v3.7.4

What's Changed

codex setup auto-upgrade

• switchbot codex setup now detects and upgrades outdated CLI versions automatically
• Network offline detection: skips install step with a helpful message when npm registry is unreachable
• Re-verifies installed version after upgrade for accurate success messages

Version check fixes

• compareVersions: strips pre-release/build metadata before comparison (e.g. 3.8.0-rc.1 treated as 3.8.0)
• fetchLatestPublishedVersion: regex changed to prefix match, accepting pre-release version strings from registry

Codex plugin credential check fix

• check-credentials now calls auth keychain get --json (checks present field) instead of auth keychain describe (only checked backend availability)
• Fixes false-positive credential detection on machines with no stored credentials

Capabilities metadata fix

• reset command reclassified from ACTION_LOCAL to DESTRUCTIVE_LOCAL
• Ensures agents prompt for confirmation before running switchbot reset

codex-plugin 0.1.2

• Bundled codex plugin update with credential check fix and updated tests

v3.7.3

What's Changed

Added

• Route B (git marketplace) — codex setup and codex repair now try codex plugin marketplace add OpenWonderLabs/switchbot-openapi-cli --sparse packages/codex-plugin --ref main before falling back to the local npm path. Route B requires no locally-installed @switchbot/codex-plugin, making fresh installs and CI environments work out of the box. Configurable via CODEX_GIT_MARKETPLACE_REF (default main) and CODEX_MARKETPLACE_ADD_TIMEOUT (default 60 000 ms).
• On-demand npm install — when both Route B and Route A fail, registerCodexPluginAuto installs @switchbot/codex-plugin@latest and retries Route A automatically. Covers fresh-machine setups where the npm package was never installed.

Changed

• codex setup removes the install-codex-plugin step — on-demand install is now embedded inside register-plugin via registerCodexPluginAuto, so the explicit step is no longer needed. --skip install-codex-plugin is still accepted (silently ignored) for backward compatibility.
• Legacy plugin ID cleanup — codex repair's remove-plugin step now removes both the current ID and the legacy ID switchbot@switchbot-skill before re-registering, matching the pre-clean behaviour already present in the registration helpers.

Fixed

• Dangling symlink crash — resolveMarketplaceSourceRoot called realpathSync without a guard; if the junction/symlink target was deleted (e.g. after nvm use or npm uninstall), it threw ENOENT and aborted registration. It now catches the error, removes the stale link, and recreates it pointing at the current package root.
• Empty CODEX_GIT_MARKETPLACE_REF env var — ?? was used instead of ||, so setting the variable to an empty string passed --ref "" to the CLI instead of falling back to "main".
• Misleading "installed" in error message — when @switchbot/codex-plugin was already present and Route A retry still failed, the error reported "installed @switchbot/codex-plugin but Route A still failed". The message now says "already present" when no install actually ran.
• Platform-split error message — the alias-path error now reads "not a junction" on Windows and "not a symlink" on Linux/macOS instead of the ambiguous "not a symlink/junction".
• switchbot-codex-install binary frozen — resolveMarketplaceSourceRoot in packages/codex-plugin/bin/install.js is now marked frozen. The binary is deprecated; use switchbot codex setup instead.

Full Changelog: v3.7.2...v3.7.3

v3.7.2

See CHANGELOG.md for full details.

v3.7.1

Fixed

• auth login — credentials now decoded as hex instead of UTF-8 after AES-128-CBC decryption. The Wonder API returns raw binary bytes; decoding as UTF-8 produced non-ASCII characters that caused "Invalid character in header content" HTTP errors on subsequent API calls.
• auth login — OAuth callback server now calls closeAllConnections() in every termination path (success, OAuth error, timeout). Previously, browser keep-alive TCP sockets prevented the CLI process from exiting after login completed.
• MCP list_devices — hubDeviceId schema relaxed to nullable().optional() in both deviceList and infraredRemoteList output schemas. Devices without a hub (standalone Wi-Fi devices, IR remotes) return null or omit the field; the strict z.string() schema caused tool call validation failures for these devices.

Full changelog: https://github.com/OpenWonderLabs/switchbot-openapi-cli/blob/main/CHANGELOG.md

v3.7.0

What's New

• auth login — browser-based OAuth 2.0 sign-in; no more manual token copy-paste
• reset — one command to wipe all local data (credentials, cache, quota, history)
• Env-var overrides for OAuth/AES constants (SWITCHBOT_OAUTH_CLIENT_SECRET, SWITCHBOT_TOKEN_AES_KEY, SWITCHBOT_TOKEN_AES_IV)
• devices expand supports setBrightness, setColor, setColorTemperature

Breaking Changes

• schemaVersion bumped to 1.2
• catalog show <Type> --json / devices commands <Type> --json: data is always an array
• _fetchedAt → fetchedAt in devices status JSON
• MCP list_devices: roomID and controlType now accept null

Bug Fixes

• reset --config scopes data paths correctly
• devices list --json --fields alias resolution
• Credential-missing hint preserves --config
• Daemon bundled-build path (BUG-001), rules exit code (BUG-002), subcommand exit code (BUG-005/008), MCP tools metadata (BUG-007), Pino stdout (BUG-009)

Full Changelog: v3.6.3...v3.7.0

v3.6.3

Bug Fixes

• Webhook listener port race: read server.address() inside the listening callback to prevent stale port on Windows IOCP
• Webhook 413 socket leak: drain request before sending 413 so response flushes; destroy socket on finish
• plan suggest exit code: missing --device now exits 2 (usage error) instead of 1
• plan suggest --devices alias: added --devices as alias for --device; mixed usage preserves argv insertion order
• devices status --strict: exits 1 if any batch device fetch fails
• device-meta list hidden filter: human mode hides hidden devices by default; --all shows all; JSON always exports all
• doctor MCP message: reports default-profile tool count and hints at --tools all
• quota status reset time: "Remaining budget" now includes local reset time
• policy/validate CJS interop: replaced createRequire hack with static import for ajv-formats
• @modelcontextprotocol/sdk bundled: moved to devDependencies; esbuild inlines it, reducing install footprint

Added

• Shell completions for policy, rules, auth keychain, status-sync, daemon (bash / zsh / fish / PowerShell)
• TESTING.md: three coverage conventions enforced going forward
• Layered coverage thresholds in CI (global ≥ 81% lines, src/commands ≥ 75% lines)
• 2581 tests (+116 vs 3.6.2)

v3.6.2

Catalog sync + LLM/daemon followups.

• Catalog: Weather Station, Lock Vision / Lock Vision Pro, Smart Lock Pro Wifi (Matter alias on Smart Lock), AI Art Frame uploadImage <imageUrl>
• LLM condition budgets gain USD (max_cost_per_day_usd) and token (max_tokens_per_hour) dimensions, sourced from src/llm/pricing.ts; audit records budgetDimension / budgetLimit / budgetObserved
• New event_count condition counts device events in a rolling window backed by the events history JSONL ring; recent_events LLM hook now wired into RulesEngine
• New provider: local for OpenAI-compatible chat endpoints (Ollama / llama.cpp / vLLM / LM Studio) with structured-output fallback for non-tool-use models; opt-in tool use via tool_use: true or SWITCHBOT_LOCAL_LLM_TOOL_USE=1
• JSON-RPC 2.0 daemon IPC over Unix socket / per-user named pipe (methods: daemon.status, daemon.ping, daemon.reload)
• New doctor checks: daemon-ipc and local-llm-reachable

See CHANGELOG.md for full details.

v3.6.1

• Catalog coverage for real-account device types (Pan/Tilt Cam Plus 3K, Remote, Presence Sensor)
• MCP --tools help clarity, doctor --quiet, inventory hint, Relay Switch 2PM docs
• Quality gates + param-validator convergence
• parseStrictInt hardening; audit client-error classification

3.6.0

MCP tool profiles, parameter validation hardening.

• Add --tools flag to mcp serve / mcp tools: readonly (10), default (13), all (24)
• Client-side parameter validation for 15+ device families
• Type coercion guards reject booleans, arrays, empty strings before Number()
• Alias canonicalization in validateParameter and isLightingCommandSupported
• Sync expand validators with raw validators (device-aware brightness, even-angle blind tilt)
• Extract parseParameterForWire for consistent JSON parameter dispatch

3.5.0

• AI device type fallback with typeSource signal and Unknown Device sentinel
• Status identity injection (deviceId/deviceType in all responses)
• ~148 CSS Level 4 named colors for setColor
• Command aliases: scenes run, history list
• --once shorthand for --max 1 on watch
• --plan inline JSON for plan run
• Health audit layered error breakdown (expected vs unexpected)
• Batch [n/total] progress in human mode