homebridge-roborock-vacuum 2.2.1 → 2.2.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.2.2
+
+- **Fix (config UI)**: 2FA verification and login no longer fail with the generic "The Homebridge UI did not respond in time" message on slow connections (#58). Cloud-backed actions (login, 2FA, device list) now get a 60-second budget in the UI instead of 15 seconds — 2FA verify and password login each make two sequential Roborock cloud requests, which could legitimately exceed the old limit. Each underlying cloud request is also capped at 20 seconds, so a genuinely unreachable Roborock server now surfaces the real network error instead of the generic timeout
+
 ## 2.2.1
 
 Maintenance release — no functional changes to device control. Reworks the four code patterns flagged by the Homebridge verification security scan so the automated checks come back clean:

package/homebridge-ui/public/index.js

@@ -106,6 +106,20 @@ function showToast(type, message) {
 // leave the page hanging forever.
 const REQUEST_TIMEOUT_MS = 15000;
 
+// Endpoints that round-trip to the Roborock cloud need a bigger budget:
+// 2FA verify and password login each make two sequential cloud requests,
+// which can legitimately exceed 15s on a slow route. Each underlying
+// request is capped at 20s (axios timeout in roborockAuth/roborockHome),
+// so the server always answers — with a real error if the cloud hangs —
+// before this deadline fires.
+const CLOUD_REQUEST_TIMEOUT_MS = 60000;
+const CLOUD_PATHS = [
+  "/auth/login",
+  "/auth/send-2fa-email",
+  "/auth/verify-2fa-code",
+  "/devices/list",
+];
+
 function withTimeout(promise, ms, fallback) {
   return Promise.race([
     promise,
@@ -116,10 +130,13 @@ function withTimeout(promise, ms, fallback) {
 }
 
 async function request(path, body) {
+  const timeoutMs = CLOUD_PATHS.includes(path)
+    ? CLOUD_REQUEST_TIMEOUT_MS
+    : REQUEST_TIMEOUT_MS;
   try {
     return await withTimeout(
       window.homebridge.request(path, body),
-      REQUEST_TIMEOUT_MS,
+      timeoutMs,
       {
         ok: false,
         message:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "homebridge-roborock-vacuum",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Roborock Vacuum Cleaner - plugin for Homebridge.",
   "license": "MIT",
   "keywords": [

package/roborockLib/lib/roborockAuth.js

@@ -51,6 +51,9 @@ function encryptPassword(password, k) {
 function createLoginApi({ baseURL, username, clientID, language }) {
 	return axios.create({
 		baseURL: `https://${normalizeBaseURL(baseURL)}`,
+		// Fail with a real error instead of hanging: the config UI budgets 60s
+		// per action, and login/2FA-verify chain two requests through this client.
+		timeout: 20000,
 		headers: {
 			header_clientid: crypto.createHash("md5").update(username).update(clientID).digest().toString("base64"),
 			header_clientlang: language || DEFAULT_HEADERS.header_clientlang,

package/roborockLib/lib/roborockHome.js

@@ -12,7 +12,7 @@ function md5hex(str) {
 // credentials, mirroring the signing the main plugin uses for the Roborock
 // "real" API (see roborockAPI.js initUser).
 function createSignedApi(rriot) {
-  const api = axios.create({ baseURL: rriot.r.a });
+  const api = axios.create({ baseURL: rriot.r.a, timeout: 20000 });
   api.interceptors.request.use((config) => {
     const timestamp = Math.floor(Date.now() / 1000);
     const nonce = crypto