homebridge-tuya-plus 3.14.0-dev.5 → 3.14.0-dev.52

package/lib/TuyaAccessory.js

@@ -13,7 +13,13 @@ class TuyaAccessory extends EventEmitter {
     constructor(props) {
         super();
 
-        if (!(props.id && props.key && props.ip) && !props.fake) return this.log.info('Insufficient details to initialize:', props);
+        if (!(props.id && props.key && props.ip) && !props.fake) {
+            // `this.log` isn't assigned yet, and `props` carries the device's
+            // local key — log via props.log and name only the id (never dump the
+            // whole config, which leaks the key into logs/bug reports).
+            if (props.log) props.log.warn('Insufficient details to initialize device %s (need id, key and ip).', props.id || '(unknown id)');
+            return;
+        }
 
         this.log = props.log;
 
@@ -42,6 +48,21 @@ class TuyaAccessory extends EventEmitter {
             this.log.info(`${this.context.name} reports protocol ${this.context.version}, newer than the newest known Tuya LAN protocol (3.5); using the 3.5 (GCM) stack with ${this.context.version} headers.`);
         }
 
+        // A Tuya local key is the AES-128 key used for every LAN frame and must be
+        // exactly 16 bytes. A wrong-length key (mistyped, truncated, or pasted with
+        // stray characters) makes crypto.createCipheriv throw "Invalid key length"
+        // the moment we first talk to the device. That throw originates inside a
+        // socket callback, so it goes unhandled and crashes Homebridge - which then
+        // restarts and crashes again: a boot loop. Refuse to bring the LAN backend
+        // up for such a device and say why; with a Tuya Cloud session configured it
+        // still works as a cloud-only device, and other devices are unaffected.
+        this._invalidKey = !this.context.fake && !TuyaAccessory.isValidLocalKey(this.context.key);
+        if (this._invalidKey && this.log) {
+            const key = this.context.key;
+            const keyLength = typeof key === 'string' ? Buffer.byteLength(key, 'utf8') : (Buffer.isBuffer(key) ? key.length : 0);
+            this.log.error(`${this.context.name} (${this.context.id}) has an invalid local key: a Tuya local key must be exactly 16 characters (this one has ${keyLength}). LAN control is disabled for this device until the key is corrected.`);
+        }
+
         this.state = {};
         this._cachedBuffer = Buffer.allocUnsafe(0);
 
@@ -53,7 +74,6 @@ class TuyaAccessory extends EventEmitter {
 
         if (this._protocolVersion >= 3.2) {
             this.context.pingGap = Math.min(this.context.pingGap || 9, 9);
-            //this.log.info(`Changing ping gap for ${this.context.name} to ${this.context.pingGap}s`);
         }
 
         this.connected = false;
@@ -67,7 +87,19 @@ class TuyaAccessory extends EventEmitter {
         this.session_key = null;
     }
 
+    // A Tuya local key is the AES-128 key for the LAN protocol, so it must be
+    // exactly 16 bytes (createCipheriv rejects any other length). Measure a
+    // string the way createCipheriv does - by its UTF-8 byte length - so a key
+    // that merely looks 16 characters long but isn't (e.g. a stray multibyte
+    // character) is still caught.
+    static isValidLocalKey(key) {
+        if (Buffer.isBuffer(key)) return key.length === 16;
+        if (typeof key === 'string') return Buffer.byteLength(key, 'utf8') === 16;
+        return false;
+    }
+
     _connect() {
+        if (this._invalidKey) return;
         if (this.context.fake) {
             this.connected = true;
             return setTimeout(() => {
@@ -80,7 +112,6 @@ class TuyaAccessory extends EventEmitter {
         this._incrementAttemptCounter();
 
         (this._socket.reconnect = () => {
-            //this.log.debug(`reconnect called for ${this.context.name}`);
             if (this._socket._pinger) {
                 clearTimeout(this._socket._pinger);
                 this._socket._pinger = null;
@@ -196,7 +227,11 @@ class TuyaAccessory extends EventEmitter {
 
         this._socket.on('error', err => {
             this.connected = false;
-            this.log.info(`Socket had a problem and will reconnect to ${this.context.name} (${err && err.code || err})`);
+            // Routine: many Tuya devices recycle their LAN socket every few
+            // minutes, and a transient ECONNRESET/EPIPE reconnects silently.
+            // Keep the churn at debug; a genuine outage surfaces as HomeKit
+            // "No Response" (and via the cloud-fallback warnings).
+            this.log.debug(`Socket had a problem and will reconnect to ${this.context.name} (${err && err.code || err})`);
 
             if (err && (err.code === 'ECONNRESET' || err.code === 'EPIPE') && this._connectionAttempts < 10) {
                 this.log.debug(`Reconnecting with connection attempts =  ${this._connectionAttempts}`);
@@ -209,10 +244,10 @@ class TuyaAccessory extends EventEmitter {
             if (err) {
                 if (err.code === 'ENOBUFS') {
                     this.log.warn('Operating system complained of resource exhaustion; did I open too many sockets?');
-                    this.log.info('Slowing down retry attempts; if you see this happening often, it could mean some sort of incompatibility.');
+                    this.log.debug('Slowing down retry attempts; if you see this happening often, it could mean some sort of incompatibility.');
                     delay = 60000;
                 } else if (this._connectionAttempts > 10) {
-                    this.log.info('Slowing down retry attempts; if you see this happening often, it could mean some sort of incompatibility.');
+                    this.log.debug('Slowing down retry attempts; if you see this happening often, it could mean some sort of incompatibility.');
                     delay = 60000;
                 }
             }
@@ -240,14 +275,15 @@ class TuyaAccessory extends EventEmitter {
                 clearTimeout(this._socket._pinger);
                 this._socket._pinger = null;
             }
-
-            //this.log.info('Closed connection with', this.context.name);
         });
 
         this._socket.on('end', () => {
             this.connected = false;
             this.session_key = null;
-            this.log.info('Disconnected from', this.context.name);
+            // Routine for devices that recycle their socket; we reconnect
+            // promptly below, so keep it at debug rather than announcing a
+            // disconnect every few minutes.
+            this.log.debug('Disconnected from', this.context.name);
 
             // The device closed the connection on its own. This is routine for
             // many Tuya devices (e.g. LED ceiling lights) that recycle their
@@ -280,7 +316,6 @@ class TuyaAccessory extends EventEmitter {
     _incrementAttemptCounter() {
         this._connectionAttempts++;
         setTimeout(() => {
-            this.log.debug(`decrementing this._connectionAttempts, currently ${this._connectionAttempts}`);
             this._connectionAttempts--;
         }, 10000);
     }
@@ -301,7 +336,7 @@ class TuyaAccessory extends EventEmitter {
         let data = task.msg.slice(len - size, len - 8).toString('utf8').trim().replace(/\0/g, '');
 
         if (this.context.intro === false && cmd !== 9)
-            this.log.info('Message from', this.context.name + ':', data);
+            this.log.debug('Message from', this.context.name + ':', data);
 
         switch (cmd) {
             case 7:
@@ -329,13 +364,12 @@ class TuyaAccessory extends EventEmitter {
                     data = JSON.parse(decryptedMsg);
                 } catch (ex) {
                     data = decryptedMsg;
-                    this.log.info(`Odd message from ${this.context.name} with command ${cmd}:`, data);
-                    this.log.info(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
+                    this.log.debug(`Odd message from ${this.context.name} with command ${cmd}:`, data);
+                    this.log.debug(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
                     break;
                 }
 
                 if (data && data.dps) {
-                    //this.log.info('Update from', this.context.name, 'with command', cmd + ':', data.dps);
                     this._change(data.dps);
                 }
                 break;
@@ -344,7 +378,7 @@ class TuyaAccessory extends EventEmitter {
             case 10:
                 if (data) {
                     if (data === 'json obj data unvalid') {
-                        this.log.info(`${this.context.name} (${this.context.version}) didn't respond with its current state.`);
+                        this.log.debug(`${this.context.name} (${this.context.version}) didn't respond with its current state.`);
                         this.emit('change', {}, this.state);
                         break;
                     }
@@ -352,8 +386,8 @@ class TuyaAccessory extends EventEmitter {
                     try {
                         data = JSON.parse(data);
                     } catch (ex) {
-                        this.log.info(`Malformed update from ${this.context.name} with command ${cmd}:`, data);
-                        this.log.info(`Raw update from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
+                        this.log.debug(`Malformed update from ${this.context.name} with command ${cmd}:`, data);
+                        this.log.debug(`Raw update from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
                         break;
                     }
 
@@ -362,8 +396,8 @@ class TuyaAccessory extends EventEmitter {
                 break;
 
             default:
-                this.log.info(`Odd message from ${this.context.name} with command ${cmd}:`, data);
-                this.log.info(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
+                this.log.debug(`Odd message from ${this.context.name} with command ${cmd}:`, data);
+                this.log.debug(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
         }
 
         callback();
@@ -408,7 +442,7 @@ class TuyaAccessory extends EventEmitter {
         }
 
         if (cmd === 10 && decryptedMsg === 'json obj data unvalid') {
-            this.log.info(`${this.context.name} (${this.context.version}) didn't respond with its current state.`);
+            this.log.debug(`${this.context.name} (${this.context.version}) didn't respond with its current state.`);
             this.emit('change', {}, this.state);
             return callback();
         }
@@ -417,8 +451,8 @@ class TuyaAccessory extends EventEmitter {
         try {
             data = JSON.parse(decryptedMsg);
         } catch(ex) {
-            this.log.info(`Odd message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
-            this.log.info(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
+            this.log.debug(`Odd message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
+            this.log.debug(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
             return callback();
         }
 
@@ -427,18 +461,17 @@ class TuyaAccessory extends EventEmitter {
             case 10:
                 if (data) {
                     if (data.dps) {
-                        //this.log.info(`Heard back from ${this.context.name} with command ${cmd}`);
                         this._change(data.dps);
                     } else {
-                        this.log.info(`Malformed message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
-                        this.log.info(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
+                        this.log.debug(`Malformed message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
+                        this.log.debug(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
                     }
                 }
                 break;
 
             default:
-                this.log.info(`Odd message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
-                this.log.info(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
+                this.log.debug(`Odd message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
+                this.log.debug(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
         }
 
         callback();
@@ -537,7 +570,7 @@ class TuyaAccessory extends EventEmitter {
         }
 
         if (cmd === 10 && parsedPayload === 'json obj data unvalid') {
-            this.log.info(`${this.context.name} (${this.context.version}) didn't respond with its current state.`);
+            this.log.debug(`${this.context.name} (${this.context.version}) didn't respond with its current state.`);
             this.emit('change', {}, this.state);
             return callback();
         }
@@ -548,18 +581,17 @@ class TuyaAccessory extends EventEmitter {
             case 16:
                 if (parsedPayload) {
                     if (parsedPayload.dps) {
-                        //this.log.info(`Heard back from ${this.context.name} with command ${cmd}`);
                         this._change(parsedPayload.dps);
                     } else {
-                        this.log.info(`Malformed message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
-                        this.log.info(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
+                        this.log.debug(`Malformed message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
+                        this.log.debug(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
                     }
                 }
                 break;
 
             default:
-                this.log.info(`Odd message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
-                this.log.info(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
+                this.log.debug(`Odd message from ${this.context.name} with command ${cmd}:`, decryptedMsg);
+                this.log.debug(`Raw message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, task.msg.toString('hex'));
         }
 
         callback();
@@ -603,7 +635,7 @@ class TuyaAccessory extends EventEmitter {
             decipher.setAuthTag(tag);
             decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
         } catch(ex) {
-            this.log.info(`Failed to decrypt message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, ex);
+            this.log.debug(`Failed to decrypt message from ${this.context.name} (${this.context.version}) with command ${cmd}:`, ex);
             return callback();
         }
 
@@ -663,7 +695,7 @@ class TuyaAccessory extends EventEmitter {
         }
 
         if (cmd === 10 && parsedPayload === 'json obj data unvalid') {
-            this.log.info(`${this.context.name} (${this.context.version}) didn't respond with its current state.`);
+            this.log.debug(`${this.context.name} (${this.context.version}) didn't respond with its current state.`);
             this.emit('change', {}, this.state);
             return callback();
         }
@@ -675,11 +707,11 @@ class TuyaAccessory extends EventEmitter {
                 if (parsedPayload && parsedPayload.dps) {
                     this._change(parsedPayload.dps);
                 } else {
-                    this.log.info(`Malformed message from ${this.context.name} with command ${cmd}:`, payload.toString('utf8'));
+                    this.log.debug(`Malformed message from ${this.context.name} with command ${cmd}:`, payload.toString('utf8'));
                 }
                 break;
             default:
-                this.log.info(`Odd message from ${this.context.name} with command ${cmd}:`, payload.toString('utf8'));
+                this.log.debug(`Odd message from ${this.context.name} with command ${cmd}:`, payload.toString('utf8'));
         }
 
         callback();
@@ -702,7 +734,6 @@ class TuyaAccessory extends EventEmitter {
 
         let result = false;
         if (hasDataPoint) {
-            //this.log.info(" Sending", this.context.name, JSON.stringify(dps));
             const t = (Date.now() / 1000).toFixed(0);
             const payload = {
                 devId: this.context.id,
@@ -725,13 +756,14 @@ class TuyaAccessory extends EventEmitter {
                 data,
                 cmd: this._protocolVersion >= 3.4 ? 13 : 7
             });
-            if (result !== true) this.log.info(" Result", result);
+            // A non-true result here is the socket reporting backpressure (or a
+            // closed connection), not necessarily a dropped command; callers that
+            // care already check the boolean. Keep it as a debug breadcrumb.
+            if (result !== true) this.log.debug(`${this.context.name}: socket write returned ${JSON.stringify(result)}.`);
             if (this.context.sendEmptyUpdate) {
-                //this.log.info(" Sending", this.context.name, 'empty signature');
                 this._send({cmd: this._protocolVersion >= 3.4 ? 13 : 7});
             }
         } else {
-            //this.log.info(`Sending first query to ${this.context.name} (${this.context.version})`);
             result = this._send({
                 data: {
                     gwId: this.context.id,
@@ -762,6 +794,7 @@ class TuyaAccessory extends EventEmitter {
 
     _send(o) {
         if (this.context.fake) return;
+        if (this._invalidKey) return false;
         if (!this.connected) return false;
 
         if (this._protocolVersion < 3.2) return this._send_3_1(o);
@@ -963,7 +996,7 @@ class TuyaAccessory extends EventEmitter {
     }
 
     _fakeUpdate(dps) {
-        this.log.info('Fake update:', JSON.stringify(dps));
+        this.log.debug('Fake update:', JSON.stringify(dps));
         Object.keys(dps).forEach(dp => {
             this.state[dp] = dps[dp];
         });

package/lib/TuyaCloudApi.js

@@ -53,9 +53,18 @@ const REGION_ENDPOINTS = {
 // see one we drop the cached token and retry the call once.
 const TOKEN_INVALID_CODES = new Set([1010, 1011, 1004]);
 
+// Header/body/response field names whose values may be a credential or token.
+// Their values are masked before an HTTP trace is logged (debug.logCloudHttp),
+// so the trace never leaks the access token, signature, account password, uid,
+// or access key/id.
+const SECRET_FIELDS = /^(access_token|refresh_token|password|sign|secret|access_?key|access_?id|client_id|uid|localKey|key)$/i;
+
 class TuyaCloudApi {
-    constructor({accessId, accessKey, region, endpoint, username, password, countryCode, schema, log} = {}) {
+    constructor({accessId, accessKey, region, endpoint, username, password, countryCode, schema, log, logHttp} = {}) {
         this.log = log || console;
+        // Dev/diagnostic switch (debug.logCloudHttp): trace every cloud HTTP
+        // request/response, with credentials redacted. Off by default.
+        this.logHttp = !!logHttp;
         this.accessId = ('' + (accessId || '')).trim();
         this.accessKey = ('' + (accessKey || '')).trim();
 
@@ -78,6 +87,10 @@ class TuyaCloudApi {
         this.uid = null;           // linked app-account uid (needed for realtime MQTT)
         this._tokenExpiry = 0;     // ms epoch when the token must be refreshed
         this._tokenPromise = null; // in-flight token request (de-dupes concurrent callers)
+
+        // Reuse TLS connections across requests instead of a fresh handshake each
+        // time — noticeably cuts per-command latency and the startup read burst.
+        this._agent = new https.Agent({keepAlive: true, maxSockets: 8});
     }
 
     isConfigured() {
@@ -209,15 +222,67 @@ class TuyaCloudApi {
     }
 
     // Read every reported data-point in one call → array of {code, value}.
+    // Uses the current iot-03 device API, not the legacy /v1.0/devices/* set: the
+    // legacy endpoints answer 2003 ("function not support") for devices they don't
+    // model, where iot-03 works. This is the same family tinytuya and the official
+    // Tuya Homebridge plugin use throughout.
     async getStatus(deviceId) {
-        const res = await this.request('GET', `/v1.0/devices/${encodeURIComponent(deviceId)}/status`);
+        const res = await this.request('GET', `/v1.0/iot-03/devices/${encodeURIComponent(deviceId)}/status`);
         return (res && Array.isArray(res.result)) ? res.result : [];
     }
 
-    // Issue one or more commands: [{code, value}, …].
+    // Read the device's "thing shadow" properties. Like getStatus, but each item
+    // ALSO carries its numeric `dp_id` — which is exactly the id the LAN protocol
+    // uses to address that data-point. That mapping is what lets the plugin bridge
+    // a LAN-style (numeric DP) configuration to the cloud (string codes), and back,
+    // transparently — so the same accessory works over either transport.
+    //
+    // Returns an array of {code, dp_id, value} on success, or null when the
+    // endpoint isn't available (older projects, or the device-shadow API isn't
+    // authorised). Callers fall back to getStatus() in that case (code-only, no
+    // numeric mapping). Never throws.
+    //   Docs: https://developer.tuya.com/en/docs/cloud/116cc8bf6f?id=Kcp2kwfrpe719
+    async getShadowProperties(deviceId) {
+        try {
+            const res = await this.request('GET', `/v2.0/cloud/thing/${encodeURIComponent(deviceId)}/shadow/properties`);
+            return (res && res.result && Array.isArray(res.result.properties)) ? res.result.properties : null;
+        } catch (ex) {
+            this.log.debug(`Tuya Cloud shadow/properties unavailable for ${deviceId} (${ex.message}); falling back to /status.`);
+            return null;
+        }
+    }
+
+    // Read the device record (name, product, and crucially `online`). Used to
+    // learn whether the device is currently reachable. Returns the raw `result`
+    // object or null. Requires the project to have the device-management API
+    // authorized; callers treat a failure as "online unknown".
+    async getDeviceInfo(deviceId) {
+        const res = await this.request('GET', `/v1.0/devices/${encodeURIComponent(deviceId)}`);
+        return (res && res.result && typeof res.result === 'object') ? res.result : null;
+    }
+
+    // Issue one or more commands: [{code, value}, …]. Uses the current iot-03
+    // device-control endpoint (the legacy /v1.0/devices/{id}/commands answers 2008
+    // for devices it doesn't model), matching tinytuya and the official plugin.
     async sendCommands(deviceId, commands) {
         if (!Array.isArray(commands) || !commands.length) return true;
-        const res = await this.request('POST', `/v1.0/devices/${encodeURIComponent(deviceId)}/commands`, {commands});
+        const res = await this.request('POST', `/v1.0/iot-03/devices/${encodeURIComponent(deviceId)}/commands`, {commands});
+        return !!(res && res.result);
+    }
+
+    // Control a device through the thing-model "send property" endpoint. Some
+    // fully-custom devices (e.g. gate controllers) have no standard instruction
+    // set at all — every /commands API, legacy or iot-03, answers 2008 for them —
+    // but the cloud still models them as thing-model properties (their shadow
+    // reads fine). Issuing those properties is how Tuya's own app drives such a
+    // device. Same [{code, value}, …] in; the body is {properties: "<json>"} where
+    // <json> is a JSON string of {code: value, …}.
+    //   Docs: https://developer.tuya.com/en/docs/cloud/c057ad5cfd?id=Kcp2kxdzftp91
+    async sendProperties(deviceId, commands) {
+        if (!Array.isArray(commands) || !commands.length) return true;
+        const properties = {};
+        commands.forEach(c => { properties[c.code] = c.value; });
+        const res = await this.request('POST', `/v2.0/cloud/thing/${encodeURIComponent(deviceId)}/shadow/properties/issue`, {properties: JSON.stringify(properties)});
         return !!(res && res.result);
     }
 
@@ -250,6 +315,46 @@ class TuyaCloudApi {
 
     /* ------------------------- transport ------------------------------- */
 
+    _maskSecret(value) {
+        const s = '' + value;
+        return s.length <= 8 ? '***' : `${s.slice(0, 4)}…${s.slice(-4)}`;
+    }
+
+    // Deep copy with any credential-looking field masked, so a full HTTP trace
+    // can be logged without leaking the token, signature, account password, or
+    // access key/id (the device `value`s themselves are not secret and stay).
+    _redactForLog(value) {
+        if (Array.isArray(value)) return value.map(v => this._redactForLog(v));
+        if (value && typeof value === 'object') {
+            const out = {};
+            for (const k of Object.keys(value)) {
+                out[k] = SECRET_FIELDS.test(k) ? this._maskSecret(value[k]) : this._redactForLog(value[k]);
+            }
+            return out;
+        }
+        return value;
+    }
+
+    // One redacted request/response trace line, emitted only when the
+    // debug.logCloudHttp switch is set. It's routine, per-request and verbose, so
+    // it goes to debug. Never throws and never leaks a secret (see _redactForLog).
+    _traceHttp(method, urlPath, headers, bodyStr, statusCode, responseBody) {
+        if (!this.logHttp) return;
+        try {
+            let reqBody = '(none)';
+            if (bodyStr) {
+                try { reqBody = JSON.stringify(this._redactForLog(JSON.parse(bodyStr))); }
+                catch (_) { reqBody = ('' + bodyStr).slice(0, 200); }
+            }
+            this.log.debug(
+                `[TuyaCloud HTTP] ${method} ${urlPath} → HTTP ${statusCode}` +
+                ` | req.headers=${JSON.stringify(this._redactForLog(headers))}` +
+                ` | req.body=${reqBody}` +
+                ` | res=${JSON.stringify(this._redactForLog(responseBody))}`
+            );
+        } catch (_) { /* logging must never throw */ }
+    }
+
     _httpsRequest(method, urlPath, headers, bodyStr) {
         return new Promise((resolve, reject) => {
             let url;
@@ -264,21 +369,29 @@ class TuyaCloudApi {
                 port: url.port || 443,
                 path: url.pathname + url.search,
                 method,
-                headers
+                headers,
+                agent: this._agent
             }, resp => {
                 let data = '';
                 resp.setEncoding('utf8');
                 resp.on('data', chunk => { data += chunk; });
                 resp.on('end', () => {
+                    let parsed;
                     try {
-                        resolve(JSON.parse(data));
+                        parsed = JSON.parse(data);
                     } catch (ex) {
-                        reject(new Error(`Tuya Cloud returned non-JSON (HTTP ${resp.statusCode}): ${('' + data).slice(0, 200)}`));
+                        this._traceHttp(method, urlPath, headers, bodyStr, resp.statusCode, data);
+                        return reject(new Error(`Tuya Cloud returned non-JSON (HTTP ${resp.statusCode}): ${('' + data).slice(0, 200)}`));
                     }
+                    this._traceHttp(method, urlPath, headers, bodyStr, resp.statusCode, parsed);
+                    resolve(parsed);
                 });
             });
 
-            req.on('error', reject);
+            req.on('error', err => {
+                if (this.logHttp) { try { this.log.debug(`[TuyaCloud HTTP] ${method} ${urlPath} → error: ${err.message}`); } catch (_) { /* never throw */ } }
+                reject(err);
+            });
             req.setTimeout(20000, () => req.destroy(new Error('request timed out')));
             if (bodyStr) req.write(bodyStr);
             req.end();