homebridge-tuya-plus 3.14.0-dev.6 → 3.14.0-pr.59.7

package/.github/workflows/publish-dev.yml

@@ -1,97 +1,56 @@
-name: Publish to npm (dev + PR test builds)
+name: Publish dev to npm
 
-# This workflow publishes two kinds of UNSTABLE builds to npm. Stable releases
-# always live on the `latest` dist-tag and are cut manually; nothing here ever
-# touches `latest`.
+# Publishes commits on `main` to npm under the `dev` dist-tag.
 #
-# 1. Dev builds (automatic) — every push to `main`:
-#      * Published under the `dev` dist-tag.
-#      * Versioned as <next-minor>.0-dev.<run-number> (e.g. 3.14.0-dev.42).
-#        package.json at 3.13.0 -> dev builds target 3.14.0. In semver these
-#        sort below the eventual 3.14.0 release, so `latest` always wins.
-#      * Release commits are skipped: if a push changes package.json's version
-#        (you bumped it to cut a real release), no dev build is published.
+# Versioning:
+#   * Dev builds target the NEXT minor release, since releases here are
+#     usually a minor bump. With package.json at e.g. 3.13.0, dev builds
+#     are published as 3.14.0-dev.<run-number> (minor +1, patch reset to 0,
+#     prerelease tag = the GitHub Actions run number). In semver these sort
+#     below the eventual 3.14.0 release, so `latest` always wins once cut.
+#   * Release commits are skipped: if a push changes package.json's version
+#     (i.e. you bumped it to cut a real release and publish to npm
+#     manually), no dev build is published for that push.
 #
-# 2. PR test builds (manual) — a maintainer comments `/publish` on a PR:
-#      * Published under a PR-specific `pr-<N>` dist-tag (e.g. pr-57), with a
-#        unique version <next-minor>.0-pr.<N>.<run-number> (e.g. 3.14.0-pr.57.43).
-#      * Lets you install and try an unmerged PR on real hardware without
-#        disturbing `latest` OR `dev`:  npm i -g homebridge-tuya-plus@pr-57
-#      * Cleanup is a token-free local step: run `npm run cleanup:pr-tags` to
-#        delete the `pr-<N>` tags of merged/closed PRs (uses your npm login).
-#        OIDC can't manage dist-tags, so this is intentionally not a CI job.
-#      * Triggered ONLY by someone with push (write) access to the repo — the
-#        owner and any write/maintain/admin collaborator. A drive-by `/publish`
-#        from an outside PR author (no push access) does nothing.
+# Security model (why a malicious PR cannot steal publishing rights):
+#   * No npm token is stored anywhere. Publishing uses npm Trusted
+#     Publishing (OIDC): GitHub mints a short-lived, cryptographically
+#     signed token that npm only accepts when its claims match THIS repo +
+#     THIS workflow file. There is no durable credential to exfiltrate.
+#   * This workflow never runs on `pull_request`, only on pushes to `main`
+#     (post-merge) and manual dispatch — so fork PRs get nothing.
+#   * The privileged `publish` job is minimal and isolated: it does not
+#     run `npm ci`, a build, or tests, and uses `--ignore-scripts`, so no
+#     repo/dependency code executes while the OIDC permission is present.
+#     Tests run in a separate, unprivileged job that gates publishing, and
+#     the version is computed in an unprivileged `prepare` job.
 #
-# Why a separate `pr-<N>` tag instead of reusing `dev`: `dev` is a moving
-# channel users follow to get "latest main". Publishing unmerged PR code there
-# would feed untested code to everyone on `@dev`. A per-PR tag keeps three clear
-# lanes — `latest` (everyone), `dev` (main followers), `pr-<N>` (that one PR).
-#
-# ---------------------------------------------------------------------------
-# Security model (why a malicious PR cannot steal publishing rights)
-# ---------------------------------------------------------------------------
-#   * No npm token is stored anywhere. Publishing uses npm Trusted Publishing
-#     (OIDC): GitHub mints a short-lived token that npm only accepts when its
-#     claims match THIS repo + THIS workflow file (publish-dev.yml) + the
-#     `npm-dev` environment. There is no durable credential to exfiltrate.
-#   * npm allows only ONE trusted publisher per package, so BOTH paths must run
-#     from this file and use `environment: npm-dev` to authenticate. (The PR
-#     path needs no extra npm/GitHub setup beyond the existing dev config.)
-#   * The `dev` path never runs on `pull_request`; the PR path runs on
-#     `issue_comment`, which always uses the workflow file from `main` — a PR
-#     cannot alter this file to change what runs.
-#   * Untrusted PR code is fenced off from the publishing credential:
-#       - `pr-test` checks out and runs the PR's code (npm ci / lint / test)
-#         but is UNPRIVILEGED: `contents: read`, no secrets, no id-token, and
-#         `persist-credentials: false`. Same blast radius as ordinary fork CI.
-#       - `pr-publish` HOLDS the OIDC permission but runs NO PR code: no
-#         `npm ci`, no build, no tests, and `--ignore-scripts` on both
-#         `npm version` and `npm publish`, so no lifecycle script executes
-#         while the credential is present. It only packs + uploads the tarball.
-#       - The OIDC token is scoped to THIS package, so a PR that renames the
-#         package in package.json cannot hijack a different one (publish fails).
-#       - The head SHA is resolved once, up front, and pinned for every later
-#         job, so a push landed after `/publish` cannot swap in different code.
-#   * Comment/reaction jobs use a write-scoped token but check out NO PR code.
-#
-# ---------------------------------------------------------------------------
-# One-time setup (already in place for the dev path; PR path reuses it):
+# One-time setup required for this to succeed (see PR/commit notes):
 #   1. npmjs.com -> package Settings -> Trusted Publisher:
 #        Publisher: GitHub Actions
 #        Organization/user: adrianjagielak
 #        Repository:        homebridge-tuya-plus
 #        Workflow filename: publish-dev.yml
 #        Environment:       npm-dev
-#   2. GitHub repo Settings -> Environments -> `npm-dev`, deployment branches
-#      restricted to `main` (optional: required reviewer). The PR path runs on
-#      `main`'s ref too, so this restriction is satisfied for both paths.
+#   2. GitHub repo Settings -> Environments -> create `npm-dev`,
+#      restrict deployment branches to `main` (optional: required reviewer).
 
 on:
   push:
     branches: [main]
   workflow_dispatch:
-  # Maintainer types `/publish` on a PR to cut a test build of that PR.
-  issue_comment:
-    types: [created]
 
-# Least privilege by default; jobs opt into more only where needed.
+# Least privilege by default; only the publish job opts into id-token.
 permissions:
   contents: read
 
-# Serialize per lane, never cancel an in-flight publish: `publish-dev` for the
-# dev path, `publish-pr-<N>` per PR for the PR path (so they don't block).
+# Don't cancel an in-flight publish; let each commit publish its version.
 concurrency:
-  group: ${{ github.event_name == 'issue_comment' && format('publish-pr-{0}', github.event.issue.number) || 'publish-dev' }}
+  group: publish-dev
   cancel-in-progress: false
 
 jobs:
-  # ===========================================================================
-  # DEV PATH — push to main / manual dispatch. (Behavior unchanged.)
-  # ===========================================================================
   test:
-    if: github.event_name != 'issue_comment'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -106,7 +65,6 @@ jobs:
   # computes the dev version. Kept out of the `publish` job so no extra work
   # runs while the OIDC publishing permission is present.
   prepare:
-    if: github.event_name != 'issue_comment'
     runs-on: ubuntu-latest
     outputs:
       should_publish: ${{ steps.check.outputs.should_publish }}
@@ -155,8 +113,8 @@ jobs:
 
   publish:
     needs: [test, prepare]
-    # Dev path only, and skip release commits (version bumped in this push).
-    if: github.event_name != 'issue_comment' && needs.prepare.outputs.should_publish == 'true'
+    # Skip release commits (version bumped in this push).
+    if: needs.prepare.outputs.should_publish == 'true'
     runs-on: ubuntu-latest
     # Bind this environment in repo Settings to the `main` branch so that
     # only main can ever reach the publish step.
@@ -186,236 +144,3 @@ jobs:
       # --provenance attaches a signed build attestation (needs a public repo).
       - name: Publish (dev tag)
         run: npm publish --tag dev --provenance --ignore-scripts
-
-  # ===========================================================================
-  # PR PATH — maintainer comments `/publish` on a PR. (New.)
-  # ===========================================================================
-
-  # Gate + ack. Runs NO PR code. Verifies the commenter is a maintainer,
-  # resolves & pins the PR head, and reads the version base from trusted `main`.
-  authorize:
-    if: >
-      github.event_name == 'issue_comment' &&
-      github.event.issue.pull_request &&
-      startsWith(github.event.comment.body, '/publish') &&
-      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read # checkout main to read the version base
-      issues: write # react to / comment on the triggering comment
-      pull-requests: write
-    outputs:
-      authorized: ${{ steps.auth.outputs.authorized }}
-      head_sha: ${{ steps.auth.outputs.head_sha }}
-      head_repo: ${{ steps.auth.outputs.head_repo }}
-      pr_number: ${{ steps.auth.outputs.pr_number }}
-      base_version: ${{ steps.basever.outputs.base_version }}
-    steps:
-      - name: Verify maintainer & resolve PR head
-        id: auth
-        uses: actions/github-script@v7
-        with:
-          script: |
-            // Require the command to be exactly `/publish` (optional trailing text).
-            const body = (context.payload.comment.body || '').trim();
-            if (!/^\/publish(?:\s|$)/.test(body)) {
-              core.setOutput('authorized', 'false');
-              return;
-            }
-            // Authorization: the commenter must have PUSH (write) access. The
-            // REST `permission` field uses legacy roles, so `admin`/`write`
-            // covers admin/maintain/write (can push) and excludes triage/read.
-            // This is stricter and truer to intent than author_association (a
-            // COLLABORATOR could be read-only). The job `if` is only a coarse
-            // pre-filter; this API check is the authoritative gate.
-            const username = context.payload.comment.user.login;
-            let canPush = false;
-            try {
-              const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                username,
-              });
-              canPush = ['admin', 'write'].includes(perm.permission);
-              core.info(`${username} permission: ${perm.permission} (role: ${perm.role_name || 'n/a'})`);
-            } catch (err) {
-              // If the permission API can't be read, fall back to the trusted
-              // author_association set so a maintainer is never locked out. This
-              // still keeps out drive-by PR authors (CONTRIBUTOR / NONE).
-              const assoc = context.payload.comment.author_association;
-              canPush = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(assoc);
-              core.warning(`Permission API unavailable (${err.status || err.message}); fell back to association ${assoc}.`);
-            }
-            if (!canPush) {
-              core.notice(`Ignoring /publish from ${username}: no push access.`);
-              core.setOutput('authorized', 'false');
-              return;
-            }
-            // Resolve the PR's CURRENT head and pin this exact SHA for every
-            // later job, so a push landed after `/publish` can't swap in code.
-            const { data: pr } = await github.rest.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.payload.issue.number,
-            });
-            if (!pr.head.repo) {
-              core.setFailed('PR head repository is unavailable (fork deleted?).');
-              core.setOutput('authorized', 'false');
-              return;
-            }
-            core.setOutput('head_sha', pr.head.sha);
-            core.setOutput('head_repo', pr.head.repo.full_name);
-            core.setOutput('pr_number', String(pr.number));
-            core.setOutput('authorized', 'true');
-            // Acknowledge so the maintainer sees the command was accepted.
-            await github.rest.reactions.createForIssueComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: context.payload.comment.id,
-              content: 'eyes',
-            });
-
-      # Version base comes from TRUSTED main, never the PR's package.json, so an
-      # untrusted PR cannot influence the published version.
-      - name: Checkout main (trusted)
-        if: steps.auth.outputs.authorized == 'true'
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: Compute version base from main
-        id: basever
-        if: steps.auth.outputs.authorized == 'true'
-        run: |
-          NEXT="$(node -e "const v=require('./package.json').version.split('.'); v[1]=Number(v[1])+1; v[2]=0; console.log(v.join('.'))")"
-          echo "base_version=$NEXT" >> "$GITHUB_OUTPUT"
-          echo "Version base (from main): $NEXT"
-
-  # Unprivileged gate: runs the PR's code. No secrets, read-only token, no
-  # id-token, no persisted git credentials — same trust level as fork CI.
-  pr-test:
-    needs: authorize
-    if: needs.authorize.outputs.authorized == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ needs.authorize.outputs.head_repo }}
-          ref: ${{ needs.authorize.outputs.head_sha }}
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-      - run: npm ci
-      - run: npm run lint
-      - run: npm run test
-
-  # Privileged publish. Holds the OIDC permission but runs NO PR code: no
-  # npm ci, no build, no tests; --ignore-scripts on version + publish.
-  pr-publish:
-    needs: [authorize, pr-test]
-    if: needs.authorize.outputs.authorized == 'true'
-    runs-on: ubuntu-latest
-    # Must match the trusted publisher's environment (npm allows one publisher
-    # per package). issue_comment runs on main's ref, so a main-only branch
-    # restriction on this environment is satisfied.
-    environment: npm-dev
-    permissions:
-      contents: read
-      id-token: write # OIDC -> npm Trusted Publishing (no stored token)
-    outputs:
-      version: ${{ steps.ver.outputs.version }}
-      tag: ${{ steps.ver.outputs.tag }}
-    steps:
-      # The PR's code — but we never execute it (see --ignore-scripts below).
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ needs.authorize.outputs.head_repo }}
-          ref: ${{ needs.authorize.outputs.head_sha }}
-          persist-credentials: false
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-          registry-url: "https://registry.npmjs.org"
-
-      # Trusted Publishing (OIDC) requires npm >= 11.5.1.
-      - name: Ensure OIDC-capable npm
-        run: npm install -g npm@latest
-
-      # Unique, immutable version + a PR-specific dist-tag. Base comes from main
-      # (via authorize), so the PR's package.json cannot influence versioning.
-      - name: Compute PR build version + tag
-        id: ver
-        env:
-          BASE: ${{ needs.authorize.outputs.base_version }}
-          PR: ${{ needs.authorize.outputs.pr_number }}
-        run: |
-          VERSION="${BASE}-pr.${PR}.${GITHUB_RUN_NUMBER}"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "tag=pr-${PR}" >> "$GITHUB_OUTPUT"
-          echo "Will publish $VERSION under dist-tag pr-${PR}"
-
-      # Writes package.json on the runner only; --ignore-scripts so no PR
-      # version/preversion/postversion hook runs with the credential present.
-      - name: Set version
-        run: npm version "${{ steps.ver.outputs.version }}" --no-git-tag-version --allow-same-version --ignore-scripts
-
-      # Published under pr-<N>, NEVER latest/dev. No NODE_AUTH_TOKEN: npm
-      # exchanges the OIDC id-token for a short-lived, package-scoped credential.
-      # --ignore-scripts ensures no PR lifecycle script runs with that credential.
-      - name: Publish (pr-<N> tag)
-        run: npm publish --tag "${{ steps.ver.outputs.tag }}" --provenance --ignore-scripts
-
-  # Report the outcome back on the PR. Runs NO PR code.
-  notify:
-    needs: [authorize, pr-publish]
-    if: always() && needs.authorize.outputs.authorized == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/github-script@v7
-        env:
-          PUBLISH_RESULT: ${{ needs.pr-publish.result }}
-          PR_NUMBER: ${{ needs.authorize.outputs.pr_number }}
-          HEAD_SHA: ${{ needs.authorize.outputs.head_sha }}
-          VERSION: ${{ needs.pr-publish.outputs.version }}
-          TAG: ${{ needs.pr-publish.outputs.tag }}
-        with:
-          script: |
-            const { PUBLISH_RESULT, PR_NUMBER, HEAD_SHA, VERSION, TAG } = process.env;
-            const issue_number = Number(PR_NUMBER);
-            const comment_id = context.payload.comment.id;
-            const { owner, repo } = context.repo;
-            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
-            if (PUBLISH_RESULT === 'success') {
-              const sha = (HEAD_SHA || '').slice(0, 7);
-              const body = [
-                `🚀 Published this PR to npm for testing — built from \`${sha}\`.`,
-                ``,
-                `**Install this exact build:**`,
-                '```sh',
-                `npm install -g homebridge-tuya-plus@${VERSION}`,
-                '```',
-                `**…or follow this PR's tag** (always points at this PR's newest \`/publish\` build):`,
-                '```sh',
-                `npm install -g homebridge-tuya-plus@${TAG}`,
-                '```',
-                ``,
-                `In the Homebridge UI you can also paste \`${VERSION}\` into the plugin's “Install Alternate Version” field.`,
-                ``,
-                `> ℹ️ Prerelease for testing only — **not** tagged \`latest\` or \`dev\`, so it won't reach normal installs.`,
-              ].join('\n');
-              await github.rest.issues.createComment({ owner, repo, issue_number, body });
-              await github.rest.reactions.createForIssueComment({ owner, repo, comment_id, content: 'rocket' });
-            } else {
-              await github.rest.issues.createComment({
-                owner, repo, issue_number,
-                body: `❌ \`/publish\` did not complete — the build, tests, or publish step failed. See the [run logs](${runUrl}).`,
-              });
-              await github.rest.reactions.createForIssueComment({ owner, repo, comment_id, content: 'confused' });
-            }

package/Changelog.md

@@ -9,6 +9,8 @@ All notable changes to this project will be documented in this file. This projec
   * Works with both **Custom** and **Smart Home** Cloud projects (the latter via app-account login).
   * The existing **IrrigationSystem** accessory works unchanged over the cloud — its data-points are simply addressed by Tuya "code" (e.g. `switch_1`, `battery_percentage`) instead of a numeric id; the device logs its codes on startup. Battery-only controllers with no rain sensor: set `"noRainSensor": true`.
   * See the wiki: **[Tuya Cloud Setup](https://github.com/adrianjagielak/homebridge-tuya-plus/blob/main/wiki/Tuya-Cloud-Setup.md)**.
+* [*] **Fix realtime (MQTT) cloud updates being silently dropped** — external changes (physical buttons, the Tuya app, the device's own timers) now show up in HomeKit within a second or two. The decryptor was verifying the AES-GCM auth tag (`decipher.final()`), but Tuya's real status frames don't carry a tag that verifies against the documented AAD, so every realtime message was being thrown away. Now decrypts with `update()` only, matching the official `tuya/tuya-homebridge` and `0x5e/homebridge-tuya-platform` implementations.
+* [*] **Fix cloud irrigation valves that could be turned on but not off** — the per-zone write coalescer was dropping any command that matched the last-known `device.state`. Cloud devices never optimistically advance `state` (it only moves once the realtime stream confirms the device), so an "off" issued before the "on" was echoed matched the stale "off" and was discarded — HomeKit showed the zone closed while it kept running. Queued commands are now sent as-is (callers already queue only genuine changes).
 
 ## 2.0.1 (2021-03-25)
 This update includes the following changes:

package/Readme.MD

@@ -99,23 +99,9 @@ won't affect normal installs. To try the latest in-development build:
 sudo npm install -g homebridge-tuya-plus@dev
 ```
 
-These are versioned like `3.14.0-dev.<n>` and may be unstable; use the default
+These are versioned like `3.13.1-dev.<n>` and may be unstable; use the default
 install above for production.
 
-#### Testing a specific pull request:
-
-Maintainers can publish an unmerged PR as a throwaway test build by commenting
-`/publish` on it. The build goes to its own `pr-<number>` tag — never `latest`
-or `dev` — so it never reaches normal installs. The bot replies on the PR with
-the exact install command, e.g.:
-
-```
-sudo npm install -g homebridge-tuya-plus@pr-57
-```
-
-Each build also gets a unique, immutable version like `3.14.0-pr.57.<n>` that you
-can pin or paste into the Homebridge UI's "Install Alternate Version" field.
-
 ## Configuration
 > UI
 

package/lib/IrrigationSystemAccessory.js

@@ -614,16 +614,19 @@ class IrrigationSystemAccessory extends BaseAccessory {
             return;
         }
 
-        const dps = {};
-        let count = 0;
-        Object.keys(pending.dps).forEach(dp => {
-            if (pending.dps[dp] !== this.device.state[dp]) {
-                dps[dp] = pending.dps[dp];
-                count++;
-            }
-        });
-
-        if (count) this.device.update(dps);
+        // Send exactly what was queued. We deliberately do NOT drop data-points
+        // that appear to already match `device.state`: cloud devices never
+        // optimistically advance `state` (it only moves when the realtime/refresh
+        // stream confirms the device), so comparing against it would silently
+        // swallow a genuine command. The most visible symptom was a valve that
+        // could be turned on but never off — the "off" matched the stale "off"
+        // still in `state` (the "on" hadn't been echoed back yet) and was
+        // discarded, so HomeKit showed the zone closed while it kept running.
+        // Callers (_setValveActive, _setSystemActive, the auto-shutoff timers)
+        // already queue only real changes, judged against the HomeKit state the
+        // user sees, so there is nothing left to de-dupe here.
+        const dps = pending.dps;
+        if (Object.keys(dps).length) this.device.update(dps);
     }
 
     _valveService(cfg) {

package/lib/TuyaCloudMessaging.js

@@ -145,12 +145,12 @@ class TuyaCloudMessaging extends EventEmitter {
             envelope = JSON.parse(payload.toString());
         } catch (_) { return; }
 
-        const {protocol, data, t} = envelope;
+        const {protocol, data} = envelope;
         if (!data) return;
 
         let plaintext;
         try {
-            plaintext = this._decrypt(data, this.config && this.config.password, t);
+            plaintext = this._decrypt(data, this.config && this.config.password);
         } catch (ex) {
             this.log.debug(`Tuya Cloud realtime decrypt failed: ${ex.message}`);
             return;
@@ -179,26 +179,31 @@ class TuyaCloudMessaging extends EventEmitter {
     // Decrypt the MQTT `data` field. msg_encrypted_version 2.0 → AES-128-GCM,
     // 1.0 → AES-128-ECB. The AES key is the middle 16 chars of the broker
     // password (NOT the project Access Secret).
-    _decrypt(data, password, t) {
+    //
+    // The GCM auth tag is intentionally NOT verified: Tuya's real status frames
+    // do not carry a tag that verifies against the documented AAD, so calling
+    // `decipher.final()` would throw on every genuine message and silently drop
+    // all realtime updates. AES-GCM is a stream cipher, so `update()` alone
+    // recovers the plaintext correctly regardless of the tag; a wrong key just
+    // yields garbage that the subsequent JSON.parse rejects. Both the official
+    // `tuya/tuya-homebridge` and `0x5e/homebridge-tuya-platform` decrypt with
+    // `update()` only, for exactly this reason — `final()` here was the bug that
+    // stopped external changes (physical buttons, the Tuya app) from showing up.
+    _decrypt(data, password) {
         const key = Buffer.from(('' + (password || '')).substring(8, 24), 'utf8');
         const buf = Buffer.from(data, 'base64');
 
         // GCM (v2.0) layout: [ivLen(4) BE][iv(ivLen)][ciphertext][tag(16)].
-        // Try it first; if the header doesn't look like a sane IV length, or
-        // auth fails, fall back to ECB (v1.0).
+        // Try it first; if the header doesn't look like a sane IV length, fall
+        // back to ECB (v1.0).
         if (buf.length > 4 + GCM_TAG_LENGTH) {
             const ivLen = buf.readUIntBE(0, 4);
             if (ivLen >= 12 && ivLen <= 16 && (4 + ivLen + GCM_TAG_LENGTH) <= buf.length) {
                 try {
                     const iv = buf.slice(4, 4 + ivLen);
                     const ciphertext = buf.slice(4 + ivLen, buf.length - GCM_TAG_LENGTH);
-                    const tag = buf.slice(buf.length - GCM_TAG_LENGTH);
                     const decipher = crypto.createDecipheriv('aes-128-gcm', key, iv);
-                    decipher.setAuthTag(tag);
-                    const aad = Buffer.allocUnsafe(6);
-                    aad.writeUIntBE(Number(t) || 0, 0, 6);
-                    decipher.setAAD(aad);
-                    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+                    return decipher.update(ciphertext).toString('utf8');
                 } catch (gcmEx) {
                     // fall through to ECB
                 }

package/package.json

@@ -1,12 +1,11 @@
 {
   "name": "homebridge-tuya-plus",
-  "version": "3.14.0-dev.6",
+  "version": "3.14.0-pr.59.7",
   "description": "A community-maintained Homebridge plugin for controlling Tuya devices locally over LAN. Includes new features, fixes, and updated device support.",
   "main": "index.js",
   "scripts": {
     "test": "jest",
-    "lint": "eslint index.js lib/**.js bin/**.js",
-    "cleanup:pr-tags": "node scripts/cleanup-pr-tags.js"
+    "lint": "eslint index.js lib/**.js bin/**.js"
   },
   "bin": {
     "tuya-lan": "./bin/cli.js",

package/test/IrrigationSystemAccessory.test.js

@@ -492,4 +492,36 @@ describe('IrrigationSystemAccessory — cloud mode (data-points keyed by code)',
         jest.advanceTimersByTime(500);
         expect(device.update).toHaveBeenCalledWith({ zone_b: true });
     });
+
+    test('turning a zone off still writes false when the cloud never echoed the "on"', () => {
+        // The real cloud device never optimistically advances `state`; it only
+        // moves when the realtime stream confirms the device. Emulate that by
+        // making update() a no-op on state. A follow-up "off" must STILL be sent
+        // — otherwise the valve stays open while HomeKit shows it closed (the
+        // exact "can turn on but not off" report).
+        const { accessory, device } = makeHarness(cloudState(), { ...cloudCtx, defaultDuration: 0 });
+        device.update.mockImplementation(() => true); // writes never touch state
+        const v = valve(accessory, 'switch_1');
+
+        v.getCharacteristic(Characteristic.Active).triggerSet(1);
+        jest.advanceTimersByTime(500);
+        expect(device.update).toHaveBeenLastCalledWith({ switch_1: true });
+
+        v.getCharacteristic(Characteristic.Active).triggerSet(0);
+        jest.advanceTimersByTime(500);
+        expect(device.update).toHaveBeenLastCalledWith({ switch_1: false });
+    });
+
+    test('master OFF closes zones the cloud has not echoed as open', () => {
+        const { accessory, device } = makeHarness(cloudState(), { ...cloudCtx, defaultDuration: 0 });
+        device.update.mockImplementation(() => true); // writes never touch state
+
+        valve(accessory, 'switch_1').getCharacteristic(Characteristic.Active).triggerSet(1);
+        valve(accessory, 'switch_2').getCharacteristic(Characteristic.Active).triggerSet(1);
+        jest.advanceTimersByTime(500);
+
+        irrigation(accessory).getCharacteristic(Characteristic.Active).triggerSet(0);
+        jest.advanceTimersByTime(500);
+        expect(device.update).toHaveBeenLastCalledWith({ switch_1: false, switch_2: false });
+    });
 });

package/test/TuyaCloudMessaging.test.js

@@ -56,6 +56,30 @@ describe('TuyaCloudMessaging — decryption + dispatch', () => {
         expect(received[0]).toEqual([{code: 'switch_1', value: true, t}, {code: 'battery_percentage', value: 80, t}]);
     });
 
+    test('decrypts a GCM frame even when the auth tag does not verify (Tuya quirk)', () => {
+        // Real Tuya status frames carry a GCM tag that does NOT verify against
+        // the documented AAD. We must decrypt with update() only (no final(),
+        // no tag check) or every realtime update is silently dropped — which is
+        // exactly what stopped external changes from reaching HomeKit. Simulate
+        // it by clobbering the trailing 16-byte tag: the plaintext must still
+        // come through.
+        const mq = makeIdle();
+        const received = [];
+        mq.subscribeDevice('DEV1', status => received.push(status));
+
+        const t = Date.now();
+        const raw = Buffer.from(
+            encryptGCM(JSON.stringify({devId: 'DEV1', status: [{code: 'switch_1', value: true}]}), mq.config.password, t),
+            'base64'
+        );
+        crypto.randomBytes(16).copy(raw, raw.length - 16); // corrupt the auth tag
+
+        mq._onMessage('topic', Buffer.from(JSON.stringify({protocol: 4, data: raw.toString('base64'), t})));
+
+        expect(received).toHaveLength(1);
+        expect(received[0]).toEqual([{code: 'switch_1', value: true}]);
+    });
+
     test('decrypts a legacy ECB (v1.0) frame too', () => {
         const mq = makeIdle();
         const received = [];

package/scripts/cleanup-pr-tags.js

@@ -1,122 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * Prune stale `pr-<N>` npm dist-tags created by the `/publish` PR-test-build
- * workflow (.github/workflows/publish-dev.yml).
- *
- * Token-free by design: it shells out to `npm dist-tag`, which uses your
- * existing local npm login — the same one you use to publish releases. No CI
- * secret is involved. (npm's OIDC trusted publishing only covers `npm publish`,
- * not dist-tag management, which is why this is a local maintainer script
- * rather than a CI job.)
- *
- * Default: removes the `pr-<N>` tag for every PR that is MERGED or CLOSED, and
- * keeps tags for PRs that are still open. PR state is read from the public
- * GitHub API (unauthenticated).
- *
- * Usage:
- *   npm run cleanup:pr-tags                # remove tags for merged/closed PRs
- *   npm run cleanup:pr-tags -- --dry-run   # preview only, change nothing
- *   npm run cleanup:pr-tags -- --all       # remove ALL pr-* tags (incl. open)
- *
- * Note: this removes the dist-tag pointer only. The underlying prerelease
- * versions stay published (npm disallows unpublishing after 72h), but they sort
- * below `latest`/`dev` and are never installed by default.
- */
-
-const { execFileSync } = require('child_process');
-const path = require('path');
-
-const pkgJson = require(path.join(__dirname, '..', 'package.json'));
-const PKG = pkgJson.name;
-const NPM = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-
-const args = process.argv.slice(2);
-const DRY_RUN = args.includes('--dry-run') || args.includes('-n');
-const ALL = args.includes('--all');
-
-// Derive "owner/repo" from package.json's repository URL.
-function repoSlug() {
-  const url = (pkgJson.repository && pkgJson.repository.url) || '';
-  const m = url.match(/github\.com[/:]([^/]+)\/(.+?)(?:\.git)?$/i);
-  if (!m) throw new Error(`Cannot parse a GitHub repo from repository.url: "${url}"`);
-  return `${m[1]}/${m[2]}`;
-}
-
-// Parse `npm dist-tag ls <pkg>` output ("pr-57: 3.14.0-pr.57.3") into pr-* tags.
-function listPrTags() {
-  let out;
-  try {
-    out = execFileSync(NPM, ['dist-tag', 'ls', PKG], { encoding: 'utf8' });
-  } catch (err) {
-    throw new Error(`Failed to list dist-tags for ${PKG}: ${err.message}`);
-  }
-  const tags = [];
-  for (const line of out.split('\n')) {
-    const m = line.match(/^(pr-(\d+)):\s*(.+)$/);
-    if (m) tags.push({ tag: m[1], pr: Number(m[2]), version: m[3].trim() });
-  }
-  return tags;
-}
-
-async function prState(slug, num) {
-  const res = await fetch(`https://api.github.com/repos/${slug}/pulls/${num}`, {
-    headers: { Accept: 'application/vnd.github+json', 'User-Agent': `${PKG}-cleanup` },
-  });
-  if (res.status === 404) return 'unknown';
-  if (!res.ok) throw new Error(`GitHub API responded ${res.status}`);
-  const data = await res.json();
-  return data.merged ? 'merged' : data.state; // 'merged' | 'open' | 'closed'
-}
-
-async function main() {
-  const slug = repoSlug();
-  const tags = listPrTags();
-  if (tags.length === 0) {
-    console.log(`No pr-* dist-tags on ${PKG}. Nothing to do.`);
-    return;
-  }
-  console.log(`Found ${tags.length} pr-* tag(s) on ${PKG}${DRY_RUN ? ' (dry run)' : ''}:`);
-
-  let removed = 0;
-  for (const { tag, pr, version } of tags) {
-    let remove = ALL;
-    let reason = 'forced by --all';
-    if (!ALL) {
-      let state;
-      try {
-        state = await prState(slug, pr);
-      } catch (err) {
-        console.log(`  • ${tag} -> ${version}: skip (could not check PR #${pr}: ${err.message})`);
-        continue;
-      }
-      remove = state === 'merged' || state === 'closed';
-      reason = `PR #${pr} is ${state}`;
-    }
-
-    if (!remove) {
-      console.log(`  • ${tag} -> ${version}: keep (${reason})`);
-      continue;
-    }
-    if (DRY_RUN) {
-      console.log(`  • ${tag} -> ${version}: would remove (${reason})`);
-      removed++;
-      continue;
-    }
-    try {
-      execFileSync(NPM, ['dist-tag', 'rm', PKG, tag], { encoding: 'utf8' });
-      console.log(`  • ${tag} -> ${version}: removed (${reason})`);
-      removed++;
-    } catch (err) {
-      console.log(`  • ${tag}: FAILED to remove (${err.message}). Are you \`npm login\`'d?`);
-    }
-  }
-
-  console.log(DRY_RUN ? `Would remove ${removed} tag(s).` : `Removed ${removed} tag(s).`);
-}
-
-main().catch((err) => {
-  console.error(err.message);
-  process.exit(1);
-});