homebridge-tuya-plus 3.14.0-beta.2 → 3.14.0-dev.3

package/.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# Changes to CI/release automation require the maintainer's review.
+# Enforced only when branch protection on `main` has
+# "Require review from Code Owners" enabled.
+/.github/workflows/ @adrianjagielak
+/.github/CODEOWNERS  @adrianjagielak

package/.github/workflows/publish-dev.yml

@@ -0,0 +1,146 @@
+name: Publish dev to npm
+
+# Publishes commits on `main` to npm under the `dev` dist-tag.
+#
+# Versioning:
+#   * Dev builds target the NEXT minor release, since releases here are
+#     usually a minor bump. With package.json at e.g. 3.13.0, dev builds
+#     are published as 3.14.0-dev.<run-number> (minor +1, patch reset to 0,
+#     prerelease tag = the GitHub Actions run number). In semver these sort
+#     below the eventual 3.14.0 release, so `latest` always wins once cut.
+#   * Release commits are skipped: if a push changes package.json's version
+#     (i.e. you bumped it to cut a real release and publish to npm
+#     manually), no dev build is published for that push.
+#
+# Security model (why a malicious PR cannot steal publishing rights):
+#   * No npm token is stored anywhere. Publishing uses npm Trusted
+#     Publishing (OIDC): GitHub mints a short-lived, cryptographically
+#     signed token that npm only accepts when its claims match THIS repo +
+#     THIS workflow file. There is no durable credential to exfiltrate.
+#   * This workflow never runs on `pull_request`, only on pushes to `main`
+#     (post-merge) and manual dispatch — so fork PRs get nothing.
+#   * The privileged `publish` job is minimal and isolated: it does not
+#     run `npm ci`, a build, or tests, and uses `--ignore-scripts`, so no
+#     repo/dependency code executes while the OIDC permission is present.
+#     Tests run in a separate, unprivileged job that gates publishing, and
+#     the version is computed in an unprivileged `prepare` job.
+#
+# One-time setup required for this to succeed (see PR/commit notes):
+#   1. npmjs.com -> package Settings -> Trusted Publisher:
+#        Publisher: GitHub Actions
+#        Organization/user: adrianjagielak
+#        Repository:        homebridge-tuya-plus
+#        Workflow filename: publish-dev.yml
+#        Environment:       npm-dev
+#   2. GitHub repo Settings -> Environments -> create `npm-dev`,
+#      restrict deployment branches to `main` (optional: required reviewer).
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+# Least privilege by default; only the publish job opts into id-token.
+permissions:
+  contents: read
+
+# Don't cancel an in-flight publish; let each commit publish its version.
+concurrency:
+  group: publish-dev
+  cancel-in-progress: false
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run test
+
+  # Unprivileged: decides whether this push should publish a dev build, and
+  # computes the dev version. Kept out of the `publish` job so no extra work
+  # runs while the OIDC publishing permission is present.
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      should_publish: ${{ steps.check.outputs.should_publish }}
+      version: ${{ steps.ver.outputs.version }}
+    steps:
+      # Full history so we can read package.json from before this push.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Skip dev builds for release commits: if package.json's version
+      # changed anywhere in this push (before -> after), treat it as a manual
+      # release and publish nothing. If we can't determine the previous
+      # version (first push, manual dispatch, missing file), default to
+      # publishing — a dev build is the safe fallback.
+      - name: Decide whether to publish a dev build
+        id: check
+        run: |
+          CURR="$(node -p "require('./package.json').version")"
+          BEFORE="${{ github.event.before }}"
+          if [ -z "$BEFORE" ] || [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
+            BEFORE="$(git rev-parse --verify --quiet HEAD~1 || true)"
+          fi
+          PREV=""
+          if [ -n "$BEFORE" ] && git cat-file -e "$BEFORE:package.json" 2>/dev/null; then
+            git show "$BEFORE:package.json" > "$RUNNER_TEMP/prev-package.json"
+            PREV="$(node -p "require('$RUNNER_TEMP/prev-package.json').version")"
+          fi
+          echo "Previous version: ${PREV:-<unknown>}"
+          echo "Current version:  $CURR"
+          if [ -n "$PREV" ] && [ "$PREV" != "$CURR" ]; then
+            echo "::notice::package.json version changed ($PREV -> $CURR); skipping dev publish (treated as a manual release commit)."
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Dev builds target the next MINOR release (minor +1, patch -> 0).
+      - name: Compute dev version
+        id: ver
+        run: |
+          NEXT="$(node -e "const v=require('./package.json').version.split('.'); v[1]=Number(v[1])+1; v[2]=0; console.log(v.join('.'))")"
+          VERSION="${NEXT}-dev.${GITHUB_RUN_NUMBER}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Will publish $VERSION"
+
+  publish:
+    needs: [test, prepare]
+    # Skip release commits (version bumped in this push).
+    if: needs.prepare.outputs.should_publish == 'true'
+    runs-on: ubuntu-latest
+    # Bind this environment in repo Settings to the `main` branch so that
+    # only main can ever reach the publish step.
+    environment: npm-dev
+    permissions:
+      contents: read # checkout
+      id-token: write # OIDC -> npm Trusted Publishing (no stored token)
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+
+      # Trusted Publishing (OIDC) requires npm >= 11.5.1.
+      - name: Ensure OIDC-capable npm
+        run: npm install -g npm@latest
+
+      # Writes package.json on the runner only; nothing is committed.
+      - name: Set version
+        run: npm version "${{ needs.prepare.outputs.version }}" --no-git-tag-version --allow-same-version --ignore-scripts
+
+      # No NODE_AUTH_TOKEN: npm exchanges the OIDC id-token for a
+      # short-lived, package-scoped credential at publish time.
+      # --ignore-scripts ensures no lifecycle script runs with that credential.
+      # --provenance attaches a signed build attestation (needs a public repo).
+      - name: Publish (dev tag)
+        run: npm publish --tag dev --provenance --ignore-scripts

package/Readme.MD

@@ -81,6 +81,19 @@ Search for "Tuya" in [homebridge-config-ui-x](https://github.com/oznu/homebridge
 sudo npm install -g homebridge-tuya-plus
 ```
 
+#### Bleeding-edge (`dev`) builds:
+
+Every commit to `main` is automatically published to npm under the `dev` tag — a
+separate, unstable channel. The stable release always stays on `latest`, so this
+won't affect normal installs. To try the latest in-development build:
+
+```
+sudo npm install -g homebridge-tuya-plus@dev
+```
+
+These are versioned like `3.13.1-dev.<n>` and may be unstable; use the default
+install above for production.
+
 ## Configuration
 > UI
 

package/lib/TuyaAccessory.js

@@ -226,9 +226,21 @@ class TuyaAccessory extends EventEmitter {
             }
         });
 
-        this._socket.on('close', err => {
+        this._socket.on('close', () => {
             this.connected = false;
             this.session_key = null;
+
+            // A heartbeat timer must never outlive its socket. The pinger
+            // callbacks act on `this._socket`, so a stale timer left over from a
+            // dead socket would later fire against a freshly reconnected one and
+            // trip a spurious ERR_PING_TIMED_OUT. Clearing it here covers every
+            // teardown path (error-driven destroy as well as the graceful end
+            // below).
+            if (this._socket._pinger) {
+                clearTimeout(this._socket._pinger);
+                this._socket._pinger = null;
+            }
+
             //this.log.info('Closed connection with', this.context.name);
         });
 
@@ -236,6 +248,32 @@ class TuyaAccessory extends EventEmitter {
             this.connected = false;
             this.session_key = null;
             this.log.info('Disconnected from', this.context.name);
+
+            // The device closed the connection on its own. This is routine for
+            // many Tuya devices (e.g. LED ceiling lights) that recycle their
+            // long-lived LAN sockets every few minutes. Previously nothing here
+            // tore the socket down or reconnected: the heartbeat timer kept
+            // running and, because `connected` is now false, its pings went
+            // nowhere until the full ping timeout elapsed and emitted a
+            // misleading "ERR_PING_TIMED_OUT" ~30s later - which was the only
+            // thing that ultimately triggered a reconnect. Tear down and
+            // reconnect promptly instead, so recovery is quick and the logs
+            // reflect what actually happened (a clean disconnect, not a ping
+            // failure).
+            if (this._socket._pinger) {
+                clearTimeout(this._socket._pinger);
+                this._socket._pinger = null;
+            }
+
+            // Destroying first means a trailing RST can't resurface as an
+            // 'error' and schedule a second, competing reconnect.
+            this._socket.destroy();
+
+            if (!this._socket._errorReconnect) {
+                this._socket._errorReconnect = setTimeout(() => {
+                    process.nextTick(this._connect.bind(this));
+                }, 5000);
+            }
         });
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "homebridge-tuya-plus",
-  "version": "3.14.0-beta.2",
+  "version": "3.14.0-dev.3",
   "description": "A community-maintained Homebridge plugin for controlling Tuya devices locally over LAN. Includes new features, fixes, and updated device support.",
   "main": "index.js",
   "scripts": {

package/test/TuyaAccessory.protocol.test.js

@@ -10,6 +10,7 @@
 // mix of legacy paths.
 
 const crypto = require('crypto');
+const EventEmitter = require('events');
 const TuyaAccessory = require('../lib/TuyaAccessory');
 const TuyaDiscovery = require('../lib/TuyaDiscovery');
 
@@ -526,3 +527,100 @@ describe('discovery of 3.5+/3.6 devices', () => {
         expect(found[0].version).toBe('3.6');
     });
 });
+
+// Many Tuya devices (e.g. LED ceiling lights) recycle their long-lived LAN
+// sockets every few minutes, closing the connection with a TCP FIN ('end').
+// The handler must tear that connection down and reconnect promptly instead of
+// leaving a half-dead socket whose stale heartbeat timer later fires a
+// misleading ERR_PING_TIMED_OUT - which used to be the only thing that
+// triggered a reconnect.
+describe('graceful disconnect handling', () => {
+    const net = require('net');
+    let realNetSocket;
+    let createdSockets;
+
+    const makeFakeSocket = () => {
+        const s = new EventEmitter();
+        s.destroyed = false;
+        s.setKeepAlive = () => {};
+        s.setNoDelay = () => {};
+        s.connect = jest.fn();
+        s.write = jest.fn(() => true);
+        s.destroy = jest.fn(function destroy() { this.destroyed = true; });
+        return s;
+    };
+
+    beforeEach(() => {
+        jest.useFakeTimers();
+        createdSockets = [];
+        realNetSocket = net.Socket;
+        // TuyaAccessory calls net.Socket() dynamically, so swapping the property
+        // is enough to hand it a controllable fake (no real network I/O).
+        net.Socket = function FakeSocket() {
+            const s = makeFakeSocket();
+            createdSockets.push(s);
+            return s;
+        };
+    });
+
+    afterEach(() => {
+        net.Socket = realNetSocket;
+        jest.clearAllTimers();
+        jest.useRealTimers();
+    });
+
+    // Bring a device up to a steady, connected state on a fake socket.
+    const establish = device => {
+        device._connect();
+        const socket = device._socket;
+        // An established connection has already cleared its connect watchdog.
+        clearTimeout(socket._connTimeout);
+        socket._connTimeout = null;
+        device.connected = true;
+        return socket;
+    };
+
+    test("a device-initiated 'end' clears the heartbeat, tears down, and schedules a reconnect without a spurious ping timeout", () => {
+        const device = makeDevice('3.5');
+        const socket = establish(device);
+
+        // A heartbeat retry timer is in flight. With the old handler it survived
+        // the disconnect and later emitted a misleading ERR_PING_TIMED_OUT.
+        const pingErrors = [];
+        socket.on('error', err => {
+            if (err && err.message === 'ERR_PING_TIMED_OUT') pingErrors.push(err);
+        });
+        socket._pinger = setTimeout(
+            () => device._socket.emit('error', new Error('ERR_PING_TIMED_OUT')),
+            50
+        );
+
+        // The device closes the LAN connection on its own (TCP FIN -> 'end').
+        socket.emit('end');
+
+        expect(device.connected).toBe(false);
+        expect(socket._pinger).toBeNull();             // stale timer cleared
+        expect(socket.destroy).toHaveBeenCalledTimes(1); // socket torn down
+        expect(socket._errorReconnect).toBeTruthy();     // a reconnect is scheduled
+
+        // Advance well past where the leaked timer would have fired: it must not.
+        jest.advanceTimersByTime(1000);
+        expect(pingErrors).toHaveLength(0);
+
+        // The log reflects a clean disconnect, never a ping failure.
+        expect(device.log.info).toHaveBeenCalledWith('Disconnected from', device.context.name);
+        const logged = device.log.info.mock.calls.flat().join(' ');
+        expect(logged).not.toMatch(/ERR_PING_TIMED_OUT/);
+    });
+
+    test("the 'close' teardown clears any lingering heartbeat timer", () => {
+        const device = makeDevice('3.5');
+        const socket = establish(device);
+
+        socket._pinger = setTimeout(() => {}, 10000);
+        socket.emit('close');
+
+        expect(socket._pinger).toBeNull();
+        expect(device.connected).toBe(false);
+    });
+});