@homebridge-plugins/homebridge-govee 11.32.2-beta.27 → 11.32.2-beta.28

package/CHANGELOG.md

@@ -44,7 +44,7 @@ All notable changes to `@homebridge-plugins/homebridge-govee` will be documented
 - feat: recognise eleven more meat thermometers, which report what they send so their readings can be worked out, and stop the one already known printing its whole update as a warning
 - feat: add the H5161 power strip and give the H7184 kitchen composter an on and off switch
 - feat: recognise three more sensors, which report what they send, and say plainly in the log why a sensor has no tile yet
-- feat: add ble encryption for the H3001 solar string lights, which silently ignore unencrypted frames (#1328)
+- feat: add ble encryption for the H3001 solar string lights, which silently ignore unencrypted frames (#1328) (@dominick-han)
 
 ## v11.32.1 (2026-08-02)
 

package/lib/connection/ble.js

@@ -319,7 +319,7 @@ export default class BLEConnection {
    * Unlike every other path in this client we need a reply, which arrives as a
    * notification on UUID.NOTIFY. Note that we deliberately do NOT subscribe:
    * these lights push notifications without the client ever writing the client
-   * characteristic configuration descriptor, exactly as the official app does.
+   * characteristic configuration descriptor.
    * Calling subscribeAsync() here makes the descriptor write hang and the light
    * then drops the connection, so listening is both sufficient and required.
    *

package/lib/device/sensor-co2.js

@@ -9,7 +9,8 @@ import platformLang from '../utils/lang-en.js'
 import GoveeDevice from './base.js'
 
 // HomeKit triggers "CO2 detected" abnormal flag at this threshold (ppm).
-// Govee app default warn level is 1000 ppm; override via deviceConf.co2AbnormalThreshold.
+// 1000 ppm is the usual warning level for these sensors; override it with
+// deviceConf.co2AbnormalThreshold.
 const DEFAULT_CO2_ABNORMAL_PPM = 1000
 
 export default class extends GoveeDevice {

package/lib/utils/ble-crypto.js

@@ -1,9 +1,9 @@
 /**
- * Govee "V2" BLE encryption (EncryptionManagerV2 in the Govee Home app).
+ * The wrapped bluetooth transport that newer Govee devices require.
  *
- * Used by newer Bluetooth-only devices such as the H3001 solar string lights.
- * Older devices take the plain 20-byte frame; these wrap it in AES-128-GCM and
- * silently ignore anything that is not wrapped.
+ * Most devices take the plain 20-byte frame. These wrap it in AES-128-GCM and
+ * silently ignore anything that is not wrapped, which is why a light like the
+ * H3001 appears to accept every command and then does nothing at all.
  *
  * Wire format on 00010203-0405-0607-0809-0a0b0c0d2b11 (write) and ...2b10 (notify):
  *
@@ -31,12 +31,12 @@
 import { Buffer } from 'node:buffer'
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
 
-// Application-wide constants, recovered from the Govee Home app's string
-// resources (LibTools KEY_COMMUNICATION_X / _Y).
+// Fixed across every device that uses this transport, rather than being tied
+// to an account or a pairing, so no lookup is needed to talk to one.
 const KEY_HANDSHAKE = Buffer.from('fc03783c7c42cb83e202a1643648aff6', 'hex')
 const KEY_DEVICE = Buffer.from('ae028b630bae6ecc4bff1b249e22f955', 'hex')
 
-const TAG_LEN = 12 // 96-bit tag; the app falls back to 128-bit
+const TAG_LEN = 12 // 96-bit tag
 const HDR = { MAGIC0: 0xE7, MAGIC1: 0x11, SUB_REQUEST: 0x01, STATUS_OK: 0x00 }
 
 /** True if `data` is an e711 handshake frame rather than a data frame. */

package/lib/utils/ble-protocol.js

@@ -74,8 +74,8 @@ export const BLE_STAGE_TIMEOUTS = {
   connect: 10000,
   write: 5000,
   // Encrypted models exchange a session key before the first real command (see
-  // ble-crypto.js). Captures of the official app show the light replying in
-  // about 30ms, so this is a generous ceiling rather than an expected cost.
+  // ble-crypto.js). A light answers in about 30ms, so this is a generous
+  // ceiling rather than an expected cost.
   // Models that need no handshake never spend any of it.
   handshake: 5000,
   settle: 100, // let the controller transmit before disconnecting

package/lib/utils/device-capabilities.js

@@ -56,8 +56,8 @@ const modelOverrides = {
 
   // Bluetooth-only solar string lights (#1328). Every frame is wrapped in
   // AES-128-GCM, so this model needs the key handshake in ble-crypto.js before
-  // any command is accepted. Its colour and brightness formats were read off a
-  // capture of the official app:
+  // any command is accepted. Its colour and brightness formats, observed on
+  // the wire:
   //   colour     33 05 15 01 RR GG BB 00 00 00 00 00 FF  (then zero padding)
   //   brightness 33 04 <0-100>          e.g. 0x1e for 30%, 0x64 for 100%
   // Writes are unacknowledged, so without the wrapper the light silently

package/package.json

@@ -2,7 +2,7 @@
   "name": "@homebridge-plugins/homebridge-govee",
   "alias": "Govee",
   "type": "module",
-  "version": "11.32.2-beta.27",
+  "version": "11.32.2-beta.28",
   "description": "Homebridge plugin to integrate Govee devices into HomeKit.",
   "author": {
     "name": "bwp91",