fix: track a ring-mqtt that can still authenticate with Ring

[pkeenan87]

Sign-in is currently broken for every user

Ring retired the password-grant OAuth endpoint. The pinned ring-mqtt v5.9.3 requires "@tsightler/ring-client-api": "^14.3.1-beta.0", which still posts grant_type=password to /oauth/token.

I traced what happens on a real machine. Ring replies with a body that is not a JSON object, so the client's JSON.parse fallback leaves response.refresh_token as undefined:

{"at":"getAuth.response","grant":"password","had2faCode":true,
 "responseKeys":"string","hasRefreshToken":false,"hasAccessToken":false}

JSON.stringify then drops the undefined field, and what gets saved as the refresh token is a 64-character blob containing only the hardware id:

{"hid":"…"}

Every subsequent call fails:

401 invalid_grant — "token is invalid or does not exists"

ring-client-api 15.0.0-beta.2 replaces that flow with the PKCE authorization Ring now requires (/oauth/v2/authorize, code verifier, cookie jar, User-Agent: android:com.ringapp, apiVersion: 11). A caret range cannot cross a major, so no tagged ring-mqtt release resolves to it — this is not something a user can work around, and it affects every distribution, not just Arch.

What this changes

Pins ring-mqtt 5.10.0 (dev, 6bd8ed6), which pairs that client with the code written for it. Two consequences in the installed tree:

• scripts/start-stream.sh and scripts/monitor-stream.sh no longer exist, so the existing chmod 755 on them aborts setup under set -e. Removed.
• Streaming moved off the go2rtc exec source onto a helper binary. It ships prebuilt inside the checkout you already verify against an immutable commit, so installing it adds no download and no new trust surface.

Verified end to end

On Arch, against real cameras — not just a green test run:

• sign-in now yields a token carrying rt (1216 chars, {"hid","rt"}) instead of the 64-char shell
• six cameras discovered, all online, with battery and wifi telemetry
• ffprobe confirms a live stream: 1080p HEVC + Opus
• the helper serves RTSP on the same port 8554, so the panel's stream URLs are unchanged

node --test tests/*.test.mjs passes 44/44.

The tradeoff

This pins an unreleased commit, which I know is not ideal. The alternative is leaving the plugin unusable until ring-mqtt tags 5.10.0. Happy to rework this into a tag bump the moment one exists, or to hold it open until then.

One thing I deliberately left alone: go2rtc is now installed but unused, since only ring-mqtt ever spawned it. Removing it touches the README, the removal script, and the install marker, so I kept this change focused — glad to do it as a follow-up.

Note: this touches scripts/setup-native.sh and the same tests as my other two PRs. I'll rebase whichever lands second.

🤖 Generated with Claude Code