v0.1.9 — security: stop token leak + fix websocket flapping

python-homely 0.1.9

Security

• Disabled the Engine.IO logger. It logged the full WebSocket connection URL, which carries the bearer token in the query string (?token=Bearer <access_token>), leaking the access token to the consuming app's logs. All earlier versions (<=0.1.8) are affected and have been yanked.

Fixed

• Stopped sending the partner WebSocket query parameter. Homely's server rejects it (Partner <code> is not supported) and immediately closes the connection, causing a rapid connect/disconnect loop. partner_code is still accepted for API compatibility but is no longer added to the URL. Verified live: the socket connects once and stays connected.

Full changelog: v0.1.8...v0.1.9

v0.1.8 — WebSocket partner_code + hardened auth/logging

Added

• HomelyWebSocket accepts a partner_code argument and appends it as the
  partner query parameter on connect — required for the Homely Socket.IO
  endpoint to authorize the live-update stream.

Changed

• Token refresh now sends an X-Forwarded-For header.
• Location-data fetch failures log the Retry-After header and a truncated
  response body, making the current HTTP 439 outage easier to diagnose.

Notes

• Consumed by the Home Assistant homely integration v1.4.2, which runs in
  WebSocket-only mode while Homely's /home REST endpoint returns HTTP 439.

v0.1.7 websocket updates

test: update version assertion to 0.1.7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

v0.1.4 small websocket changes

bump + websocket-endringer

Release 0.1.3

Moves websocket connection lifecycle handling into python-homely
Adds a more accurate websocket connection-state model based on actual transport health
Prevents unnecessary reconnects when the websocket transport is still alive
Keeps token updates in sync without forcing reconnects on healthy websocket sessions
Exposes normalized websocket status helpers for integrations and diagnostics

Release 0.1.2

Added

• Added TokenEndpointResult with detailed auth/refresh failure metadata.
• Added fetch_token_details() and fetch_refresh_token_details() for typed, non-raising token endpoint diagnostics.

Changed

• authenticate() and refresh_access_token() now classify malformed responses, HTTP failures, auth failures, and network failures more precisely.
• HomelyResponseError now carries body_preview in addition to HTTP status metadata.
• Legacy token helpers remain available as compatibility wrappers on top of the new detailed token methods.

v0.1.1

Release 0.1.1

0.1.0 Initial release

Delete File