Skip to content

Verification Request: homebridge-hilo-challenge #1181

Open
Open
Verification Request: homebridge-hilo-challenge#1181
Labels
awaiting-final-reviewrequest-verification

Description

@justinjsp
justinjsp
opened on Aug 24, 2026

Plugin Name

homebridge-hilo-challenge

Link To GitHub Repo

https://github.com/justinjsp/homebridge-hilo-challenge

Plugin Icon (Optional)

No response

The plugin does not offer the same nor less functionality than that of any existing verified plugin.

🟢 Yes

The plugin successfully installs and does not start unless it is configured.

🟢 Yes

The plugin does not require the user to run Homebridge in a TTY or with non-standard startup parameters, even for initial configuration.

🟢 Yes

The plugin does not contain any analytics or calls that enable you to track the user.

🟢 Yes

If the plugin needs to write files to disk (cache, keys, etc.), it stores them inside the Homebridge storage directory.

🟢 Yes

The plugin does not throw unhandled exceptions, the plugin must catch and log its own errors.

🟢 Yes

More Information

homebridge-hilo-challenge exposes Hilo (Hydro-Québec) demand-response challenge phases as two HomeKit contact sensors — Hilo Preheat and Hilo Reduction — so HomeKit automations can react to peak-demand events (e.g. pausing EV charging during a reduction).

  • Not a duplicate of the verified homebridge-hilo: that plugin integrates Hilo devices (thermostats, water heaters) as HomeKit accessories. This plugin does not control or expose devices — it detects the active challenge phase (via the gDState field on enrolled devices) and surfaces it as contact sensors. homebridge-hilo does not expose challenge-phase state, so the functionality is complementary, not overlapping.
  • Requires homebridge-hilo as a prerequisite: this plugin reuses the refresh token obtained by homebridge-hilo. The README and the config UI header both state that homebridge-hilo must be installed and configured first.
  • Does not start unless configured: the platform validates the required refreshToken field in its constructor and logs a clear error (no API calls, no accessories) when it is missing.
  • API calls go only to Hilo's Azure B2C auth endpoint (connexion.hiloenergie.com) and the Hilo GraphQL API (platform.hiloenergie.com) — no analytics or tracking. The plugin writes no files to disk, and polls only during challenge season (December–March).

npm: https://www.npmjs.com/package/homebridge-hilo-challenge

Activity

  1. justinjsp
    added
    pendingthe label given to a new verification/icon request
    request-verification
    on Aug 24, 2026

  2. github-actions commented on Aug 24, 2026

    @github-actions
    github-actionsBot
    on Aug 24, 2026 – with GitHub Actions
    Contributor

    🔴 Failed Checks

    • Config Schema JSON: schema is invalid - required should not be a boolean property on individual fields. In JSON Schema, required must be an array at the object level listing required property names. Remove "required": true/false from individual properties and use "required": ["property1", "property2"] at the object level instead.
    • Config Schema JSON: does not contain a name schema property
    • Dependencies: homebridge must only be in devDependencies (not dependencies, optionalDependencies, bundledDependencies, or peerDependencies — npm auto-installs peer deps)

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: keywords declare the supported transports ('supports-hap' and/or 'supports-matter')
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.4.0
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v0.1.5) matches NPM version (v0.1.5)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: no unsafe code patterns detected
    • Security: no privilege escalation attempts detected
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: issues are enabled
    • GitHub Repo: contains releases

    ℹ️ Check Details

    • These checks were run against v0.1.5 of the plugin.
    • Link to the run workflow: visit →.

    📋 Next Steps

    • Once you have fixed these failures, comment /check on this issue to run the checks again — your request will not move forward until the checks are re-run.
    • If updating your package.json and config.schema.json files, don't forget to publish a new version to NPM.
    • Remember this is an automatic script: if you think something has been marked as a failure in error, let us know with a reply.
    • Feel free to ask any questions you have by replying to this issue.
  3. github-actions
    added
    awaiting-changesuse after review has started - awaiting user to make changes to plugin
    and removed
    pendingthe label given to a new verification/icon request
    on Aug 24, 2026

  4. justinjsp commented on Aug 24, 2026

    @justinjsp
    justinjsp
    on Aug 24, 2026
    Author

    /check

  5. github-actions
    added
    pendingthe label given to a new verification/icon request
    and removed
    awaiting-changesuse after review has started - awaiting user to make changes to plugin
    on Aug 24, 2026

  6. github-actions commented on Aug 24, 2026

    @github-actions
    github-actionsBot
    on Aug 24, 2026 – with GitHub Actions
    Contributor

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: keywords declare the supported transports ('supports-hap' and/or 'supports-matter')
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.4.0
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v0.1.6) matches NPM version (v0.1.6)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains valid JSON Schema
    • Config Schema JSON: schema has valid type property
    • Config Schema JSON: schema has valid properties for object type
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Config Schema JSON: contains a name schema property
    • Dependencies: homebridge is not declared as a runtime/peer/bundled dependency
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: no unsafe code patterns detected
    • Security: no privilege escalation attempts detected
    • Runtime: homebridge installed successfully
    • Runtime: no config - homebridge should start without plugin configuration and plugin should not load
    • Runtime: platform only - plugin should start with just platform property
    • Runtime: minimal required - plugin should start with minimal required configuration
    • Runtime: full config - plugin should start with comprehensive configuration
    • Runtime: network resilience - plugin should handle network failures without crashing
    • Runtime: plugin shuts down cleanly within 12s of SIGTERM
    • Runtime: plugin restarts cleanly without port conflicts
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: issues are enabled
    • GitHub Repo: contains releases

    ℹ️ Check Details

    • These checks were run against v0.1.6 of the plugin.
    • Link to the run workflow: visit →.
    • External HTTP requests detected:
      • 📡 https://connexion.hiloenergie.com/HiloDirectoryB2C.onmicrosoft.com/oauth2/v2.0/token
        Methods: POST | Count: 1 | Scenarios: minimal required

    📋 Next Steps

    All checks passed successfully, nice work! Your plugin and/or icon will now be manually reviewed by the Homebridge team.

  7. github-actions
    added
    awaiting-final-review
    and removed
    pendingthe label given to a new verification/icon request
    on Aug 24, 2026

  8. bwp91 commented on Aug 25, 2026

    @bwp91
    bwp91
    on Aug 25, 2026
    Contributor

    Hi @justinjsp, thanks for this one too — and congrats again on homebridge-grizzl-e earlier today.

    I've spent some time with this plugin's code and I have a few concerns I'd like to talk through before verifying, because they're about how it behaves alongside the verified homebridge-hilo rather than about code quality (which is good).

    1. The shared refresh token can break homebridge-hilo. The user pastes homebridge-hilo's refreshToken into this plugin's config, so both plugins end up refreshing the same token — and Azure B2C rotates refresh tokens on use. Whichever plugin refreshes second gets invalid_grant. If that's homebridge-hilo, the user's actual Hilo devices drop out of HomeKit until they re-run its login flow. I'd also note this plugin keeps its rotated token in memory only, so after a Homebridge restart it falls back to the stale pasted value — meaning it will stop working on its own within days or weeks, with no recovery path other than re-pasting.

    2. The Preheat sensor values don't match the API schema. The plugin maps gDState values PRE_HEAT and RECOVERY, but the introspected schema for the same v3 GraphQL endpoint (committed in homebridge-hilo's repo as schema.graphql) defines DeviceGDState as a closed enum — ACTIVE, the CCR_* states, EXCLUDED, the OPT_OUT_* states, and UNKNOWN. PRE_HEAT/RECOVERY/OFF aren't in it, so as far as I can tell only the Reduction sensor (ACTIVE) can ever fire. If you've genuinely observed those values in responses I'd love to see one, because that would mean the schema is out of date.

    3. Smaller things. The location auto-discovery tries three REST paths that the code itself notes may 404 — the working one is /Automation/v1/api/Locations (visible in homebridge-hilo's source). And the README/config-header link to johannrichard/homebridge-hilo, which no longer exists — the prerequisite plugin lives at SanterreJo/homebridge-hilo.

    Given all of that, honestly I think this feature might be best delivered as a PR to homebridge-hilo itself: it already receives gDState in real time over its WebSocket subscription (it fetches the field today and discards it), and it owns the token lifecycle safely — which makes the whole shared-token problem disappear. Exposing the two contact sensors there would likely be a small addition.

    I'll leave this request open while you have a think — happy to discuss any of the above. Thanks!

  9. justinjsp commented on Oct 20, 2026

    @justinjsp
    justinjsp
    on Oct 20, 2026
    Author

    Thanks for the careful review, @bwp91. Taking your points in order:

    Purpose. homebridge-hilo exposes Hilo devices. This plugin exposes the challenge itself (Preheat, Reduction, Recovery) as sensors that drive automations for things Hilo doesn't control, like pausing EV charging or running a home battery. That's a separate job, which is why I'd like to keep it as its own plugin.

    1. Shared token. Agreed this needs fixing. 0.2.0 reads homebridge-hilo's current token from config.json instead of a pasted copy, which removes the stale-token-after-restart problem, but it still redeems that token itself. I'll change it so the plugin never redeems a token homebridge-hilo depends on.

    2. Preheat values. You're right: I don't have a captured response with PRE_HEAT or RECOVERY, and the schema doesn't include them. I'll move phase detection to the challenge events endpoint, which returns explicit preheat, reduction and recovery windows (the approach the Home Assistant Hilo integration uses), rather than inferring phases from gDState.

    3. I'll switch location discovery to /Automation/v1/api/Locations and fix the links to point at SanterreJo/homebridge-hilo.

    I'll comment /check once the new release is out. Could you leave this open until then?

  10. github-actions commented on Oct 20, 2026

    @github-actions
    github-actionsBot
    on Oct 20, 2026 – with GitHub Actions
    Contributor

    It looks like you wanted to re-run the checks, but the checks have not been started.

    To run them, please add a new comment with /check on a line by itself (it can be the only thing in the comment). It will not be picked up when it is part of a longer line.

  11. justinjsp
    added a commit that references this issue on Oct 26, 2026

    Own Hilo login, events-based phases, Automation locations endpoint

    6951106

  12. justinjsp commented on Oct 26, 2026

    @justinjsp
    justinjsp
    on Oct 26, 2026
    Author

    /check

  13. github-actions
    added
    pendingthe label given to a new verification/icon request
    and removed
    awaiting-final-review
    on Oct 26, 2026

  14. github-actions commented on Oct 26, 2026

    @github-actions
    github-actionsBot
    on Oct 26, 2026 – with GitHub Actions
    Contributor

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: keywords declare the supported transports ('supports-hap' and/or 'supports-matter')
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.4.0
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v0.2.0) matches NPM version (v0.2.0)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains valid JSON Schema
    • Config Schema JSON: schema has valid type property
    • Config Schema JSON: schema has valid properties for object type
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Config Schema JSON: contains a name schema property
    • Dependencies: homebridge is not declared as a runtime/peer/bundled dependency
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: no unsafe code patterns detected
    • Security: no privilege escalation attempts detected
    • Runtime: homebridge installed successfully
    • Runtime: no config - homebridge should start without plugin configuration and plugin should not load
    • Runtime: platform only - plugin should start with just platform property
    • Runtime: minimal required - plugin should start with minimal required configuration
    • Runtime: full config - plugin should start with comprehensive configuration
    • Runtime: plugin shuts down cleanly within 12s of SIGTERM
    • Runtime: plugin restarts cleanly without port conflicts
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: issues are enabled
    • GitHub Repo: contains releases

    ℹ️ Check Details

    • These checks were run against v0.2.0 of the plugin.
    • Link to the run workflow: visit →.

    📋 Next Steps

    All checks passed successfully, nice work! Your plugin and/or icon will now be manually reviewed by the Homebridge team.

  15. github-actions
    added
    awaiting-final-review
    and removed
    pendingthe label given to a new verification/icon request
    on Oct 26, 2026

  16. justinjsp commented on Oct 27, 2026

    @justinjsp
    justinjsp
    on Oct 27, 2026
    Author

    /check

  17. github-actions
    added
    pendingthe label given to a new verification/icon request
    and removed
    awaiting-final-review
    on Oct 27, 2026

  18. github-actions commented on Oct 27, 2026

    @github-actions
    github-actionsBot
    on Oct 27, 2026 – with GitHub Actions
    Contributor

    🟢 Passed Checks

    • Installation: successfully installed
    • Package JSON: homepage exists
    • Package JSON: bugs.url exists and seems a valid URL
    • Package JSON: keywords exist and contain 'homebridge-plugin'
    • Package JSON: keywords declare the supported transports ('supports-hap' and/or 'supports-matter')
    • Package JSON: 'preinstall' in scripts is not present
    • Package JSON: 'install' in scripts is not present
    • Package JSON: 'postinstall' in scripts is not present
    • Package JSON: engines.node property is compatible with Node 22
    • Package JSON: engines.node property is compatible with Node 24
    • Package JSON: engines.homebridge property is compatible with Homebridge 2.4.0
    • Package JSON: initializer function found
    • NPM Package: has not been deprecated
    • GitHub Repo: version in package.json (v0.3.0) matches NPM version (v0.3.0)
    • Config Schema JSON: exists and is valid JSON
    • Config Schema JSON: contains valid JSON Schema
    • Config Schema JSON: schema has valid type property
    • Config Schema JSON: schema has valid properties for object type
    • Config Schema JSON: contains a valid pluginAlias
    • Config Schema JSON: pluginAlias matches the platform/accessory registered in code
    • Config Schema JSON: the pluginType is set to 'platform'
    • Config Schema JSON: contains a name schema property
    • Dependencies: homebridge is not declared as a runtime/peer/bundled dependency
    • Dependencies: hap-nodejs is not declared as a runtime/peer/bundled dependency
    • Security: no known vulnerabilities in dependencies
    • Security: no unsafe code patterns detected
    • Security: no privilege escalation attempts detected
    • Runtime: homebridge installed successfully
    • Runtime: no config - homebridge should start without plugin configuration and plugin should not load
    • Runtime: platform only - plugin should start with just platform property
    • Runtime: minimal required - plugin should start with minimal required configuration
    • Runtime: full config - plugin should start with comprehensive configuration
    • Runtime: plugin shuts down cleanly within 12s of SIGTERM
    • Runtime: plugin restarts cleanly without port conflicts
    • GitHub Repo: repository is public
    • GitHub Repo: repository is not archived
    • GitHub Repo: issues are enabled
    • GitHub Repo: contains releases

    ℹ️ Check Details

    • These checks were run against v0.3.0 of the plugin.
    • Link to the run workflow: visit →.

    📋 Next Steps

    All checks passed successfully, nice work! Your plugin and/or icon will now be manually reviewed by the Homebridge team.

  19. github-actions
    added
    awaiting-final-review
    and removed
    pendingthe label given to a new verification/icon request
    on Oct 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    awaiting-final-reviewrequest-verification

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions