@homebridge-plugins/homebridge-govee 11.32.2-beta.27 → 11.32.2-beta.29

package/CHANGELOG.md

@@ -44,7 +44,8 @@ All notable changes to `@homebridge-plugins/homebridge-govee` will be documented
 - feat: recognise eleven more meat thermometers, which report what they send so their readings can be worked out, and stop the one already known printing its whole update as a warning
 - feat: add the H5161 power strip and give the H7184 kitchen composter an on and off switch
 - feat: recognise three more sensors, which report what they send, and say plainly in the log why a sensor has no tile yet
-- feat: add ble encryption for the H3001 solar string lights, which silently ignore unencrypted frames (#1328)
+- feat: add ble encryption for the H3001 solar string lights, which silently ignore unencrypted frames (#1328) (@dominick-han)
+- fix: only mention an unrecognised bluetooth broadcast when the device is on your own account, since a scan also hears the neighbours
 
 ## v11.32.1 (2026-08-02)
 

package/lib/connection/ble.js

@@ -124,17 +124,22 @@ export default class BLEConnection {
     try {
       const { uuid, address, rssi, advertisement } = peripheral
 
-      // Skip if not a valid Govee sensor. Sensors whose broadcast the plugin
-      // cannot decode yet are logged rather than dropped in silence, since the
-      // hex is the one thing needed to add a model, and there is no other way
-      // for an owner to get hold of it.
+      // A broadcast this plugin cannot decode is worth reporting rather than
+      // dropping in silence, since the hex is the one thing needed to add a
+      // model and an owner has no other way to get hold of it.
       if (!isValidPeripheral(peripheral)) {
         const unknownName = advertisement?.localName
         if (unknownName && unknownName.toLowerCase().startsWith('govee')) {
           const raw = advertisement.manufacturerData
             ? advertisement.manufacturerData.toString('hex')
             : 'no manufacturer data'
-          const line = `[BLE] unrecognised govee sensor - please include this line if you report it: ${JSON.stringify({
+
+          // Bluetooth is a broadcast medium, so this scan hears every Govee
+          // device in range - including a neighbour's, which is not something
+          // the owner can do anything about. Only a device on this account is
+          // worth putting in front of them.
+          const isOurs = this.platform.hasBleDevice(address)
+          const line = `[BLE] unrecognised broadcast from a govee device - please include this line if you report it: ${JSON.stringify({
             name: unknownName,
             address,
             source: 'BLE',
@@ -143,8 +148,8 @@ export default class BLEConnection {
           })}`
 
           // Say it once so it is actually noticed, then stay quiet about this
-          // sensor for the rest of the session - it rebroadcasts constantly.
-          if (isFirstReport(`ble|${address}|${raw}`)) {
+          // device for the rest of the session - it rebroadcasts constantly.
+          if (isOurs && isFirstReport(`ble|${address}|${raw}`)) {
             this.log.warn(line)
           } else {
             this.log.debug(line)
@@ -319,7 +324,7 @@ export default class BLEConnection {
    * Unlike every other path in this client we need a reply, which arrives as a
    * notification on UUID.NOTIFY. Note that we deliberately do NOT subscribe:
    * these lights push notifications without the client ever writing the client
-   * characteristic configuration descriptor, exactly as the official app does.
+   * characteristic configuration descriptor.
    * Calling subscribeAsync() here makes the descriptor write hang and the light
    * then drops the connection, so listening is both sufficient and required.
    *

package/lib/device/sensor-co2.js

@@ -9,7 +9,8 @@ import platformLang from '../utils/lang-en.js'
 import GoveeDevice from './base.js'
 
 // HomeKit triggers "CO2 detected" abnormal flag at this threshold (ppm).
-// Govee app default warn level is 1000 ppm; override via deviceConf.co2AbnormalThreshold.
+// 1000 ppm is the usual warning level for these sensors; override it with
+// deviceConf.co2AbnormalThreshold.
 const DEFAULT_CO2_ABNORMAL_PPM = 1000
 
 export default class extends GoveeDevice {

package/lib/platform.js

@@ -1060,6 +1060,23 @@ export default class {
     }
   }
 
+  /**
+   * Whether a bluetooth address belongs to one of this account's devices.
+   *
+   * Bluetooth is a broadcast medium: a scan hears every Govee device in range,
+   * including a neighbour's. Without this the plugin cannot tell the two apart,
+   * and asking someone to report a device that is not theirs is noise.
+   */
+  hasBleDevice(address) {
+    if (!address) {
+      return false
+    }
+    const wanted = String(address).toLowerCase()
+    return [...devicesInHB.values()].some(
+      accessory => String(accessory.context.bleAddress || '').toLowerCase() === wanted,
+    )
+  }
+
   configureAccessory(accessory) {
     // Set the correct firmware version if we can
     if (this.api && accessory.context.firmware) {

package/lib/utils/ble-crypto.js

@@ -1,9 +1,9 @@
 /**
- * Govee "V2" BLE encryption (EncryptionManagerV2 in the Govee Home app).
+ * The wrapped bluetooth transport that newer Govee devices require.
  *
- * Used by newer Bluetooth-only devices such as the H3001 solar string lights.
- * Older devices take the plain 20-byte frame; these wrap it in AES-128-GCM and
- * silently ignore anything that is not wrapped.
+ * Most devices take the plain 20-byte frame. These wrap it in AES-128-GCM and
+ * silently ignore anything that is not wrapped, which is why a light like the
+ * H3001 appears to accept every command and then does nothing at all.
  *
  * Wire format on 00010203-0405-0607-0809-0a0b0c0d2b11 (write) and ...2b10 (notify):
  *
@@ -31,12 +31,12 @@
 import { Buffer } from 'node:buffer'
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
 
-// Application-wide constants, recovered from the Govee Home app's string
-// resources (LibTools KEY_COMMUNICATION_X / _Y).
+// Fixed across every device that uses this transport, rather than being tied
+// to an account or a pairing, so no lookup is needed to talk to one.
 const KEY_HANDSHAKE = Buffer.from('fc03783c7c42cb83e202a1643648aff6', 'hex')
 const KEY_DEVICE = Buffer.from('ae028b630bae6ecc4bff1b249e22f955', 'hex')
 
-const TAG_LEN = 12 // 96-bit tag; the app falls back to 128-bit
+const TAG_LEN = 12 // 96-bit tag
 const HDR = { MAGIC0: 0xE7, MAGIC1: 0x11, SUB_REQUEST: 0x01, STATUS_OK: 0x00 }
 
 /** True if `data` is an e711 handshake frame rather than a data frame. */

package/lib/utils/ble-protocol.js

@@ -74,8 +74,8 @@ export const BLE_STAGE_TIMEOUTS = {
   connect: 10000,
   write: 5000,
   // Encrypted models exchange a session key before the first real command (see
-  // ble-crypto.js). Captures of the official app show the light replying in
-  // about 30ms, so this is a generous ceiling rather than an expected cost.
+  // ble-crypto.js). A light answers in about 30ms, so this is a generous
+  // ceiling rather than an expected cost.
   // Models that need no handshake never spend any of it.
   handshake: 5000,
   settle: 100, // let the controller transmit before disconnecting

package/lib/utils/device-capabilities.js

@@ -56,8 +56,8 @@ const modelOverrides = {
 
   // Bluetooth-only solar string lights (#1328). Every frame is wrapped in
   // AES-128-GCM, so this model needs the key handshake in ble-crypto.js before
-  // any command is accepted. Its colour and brightness formats were read off a
-  // capture of the official app:
+  // any command is accepted. Its colour and brightness formats, observed on
+  // the wire:
   //   colour     33 05 15 01 RR GG BB 00 00 00 00 00 FF  (then zero padding)
   //   brightness 33 04 <0-100>          e.g. 0x1e for 30%, 0x64 for 100%
   // Writes are unacknowledged, so without the wrapper the light silently

package/package.json

@@ -2,7 +2,7 @@
   "name": "@homebridge-plugins/homebridge-govee",
   "alias": "Govee",
   "type": "module",
-  "version": "11.32.2-beta.27",
+  "version": "11.32.2-beta.29",
   "description": "Homebridge plugin to integrate Govee devices into HomeKit.",
   "author": {
     "name": "bwp91",