Undiscovered commands (LOCATE, cleaning-preset room names) — ideas & findings welcome

[jan-tdy]

Two features aren't implemented because no working local device call for them has been found:

1. LOCATE ("find me" / beep) — a native Home Assistant vacuum feature, but no TPAP equivalent has turned up.
2. Resolving a schedule's custom_rule_id back to actual room names — when a Tapo-app schedule is built from a saved "cleaning preset" instead of picking rooms directly, we can see the preset's ID but not what rooms it covers.

What's been tried

• Guessed several plausible method names via vacuum.send_command against a real TPAP-transport RV30 Max: setRobotFindMe, setFindMe, playFindMe, get_custom_clean_rules (with/without a start_index param). All four returned the identical Device error -1002 — most likely a generic "unrecognized method" response, not a near-miss.
• Captured real traffic from the official Tapo app (Android, PCAPdroid, connection-level metadata only — no TLS payload decryption) while using the app's locate and room/preset-editing screens. Result: zero connections to port 4433 (the local TPAP port this integration uses) — nearly all traffic went to TP-Link's cloud (euw1-app-server.iot.i.tplinkcloud.com and similar). This suggests these two features are likely handled via TP-Link's cloud API, not the local protocol.
• Local UDP discovery broadcasts (ports 20004/9999/9998) fired but got no replies during capture — most likely an Android VPN-capture limitation with broadcast/multicast, not proof the device doesn't respond to them.

An untried angle

Instead of watching the phone's outbound traffic (which mostly goes to the cloud and is hard to intercept cleanly), it might be more fruitful to watch traffic arriving at the vacuum itself — the device has to receive the command from somewhere eventually, even if the app sends it via the cloud. Options: port mirroring on your router (if supported), or ARP-spoofing just the vacuum's IP specifically (more surgical than intercepting the whole phone). If the cloud relays back to the device locally, this could reveal it without needing to break TLS on the phone side at all.

Want to help?

• Have a working command? Open a PR.
• Got a lead or a capture worth discussing? Reply here or open an issue.
• New idea entirely (room presets, path/trajectory tracking, anything else)? Post it here.