Fix BLE bonding persistence and add aggressive power management

- Add encrypted flags to HID characteristics to force pairing
- Remove broken nimble_bond clearing code
- Simplify keystore to exact-key matching only (RPA devices need re-pair)
- Reduce sleep timeouts: 30s idle → light sleep, 1min → deep sleep
- Update README with new power management timings

Author: APIUM

README.md

@@ -105,8 +105,8 @@ Hold **Shortcut1 + Shortcut3** for 10 seconds.
 
 ## Power Management
 
-- **5 minutes** idle → Light sleep (BLE stays active)
-- **1 hour** of light sleep → Deep sleep
+- **30 seconds** idle → Light sleep (BLE stays active)
+- **1 minute** of light sleep → Deep sleep
 - **Wake**: Any button press or motion (if MPU6050 installed)
 
 ## Build

modules/ha_client.py

@@ -158,7 +158,7 @@ def _send_discovery(self):
             ("shortcut_1", "Shortcut 1"),
             ("shortcut_2", "Shortcut 2"),
             ("shortcut_3", "Shortcut 3"),
-            ("shortcut_4", "Shortcut 4"),
+            ("shortcut_4", "Shortcut 4"),  # GPIO33 shared with I2C at boot
             ("brightness_up", "Brightness Up"),
             ("brightness_down", "Brightness Down"),
         ]

modules/hid_keystores.py

@@ -28,13 +28,17 @@ def get_secret(self, sec_type, index, key):
         value = None
 
         if key is None:
+            # Lookup by index
             i = 0
             for (t, _k), _val in self.secrets.items():
                 if t == sec_type:
                     if i == index:
                         value = _val
+                        break
                     i += 1
         else:
+            # Lookup by exact key only - no fallback
+            # RPA devices will need to re-pair after address change
             value = self.secrets.get(_key, None)
 
         return value

modules/hid_services.py

@@ -18,6 +18,15 @@
 F_READ_WRITE_NORESPONSE = bluetooth.FLAG_READ | bluetooth.FLAG_WRITE | bluetooth.FLAG_WRITE_NO_RESPONSE
 F_READ_WRITE_NOTIFY_NORESPONSE = bluetooth.FLAG_READ | bluetooth.FLAG_WRITE | bluetooth.FLAG_NOTIFY | bluetooth.FLAG_WRITE_NO_RESPONSE
 
+# Security flags for encrypted characteristics (require pairing)
+_FLAG_READ_ENCRYPTED = const(0x0200)
+_FLAG_WRITE_ENCRYPTED = const(0x1000)
+F_READ_ENC = F_READ | _FLAG_READ_ENCRYPTED
+F_READ_NOTIFY_ENC = F_READ_NOTIFY | _FLAG_READ_ENCRYPTED
+F_READ_WRITE_ENC = F_READ_WRITE | _FLAG_READ_ENCRYPTED | _FLAG_WRITE_ENCRYPTED
+F_READ_WRITE_NORESPONSE_ENC = F_READ_WRITE_NORESPONSE | _FLAG_READ_ENCRYPTED | _FLAG_WRITE_ENCRYPTED
+F_READ_WRITE_NOTIFY_NORESPONSE_ENC = F_READ_WRITE_NOTIFY_NORESPONSE | _FLAG_READ_ENCRYPTED | _FLAG_WRITE_ENCRYPTED
+
 DSC_F_READ = const(0x02)
 
 # Advertising types
@@ -244,20 +253,6 @@ def ble_irq(self, event, data):
 
     def start(self):
         if self.device_state == self.DEVICE_STOPPED:
-            # Clear NimBLE's internal bonding state to prevent IRK conflicts
-            # This ensures Python keystore is the sole source of bonding data
-            # Without this, deep sleep causes "failed to configure restored IRK" errors
-            try:
-                nvs = esp32.NVS("nimble_bond")
-                for key in ["cccd", "peer_id", "our_id", "peer_sec", "our_sec"]:
-                    try:
-                        nvs.erase_key(key)
-                    except:
-                        pass
-                nvs.commit()
-            except:
-                pass  # Namespace may not exist on first boot
-
             self.secrets.load_secrets()
             self._ble.irq(self.ble_irq)
             self._ble.active(True)
@@ -355,19 +350,19 @@ def __init__(self, name="BLE Keyboard"):
         self.HIDS = (
             UUID(0x1812),  # Human Interface Device
             (
-                (UUID(0x2A4A), F_READ),  # HID Information
-                (UUID(0x2A4B), F_READ),  # Report Map
-                (UUID(0x2A4C), F_READ_WRITE_NORESPONSE),  # Control Point
-                (UUID(0x2A4D), F_READ_NOTIFY, (  # Input Report (Keyboard)
+                (UUID(0x2A4A), F_READ_ENC),  # HID Information
+                (UUID(0x2A4B), F_READ_ENC),  # Report Map
+                (UUID(0x2A4C), F_READ_WRITE_NORESPONSE_ENC),  # Control Point
+                (UUID(0x2A4D), F_READ_NOTIFY_ENC, (  # Input Report (Keyboard)
                     (UUID(0x2908), DSC_F_READ),  # Report Reference
                 )),
-                (UUID(0x2A4D), F_READ_WRITE_NOTIFY_NORESPONSE, (  # Output Report
+                (UUID(0x2A4D), F_READ_WRITE_NOTIFY_NORESPONSE_ENC, (  # Output Report
                     (UUID(0x2908), DSC_F_READ),
                 )),
-                (UUID(0x2A4D), F_READ_NOTIFY, (  # Input Report (Consumer)
+                (UUID(0x2A4D), F_READ_NOTIFY_ENC, (  # Input Report (Consumer)
                     (UUID(0x2908), DSC_F_READ),  # Report Reference
                 )),
-                (UUID(0x2A4E), F_READ_WRITE_NORESPONSE),  # Protocol Mode
+                (UUID(0x2A4E), F_READ_WRITE_NORESPONSE_ENC),  # Protocol Mode
             ),
         )
 

modules/shield_remote.py

@@ -64,10 +64,10 @@
 ]
 
 # Power management settings
-IDLE_TIMEOUT_CONNECTED_MS = 5 * 60 * 1000  # 5 minutes before light sleep
-IDLE_TIMEOUT_DISCONNECTED_MS = 5 * 60 * 1000  # 5 minutes before light sleep
+IDLE_TIMEOUT_CONNECTED_MS = 30 * 1000  # 30 seconds before light sleep
+IDLE_TIMEOUT_DISCONNECTED_MS = 30 * 1000  # 30 seconds before light sleep
 LIGHT_SLEEP_MS = 50               # Light sleep interval between polls
-DEEP_SLEEP_AFTER_MS = 60 * 60 * 1000  # 1 hour of light sleep before deep sleep
+DEEP_SLEEP_AFTER_MS = 60 * 1000  # 1 minute of light sleep before deep sleep
 
 # HID key codes (USB HID Keyboard Usage Tables - Page 0x07)
 KEY_UP = 0x52