@thinremote/thinr-cli 1.3.1 → 1.3.3

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [1.3.3] - 2026-09-24
+
+### Changed
+
+- MCP tools take the target device as `device_id`. A tool argument named
+  `device` never reaches this server through Claude Desktop's remote-devices
+  bridge, which claims that name for its own call routing and strips it, so
+  every tool needing a device failed with `device is required` however the
+  caller spelled the call, while tools without one worked. Reproduced on one
+  machine with one binary: a direct JSON-RPC call succeeded, the same call
+  through Claude Desktop arrived without the field, and renaming the argument
+  fixed it with nothing else changed. `device` is no longer accepted.
+
+## [1.3.2] - 2026-09-24
+
+### Fixed
+
+- Device properties and device status now honour the `user` argument.
+  `thinr_property_get`, `thinr_property_set` and the playbook `property`
+  actions accepted it but addressed the active profile's own account, the
+  same gap fixed for resources in 1.3.1.
+
+### Changed
+
+- Account-scoped API paths are built in one place (`lib/paths.js`): the
+  `/v{1,2,3}/users/{account}` prefixes and the device prefix, all resolving
+  the account through a single `resolveUser`. Five modules carried private
+  copies of the same three lines and four more interpolated the account by
+  hand. A test fails the build if any module starts doing that again, which
+  is what keeps the account from being silently dropped: omitting it
+  produces a URL that works against your own account and only breaks when
+  acting on behalf of another.
+- Not-found errors from properties and status name the account they looked
+  in, matching the resource helpers.
+
 ## [1.3.1] - 2026-09-24
 
 ### Fixed

package/lib/alarms.js

@@ -1,10 +1,6 @@
 import api from './api.js';
 import { apiError } from './errors.js';
-import { requireConfig } from './config.js';
-
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
+import { v1 } from './paths.js';
 
 // Backend enums (see backend/src/thinger/features/alarms/alarm_rule.hpp).
 // Exported so the dashboard can render labels/colors without re-deriving
@@ -114,7 +110,6 @@ export async function getAlarmInstances({
     sort,
     order,
 } = {}) {
-    const apiUser = resolveUser(user);
     const params = new URLSearchParams();
     params.set('count', String(count));
     params.set('index', String(index));
@@ -124,9 +119,7 @@ export async function getAlarmInstances({
     appendMulti(params, 'state', state);
     appendMulti(params, 'severity', severity);
     try {
-        const res = await api.get(
-            `/v1/users/${apiUser}/alarms/instances?${params.toString()}`,
-        );
+        const res = await api.get(`${v1(user)}/alarms/instances?${params.toString()}`);
         return Array.isArray(res.data) ? res.data : [];
     } catch (e) {
         throw apiError(e);
@@ -137,9 +130,8 @@ export async function getAlarmInstances({
 // server seeds zeros for every known state so consumers can render a
 // stable layout without null-checks.
 export async function getAlarmInstanceStats({ user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.get(`/v1/users/${apiUser}/alarms/instances/stats`);
+        const res = await api.get(`${v1(user)}/alarms/instances/stats`);
         return res.data || {};
     } catch (e) {
         throw apiError(e);
@@ -147,11 +139,8 @@ export async function getAlarmInstanceStats({ user = null } = {}) {
 }
 
 export async function getAlarmInstance(instance, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.get(
-            `/v1/users/${apiUser}/alarms/instances/${encodeURIComponent(instance)}`,
-        );
+        const res = await api.get(`${v1(user)}/alarms/instances/${encodeURIComponent(instance)}`);
         return res.data;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm instance not found: ${instance}` });
@@ -162,10 +151,9 @@ export async function getAlarmInstance(instance, { user = null } = {}) {
 // (see UPDATE_SCHEMA in alarms_instances.cpp): name, description, state,
 // annotation, reactivation. Anything else is rejected.
 export async function updateAlarmInstance(instance, body, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
         const res = await api.put(
-            `/v1/users/${apiUser}/alarms/instances/${encodeURIComponent(instance)}`,
+            `${v1(user)}/alarms/instances/${encodeURIComponent(instance)}`,
             body,
         );
         return res.data;
@@ -175,11 +163,8 @@ export async function updateAlarmInstance(instance, body, { user = null } = {})
 }
 
 export async function deleteAlarmInstance(instance, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        await api.delete(
-            `/v1/users/${apiUser}/alarms/instances/${encodeURIComponent(instance)}`,
-        );
+        await api.delete(`${v1(user)}/alarms/instances/${encodeURIComponent(instance)}`);
         return true;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm instance not found: ${instance}` });
@@ -187,14 +172,11 @@ export async function deleteAlarmInstance(instance, { user = null } = {}) {
 }
 
 export async function getAlarmRules({ user = null, count = 200, index = 0 } = {}) {
-    const apiUser = resolveUser(user);
     const params = new URLSearchParams();
     params.set('count', String(count));
     params.set('index', String(index));
     try {
-        const res = await api.get(
-            `/v1/users/${apiUser}/alarms/rules?${params.toString()}`,
-        );
+        const res = await api.get(`${v1(user)}/alarms/rules?${params.toString()}`);
         return Array.isArray(res.data) ? res.data : [];
     } catch (e) {
         throw apiError(e);
@@ -202,11 +184,8 @@ export async function getAlarmRules({ user = null, count = 200, index = 0 } = {}
 }
 
 export async function getAlarmRule(rule, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.get(
-            `/v1/users/${apiUser}/alarms/rules/${encodeURIComponent(rule)}`,
-        );
+        const res = await api.get(`${v1(user)}/alarms/rules/${encodeURIComponent(rule)}`);
         return res.data;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm rule not found: ${rule}` });
@@ -217,9 +196,8 @@ export async function getAlarmRule(rule, { user = null } = {}) {
 // `name`, `enabled` and an optional `config` object — see CREATE_SCHEMA
 // in alarms_rules.cpp for the full shape.
 export async function createAlarmRule(body, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.post(`/v1/users/${apiUser}/alarms/rules`, body);
+        const res = await api.post(`${v1(user)}/alarms/rules`, body);
         return res.data;
     } catch (e) {
         throw apiError(e);
@@ -227,12 +205,8 @@ export async function createAlarmRule(body, { user = null } = {}) {
 }
 
 export async function updateAlarmRule(rule, body, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.put(
-            `/v1/users/${apiUser}/alarms/rules/${encodeURIComponent(rule)}`,
-            body,
-        );
+        const res = await api.put(`${v1(user)}/alarms/rules/${encodeURIComponent(rule)}`, body);
         return res.data;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm rule not found: ${rule}` });
@@ -240,11 +214,8 @@ export async function updateAlarmRule(rule, body, { user = null } = {}) {
 }
 
 export async function deleteAlarmRule(rule, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        await api.delete(
-            `/v1/users/${apiUser}/alarms/rules/${encodeURIComponent(rule)}`,
-        );
+        await api.delete(`${v1(user)}/alarms/rules/${encodeURIComponent(rule)}`);
         return true;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm rule not found: ${rule}` });

package/lib/auth.js

@@ -7,6 +7,7 @@ import { label, success, warning, error as errorStyle, info } from './format.js'
 
 import api, { setBaseURL } from './api.js';
 import { OAUTH, TIMEOUTS } from './constants.js';
+import { v1 } from './paths.js';
 
 const OAUTH_CLIENT_ID = OAUTH.CLIENT_ID;
 const OAUTH_DEVICE_CODE_TIMEOUT_MS = TIMEOUTS.OAUTH_DEVICE_CODE_MS;
@@ -89,14 +90,14 @@ async function authenticateWithUserPass() {
         // Replace any existing token with a fresh permanent one
         spinner.text = 'Preparing user token...';
         try {
-            await api.delete(`/v1/users/${username}/tokens/ThinRemote`);
+            await api.delete(`${v1(username)}/tokens/ThinRemote`);
         } catch (error) {
             if (error.response && error.response.status !== 404) throw error;
         }
 
         spinner.text = 'Creating new user token...';
         const createTokenResponse = await api.post(
-            `/v1/users/${username}/tokens`,
+            `${v1(username)}/tokens`,
             {
                 enabled: true,
                 allow: { '*': { '*': '*' } },
@@ -234,7 +235,7 @@ export async function deleteToken() {
         const spinner = ora('Deleting user token...').start();
 
         try {
-            await api.delete(`/v1/users/${config.username}/tokens/ThinRemote`);
+            await api.delete(`${v1(config.username)}/tokens/ThinRemote`);
             spinner.succeed('Token deleted successfully');
         } catch (error) {
             if (error.response && error.response.status === 404) {

package/lib/bucket.js

@@ -1,10 +1,6 @@
 import api from './api.js';
 import { apiError } from './errors.js';
-import { requireConfig } from './config.js';
-
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
+import { v2, v3 } from './paths.js';
 
 /**
  * Query an arbitrary time-series bucket declared in a product profile.
@@ -60,7 +56,6 @@ export async function getBucketData({
     group_by,
 } = {}) {
     if (!bucket) throw new Error('bucket is required');
-    const apiUser = resolveUser(user);
     const params = { items, sort };
     if (minutes) {
         params.min_ts = Date.now() - minutes * 60 * 1000;
@@ -75,8 +70,8 @@ export async function getBucketData({
     if (fields) params.fields = fields;
 
     const url = device
-        ? `/v3/users/${apiUser}/devices/${device}/buckets/${bucket}/data`
-        : `/v2/users/${apiUser}/buckets/${bucket}/data`;
+        ? `${v3(user)}/devices/${device}/buckets/${bucket}/data`
+        : `${v2(user)}/buckets/${bucket}/data`;
 
     try {
         const res = await api.get(url, { params });

package/lib/command-stream.js

@@ -2,6 +2,7 @@
 import WebSocket from 'ws';
 import { randomUUID } from 'crypto';
 import { TIMEOUTS } from './constants.js';
+import { device } from './paths.js';
 
 /**
  * One-shot execution of a shell command on a device over the IOTMP
@@ -79,7 +80,7 @@ export class CommandStream {
         const { server, apiUser, deviceId, cmd, timeout } = this.opts;
         const params = new URLSearchParams({ cmd });
         if (timeout && timeout > 0) params.set('timeout', String(timeout));
-        return `wss://${server}/v3/users/${apiUser}/devices/${deviceId}/resources/${this.resource}?${params}`;
+        return `wss://${server}${device(apiUser, deviceId)}/resources/${this.resource}?${params}`;
     }
 
     _openSocket() {

package/lib/config.js

@@ -164,6 +164,15 @@ export function readConfig() {
  * via classifyError. Replaces the same boilerplate that used to live
  * at the top of every helper in lib/.
  */
+/**
+ * The account an API call is addressed to: an explicit one when acting on
+ * behalf of another account, the active profile's own otherwise. Single
+ * source of truth — every path in lib/paths.js goes through it.
+ */
+export function resolveUser(user) {
+    return user || requireConfig().username;
+}
+
 export function requireConfig() {
     const config = readConfig();
     if (!config.token || !config.server || !config.username) {

package/lib/console.js

@@ -3,6 +3,7 @@ import { requireConfig } from './config.js';
 import { ensureFreshToken } from './auth.js';
 import api from './api.js';
 import { warning, error as errorStyle } from './format.js';
+import { device } from './paths.js';
 
 /**
  * Creates a WebSocket connection to a device terminal. Returns a
@@ -14,9 +15,10 @@ import { warning, error as errorStyle } from './format.js';
  * never calls process.exit.
  *
  * @param {string} deviceId - The ID of the device to connect to
+ * @param {string} [user] - Account that owns the device (defaults to the active profile)
  * @returns {Promise<number>} Exit code (0 on clean close)
  */
-export async function connectToDeviceConsole(deviceId) {
+export async function connectToDeviceConsole(deviceId, user) {
     const config = requireConfig();
 
     // WS handshakes lack the refresh-on-401 retry that api.js gives
@@ -25,7 +27,7 @@ export async function connectToDeviceConsole(deviceId) {
     const token = (await ensureFreshToken()) || config.token;
 
     const sessionId = createUUID();
-    const wsUrl = `wss://${config.server}/v3/users/${config.username}/devices/${deviceId}/resources/$terminal/${sessionId}?raw=1`;
+    const wsUrl = `wss://${config.server}${device(user, deviceId)}/resources/$terminal/${sessionId}?raw=1`;
     const ws = new WebSocket(wsUrl, {
         headers: { Authorization: `Bearer ${token}` },
     });
@@ -46,7 +48,7 @@ export async function connectToDeviceConsole(deviceId) {
     return new Promise((resolve, reject) => {
         ws.on('open', () => {
             updateTerminalSize(
-                config,
+                user,
                 deviceId,
                 sessionId,
                 process.stdout.columns,
@@ -55,7 +57,7 @@ export async function connectToDeviceConsole(deviceId) {
 
             process.stdout.on('resize', () => {
                 updateTerminalSize(
-                    config,
+                    user,
                     deviceId,
                     sessionId,
                     process.stdout.columns,
@@ -130,15 +132,15 @@ export async function connectToDeviceConsole(deviceId) {
 
 /**
  * Update terminal size on remote device
- * @param {Object} config - Configuration object
+ * @param {string|undefined} user - Account that owns the device
  * @param {string} deviceId - Device ID
  * @param {string} sessionId - Session ID
  * @param {number} cols - Number of columns
  * @param {number} rows - Number of rows
  */
-async function updateTerminalSize(config, deviceId, sessionId, cols, rows) {
+async function updateTerminalSize(user, deviceId, sessionId, cols, rows) {
     try {
-        const url = `/v3/users/${config.username}/devices/${deviceId}/resources/$terminal/${sessionId}/params`;
+        const url = `${device(user, deviceId)}/resources/$terminal/${sessionId}/params`;
 
         await api.post(url, {
             size: {

package/lib/dashboard/event-stream.js

@@ -3,6 +3,7 @@ import WebSocket from 'ws';
 import { readConfig } from '../config.js';
 import { refreshToken } from '../auth.js';
 import { debugCount, debugLog } from '../debug-log.js';
+import { v2 } from '../paths.js';
 
 // Single shared websocket to /v2/users/{user}/events. Both fleet
 // monitoring and product metrics live on the same endpoint with the
@@ -99,14 +100,18 @@ class EventStream {
         // background; await it here so the next attempt uses the fresh
         // token instead of racing the HTTP interceptor's refresh.
         if (this._refreshing) {
-            try { await this._refreshing; } catch { /* fall through; readConfig may still have a usable token */ }
+            try {
+                await this._refreshing;
+            } catch {
+                /* fall through; readConfig may still have a usable token */
+            }
         }
         if (this.disposed) return;
         const config = readConfig();
         if (!config?.server || !config?.token || !config?.username) return;
-        const url = `wss://${config.server}/v2/users/${config.username}/events?authorization=${config.token}`;
+        const url = `wss://${config.server}${v2(config.username)}/events?authorization=${config.token}`;
         debugLog('ws:events', 'connecting', {
-            endpoint: `wss://${config.server}/v2/users/${config.username}/events`,
+            endpoint: `wss://${config.server}${v2(config.username)}/events`,
             pending_subs: this.subs.size,
         });
         const ws = new WebSocket(url);
@@ -132,7 +137,9 @@ class EventStream {
             // fully resubscribed socket — they can rely on new events landing.
             if (isReconnect) {
                 for (const h of this.reconnectHandlers) {
-                    try { h(); } catch (err) {
+                    try {
+                        h();
+                    } catch (err) {
                         debugLog('ws:events', 'reconnect-handler-error', {
                             error: err?.message || String(err),
                         });

package/lib/device-api.js

@@ -1,9 +1,10 @@
 import api from './api.js';
-import { requireConfig } from './config.js';
+import { requireConfig, resolveUser } from './config.js';
 import { BYTES, TIMEOUTS } from './constants.js';
 import { CommandStream } from './command-stream.js';
 import { ensureFreshToken, refreshToken } from './auth.js';
 import { Readable } from 'node:stream';
+import { device } from './paths.js';
 
 // Directory endpoints on the agent expect a trailing slash so it can
 // distinguish "list this directory" from "read a file with this name".
@@ -16,9 +17,10 @@ const withLeadingSlash = (p) => (p.startsWith('/') ? p : `/${p}`);
 
 export function createDeviceAPI(deviceId, options = {}) {
     const config = requireConfig();
-    const apiUser = options.user || config.username;
-    const resourcePath = `/v3/users/${apiUser}/devices/${deviceId}/resources`;
-    const filesPath = `/v3/users/${apiUser}/devices/${deviceId}/files`;
+    const apiUser = resolveUser(options.user);
+    const base = device(apiUser, deviceId);
+    const resourcePath = `${base}/resources`;
+    const filesPath = `${base}/files`;
 
     async function callResource(resource, payload = null, opts = {}) {
         const url = `${resourcePath}/${resource}`;

package/lib/devices.js

@@ -1,10 +1,8 @@
-import { requireConfig } from './config.js';
 import api from './api.js';
 import { apiError } from './errors.js';
+import { v1 } from './paths.js';
 
 export async function getDevices(filter, user = null) {
-    const config = requireConfig();
-    const apiUser = user || config.username;
     let devices = [];
 
     let queryParametersString = '';
@@ -14,7 +12,7 @@ export async function getDevices(filter, user = null) {
 
     try {
         const count = 50;
-        const url = `/v1/users/${apiUser}/devices?count=${count}&${queryParametersString}`;
+        const url = `${v1(user)}/devices?count=${count}&${queryParametersString}`;
         let index = 0;
         let res_length = 0;
 
@@ -37,10 +35,8 @@ export async function getDevices(filter, user = null) {
 // connection state…). For device-side data — system_info, monitoring —
 // hit the agent resources directly instead.
 export async function getDevice(deviceId, user = null) {
-    const config = requireConfig();
-    const apiUser = user || config.username;
     try {
-        const response = await api.get(`/v1/users/${apiUser}/devices/${deviceId}`);
+        const response = await api.get(`${v1(user)}/devices/${deviceId}`);
         return response.data || {};
     } catch (error) {
         throw apiError(error, { notFound: `Device not found: ${deviceId}` });
@@ -50,10 +46,8 @@ export async function getDevice(deviceId, user = null) {
 // Idempotent: returns true if the device record was removed, false if it
 // was already absent. Other failures (auth, network) propagate as apiError.
 export async function deleteDevice(deviceId, user = null) {
-    const config = requireConfig();
-    const apiUser = user || config.username;
     try {
-        await api.delete(`/v1/users/${apiUser}/devices/${deviceId}`);
+        await api.delete(`${v1(user)}/devices/${deviceId}`);
         return true;
     } catch (error) {
         if (error.response?.status === 404) return false;

package/lib/mcp/tools-alarms.js

@@ -43,9 +43,7 @@ function normalizeSeverityInput(value) {
     for (const v of arr) {
         const parsed = parseAlarmSeverity(v);
         if (parsed === undefined) {
-            throw inputError(
-                `Unknown alarm severity "${v}". Valid: low, medium, high, critical.`,
-            );
+            throw inputError(`Unknown alarm severity "${v}". Valid: low, medium, high, critical.`);
         }
         out.push(parsed);
     }
@@ -195,7 +193,8 @@ async function toolAlarmInstanceUpdate(args) {
         content: [
             {
                 type: 'text',
-                text: `Updated ${args.instance} → state=${stateLabel}` +
+                text:
+                    `Updated ${args.instance} → state=${stateLabel}` +
                     (updated?.annotation ? `, annotation="${updated.annotation}"` : ''),
             },
         ],
@@ -228,9 +227,7 @@ async function toolAlarmRules(args) {
         return `${enabled}  ${id}${name}${desc}`;
     });
     return {
-        content: [
-            { type: 'text', text: `${rules.length} alarm rule(s):\n${lines.join('\n')}` },
-        ],
+        content: [{ type: 'text', text: `${rules.length} alarm rule(s):\n${lines.join('\n')}` }],
         isError: false,
     };
 }

package/lib/mcp/tools-buckets.js

@@ -9,7 +9,7 @@ async function toolBucketRead(args) {
         );
     const data = await getBucketData({
         bucket: args.bucket,
-        device: args.device,
+        device: args.device_id,
         user: args.user,
         items: args.items || 10,
         sort: args.sort || 'desc',
@@ -22,9 +22,7 @@ async function toolBucketRead(args) {
         group_by: args.group_by,
     });
     const text =
-        Array.isArray(data) && data.length === 0
-            ? 'No data'
-            : JSON.stringify(data, null, 2);
+        Array.isArray(data) && data.length === 0 ? 'No data' : JSON.stringify(data, null, 2);
     return {
         content: [{ type: 'text', text }],
         isError: false,
@@ -49,10 +47,9 @@ Custom buckets may not share the \`monitoring\` schema — don't assume a \`devi
                     description:
                         'Bucket ID as declared in the product profile (e.g. "monitoring", or a custom one like "sensors", "events").',
                 },
-                device: {
+                device_id: {
                     type: 'string',
-                    description:
-                        'Device ID. Omit for a one-row-per-device fleet view.',
+                    description: 'Device ID. Omit for a one-row-per-device fleet view.',
                 },
                 items: {
                     type: 'number',
@@ -61,8 +58,7 @@ Custom buckets may not share the \`monitoring\` schema — don't assume a \`devi
                 },
                 minutes: {
                     type: 'number',
-                    description:
-                        'Get data from the last N minutes. Alternative to min_ts/max_ts.',
+                    description: 'Get data from the last N minutes. Alternative to min_ts/max_ts.',
                 },
                 min_ts: { type: 'number', description: 'Minimum timestamp in milliseconds' },
                 max_ts: {

package/lib/mcp/tools-devices.js

@@ -39,7 +39,7 @@ async function toolDevices(args) {
 }
 
 async function toolDeviceInfo(args) {
-    const { api: deviceApi } = getAPI(args.device, args.user);
+    const { api: deviceApi } = getAPI(args.device_id, args.user);
     const parts = [];
 
     // Server-side record first — surfaces the assigned product,
@@ -47,7 +47,7 @@ async function toolDeviceInfo(args) {
     // can't see. Best effort: don't fail the whole tool if the
     // record can't be read.
     try {
-        const record = await getDevice(args.device, args.user);
+        const record = await getDevice(args.device_id, args.user);
         const meta = [];
         if (record.device) meta.push(`device:        ${record.device}`);
         if (record.name) meta.push(`name:          ${record.name}`);
@@ -120,7 +120,7 @@ async function toolDeviceInfo(args) {
 }
 
 async function toolDeviceSetProduct(args) {
-    const device = args.device;
+    const device = args.device_id;
     if (!device) throw inputError('device is required');
     if (args.product === undefined || args.product === null)
         throw inputError('product is required (pass "" to unassign)');
@@ -133,7 +133,7 @@ async function toolDeviceSetProduct(args) {
 }
 
 async function toolDeviceDelete(args) {
-    const device = args.device;
+    const device = args.device_id;
     if (!device) throw inputError('device is required');
     const removed = await deleteDevice(device, args.user);
     return {
@@ -182,10 +182,10 @@ export const tools = [
         inputSchema: {
             type: 'object',
             properties: {
-                device: { type: 'string', description: 'Device ID' },
+                device_id: { type: 'string', description: 'Device ID' },
                 user: { type: 'string', description: 'API user' },
             },
-            required: ['device'],
+            required: ['device_id'],
         },
         handler: toolDeviceInfo,
     },
@@ -196,14 +196,14 @@ export const tools = [
         inputSchema: {
             type: 'object',
             properties: {
-                device: { type: 'string', description: 'Device ID' },
+                device_id: { type: 'string', description: 'Device ID' },
                 product: {
                     type: 'string',
                     description: 'Product ID to assign, or empty string "" to unassign.',
                 },
                 user: { type: 'string', description: 'API user' },
             },
-            required: ['device', 'product'],
+            required: ['device_id', 'product'],
         },
         handler: toolDeviceSetProduct,
     },
@@ -214,10 +214,10 @@ export const tools = [
         inputSchema: {
             type: 'object',
             properties: {
-                device: { type: 'string', description: 'Device ID to delete.' },
+                device_id: { type: 'string', description: 'Device ID to delete.' },
                 user: { type: 'string', description: 'API user' },
             },
-            required: ['device'],
+            required: ['device_id'],
         },
         handler: toolDeviceDelete,
     },