fix(onboarding): retry cfgwifi hello with SSID-derived pre-key

[AndLindemann]

Problem

One of my three Roborock S6 MaxV units (roborock.vacuum.a10, firmware 02.62.46) never answered the cfgwifi HELLO. Onboarding always ended with HELLO: no response, even after a factory reset and a firmware update. The other two units onboarded fine with the same machine and the same script.

Root cause

I captured the official Roborock app pairing that vacuum (Wi-Fi monitor mode on the open hotspot). The app first sends A01 frames, which the vacuum ignores. It then sends a 1.0 HELLO with the same JSON as the script. The difference is the AES key: the app uses the last 16 characters of the hotspot SSID instead of the static pre-key 6433df70f5a3a42e:

roborock-vacuum-a10_miap5F1D → uum-a10_miap5F1D

The vacuum answered the script's HELLO immediately once only that key was changed. With the static key it drops the HELLO silently: no reply and no ICMP error. The two other units still accept the static key.

Change

• onboard_once (CLI and GUI) tries the static key first, so behaviour is unchanged for vacuums that answer it. If there is no answer, it retries once with the SSID-derived key. The SSID is rebuilt as <model with dashes>_miap<last two MAC bytes>. The model comes from the selected device. The MAC is the hotspot gateway's, read from the OS ARP table: /proc/net/arp on Linux, arp -n on macOS, arp -a on Windows.
• Server: /admin/api/onboarding/devices now includes model. The clients already read device["model"], for example when they call start_session, but the payload never contained it.

Limitations

• "New vacuum" sessions have no model, so they don't get the fallback.
• Only verified on S6 MaxV (a10). The SSID format matches all three of my units.

Testing

• uv run pytest: 342 passed. The new tests/test_onboarding_prekey.py covers:
  • the key derivation;
  • ARP parsing for the macOS, Windows and Linux formats;
  • the fallback in both CLI and GUI, against a fake vacuum that only answers the SSID-derived key.
• End to end: the affected S6 MaxV now onboards and connects to the local server.

🤖 Generated with Claude Code