homebridge-bluos 2.0.1 → 2.0.3

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [2.0.3](https://github.com/tbaur/homebridge-bluos/compare/v2.0.2...v2.0.3) (2026-09-13)
+
+
+### Bug Fixes
+
+* skip public and loopback addresses in mDNS discovery ([#46](https://github.com/tbaur/homebridge-bluos/issues/46)) ([9010b86](https://github.com/tbaur/homebridge-bluos/commit/9010b861a95f8d11e450c7c3d877f1f243c2f01d))
+
+## [2.0.2](https://github.com/tbaur/homebridge-bluos/compare/v2.0.1...v2.0.2) (2026-09-10)
+
+
+### Bug Fixes
+
+* stop one reboot press from becoming several reboot waves ([#44](https://github.com/tbaur/homebridge-bluos/issues/44)) ([13661ec](https://github.com/tbaur/homebridge-bluos/commit/13661ecbc837366baebfd1bfee6489609dab986c))
+
 ## [2.0.1](https://github.com/tbaur/homebridge-bluos/compare/v2.0.0...v2.0.1) (2026-09-05)
 
 

package/README.md

@@ -56,7 +56,7 @@ Nothing needs enabling on the player, because the BluOS LAN API is always on. A
 
 ### 3. Configure
 
-**Homebridge UI** (recommended): open the plugin settings and press **Discover Players**. Every zone that answers is listed. Tick the players and accessories you want, then press the Homebridge Save button.
+**Homebridge UI** (recommended): open the plugin settings and press **Discover Players**. Every zone that answers on a local IPv4 address is listed. Public and loopback advertisements are skipped. Tick the players and accessories you want, then press the Homebridge Save button.
 
 Or in `config.json`:
 

package/SECURITY.md

@@ -16,8 +16,8 @@ Do not open a public issue. Use GitHub's [private vulnerability reporting](https
 - **Input validation:** Config is checked at startup. A missing or non-list `devices` value disables the platform without unregistering accessories. A bad player or preset is skipped. Hosts, ports and timeouts are rejected or clamped.
 - **Log safety:** Values written to logs have control characters stripped and are length-limited.
 - **Bounded I/O:** Connect and total timeouts on every request, responses capped at 128 KiB, and XML parsed with size, depth and element caps.
-- **Discovery:** mDNS errors are caught so they cannot take Homebridge down. Browse results are capped.
-- **Settings probe:** Accepts only a private or local address and a documented BluOS port.
+- **Discovery:** mDNS errors are caught so they cannot take Homebridge down. Browse results are capped. Advertised addresses are verified only when they are local (RFC 1918, CGNAT/Tailscale, link-local). Public IPv4 and loopback are skipped, so an advertisement cannot make Homebridge open `/SyncStatus` on itself or on the public internet. Players already in configuration are unchanged.
+- **Settings probe:** Accepts only a private or local address and a documented BluOS port. Loopback is allowed here because an administrator asked for that probe.
 - **Dependencies:** CI runs `npm audit` on the runtime tree and OSV-Scanner on the full tree.
 
 ## Best Practices for Users

package/dist/api/discovery.d.ts

@@ -112,10 +112,12 @@ export declare class BluOSDiscovery {
     /**
      * Turn service instances into addressable endpoints.
      *
-     * A zone is only usable once its SRV record (for the port) and an IPv4 address
-     * are both known. The address comes from an A record when one was offered, and
-     * otherwise from the responder's own source address, which for a player
-     * advertising its own service is the same machine.
+     * A zone is only usable once its SRV record (for the port) and a local IPv4
+     * address are both known (RFC 1918, CGNAT / Tailscale, link-local). Public
+     * IPv4 and loopback are ignored, so an advertisement cannot point verify at
+     * Homebridge or at an off-network host. The address comes from an A record
+     * when one was offered, and otherwise from the responder's own source
+     * address, which for a player advertising its own service is the same machine.
      */
     private toEndpoints;
     /** Collect mDNS records for the configured window. */

package/dist/api/discovery.js

@@ -35,6 +35,7 @@ const node_os_1 = __importDefault(require("node:os"));
 const settings_1 = require("../settings");
 const errors_1 = require("../utils/errors");
 const timing_1 = require("../utils/timing");
+const validators_1 = require("../utils/validators");
 const identity_1 = require("./identity");
 /** Re-query schedule, in milliseconds, to survive dropped multicast packets. */
 const QUERY_SCHEDULE_MS = [0, 400, 1_200];
@@ -202,10 +203,12 @@ class BluOSDiscovery {
     /**
      * Turn service instances into addressable endpoints.
      *
-     * A zone is only usable once its SRV record (for the port) and an IPv4 address
-     * are both known. The address comes from an A record when one was offered, and
-     * otherwise from the responder's own source address, which for a player
-     * advertising its own service is the same machine.
+     * A zone is only usable once its SRV record (for the port) and a local IPv4
+     * address are both known (RFC 1918, CGNAT / Tailscale, link-local). Public
+     * IPv4 and loopback are ignored, so an advertisement cannot point verify at
+     * Homebridge or at an off-network host. The address comes from an A record
+     * when one was offered, and otherwise from the responder's own source
+     * address, which for a player advertising its own service is the same machine.
      */
     toEndpoints(candidates) {
         const seen = new Set();
@@ -217,6 +220,13 @@ class BluOSDiscovery {
                 this.log.debug(`discovery: no IPv4 address for ${candidate.instance} (target ${candidate.target})`);
                 continue;
             }
+            if (!(0, validators_1.isDiscoveryHost)(host)) {
+                const reason = (0, validators_1.isLoopbackIpv4)(host)
+                    ? 'loopback is not accepted from mDNS'
+                    : 'not a local address';
+                this.log.debug(`discovery: skipping ${host} (${reason})`);
+                continue;
+            }
             const key = (0, identity_1.formatEndpoint)(host, candidate.port);
             if (seen.has(key)) {
                 continue;

package/dist/devices/host.d.ts

@@ -82,4 +82,13 @@ export interface AccessoryHost {
      * poll the source of truth for HomeKit instead of the pre-reboot reading.
      */
     expectReboot(host: string): void;
+    /**
+     * True while this address is still expected to be down from a reboot we sent.
+     *
+     * Asked before a reboot goes out, not only when one fails. A box part-way
+     * through a restart has no web server on port 80, so a second request cannot
+     * reach it and its failure says nothing about whether the first one worked.
+     * Sending anyway is what turns one press into a page of `could not reboot`.
+     */
+    isRebooting(host: string): boolean;
 }

package/dist/devices/reboot-accessory.d.ts

@@ -8,13 +8,20 @@
  *
  * Two departures from how every other accessory here behaves, both deliberate.
  *
- * It is momentary, never stateful. `On` always reads false, turning it on fires
- * the reboot and the tile springs back, and turning it off does nothing. There is
- * no such thing as an un-reboot, so an off has nothing to mean. This is also what
- * makes the switch safe to leave in a house full of scenes: "turn everything off"
- * and a scene that sets switches off both write false, and false does nothing
- * here. A stateful reboot switch would restart the stereo every time someone said
- * goodnight.
+ * It is momentary, never stateful. Turning it on fires the reboot, the tile
+ * springs back once the request has been sent, and turning it off does nothing.
+ * There is no such thing as an un-reboot, so an off has nothing to mean. This is
+ * also what makes the switch safe to leave in a house full of scenes: "turn
+ * everything off" and a scene that sets switches off both write false, and false
+ * does nothing here. A stateful reboot switch would restart the stereo every time
+ * someone said goodnight.
+ *
+ * `On` reads true only while a press this switch started is still being sent.
+ * That is a fact about this switch rather than a reading off the player, so it
+ * does not break the rule against inventing state. It matters because a HomeKit
+ * write must answer inside the write budget while the reboot itself can take
+ * longer: a tile that springs back before anything is logged looks like a press
+ * that did nothing, and gets pressed again.
  *
  * It stays pressable when the player is unreachable, which breaks the plugin's
  * "unknown is No Response" rule. That rule exists so automations cannot fire
@@ -36,9 +43,19 @@ import { BaseAccessory, type AccessoryInit } from './base-accessory';
 export declare class RebootAccessory extends BaseAccessory {
     private readonly service;
     private resetTimer;
+    /** True from a press until the tile springs back. @see writeOn */
+    private rebooting;
     constructor(init: AccessoryInit);
     private writeOn;
-    /** Spring the tile back to off, the way a real button returns. */
+    /** Send the reboot, unless this box is already on its way down. */
+    private sendReboot;
+    /**
+     * Spring the tile back to off, the way a real button returns.
+     *
+     * Clearing {@link rebooting} here rather than when the work finishes keeps the
+     * reported value and the pushed value in step: HomeKit is told off at the same
+     * moment a read would start answering off.
+     */
     private scheduleReset;
     /**
      * Nothing to apply.

package/dist/devices/reboot-accessory.js

@@ -9,13 +9,20 @@
  *
  * Two departures from how every other accessory here behaves, both deliberate.
  *
- * It is momentary, never stateful. `On` always reads false, turning it on fires
- * the reboot and the tile springs back, and turning it off does nothing. There is
- * no such thing as an un-reboot, so an off has nothing to mean. This is also what
- * makes the switch safe to leave in a house full of scenes: "turn everything off"
- * and a scene that sets switches off both write false, and false does nothing
- * here. A stateful reboot switch would restart the stereo every time someone said
- * goodnight.
+ * It is momentary, never stateful. Turning it on fires the reboot, the tile
+ * springs back once the request has been sent, and turning it off does nothing.
+ * There is no such thing as an un-reboot, so an off has nothing to mean. This is
+ * also what makes the switch safe to leave in a house full of scenes: "turn
+ * everything off" and a scene that sets switches off both write false, and false
+ * does nothing here. A stateful reboot switch would restart the stereo every time
+ * someone said goodnight.
+ *
+ * `On` reads true only while a press this switch started is still being sent.
+ * That is a fact about this switch rather than a reading off the player, so it
+ * does not break the rule against inventing state. It matters because a HomeKit
+ * write must answer inside the write budget while the reboot itself can take
+ * longer: a tile that springs back before anything is logged looks like a press
+ * that did nothing, and gets pressed again.
  *
  * It stays pressable when the player is unreachable, which breaks the plugin's
  * "unknown is No Response" rule. That rule exists so automations cannot fire
@@ -40,6 +47,8 @@ const base_accessory_1 = require("./base-accessory");
 class RebootAccessory extends base_accessory_1.BaseAccessory {
     service;
     resetTimer;
+    /** True from a press until the tile springs back. @see writeOn */
+    rebooting = false;
     constructor(init) {
         super(init);
         const { Characteristic: Char, Service: HapService } = this.host.hap;
@@ -47,7 +56,7 @@ class RebootAccessory extends base_accessory_1.BaseAccessory {
         this.service.setCharacteristic(Char.Name, this.displayName);
         this.service
             .getCharacteristic(Char.On)
-            .onGet(() => false)
+            .onGet(() => this.rebooting)
             .onSet(async (value) => this.writeOn(value));
         const shared = this.host.playersSharingAddress(this.deviceId);
         if (shared.length > 0) {
@@ -59,35 +68,62 @@ class RebootAccessory extends base_accessory_1.BaseAccessory {
         if (value !== true) {
             return;
         }
-        try {
-            await this.completeWithinBudget('reboot', async () => {
-                const endpoint = this.host.endpointFor(this.deviceId);
-                if (endpoint === undefined) {
-                    throw new Error('player is no longer configured');
-                }
-                // The host only: reboot lives on port 80, not on the zone's control port.
-                const result = await this.host.client.reboot(endpoint.host);
-                // The box is going down. Tell the platform so the other accessories
-                // stay quiet, and so the next poll is what HomeKit shows.
-                this.host.expectReboot(endpoint.host);
-                // Never a group operation. Grouping decides where a *volume* change
-                // reaches; a reboot restarts a box and has no notion of followers.
-                this.logAction(result.acknowledged ? 'REBOOT' : 'REBOOT (sent; the player stopped answering, as expected)', { tellSlaves: false });
-            });
+        if (this.rebooting) {
+            // A press that arrives while one is still being sent is a duplicate, not a
+            // second instruction: the box can only be restarted once.
+            this.host.log.info(`${(0, utils_1.forLog)(this.displayName)}: a restart is already under way; ignoring this press`);
+            return;
+        }
+        this.rebooting = true;
+        await this.completeWithinBudget('reboot', async () => {
+            try {
+                await this.sendReboot();
+            }
+            finally {
+                // Inside the work rather than around the budget, so the tile springs back
+                // when the reboot is actually done instead of when HomeKit stopped
+                // waiting for it. A failed reboot resets too: a tile left on would
+                // suggest something is still happening.
+                this.scheduleReset();
+            }
+        });
+    }
+    /** Send the reboot, unless this box is already on its way down. */
+    async sendReboot() {
+        const endpoint = this.host.endpointFor(this.deviceId);
+        if (endpoint === undefined) {
+            throw new Error('player is no longer configured');
         }
-        finally {
-            // In `finally` because a failed reboot must not leave the tile stuck on.
-            // The write already surfaced its own error to HomeKit and to the log.
-            this.scheduleReset();
+        if (this.host.isRebooting(endpoint.host)) {
+            // Not an error, and deliberately not a second request. Port 80 is down
+            // while the box boots, so this would fail and be reported as a reboot that
+            // did not work, when in fact one is in progress.
+            this.host.log.info(`${(0, utils_1.forLog)(this.displayName)}: ${endpoint.host} is already restarting; nothing sent`);
+            return;
         }
+        // The host only: reboot lives on port 80, not on the zone's control port.
+        const result = await this.host.client.reboot(endpoint.host);
+        // The box is going down. Tell the platform so the other accessories
+        // stay quiet, and so the next poll is what HomeKit shows.
+        this.host.expectReboot(endpoint.host);
+        // Never a group operation. Grouping decides where a *volume* change
+        // reaches; a reboot restarts a box and has no notion of followers.
+        this.logAction(result.acknowledged ? 'REBOOT' : 'REBOOT (sent; the player stopped answering, as expected)', { tellSlaves: false });
     }
-    /** Spring the tile back to off, the way a real button returns. */
+    /**
+     * Spring the tile back to off, the way a real button returns.
+     *
+     * Clearing {@link rebooting} here rather than when the work finishes keeps the
+     * reported value and the pushed value in step: HomeKit is told off at the same
+     * moment a read would start answering off.
+     */
     scheduleReset() {
         if (this.resetTimer !== undefined) {
             clearTimeout(this.resetTimer);
         }
         this.resetTimer = setTimeout(() => {
             this.resetTimer = undefined;
+            this.rebooting = false;
             this.service.updateCharacteristic(this.host.hap.Characteristic.On, false);
         }, settings_1.MOMENTARY_RESET_MS);
         // Nothing is waiting on this, so it must not hold Homebridge open at shutdown.

package/dist/devices/reboot-all-accessory.d.ts

@@ -26,6 +26,14 @@
  * See RebootAccessory for why this is momentary and why it stays pressable when
  * players are unreachable; the same reasoning applies, more so here, since a
  * fleet-wide restart is most useful when several players have stopped answering.
+ *
+ * One press is one wave, and a wave outlasts the HomeKit write budget by a good
+ * margin: the sweep alone runs for the discovery window before a single request
+ * goes out. So the tile is held on for as long as the wave runs, and a press that
+ * arrives while one is running is ignored rather than queued. Without both, a
+ * press looks like it did nothing, gets repeated, and each repeat sweeps a fleet
+ * that is now half way through restarting — which finds fewer boxes every time
+ * and reports the ones it does find as failures.
  */
 import type { PlayerObservation, RefreshReason } from '../types';
 import { BaseAccessory, type AccessoryInit } from './base-accessory';
@@ -33,8 +41,12 @@ import { BaseAccessory, type AccessoryInit } from './base-accessory';
 export declare class RebootAllAccessory extends BaseAccessory {
     private readonly service;
     private resetTimer;
+    /** True from a press until the tile springs back. @see writeOn */
+    private rebooting;
     constructor(init: AccessoryInit);
     private writeOn;
+    /** Sweep for targets, then restart every one that is not already going down. */
+    private runWave;
     /** Count at info, name every box at debug, before any request goes out. */
     private announce;
     /**
@@ -45,9 +57,30 @@ export declare class RebootAllAccessory extends BaseAccessory {
      * single dead address delay every box behind it by a full timeout.
      * `allSettled` because one failure must not abandon the rest — a fleet-wide
      * restart that stopped at the first missing player would be worse than useless.
+     *
+     * Addresses already inside their reboot grace window are left alone. Nothing
+     * serves port 80 while a box boots, so a request there could only fail, and
+     * reporting that as `could not reboot` states the opposite of what is true.
      */
     private rebootAll;
-    /** Spring the tile back to off, the way a real button returns. */
+    /** Split targets into those still to restart and those already restarting. */
+    private partition;
+    /**
+     * Log one failed reboot, and say whether it counts against the total.
+     *
+     * A box that entered its grace window after the check above — because the
+     * per-player switch was pressed, or an earlier wave reached it — is going down
+     * already. A refused or unanswered port 80 is what that looks like, so it is a
+     * debug line rather than a warning about a reboot that did not work.
+     */
+    private isExcusedFailure;
+    /**
+     * Spring the tile back to off, the way a real button returns.
+     *
+     * Clearing {@link rebooting} here rather than when the wave finishes keeps the
+     * reported value and the pushed value in step: HomeKit is told off at the same
+     * moment a read would start answering off.
+     */
     private scheduleReset;
     /**
      * Never marked unreachable.

package/dist/devices/reboot-all-accessory.js

@@ -27,6 +27,14 @@
  * See RebootAccessory for why this is momentary and why it stays pressable when
  * players are unreachable; the same reasoning applies, more so here, since a
  * fleet-wide restart is most useful when several players have stopped answering.
+ *
+ * One press is one wave, and a wave outlasts the HomeKit write budget by a good
+ * margin: the sweep alone runs for the discovery window before a single request
+ * goes out. So the tile is held on for as long as the wave runs, and a press that
+ * arrives while one is running is ignored rather than queued. Without both, a
+ * press looks like it did nothing, gets repeated, and each repeat sweeps a fleet
+ * that is now half way through restarting — which finds fewer boxes every time
+ * and reports the ones it does find as failures.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RebootAllAccessory = void 0;
@@ -37,6 +45,8 @@ const base_accessory_1 = require("./base-accessory");
 class RebootAllAccessory extends base_accessory_1.BaseAccessory {
     service;
     resetTimer;
+    /** True from a press until the tile springs back. @see writeOn */
+    rebooting = false;
     constructor(init) {
         super(init);
         const { Characteristic: Char, Service: HapService } = this.host.hap;
@@ -44,28 +54,40 @@ class RebootAllAccessory extends base_accessory_1.BaseAccessory {
         this.service.setCharacteristic(Char.Name, this.displayName);
         this.service
             .getCharacteristic(Char.On)
-            .onGet(() => false)
+            .onGet(() => this.rebooting)
             .onSet(async (value) => this.writeOn(value));
     }
     async writeOn(value) {
         if (value !== true) {
             return;
         }
-        try {
-            await this.completeWithinBudget('reboot all', async () => {
-                const targets = await this.host.rebootTargets();
-                if (targets.length === 0) {
-                    this.host.log.warn(`${(0, utils_1.forLog)(this.displayName)}: found nothing to reboot. `
-                        + 'Multicast may be filtered on this network and no players are configured');
-                    return;
-                }
-                this.announce(targets);
-                await this.rebootAll(targets);
-            });
+        if (this.rebooting) {
+            this.host.log.info(`${(0, utils_1.forLog)(this.displayName)}: a restart is already under way; ignoring this press`);
+            return;
         }
-        finally {
-            this.scheduleReset();
+        this.rebooting = true;
+        await this.completeWithinBudget('reboot all', async () => {
+            try {
+                await this.runWave();
+            }
+            finally {
+                // Inside the work rather than around the budget. The budget expires long
+                // before the sweep finishes, so resetting there springs the tile back
+                // before the first line of the log is written.
+                this.scheduleReset();
+            }
+        });
+    }
+    /** Sweep for targets, then restart every one that is not already going down. */
+    async runWave() {
+        const targets = await this.host.rebootTargets();
+        if (targets.length === 0) {
+            this.host.log.warn(`${(0, utils_1.forLog)(this.displayName)}: found nothing to reboot. `
+                + 'Multicast may be filtered on this network and no players are configured');
+            return;
         }
+        this.announce(targets);
+        await this.rebootAll(targets);
     }
     /** Count at info, name every box at debug, before any request goes out. */
     announce(targets) {
@@ -85,12 +107,25 @@ class RebootAllAccessory extends base_accessory_1.BaseAccessory {
      * single dead address delay every box behind it by a full timeout.
      * `allSettled` because one failure must not abandon the rest — a fleet-wide
      * restart that stopped at the first missing player would be worse than useless.
+     *
+     * Addresses already inside their reboot grace window are left alone. Nothing
+     * serves port 80 while a box boots, so a request there could only fail, and
+     * reporting that as `could not reboot` states the opposite of what is true.
      */
     async rebootAll(targets) {
-        const outcomes = await Promise.allSettled(targets.map(async (target) => this.host.client.reboot(target.host)));
+        const { pending, restarting } = this.partition(targets);
+        if (restarting.length > 0) {
+            this.host.log.info(`${(0, utils_1.forLog)(this.displayName)}: skipping ${restarting.length} device(s) already `
+                + `restarting: ${restarting.map((target) => target.host).join(', ')}`);
+        }
+        if (pending.length === 0) {
+            this.host.log.info(`${(0, utils_1.forLog)(this.displayName)}: every device found is already restarting; nothing sent`);
+            return;
+        }
+        const outcomes = await Promise.allSettled(pending.map(async (target) => this.host.client.reboot(target.host)));
         let failed = 0;
         outcomes.forEach((outcome, index) => {
-            const target = targets[index];
+            const target = pending[index];
             if (target === undefined) {
                 return;
             }
@@ -98,20 +133,60 @@ class RebootAllAccessory extends base_accessory_1.BaseAccessory {
                 this.host.expectReboot(target.host);
                 return;
             }
-            failed += 1;
-            this.host.log.warn(`${(0, utils_1.forLog)(this.displayName)}: could not reboot ${target.host} `
-                + `(${target.names.map(utils_1.forLog).join(', ')}): ${(0, utils_1.describeError)(outcome.reason)}`);
+            if (!this.isExcusedFailure(target, outcome.reason)) {
+                failed += 1;
+            }
         });
-        const rebooted = targets.length - failed;
-        this.host.log.info(`${(0, utils_1.forLog)(this.displayName)}: ${rebooted} of ${targets.length} device(s) rebooted`);
+        const rebooted = pending.length - failed;
+        this.host.log.info(`${(0, utils_1.forLog)(this.displayName)}: ${rebooted} of ${pending.length} device(s) rebooted`);
     }
-    /** Spring the tile back to off, the way a real button returns. */
+    /** Split targets into those still to restart and those already restarting. */
+    partition(targets) {
+        const pending = [];
+        const restarting = [];
+        for (const target of targets) {
+            if (this.host.isRebooting(target.host)) {
+                restarting.push(target);
+            }
+            else {
+                pending.push(target);
+            }
+        }
+        return { pending, restarting };
+    }
+    /**
+     * Log one failed reboot, and say whether it counts against the total.
+     *
+     * A box that entered its grace window after the check above — because the
+     * per-player switch was pressed, or an earlier wave reached it — is going down
+     * already. A refused or unanswered port 80 is what that looks like, so it is a
+     * debug line rather than a warning about a reboot that did not work.
+     */
+    isExcusedFailure(target, reason) {
+        const named = `${target.host} (${target.names.map(utils_1.forLog).join(', ')})`;
+        const detail = (0, utils_1.describeError)(reason);
+        if (this.host.isRebooting(target.host)) {
+            this.host.log.debug(`${(0, utils_1.forLog)(this.displayName)}: ${named} is already restarting, so it did not `
+                + `answer: ${detail}`);
+            return true;
+        }
+        this.host.log.warn(`${(0, utils_1.forLog)(this.displayName)}: could not reboot ${named}: ${detail}`);
+        return false;
+    }
+    /**
+     * Spring the tile back to off, the way a real button returns.
+     *
+     * Clearing {@link rebooting} here rather than when the wave finishes keeps the
+     * reported value and the pushed value in step: HomeKit is told off at the same
+     * moment a read would start answering off.
+     */
     scheduleReset() {
         if (this.resetTimer !== undefined) {
             clearTimeout(this.resetTimer);
         }
         this.resetTimer = setTimeout(() => {
             this.resetTimer = undefined;
+            this.rebooting = false;
             this.service.updateCharacteristic(this.host.hap.Characteristic.On, false);
         }, settings_1.MOMENTARY_RESET_MS);
         this.resetTimer.unref?.();

package/dist/platform.d.ts

@@ -108,6 +108,13 @@ export declare class BluOSPlatform implements DynamicPlatformPlugin, AccessoryHo
      * the grace window do not mark accessories unreachable.
      */
     expectReboot(host: string): void;
+    /**
+     * True while a reboot of this address is still expected to be in progress.
+     *
+     * The same window the pollers use to keep quiet, read by the reboot switches so
+     * they decline to send a second request to a box already on its way down.
+     */
+    isRebooting(host: string): boolean;
     /** Current address of a player, preferring the poller when it has one. */
     private hostOf;
     private start;

package/dist/platform.js

@@ -215,6 +215,15 @@ class BluOSPlatform {
             }
         }
     }
+    /**
+     * True while a reboot of this address is still expected to be in progress.
+     *
+     * The same window the pollers use to keep quiet, read by the reboot switches so
+     * they decline to send a second request to a box already on its way down.
+     */
+    isRebooting(host) {
+        return this.rebootGrace.isExpected(host);
+    }
     /** Current address of a player, preferring the poller when it has one. */
     hostOf(deviceId) {
         return this.endpointFor(deviceId)?.host

package/dist/settings.d.ts

@@ -141,12 +141,13 @@ export declare const DEFAULT_RESTORE_VOLUME = 20;
  */
 export declare const SLIDER_COALESCE_MS = 150;
 /**
- * How long a momentary switch stays on before it springs back.
+ * How long a momentary switch stays on after its work has finished.
  *
- * A reboot switch has no state to report: the player is either restarting or it
- * is not, and neither is "on". Long enough that the Home app renders the press
- * so the user sees the tap registered, short enough that the tile is not left
- * looking like a thing that is still happening.
+ * A floor on how long a press is visible, not the whole duration: the tile is
+ * held on while the reboot is actually being sent, which outlasts
+ * {@link HOMEKIT_WRITE_BUDGET_MS} and can outlast this. It matters for a press
+ * that finishes almost at once, such as a sweep that found nothing, where
+ * springing back immediately would look like a tap that never registered.
  */
 export declare const MOMENTARY_RESET_MS = 1000;
 /** Lowest BluOS volume level. */

package/dist/settings.js

@@ -147,12 +147,13 @@ exports.DEFAULT_RESTORE_VOLUME = 20;
  */
 exports.SLIDER_COALESCE_MS = 150;
 /**
- * How long a momentary switch stays on before it springs back.
+ * How long a momentary switch stays on after its work has finished.
  *
- * A reboot switch has no state to report: the player is either restarting or it
- * is not, and neither is "on". Long enough that the Home app renders the press
- * so the user sees the tap registered, short enough that the tile is not left
- * looking like a thing that is still happening.
+ * A floor on how long a press is visible, not the whole duration: the tile is
+ * held on while the reboot is actually being sent, which outlasts
+ * {@link HOMEKIT_WRITE_BUDGET_MS} and can outlast this. It matters for a press
+ * that finishes almost at once, such as a sweep that found nothing, where
+ * springing back immediately would look like a tap that never registered.
  */
 exports.MOMENTARY_RESET_MS = 1_000;
 // --- Volume ----------------------------------------------------------------

package/dist/utils/validators.d.ts

@@ -85,6 +85,17 @@ export declare function isNonPrivateIpv4(value: string): boolean;
  * hostnames are accepted.
  */
 export declare function isProbeableHost(value: unknown): value is string;
+/**
+ * True for an address discovery may dial after an unsolicited mDNS advertisement.
+ *
+ * Narrower than {@link isProbeableHost}. The settings-page probe is an
+ * administrator asking this host to open a connection, so loopback is allowed
+ * there. An advertisement on the LAN is not a request, and a packet that names
+ * 127.0.0.1 would make Homebridge talk to itself.
+ */
+export declare function isDiscoveryHost(value: unknown): value is string;
+/** True for IPv4 loopback (first octet 127). `isProbeableHost` treats this as local; discovery does not. */
+export declare function isLoopbackIpv4(value: string): boolean;
 /** Clamp the discovery window into the supported range. */
 export declare function resolveDiscoveryTimeoutSec(value: unknown, warnings?: string[]): number;
 /**

package/dist/utils/validators.js

@@ -25,6 +25,8 @@ exports.isIpv4 = isIpv4;
 exports.isValidHost = isValidHost;
 exports.isNonPrivateIpv4 = isNonPrivateIpv4;
 exports.isProbeableHost = isProbeableHost;
+exports.isDiscoveryHost = isDiscoveryHost;
+exports.isLoopbackIpv4 = isLoopbackIpv4;
 exports.resolveDiscoveryTimeoutSec = resolveDiscoveryTimeoutSec;
 exports.resolveSliderService = resolveSliderService;
 exports.validateConfig = validateConfig;
@@ -169,6 +171,28 @@ function isProbeableHost(value) {
     }
     return PROBE_LOCAL_SUFFIXES.some((suffix) => lower.endsWith(suffix) && lower.length > suffix.length);
 }
+/**
+ * True for an address discovery may dial after an unsolicited mDNS advertisement.
+ *
+ * Narrower than {@link isProbeableHost}. The settings-page probe is an
+ * administrator asking this host to open a connection, so loopback is allowed
+ * there. An advertisement on the LAN is not a request, and a packet that names
+ * 127.0.0.1 would make Homebridge talk to itself.
+ */
+function isDiscoveryHost(value) {
+    if (!isProbeableHost(value)) {
+        return false;
+    }
+    return !isLoopbackIpv4(value.trim());
+}
+/** True for IPv4 loopback (first octet 127). `isProbeableHost` treats this as local; discovery does not. */
+function isLoopbackIpv4(value) {
+    if (!isIpv4(value)) {
+        return false;
+    }
+    const [firstOctet = 0] = value.split('.').map(Number);
+    return firstOctet === 127;
+}
 /** Clamp the discovery window into the supported range. */
 function resolveDiscoveryTimeoutSec(value, warnings) {
     if (value === undefined) {

package/docs/FEATURES.md

@@ -13,7 +13,8 @@ A checklist of what is built. The plugin aims to cover everything about a BluOS
 - ✅ Volume preset switches: one exact level per switch, addressable by name with Siri; set On sets the level, set Off is a no-op
 - ✅ Battery (level, charging state, low-battery) on the volume tile, or on mute if there is no slider, for players with a pack fitted. A battery-only player still gets a standalone tile; the Home app will not render that one
 - ✅ Reboot switch per player, momentary so a scene or "turn everything off" cannot reboot the stereo, and still pressable when the player has stopped answering. Reboots the whole box on a multi-zone chassis, which BluOS gives no way to avoid, and warns at startup when that means other configured rooms
-- ✅ Optional "reboot all" switch that reboots every BluOS player on the network, sending once per box instead of once per zone. The info log is a count (`found … device(s), … player(s)`), then `N of N device(s) rebooted`. The debug log names each box before anything is sent. Accessories on a box that was just rebooted stay quiet until it answers again, then take its live state. You choose its name with `options.rebootAllName`, so it can sit in whichever Home app room suits you
+- ✅ Reboot presses are never doubled up: the tile stays on until the request has been sent rather than springing back while HomeKit is still waiting, a press that lands mid-restart is ignored, and a box already restarting is skipped rather than sent a request that could only fail
+- ✅ Optional "reboot all" switch that reboots every BluOS player on the network, sending once per box instead of once per zone. The info log is a count (`found … device(s), … player(s)`), then `N of N device(s) rebooted`, with `skipping N device(s) already restarting` when part of the fleet is already down. The debug log names each box before anything is sent. Accessories on a box that was just rebooted stay quiet until it answers again, then take its live state. You choose its name with `options.rebootAllName`, so it can sit in whichever Home app room suits you
 - ✅ Fixed-output players detected from `volume="-1"` and given no slider, with one explanatory log line
 - ✅ Multi-zone chassis support (NAD CI S2, CI 580): each zone is a separate player on its own port
 - ✅ mDNS discovery in the settings page, with manual address entry for networks that filter multicast
@@ -41,7 +42,7 @@ A checklist of what is built. The plugin aims to cover everything about a BluOS
 - ✅ An unusable configuration disables the platform and keeps every accessory registered. Nothing is deleted
 - ✅ Per-device validation: one bad entry is skipped with a warning instead of stopping the rest
 - ✅ Size-, depth-, element- and attribute-capped XML parsing, sanitised log output, and a length cap on any identity a player reports for itself
-- ✅ Bounded discovery: the records kept from a browse, the candidates verified from it and the verifications in flight are all capped
+- ✅ Bounded discovery: the records kept from a browse, the candidates verified from it and the verifications in flight are all capped. Public IPv4 and loopback advertisements are not verified
 - ✅ Clean shutdown: poll loops, backoff delays and mDNS browses are cancelled, not left to run out
 - ✅ A cached accessory that the plugin cannot drive reports No Response and says what to do about it. It never shows a stale value forever
 - ✅ Custom Homebridge UI settings page, plus a plain `config.schema.json` form

package/docs/PROTOCOL.md

@@ -259,7 +259,7 @@ mDNS, browsing two service types:
 | `_musc._tcp.local` | Primary players |
 | `_musp._tcp.local` | Secondary zones of a multi-zone chassis (spec appendix §13.1, LSDP class `0x0003`) |
 
-A zone is usable once its `SRV` record (for the port) and an IPv4 address are both known; the address comes from an `A` record when one is offered and otherwise from the responder's own source address. `TXT` records carry `model`, `version`, `mac` and `zs`, but secondary zones **omit `mac`**. That is why identity is always confirmed by reading `/SyncStatus`, and never trusted from the advertisement alone.
+A zone is usable once its `SRV` record (for the port) and a **local** IPv4 address are both known; the address comes from an `A` record when one is offered and otherwise from the responder's own source address. Public IPv4 and loopback advertisements are ignored, so a packet on the LAN cannot steer verify at Homebridge itself or at an off-network host. `TXT` records carry `model`, `version`, `mac` and `zs`, but secondary zones **omit `mac`**. That is why identity is always confirmed by reading `/SyncStatus`, and never trusted from the advertisement alone.
 
 **LSDP** (UDP 11430) is documented as an alternative and was tried first: it failed repeatedly against this fleet, while mDNS answered reliably. mDNS is therefore the only discovery path, with manual address entry as the fallback for networks that filter multicast.
 

package/docs/README-DETAILED.md

@@ -38,7 +38,9 @@ Where HomeKit is genuinely better is the tile, the scene, the automation and the
 
 **Battery.** Charge level, charging state and low-battery warning, for players with a battery pack fitted (PULSE FLEX with BP100, PULSE M). The Home app will not render a Battery accessory on its own, so the service sits on the volume tile when that exists, otherwise on mute. A player that exposes battery and nothing else still gets a standalone tile, and Home will keep saying Not Supported for that one.
 
-**Reboot switch.** Reboots the player. It springs back to off and ignores being switched off, so a scene or "turn everything off" cannot reboot your stereo. It stays pressable while a player is showing No Response, which is exactly when you want it.
+**Reboot switch.** Reboots the player. It ignores being switched off, so a scene or "turn everything off" cannot reboot your stereo. It stays pressable while a player is showing No Response, which is exactly when you want it.
+
+The tile stays on while the request is being sent, then springs back. A press that arrives while a restart is still under way is ignored, and a player already restarting is not sent a second request: nothing serves the reboot page while a box boots, so a repeat could only fail and would be reported as a reboot that did not work.
 
 On a multi-zone chassis it reboots both zones. BluOS serves reboot on the box's own web server, not on a zone's control port, so "Study Reboot" on a CI S2 also takes down the other room. There is no way to avoid this. At startup the plugin warns, naming the other affected rooms.
 
@@ -52,11 +54,13 @@ On a multi-zone chassis it reboots both zones. BluOS serves reboot on the box's
 
 The info log is a count (`found 2 device(s), 3 player(s)`), then `2 of 2 device(s) rebooted`. The debug log names every box and the players on it before a request goes out. One press sends one reboot per box, so a multi-zone chassis reboots once and takes all of its zones with it. A box that cannot be reached is a warning (`could not reboot`), and the rest still go.
 
+One press is one wave. The sweep takes longer than HomeKit will wait for a write, so the tile stays on until the wave finishes rather than springing back while it runs, and a press that lands mid-wave is ignored. Boxes already restarting are skipped with a count (`skipping 1 device(s) already restarting`), and the total counts only what was actually sent.
+
 Name it with `options.rebootAllName`. It is the one accessory with no room of its own, so you choose where it lives in the Home app.
 
 ## Reliability in detail
 
-**Discovery in the settings page.** Finds zones over mDNS and writes the configuration for you, including the stable identity the platform will look for. Manual address entry covers networks where multicast is filtered.
+**Discovery in the settings page.** Finds zones over mDNS and writes the configuration for you, including the stable identity the platform will look for. Only local IPv4 advertisements are verified (private, CGNAT/Tailscale, link-local). Public and loopback addresses are skipped. Manual address entry covers networks where multicast is filtered; the settings probe still allows loopback because you typed it.
 
 **Long-polling, not polling.** `/SyncStatus?timeout=100` with an `etag`, so a change made on the front panel, the remote or the BluOS app reaches HomeKit in about a second, without hammering the player. One poll loop per zone, because the etag is per zone and not per chassis.
 
@@ -203,6 +207,14 @@ The middle line is debug. A box that did not take the request is a warning:
 [BluOS] Downstairs Reboot: 1 of 2 device(s) rebooted
 ```
 
+A box that is already restarting is skipped rather than warned about, and the total counts only what was sent:
+
+```text
+[BluOS] Downstairs Reboot: found 2 device(s), 3 player(s)
+[BluOS] Downstairs Reboot: skipping 1 device(s) already restarting: 192.168.4.11
+[BluOS] Downstairs Reboot: 1 of 1 device(s) rebooted
+```
+
 A per-player reboot switch on a shared chassis, at startup:
 
 ```text
@@ -255,11 +267,12 @@ Ordered by how well HomeKit expresses the thing, not by how easy it is to build.
 6. **A zone on a multi-zone chassis is missing.** Check the port. Zone two is 11010, not 11000
 7. **The volume moved but the slider did not, for a second.** A change made on the player takes one long-poll round trip to arrive. A change made from HomeKit is immediate
 8. **One zone's slider moved several rooms.** That zone is currently leading a BluOS group, so it carries its followers, the same as its slider in the BluOS app. Ungroup in the BluOS app and it goes back to moving alone
-9. **The reboot switch turns itself off.** This is by design. It is a button, not a state: it fires when switched on, then springs back. Switching it off does nothing, which is what stops a scene or "turn everything off" from rebooting your stereo
+9. **The reboot switch turns itself off.** This is by design. It is a button, not a state: it stays on while the request is being sent, then springs back. Switching it off does nothing, which is what stops a scene or "turn everything off" from rebooting your stereo
 10. **Reboot All rebooted a player you did not configure.** Also by design, and the reason it is off by default. It sweeps the network instead of reading `devices[]`. The info log is a count (`found … device(s), … player(s)`); the debug log lists every player by name and address
 11. **A reboot switch rebooted the room next door.** Expect this on a multi-zone chassis such as a CI S2. BluOS serves `/reboot` on the box's own web server, not on a zone's control port, so there is no way to reboot one zone of a shared box. At startup the plugin warns, naming the other rooms
-12. **100 is louder than you ever want.** Set the limit on the player, in the BluOS app's settings for it. The wording varies by model: a volume limit on Bluesound players, a maximum volume on NAD amplifiers. The plugin deliberately has no ceiling of its own, so a limit set on the player is enforced by the hardware for every controller. No HomeKit automation or misheard Siri phrase can exceed it, and a second limit here could only disagree with the first
-13. Restart Homebridge after editing `config.json` by hand
+12. **A reboot press seems to be ignored.** Check for `a restart is already under way` or `is already restarting`. A restart already in progress is not repeated: nothing serves `/reboot` while a box boots, so a second request could only fail and would be logged as a reboot that did not work. The window is 90 seconds, after which the switch sends again
+13. **100 is louder than you ever want.** Set the limit on the player, in the BluOS app's settings for it. The wording varies by model: a volume limit on Bluesound players, a maximum volume on NAD amplifiers. The plugin deliberately has no ceiling of its own, so a limit set on the player is enforced by the hardware for every controller. No HomeKit automation or misheard Siri phrase can exceed it, and a second limit here could only disagree with the first
+14. Restart Homebridge after editing `config.json` by hand
 
 ### Why is my volume a fan?
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "homebridge-bluos",
   "displayName": "Homebridge BluOS",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "description": "Homebridge plugin for BluOS players — per-zone volume, mute, volume-preset and battery accessories over the LAN Custom Integration API. Verified on NAD and Bluesound hardware",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",