homebridge-roborock-matter 2.9.3 → 2.9.4

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 2.9.4
+
+Startup-cost cleanup release (also refreshes the npm README with the Donate button and the prominent Verified badge).
+
+- **Two fewer RSA-2048 key generations at every startup.** The MQTT connector generated a protocol keypair that nothing ever read (removed), and the message layer generated its keypair eagerly even though it is only needed for the rare photo request path on camera-equipped models (now created lazily on first use). Measured ~50 ms per keygen on fast hardware — substantially more on a Raspberry Pi.
+- Removed dead code: the never-called `decryptWithPrivateKey` helper and the unused `scenesData` field (both HomeKit-era leftovers).
+
 ## 2.9.3
 
 **The plugin is now Verified by Homebridge!** 🎉 Reviewed and endorsed by the Homebridge team (homebridge/plugins#1124), with specific praise for the encrypted at-rest session storage, the preserved fork attribution, and the per-release notes.

package/README.md

@@ -9,7 +9,6 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/homebridge/homebridge/wiki/Verified-Plugins"><img src="https://img.shields.io/badge/homebridge-verified-blueviolet?color=%23491F59&style=flat" alt="verified-by-homebridge"></a>
   <a href="https://www.npmjs.com/package/homebridge-roborock-matter"><img src="https://img.shields.io/npm/v/homebridge-roborock-matter?label=npm&color=cb3837" alt="npm version"></a>
   <a href="https://www.npmjs.com/package/homebridge-roborock-matter"><img src="https://img.shields.io/npm/dt/homebridge-roborock-matter?label=downloads&color=8a5cf5" alt="npm downloads"></a>
   <a href="https://github.com/mathiashornbek/homebridge-roborock-matter/actions"><img src="https://img.shields.io/github/actions/workflow/status/mathiashornbek/homebridge-roborock-matter/nodejs.yml?label=CI" alt="CI status"></a>
@@ -18,6 +17,14 @@
   <a href="./LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license"></a>
 </p>
 
+<p align="center">
+  <a href="https://paypal.me/MathiasHornbek"><img src="https://img.shields.io/badge/PayPal-Donate-00457C?logo=paypal&logoColor=white" alt="Donate via PayPal"></a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/homebridge/homebridge/wiki/Verified-Plugins"><img src="https://img.shields.io/badge/homebridge-verified-blueviolet?color=%23491F59&style=for-the-badge&logoColor=%23FFFFFF&logo=homebridge" alt="Verified by Homebridge"></a>
+</p>
+
 ---
 
 Log in with your **Roborock app account** — no token extraction, no rooted apps, no packet sniffing — and every robot appears in Apple Home as a first-class **Matter Robotic Vacuum Cleaner**: start, pause, dock, pick rooms, choose cleaning modes, and watch the status pill name the room the robot is _actually inside_, live.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "homebridge-roborock-matter",
-  "version": "2.9.3",
+  "version": "2.9.4",
   "description": "Matter-only Homebridge plugin publishing Roborock robot vacuums (including 2025 B01/Q7-series) as native Matter accessories for Apple Home. Fork of homebridge-roborock-vacuum2.",
   "license": "MIT",
   "author": {

package/roborockLib/lib/message.js

@@ -32,7 +32,18 @@ class message {
     this.adapter = adapter;
     this.missingLocalKeyWarnings = new Set();
 
-    this.keys = roborockCrypto.generateRsaKeyPair();
+    // The protocol RSA keypair is only needed for the rare photo request
+    // path (camera-equipped models). Generate it lazily on first use
+    // instead of paying a full RSA-2048 keygen (~50 ms on fast hardware,
+    // substantially more on a Raspberry Pi) at every startup.
+    this._keys = null;
+  }
+
+  get keys() {
+    if (!this._keys) {
+      this._keys = roborockCrypto.generateRsaKeyPair();
+    }
+    return this._keys;
   }
 
   async buildPayload(

package/roborockLib/lib/roborock_mqtt_connector.js

@@ -77,7 +77,10 @@ class roborock_mqtt_connector {
 
     this.connected = false;
 
-    this.keys = roborockCrypto.generateRsaKeyPair();
+    // NOTE: this class previously generated its own RSA-2048 keypair here,
+    // but nothing ever read it — the protocol keypair lives in message.js
+    // (lazily created for the rare photo path). Removed: one full RSA
+    // keygen less at every startup.
   }
 
   async initUser(userdata) {
@@ -524,24 +527,6 @@ class roborock_mqtt_connector {
 
     return false;
   }
-
-  decryptWithPrivateKey(privateKeyPem, encryptedData) {
-    const privateKey = crypto.createPrivateKey({
-      key: privateKeyPem,
-      format: "pem",
-      type: "pkcs8",
-    });
-
-    const decryptedData = crypto.privateDecrypt(
-      {
-        key: privateKey,
-        padding: crypto.constants.RSA_PKCS1_PADDING,
-      },
-      encryptedData
-    );
-
-    return decryptedData;
-  }
 }
 
 /**

package/roborockLib/roborockAPI.js

@@ -122,8 +122,6 @@ class Roborock {
     this.localDevices = {};
     this.remoteDevices = new Set();
 
-    this.scenesData = null; // Store scenes data locally
-
     this.name = "roborock";
     this.deviceNotify = null;
     this.serviceAreaRoomMapRefreshAttempts = new Map();