homebridge-roborock-matter 2.9.2 → 2.9.4

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 2.9.4
+
+Startup-cost cleanup release (also refreshes the npm README with the Donate button and the prominent Verified badge).
+
+- **Two fewer RSA-2048 key generations at every startup.** The MQTT connector generated a protocol keypair that nothing ever read (removed), and the message layer generated its keypair eagerly even though it is only needed for the rare photo request path on camera-equipped models (now created lazily on first use). Measured ~50 ms per keygen on fast hardware — substantially more on a Raspberry Pi.
+- Removed dead code: the never-called `decryptWithPrivateKey` helper and the unused `scenesData` field (both HomeKit-era leftovers).
+
+## 2.9.3
+
+**The plugin is now Verified by Homebridge!** 🎉 Reviewed and endorsed by the Homebridge team (homebridge/plugins#1124), with specific praise for the encrypted at-rest session storage, the preserved fork attribution, and the per-release notes.
+
+- Verified badge added to the README.
+- **Donate button enabled** on the plugin's Homebridge UI tile via the standard `funding` field (PayPal), plus a Support section in the README.
+- Verified plugins are bumped in Homebridge UI search results and distributed via the pre-bundled tarball pipeline for faster, more reliable installs on low-power devices.
+
 ## 2.9.2
 
 - **Max+ ("Grundig"/"Deep Clean") suction mode now announced on the S8 Pro Ultra.** Field report from a re-paired fleet: the S8 Pro Ultra only showed four suction levels because Max+ was gated to B01/Q7. The classic gate now uses the upstream-vetted per-model feature data (`set_custom_mode_max_plus` in the model's action list) — currently confirming the S8 Pro Ultra (`a70`); further models are added as feature data or field reports with diagnostics exports confirm the level. NOTE: the robot must be re-paired once for the new mode to appear (Matter locks the mode list at commissioning).

package/README.md

@@ -17,6 +17,14 @@
   <a href="./LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license"></a>
 </p>
 
+<p align="center">
+  <a href="https://paypal.me/MathiasHornbek"><img src="https://img.shields.io/badge/PayPal-Donate-00457C?logo=paypal&logoColor=white" alt="Donate via PayPal"></a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/homebridge/homebridge/wiki/Verified-Plugins"><img src="https://img.shields.io/badge/homebridge-verified-blueviolet?color=%23491F59&style=for-the-badge&logoColor=%23FFFFFF&logo=homebridge" alt="Verified by Homebridge"></a>
+</p>
+
 ---
 
 Log in with your **Roborock app account** — no token extraction, no rooted apps, no packet sniffing — and every robot appears in Apple Home as a first-class **Matter Robotic Vacuum Cleaner**: start, pause, dock, pick rooms, choose cleaning modes, and watch the status pill name the room the robot is _actually inside_, live.
@@ -27,7 +35,7 @@ Log in with your **Roborock app account** — no token extraction, no rooted app
 - 📍 **Live room tracking — on every robot.** While the robot works, its position is read from the map channel (encrypted SCMap on B01/Q7, classic RRMap on S/Q-series), matched against your room geometry, and published as the current Matter Service Area. Apple Home shows _"Cleaning — Kitchen"_ — including runs started from the robot's button or the Roborock app. No other Homebridge plugin does this.
 - 🧭 **Matter-only, by design.** No legacy fan tiles, no helper-switch clutter. One robot, one native accessory, on Homebridge 2's built-in Matter bridge — including room/map selection sourced from your Roborock account's named rooms.
 - 🔌 **Cloud + local, automatically.** Commands prefer a direct local TCP connection to the robot and fall back to the Roborock cloud transparently, with per-device connection diagnostics in the settings UI when you want to see exactly what happened.
-- 🛡️ **Hardened and boring where it counts.** 256 automated tests, CI on Node 22/24 against Homebridge 1.11 and 2.x, zero known vulnerabilities, no analytics, no post-install scripts, and a startup that retries with backoff instead of ever crash-looping Homebridge — verified against the Homebridge plugin-verification harness.
+- 🛡️ **Hardened and boring where it counts.** 260 automated tests, CI on Node 22/24 against Homebridge 1.11 and 2.x, zero known vulnerabilities, no analytics, no post-install scripts, and a startup that retries with backoff instead of ever crash-looping Homebridge. **Verified by Homebridge** after review by the Homebridge team.
 
 ## Features
 
@@ -116,6 +124,10 @@ The complete path — robot → plugin → Homebridge → matter.js store — wa
 
 Model reports, diagnostics exports, and pull requests are very welcome. The codebase ships with 256 tests (protocol fixtures verified against the [python-roborock](https://github.com/Python-roborock/python-roborock) reference), strict TypeScript checking, and CI across Node 22/24 × Homebridge 1.11/2.x — `npm test` before you push and you're set.
 
+## Support the project
+
+If this plugin makes your home a little smarter, you can support its development via [PayPal](https://paypal.me/MathiasHornbek) — or through the ❤️ **Donate** button on the plugin's tile in the Homebridge UI. Model reports and diagnostics exports are just as valuable!
+
 ## Attribution
 
 A Matter-only fork of [`homebridge-roborock-vacuum2`](https://github.com/applemanj/homebridge-roborock-vacuum2) by **Joshua Appleman**, itself adapted from [ioBroker.roborock](https://github.com/copystring/ioBroker.roborock) by **copystring**, with original work by **Nico Hartung**. B01/Q7 protocol work is implemented against the [python-roborock](https://github.com/Python-roborock/python-roborock) reference. All original copyright is preserved under the [MIT license](./LICENSE).

package/package.json

@@ -1,11 +1,15 @@
 {
   "name": "homebridge-roborock-matter",
-  "version": "2.9.2",
+  "version": "2.9.4",
   "description": "Matter-only Homebridge plugin publishing Roborock robot vacuums (including 2025 B01/Q7-series) as native Matter accessories for Apple Home. Fork of homebridge-roborock-vacuum2.",
   "license": "MIT",
   "author": {
     "name": "Mathias Hornbek"
   },
+  "funding": {
+    "type": "paypal",
+    "url": "https://paypal.me/MathiasHornbek"
+  },
   "keywords": [
     "apple-home",
     "homebridge-plugin",

package/roborockLib/lib/message.js

@@ -32,7 +32,18 @@ class message {
     this.adapter = adapter;
     this.missingLocalKeyWarnings = new Set();
 
-    this.keys = roborockCrypto.generateRsaKeyPair();
+    // The protocol RSA keypair is only needed for the rare photo request
+    // path (camera-equipped models). Generate it lazily on first use
+    // instead of paying a full RSA-2048 keygen (~50 ms on fast hardware,
+    // substantially more on a Raspberry Pi) at every startup.
+    this._keys = null;
+  }
+
+  get keys() {
+    if (!this._keys) {
+      this._keys = roborockCrypto.generateRsaKeyPair();
+    }
+    return this._keys;
   }
 
   async buildPayload(

package/roborockLib/lib/roborock_mqtt_connector.js

@@ -77,7 +77,10 @@ class roborock_mqtt_connector {
 
     this.connected = false;
 
-    this.keys = roborockCrypto.generateRsaKeyPair();
+    // NOTE: this class previously generated its own RSA-2048 keypair here,
+    // but nothing ever read it — the protocol keypair lives in message.js
+    // (lazily created for the rare photo path). Removed: one full RSA
+    // keygen less at every startup.
   }
 
   async initUser(userdata) {
@@ -524,24 +527,6 @@ class roborock_mqtt_connector {
 
     return false;
   }
-
-  decryptWithPrivateKey(privateKeyPem, encryptedData) {
-    const privateKey = crypto.createPrivateKey({
-      key: privateKeyPem,
-      format: "pem",
-      type: "pkcs8",
-    });
-
-    const decryptedData = crypto.privateDecrypt(
-      {
-        key: privateKey,
-        padding: crypto.constants.RSA_PKCS1_PADDING,
-      },
-      encryptedData
-    );
-
-    return decryptedData;
-  }
 }
 
 /**

package/roborockLib/roborockAPI.js

@@ -122,8 +122,6 @@ class Roborock {
     this.localDevices = {};
     this.remoteDevices = new Set();
 
-    this.scenesData = null; // Store scenes data locally
-
     this.name = "roborock";
     this.deviceNotify = null;
     this.serviceAreaRoomMapRefreshAttempts = new Map();