContent: structured,
             };
         }
-        await executeScene(sceneId);
+        try {
+            await executeScene(sceneId);
+        }
+        catch (err) {
+            return apiErrorToMcpError(err);
+        }
         const structured = { ok: true, sceneId };
         return {
             content: [{ type: 'text', text: JSON.stringify(structured, null, 2) }],
@@ -393,7 +434,7 @@ API docs: https://github.com/OpenWonderLabs/SwitchBotAPI`,
         description: 'Search the built-in device catalog by type name or alias. Returns matching entries with their commands, roles, destructive flags, and status fields. No API call.',
         _meta: { agentSafetyTier: 'read' },
         inputSchema: z.object({
-            query: z.string().describe('Search query (matches type and aliases, case-insensitive). Use empty string to list all.'),
+            query: z.string().describe('Search query (matches type and aliases, case-insensitive). Must be non-empty; use list_catalog_types to enumerate instead.'),
             limit: z.number().int().min(1).max(100).optional().default(20).describe('Max entries returned (default 20)'),
         }).strict(),
         outputSchema: {
@@ -416,6 +457,11 @@ API docs: https://github.com/OpenWonderLabs/SwitchBotAPI`,
             total: z.number().int().describe('Number of entries returned'),
         },
     }, async ({ query, limit }) => {
+        if (query.trim() === '') {
+            return mcpError('usage', 2, 'search_catalog requires a non-empty query.', {
+                hint: "Pass a search term like 'Bot' or 'Hub', or call list_catalog_types to enumerate all types without a query.",
+            });
+        }
         const hits = searchCatalog(query, limit);
         const structured = { results: hits, total: hits.length };
         return {
@@ -466,7 +512,7 @@ API docs: https://github.com/OpenWonderLabs/SwitchBotAPI`,
                     context: { deviceId },
                 });
             }
-            throw err;
+            return apiErrorToMcpError(err);
         }
     });
     // ---- aggregate_device_history --------------------------------------------
@@ -670,7 +716,7 @@ Inspect locally:
                 if (!Number.isFinite(port) || port < 1 || port > 65535) {
                     const msg = `Invalid --port "${options.port}". Must be 1-65535.`;
                     if (isJsonMode()) {
-                        console.error(JSON.stringify({ error: { code: 2, kind: 'usage', message: msg } }));
+                        emitJsonError({ code: 2, kind: 'usage', message: msg });
                     }
                     else {
                         console.error(msg);
@@ -686,7 +732,7 @@ Inspect locally:
                 if (!isLocalhost && !authToken) {
                     const msg = 'Refusing to listen on 0.0.0.0 without --auth-token. Pass --auth-token <token> or bind to localhost (default).';
                     if (isJsonMode()) {
-                        console.error(JSON.stringify({ error: { code: 2, kind: 'usage', message: msg } }));
+                        emitJsonError({ code: 2, kind: 'usage', message: msg });
                     }
                     else {
                         console.error(msg);

package/dist/commands/plan.js

@@ -191,8 +191,13 @@ Workflow:
     });
     plan
         .command('validate')
-        .description('Validate a plan file (or stdin) against the schema')
+        .description('Validate a plan file (or stdin) against the schema (structural only; does not verify device or scene existence)')
         .argument('[file]', 'Path to plan.json, or "-" / omit to read stdin')
+        .addHelpText('after', `
+To check semantic validity (e.g., that deviceIds and sceneIds actually exist),
+use 'plan run --dry-run' which exercises name resolution and device lookup
+against the live API without executing any mutations.
+`)
         .action(async (file) => {
         let raw;
         try {

package/dist/commands/scenes.js

@@ -47,6 +47,15 @@ Example:
 `)
         .action(async (sceneId) => {
         try {
+            const sceneList = await fetchScenes();
+            const found = sceneList.find((s) => s.sceneId === sceneId);
+            if (!found) {
+                throw new StructuredUsageError(`scene not found: ${sceneId}`, {
+                    error: 'scene_not_found',
+                    sceneId,
+                    candidates: sceneList.map((s) => ({ sceneId: s.sceneId, sceneName: s.sceneName })),
+                });
+            }
             await executeScene(sceneId);
             if (isJsonMode()) {
                 printJson({ ok: true, sceneId });

package/dist/commands/watch.js

@@ -61,6 +61,7 @@ export function registerWatchCommand(devices) {
         .option('--name <query>', 'Resolve one device by fuzzy name (combined with any positional IDs)', stringArg('--name'))
         .option('--interval <dur>', `Polling interval: "30s", "1m", "500ms", ... (default 30s, min ${MIN_INTERVAL_MS / 1000}s)`, durationArg('--interval'), '30s')
         .option('--max <n>', 'Stop after N ticks (default: run until Ctrl-C)', intArg('--max', { min: 1 }))
+        .option('--for <dur>', 'Stop after elapsed time (e.g. "5m", "30s"). Combines with --max: first limit wins.', durationArg('--for'))
         .option('--include-unchanged', 'Emit a tick even when no field changed')
         .addHelpText('after', `
 Each poll emits one JSON line per deviceId with the shape:
@@ -99,11 +100,15 @@ Examples:
                 }
                 maxTicks = Math.floor(n);
             }
+            const forMs = options.for ? parseDurationToMs(options.for) : null;
             const fields = getFields() ?? null;
             const ac = new AbortController();
             const onSig = () => ac.abort();
             process.on('SIGINT', onSig);
             process.on('SIGTERM', onSig);
+            const forTimer = forMs !== null && forMs > 0
+                ? setTimeout(() => ac.abort(), forMs)
+                : null;
             try {
                 const prev = new Map();
                 const client = createClient();
@@ -163,6 +168,8 @@ Examples:
                 handleError(err);
             }
             finally {
+                if (forTimer)
+                    clearTimeout(forTimer);
                 process.off('SIGINT', onSig);
                 process.off('SIGTERM', onSig);
             }

package/dist/devices/cache.js

@@ -1,47 +1,78 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+import { createHash } from 'node:crypto';
 import { getConfigPath } from '../utils/flags.js';
+import { getActiveProfile } from '../lib/request-context.js';
+/**
+ * Returns the directory where cache files should be stored.
+ *
+ * - If a profile is active, scopes into a per-profile sub-directory so that
+ *   rotating credentials or switching profiles never serves stale inventory
+ *   from a prior session (Bug #37).
+ * - If no profile is active (unnamed / default), returns `baseDir` unchanged
+ *   so the existing legacy path (~/.switchbot/devices.json) is preserved.
+ *
+ * Only called when `getConfigPath()` returns undefined — the --config-path
+ * override takes full precedence and bypasses this helper entirely.
+ */
+function scopedCacheDir(baseDir) {
+    const profile = getActiveProfile();
+    if (profile === undefined)
+        return baseDir;
+    const hash = createHash('sha256').update(profile).digest('hex').slice(0, 8);
+    const dir = path.join(baseDir, 'cache', hash);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
 /** GC cutoff for status entries: evict anything older than this. */
 const DEFAULT_STATUS_GC_TTL_MS = 24 * 60 * 60 * 1000; // 24 h
 function cacheFilePath() {
     const override = getConfigPath();
     const dir = override
         ? path.dirname(path.resolve(override))
-        : path.join(os.homedir(), '.switchbot');
+        : scopedCacheDir(path.join(os.homedir(), '.switchbot'));
     return path.join(dir, 'devices.json');
 }
-// In-memory hot-cache: undefined = not yet loaded, null = loaded but empty.
-let _listCache = undefined;
-let _statusCache = undefined;
+// In-memory hot-cache keyed by active profile (or '__default__' for no profile).
+// Using Maps instead of module-level singletons ensures that mcp serve, which
+// rotates profiles per request via withRequestContext, never leaks inventory
+// across profiles within the same process (Bug #37).
+const _listCacheByProfile = new Map();
+const _statusCacheByProfile = new Map();
+function cacheKey() {
+    return getActiveProfile() ?? '__default__';
+}
 /** Force the next loadCache() call to re-read from disk. Used in tests. */
 export function resetListCache() {
-    _listCache = undefined;
+    _listCacheByProfile.clear();
 }
 /** Force the next loadStatusCache() call to re-read from disk. Used in tests. */
 export function resetStatusCache() {
-    _statusCache = undefined;
+    _statusCacheByProfile.clear();
 }
 export function loadCache() {
-    if (_listCache !== undefined)
-        return _listCache;
+    const key = cacheKey();
+    if (_listCacheByProfile.has(key))
+        return _listCacheByProfile.get(key);
     const file = cacheFilePath();
     if (!fs.existsSync(file)) {
-        _listCache = null;
+        _listCacheByProfile.set(key, null);
         return null;
     }
     try {
         const raw = fs.readFileSync(file, 'utf-8');
         const cache = JSON.parse(raw);
         if (!cache || typeof cache.devices !== 'object' || cache.devices === null) {
-            _listCache = null;
+            _listCacheByProfile.set(key, null);
             return null;
         }
-        _listCache = cache;
+        _listCacheByProfile.set(key, cache);
         return cache;
     }
     catch {
-        _listCache = null;
+        _listCacheByProfile.set(key, null);
         return null;
     }
 }
@@ -109,7 +140,7 @@ export function updateCacheFromDeviceList(body) {
         if (!fs.existsSync(dir))
             fs.mkdirSync(dir, { recursive: true });
         fs.writeFileSync(file, JSON.stringify(cache, null, 2), { mode: 0o600 });
-        _listCache = cache;
+        _listCacheByProfile.set(cacheKey(), cache);
     }
     catch {
         // Cache write failures must not break the command that triggered them.
@@ -119,7 +150,7 @@ export function clearCache() {
     const file = cacheFilePath();
     if (fs.existsSync(file))
         fs.unlinkSync(file);
-    _listCache = null;
+    _listCacheByProfile.set(cacheKey(), null);
 }
 // ---- Device list freshness -------------------------------------------------
 /** Age of the on-disk list cache in ms, or null if there is no cache. */
@@ -143,34 +174,38 @@ function statusCacheFilePath() {
     const override = getConfigPath();
     const dir = override
         ? path.dirname(path.resolve(override))
-        : path.join(os.homedir(), '.switchbot');
+        : scopedCacheDir(path.join(os.homedir(), '.switchbot'));
     return path.join(dir, 'status.json');
 }
 export function loadStatusCache() {
-    if (_statusCache !== undefined)
-        return _statusCache;
+    const key = cacheKey();
+    if (_statusCacheByProfile.has(key))
+        return _statusCacheByProfile.get(key);
     const file = statusCacheFilePath();
     if (!fs.existsSync(file)) {
-        _statusCache = { entries: {} };
-        return _statusCache;
+        const empty = { entries: {} };
+        _statusCacheByProfile.set(key, empty);
+        return empty;
     }
     try {
         const raw = fs.readFileSync(file, 'utf-8');
         const parsed = JSON.parse(raw);
         if (!parsed || typeof parsed.entries !== 'object' || parsed.entries === null) {
-            _statusCache = { entries: {} };
-            return _statusCache;
+            const empty = { entries: {} };
+            _statusCacheByProfile.set(key, empty);
+            return empty;
         }
-        _statusCache = parsed;
+        _statusCacheByProfile.set(key, parsed);
         return parsed;
     }
     catch {
-        _statusCache = { entries: {} };
-        return _statusCache;
+        const empty = { entries: {} };
+        _statusCacheByProfile.set(key, empty);
+        return empty;
     }
 }
 function saveStatusCache(cache) {
-    _statusCache = cache;
+    _statusCacheByProfile.set(cacheKey(), cache);
     try {
         const file = statusCacheFilePath();
         const dir = path.dirname(file);
@@ -220,7 +255,7 @@ export function clearStatusCache() {
     const file = statusCacheFilePath();
     if (fs.existsSync(file))
         fs.unlinkSync(file);
-    _statusCache = { entries: {} };
+    _statusCacheByProfile.set(cacheKey(), { entries: {} });
 }
 export function describeCache(now = Date.now()) {
     const listFile = cacheFilePath();