Waiting for badge approval
" + b"Show this code on the badge to allow this device.
" + b"✓ Sent. Pick another?
" + b"Returning to upload form...
") + _send_status(sock, 200, "OK", body) diff --git a/oreoOS/launcher.py b/oreoOS/launcher.py index 7d26cb9..71d8b76 100644 --- a/oreoOS/launcher.py +++ b/oreoOS/launcher.py @@ -167,6 +167,12 @@ def run_app(os_obj, app): from oreoOS import notif_panel as _np_mod panel = _np_mod.get(os_obj) + # Pair-confirm overlay — sits above the notif panel and the app. + # While active it eats all input. Drawn after the panel so a fresh + # SMP prompt is never visually clobbered by a passing notification. + from oreoOS import pair_prompt as _pp_mod + pair_pp = _pp_mod.get(os_obj) + # Consecutive-frame error counter. A single bad frame (transient # I2C glitch, momentary divide-by-zero) shouldn't kill the whole # OS — we count, log, and only escalate to a crash screen if the @@ -206,6 +212,15 @@ def run_app(os_obj, app): if os_obj.buttons.just_pressed(b): if pm: pm.note_event() + # Pair-confirm prompt has top priority — when an + # SMP numeric comparison is in flight, NOTHING + # else gets the button. Eats every key including + # C and HOME so the user can't accidentally + # accept a stranger's pair attempt by hitting C. + if pair_pp.is_active(): + pair_pp.handle_button(b) + continue + # Global C hotkey → toggle the notification panel # before anything else gets a look. Works from any # app, including ones that would otherwise consume C. @@ -290,10 +305,32 @@ def run_app(os_obj, app): except Exception: pass + # Refresh the pair-confirm overlay's view of the SMP state + # every frame. Cheap — just one module-level dict peek. + pp_was_active = pair_pp.is_active() + try: + pair_pp.tick() + except Exception: + pass + if pp_was_active and not pair_pp.is_active(): + # Prompt dismissed — force the underlying app to redraw + # because the overlay painted over its frame. + try: + app._dirty = True + except Exception: + pass + try: app.update(dt) app.draw(os_obj.display) panel.draw(os_obj.display) + # Pair prompt is the topmost layer — drawn last so the + # 6-digit code can never be obscured by a panel slide-in. + if pair_pp.is_active(): + try: + pair_pp.draw(os_obj.display) + except Exception: + pass os_obj.display.present() frame_errs = 0 except Exception as e: @@ -336,6 +373,30 @@ def run_app(os_obj, app): # i2c.scan ran every iteration — now apps without an IMU # need pay nothing. + # BLE adv watchdog. Internal rate-limit means this is a + # ticks_diff comparison on the fast path; only every 30 s + # does it actually re-issue gap_advertise. Fixes the + # "phone says paired-but-not-connected and won't reconnect" + # case where adv silently stopped between sessions. + try: + from oreoWare import bt as _bt + _bt.watchdog_tick() + except Exception: + pass + + # LAN HTTP upload server tick. Non-blocking accept on the + # listening socket — costs one syscall per frame on the + # idle path. Handles one request synchronously when a + # phone POSTs, which briefly stalls the UI for the + # duration of the upload (fine for sub-second photo + # transfers; we'll move to a background worker later if + # uploads ever grow above a few hundred KB). + try: + from oreoOS import http_server as _hs + _hs.tick() + except Exception: + pass + elapsed = time.ticks_diff(time.ticks_ms(), now) if elapsed < FRAME_MIN_MS: time.sleep_ms(FRAME_MIN_MS - elapsed) @@ -615,6 +676,14 @@ def boot(): _bc("wifi.connect_from_config begin") wifi.connect_from_config() _bc("wifi.connect_from_config done") + # Bring up the LAN file-upload server now that we have an + # IP. Listener is non-blocking + idempotent; the run-loop + # tick handles accept(). No-op if WiFi failed. + try: + from oreoOS import http_server as _hs + _hs.start(os_obj) + except Exception: + pass else: _bc("wifi skipped") _bc("bt.init_from_config begin") diff --git a/oreoOS/notif_panel.py b/oreoOS/notif_panel.py index 8a83112..6a105c1 100644 --- a/oreoOS/notif_panel.py +++ b/oreoOS/notif_panel.py @@ -448,7 +448,24 @@ def _quick_states(self): from oreoWare import bt active = bt.is_active() out[1]["on"] = bool(active) - out[1]["sub"] = "on" if active else "off" + # Blink "transferring" while a peer is connected. The panel + # samples this dict every frame the panel is open, so just + # alternating the sublabel is enough to make the BT chip + # visibly pulse without a dedicated animator. ticks_ms / 500 + # gives a ~2 Hz cadence. + try: + busy = bt.is_busy() + except Exception: + busy = False + if busy: + try: + import time as _t + phase = (_t.ticks_ms() // 500) & 1 + except Exception: + phase = 0 + out[1]["sub"] = "transfer…" if phase else "transferring" + else: + out[1]["sub"] = "on" if active else "off" except Exception: pass return out diff --git a/oreoOS/pair_prompt.py b/oreoOS/pair_prompt.py new file mode 100644 index 0000000..9768b6d --- /dev/null +++ b/oreoOS/pair_prompt.py @@ -0,0 +1,133 @@ +"""On-screen BLE pair-confirm overlay. + +Renders a full-screen "Confirm pairing?" prompt the moment the BLE +stack hands us an SMP Numeric Comparison request. The 6-digit code +shown here is the same one the peer (phone / laptop / tablet) shows +on its own screen — the user reads both, confirms they match, and +taps A to accept or B to reject. + +The overlay is OS-global, like the notification panel: it's rendered +over whatever app is on screen, and it captures all input while +active. The launcher run loop ticks + draws it every frame and routes +button presses to `handle_button()` when `is_active()` is True. + +State flow: + idle → (peripheral_pair fires) → active + active → user A → accept → idle + active → user B → reject → idle + active → peer drops link → idle (cancel) +""" + +from oreoOS import api, theme + + +def get(os_obj): + """Singleton accessor — same pattern as notif_panel.""" + pp = getattr(os_obj, "_pair_prompt_ui", None) + if pp is not None: + return pp + pp = PairPrompt(os_obj) + try: + os_obj._pair_prompt_ui = pp + except Exception: + pass + return pp + + +class PairPrompt: + """Frame-driven overlay. Holds no state of its own — the SMP + prompt lives inside oreoWare.bt and we just mirror it visually.""" + + def __init__(self, os_obj): + self._os = os_obj + # Cached last-seen prompt dict so a transient peek-failure + # doesn't flicker the overlay off mid-prompt. + self._last = None + self._dirty = True + + # ── module-edge polling ───────────────────────────────────────────── + def tick(self): + """Re-read the SMP state from bt.py. Called from the OS run loop.""" + try: + from oreoWare import bt + live = bt.peek_pair_prompt() + except Exception: + live = None + if live is None and self._last is not None: + self._last = None + self._dirty = True + elif live is not None and self._last is not live: + self._last = live + self._dirty = True + + def is_active(self): + return self._last is not None + + # ── input routing ─────────────────────────────────────────────────── + def handle_button(self, btn): + """Routed from the run loop when is_active() is True. Returns + True iff the button was consumed.""" + if self._last is None: + return False + if btn == api.BTN_A: + try: + from oreoWare import bt + bt.accept_pair_prompt() + except Exception: + pass + self._last = None + self._dirty = True + return True + if btn in (api.BTN_B, api.BTN_HOME): + try: + from oreoWare import bt + bt.reject_pair_prompt() + except Exception: + pass + self._last = None + self._dirty = True + return True + return True # swallow other buttons so the app behind doesn't see them + + # ── render ────────────────────────────────────────────────────────── + def draw(self, d): + if self._last is None: + return + SW = api.SCREEN_W + SH = api.SCREEN_H + + # Dim the screen behind the prompt so the user can't possibly + # miss it. Fill, then draw a centered card. + d.rect(0, 0, SW, SH, theme.BG, fill=True) + + card_w = SW - 24 + card_h = 200 + card_x = 12 + card_y = (SH - card_h) // 2 + d.rect(card_x, card_y, card_w, card_h, theme.CARD, fill=True) + d.rect(card_x, card_y, card_w, 3, theme.PRIMARY, fill=True) + d.rect(card_x, card_y + card_h - 3, card_w, 3, theme.PRIMARY, fill=True) + + # Heading + title = "Confirm pairing?" + tw = len(title) * 16 + d.text(title, card_x + (card_w - tw) // 2, + card_y + 16, theme.TEXT_BRIGHT, scale=2) + + # Sub-heading + sub = "Does this code match your phone?" + sw = len(sub) * 8 + d.text(sub, card_x + (card_w - sw) // 2, + card_y + 46, theme.TEXT_DIM, scale=1) + + # The 6-digit code, big and centered. + code = "%06d" % int(self._last.get("passkey", 0)) + cw = len(code) * 32 + d.text(code, card_x + (card_w - cw) // 2, + card_y + 78, theme.PRIMARY, scale=4) + + # Footer actions. + foot_y = card_y + card_h - 36 + d.text("A=YES match", card_x + 14, foot_y, theme.PRIMARY, scale=1) + d.text("B=NO reject", card_x + 14, foot_y + 14, theme.MUTED, scale=1) + self._dirty = False diff --git a/oreoWare/bt.py b/oreoWare/bt.py index 2d9dda3..b8926a5 100644 --- a/oreoWare/bt.py +++ b/oreoWare/bt.py @@ -59,6 +59,12 @@ _tx_handle = None _conn = None # current central connection handle _rx_state = None # active reassembler, if any +_conn_started_ms = None # ticks_ms at the last CENTRAL_CONNECT, used + # to log how long the link survived on a + # subsequent CENTRAL_DISCONNECT +_conn_addr_type = None # addr_type from the live CENTRAL_CONNECT — + # needed so we can bond inbound pairs +_conn_addr_bytes = None # raw addr bytes from the live CENTRAL_CONNECT _HEADER_LEN = 5 # type (1) + length (4) _CRC_LEN = 4 @@ -125,18 +131,38 @@ def _classify_appearance(app): _AD_COMPLETE_UUID16 = 0x03 _AD_SHORT_NAME = 0x08 _AD_COMPLETE_NAME = 0x09 +_AD_TX_POWER = 0x0A _AD_APPEARANCE = 0x19 +_AD_MANUFACTURER = 0xFF + +# Company IDs we'll surface as "label hints" when a peer omits its name +# (common on iOS, which suppresses the GAP name until pairing). The full +# Bluetooth SIG assigned-numbers list is huge; we cover the brands the +# user is most likely to see in a conference hall. +_MFR_TAGS = { + 0x004C: "Apple", # iPhone, iPad, Mac, AirPods + 0x0006: "Microsoft", # Surface, Xbox + 0x00E0: "Google", # Pixel, Chromebook + 0x0075: "Samsung", + 0x038F: "Xiaomi", + 0x0157: "Anker", + 0x012D: "Sony", + 0x0001: "Ericsson", + 0x0059: "Nordic", # nRF dev boards +} def _parse_adv(adv_data): - """Walk AD structures. Returns (name_or_None, appearance_or_None, - [uuid16, ...]). Tolerates malformed payloads — we never trust a peer - advertiser to be conformant.""" + """Walk AD structures. Returns (name, appearance, [uuid16…], mfr_id). + Tolerates malformed payloads — we never trust a peer advertiser to + be conformant. mfr_id is the first 16-bit Company Identifier from + a manufacturer-specific data record (AD type 0xFF), or None.""" name = None appearance = None services = [] + mfr_id = None if not adv_data: - return name, appearance, services + return name, appearance, services, mfr_id i = 0 n = len(adv_data) while i < n: @@ -152,7 +178,11 @@ def _parse_adv(adv_data): payload = adv_data[i + 2 : i + 1 + ln] if ad_type in (_AD_COMPLETE_NAME, _AD_SHORT_NAME): try: - name = bytes(payload).decode("utf-8") + # Strip embedded NULs and trailing whitespace — iOS + # sometimes pads short names with NUL. + name = bytes(payload).decode("utf-8").rstrip("\x00").strip() + if not name: + name = None except Exception: name = None elif ad_type == _AD_APPEARANCE and len(payload) >= 2: @@ -161,8 +191,13 @@ def _parse_adv(adv_data): for j in range(0, len(payload), 2): if j + 1 < len(payload): services.append(payload[j] | (payload[j + 1] << 8)) + elif ad_type == _AD_MANUFACTURER and len(payload) >= 2: + # First two bytes are the little-endian Company ID; the rest + # is vendor-specific. We only keep the Company ID — that's + # enough to label "Apple" / "Samsung" / etc in the UI. + mfr_id = payload[0] | (payload[1] << 8) i += 1 + ln - return name, appearance, services + return name, appearance, services, mfr_id def _mac_str(addr_bytes): @@ -232,14 +267,32 @@ def scan_is_active(): def scan_results(): - """Filtered, RSSI-sorted snapshot of discovered devices.""" - out = [] + """Name-deduped, RSSI-sorted snapshot of discovered BLE devices. + + No filtering. The earlier appearance/service blocklists hid phones + and useful peripherals along with audio gear, and the trade wasn't + worth it — the user wants to see *everything* the radio sees. + + iOS and recent Android phones rotate their Resolvable Private + Address every ~15 min, so the same physical phone keeps showing + up under fresh MACs. We collapse all entries that share a real + (non-MAC-tail-fallback) name into one row, picking the strongest + RSSI as the representative. Anonymous "device EE:FF" entries stay + individual because we can't tell them apart. + """ + by_name = {} + anon = [] for v in _scan_results.values(): - if _is_audio_appearance(v.get("appearance")): - continue - if _has_audio_service(v.get("services", [])): - continue - out.append(v) + nm = v.get("name") or "" + if nm and not nm.startswith("device "): + cur = by_name.get(nm) + # Pick the entry with the better RSSI as the live one — its + # mac/addr_type are the ones we'll try to connect to. + if cur is None or (v.get("rssi", -999) > cur.get("rssi", -999)): + by_name[nm] = v + else: + anon.append(v) + out = list(by_name.values()) + anon out.sort(key=lambda d: d.get("rssi", -999), reverse=True) return out @@ -278,21 +331,40 @@ def _addr_from_mac(mac_str): def _apply_security_config(ble): - """Enable bonding + LE Secure Connections with JustWorks IO caps. - - Best-effort: older MicroPython builds may not support every kwarg, - so each is wrapped individually so the radio still works in a - degraded mode (no bonding) if a build is missing one.""" + """Enable bonding + LE Secure Connections with DISPLAY_YESNO IO caps. + + DISPLAY_YESNO + mitm=True asks the stack to negotiate the strongest + method available with the peer; with a modern phone that's + Numeric Comparison, which fires _IRQ_PASSKEY_ACTION on the badge so + we can render a confirm prompt. Older peers that can't do SC fall + back to legacy pairing. + + Each kwarg is wrapped individually so the radio still works in a + degraded mode if an older MicroPython build is missing one of the + keys. We PRINT which kwargs actually stuck so the user can see + from the serial log whether the build supports Secure Connections + at all — if `le_secure` or `mitm` got rejected, the stack drops + to JustWorks pairing and the numeric-comparison prompt will never + fire (which was the entire point of this config). + """ + accepted = [] + rejected = [] for kw in ( {"bond": True}, - {"mitm": False}, + {"mitm": True}, {"le_secure": True}, - {"io": _IO_NO_INPUT_NO_OUTPUT}, + {"io": _IO_DISPLAY_YESNO}, ): try: ble.config(**kw) - except Exception: - pass + accepted.append(list(kw.keys())[0]) + except Exception as e: + rejected.append("%s(%s)" % (list(kw.keys())[0], str(e)[:24])) + try: + print("[bt] security: accepted=%s rejected=%s" % + (",".join(accepted) or "-", ",".join(rejected) or "-")) + except Exception: + pass def start_pair(target): @@ -307,8 +379,24 @@ def start_pair(target): if _pair_state in (PAIR_CONNECTING, PAIR_ENCRYPTING): return False - addr_type = target.get("addr_type", 0) - addr = target.get("addr") + # Pull addr_type from the live scan dict if the caller didn't + # pass one through — defaulting to 0 (PUBLIC) silently bricked + # iPhone connections because iOS uses Random Resolvable addresses + # (type 1). The scan IRQ stashes the correct type per-entry. + mac_key = (target.get("mac") or "").upper() + scan_hit = None + for k, v in _scan_results.items(): + if k.upper() == mac_key: + scan_hit = v + break + addr_type = target.get("addr_type") + if addr_type is None and scan_hit is not None: + addr_type = scan_hit.get("addr_type", 0) + if addr_type is None: + addr_type = 0 + addr = target.get("addr") + if addr is None and scan_hit is not None: + addr = scan_hit.get("addr") if addr is None: addr = _addr_from_mac(target.get("mac", "")) if addr is None: @@ -399,11 +487,21 @@ def is_active(): def set_active(on): """Bring the radio up or down. On up, also registers the transfer - service and starts advertising as 'Oreo'.""" + service, applies JustWorks security so inbound pair attempts from + phones don't fail on IO-capability mismatch, and starts advertising. + + The security config has to land BEFORE the first inbound connection + or the stack will default to KEYBOARD_DISPLAY IO caps. When a phone + then initiates bonding, our peripheral side claims it can show a + passkey, the phone asks for one, the badge has nothing to give, and + the link is dropped. With JustWorks (NO_INPUT_NO_OUTPUT) the pair + completes silently. + """ try: ble = _get_ble() ble.active(on) if on: + _apply_security_config(ble) _register_service(ble) _start_advertising(ble) else: @@ -421,13 +519,18 @@ def toggle(): def init_from_config(): - """Enable BT on boot when the deploy-baked secrets request it.""" - try: - from secrets import BT_AUTO_ENABLE - if BT_AUTO_ENABLE: - set_active(True) - except Exception: - pass + """No-op on boot. + + Bluetooth is currently a Coming Soon feature — the BT settings + page renders a placeholder and file transfer runs over WiFi + (see oreoOS.http_server). Leaving the radio off at boot saves + flash, RAM, and ~3-4 mA standby; the user can still flip BT on + manually via a future settings toggle. When we wire the radio + back into a real user flow (peer presence, IR-Quest assist, etc.) + this function will read a `bt_enable` setting from oreoOS + settings instead of the build-time .env flag. + """ + return # ─── service registration ──────────────────────────────────────────────── @@ -460,28 +563,86 @@ def _register_service(ble): # ─── advertising ───────────────────────────────────────────────────────── +# Generic-tag appearance value — tells scanning phones to render us with +# a "generic" icon rather than "unknown peripheral". 0x0000 is the safest +# value across iOS / Android — it reads as "Unknown" but still passes +# their "advertiser must declare an Appearance" filters. If we ever ship +# a watch form factor, 0x00C0 (Generic Watch) would be a better fit. +_APPEARANCE_GENERIC = 0x0000 + + def _adv_payload(name): - """Build a minimal connectable adv payload: Flags (LE general disc) + - Complete Local Name. Stays well under the 31-byte limit.""" + """Connectable adv payload: Flags + Appearance + Complete Local Name. + + iOS and recent Android scanners often hide or de-prioritise devices + that don't declare an Appearance, so we always include one. Total + payload stays under the 31-byte cap for typical badge names — we + truncate the name itself if needed and rely on the scan response + to carry the full string.""" + name_bytes = name.encode("utf-8") + # 2-byte appearance (LE) + appearance = bytes((3, _AD_APPEARANCE, + _APPEARANCE_GENERIC & 0xFF, + (_APPEARANCE_GENERIC >> 8) & 0xFF)) + # Truncate name so Flags(3) + Appearance(4) + NameHdr(2) + name <= 31. + max_name = 31 - 3 - 4 - 2 + if len(name_bytes) > max_name: + name_bytes = name_bytes[:max_name] + return (b"\x02\x01\x06" # Flags + + appearance + + bytes((len(name_bytes) + 1, 0x09)) # Complete Local Name + + name_bytes) + + +def _scan_resp_payload(name): + """Scan-response payload returned to active scanners. Carries the + full untruncated name (so phones running active scans see "Oreo + Badge" cleanly) plus the 128-bit service UUID so apps that filter + by service can find us.""" + import bluetooth name_bytes = name.encode("utf-8") - return (b"\x02\x01\x06" - + bytes((len(name_bytes) + 1, 0x09)) + name_bytes) + name_ad = bytes((len(name_bytes) + 1, 0x09)) + name_bytes + # 128-bit Complete Service UUID list. Endianness is little-endian + # on the wire (Core Spec Vol 3 Part C 18.2). The constant matches + # the UUID registered in _register_service. + svc_bytes = bytes(reversed(bytes( + bluetooth.UUID("6f72656f-0000-1000-8000-00805f9b34fb")))) + svc_ad = bytes((len(svc_bytes) + 1, 0x07)) + svc_bytes # 0x07 = Complete 128-bit UUIDs + return name_ad + svc_ad def _start_advertising(ble): - """Set the GAP name and start advertising at the configured interval.""" + """Set the GAP name and start advertising. Default 200 ms interval + so phones (which scan in short bursts) reliably see us within one + scan window. Override via secrets.BT_ADV_INTERVAL_MS.""" try: ble.config(gap_name=DEVICE_NAME) except Exception: pass - interval_us = 500_000 + interval_us = 200_000 # was 500_000 — too slow for iOS opportunistic scans try: from secrets import BT_ADV_INTERVAL_MS interval_us = int(BT_ADV_INTERVAL_MS) * 1000 except Exception: pass + adv = _adv_payload(DEVICE_NAME) try: - ble.gap_advertise(interval_us, adv_data=_adv_payload(DEVICE_NAME)) + resp = _scan_resp_payload(DEVICE_NAME) + except Exception: + resp = None + # Try the resp_data kwarg first; older MicroPython builds without it + # fall back silently to adv-only. + try: + if resp is not None: + ble.gap_advertise(interval_us, adv_data=adv, resp_data=resp) + else: + ble.gap_advertise(interval_us, adv_data=adv) + except TypeError: + # Build doesn't accept resp_data — keep going with adv only. + try: + ble.gap_advertise(interval_us, adv_data=adv) + except Exception: + pass except Exception: pass @@ -514,10 +675,32 @@ def _start_advertising(ble): _pair_target = None # {"mac", "name", "kind", "addr_type", "addr", "conn"} _pair_message = "" -# Security config — JustWorks pairing (no passkey UI). The on-badge "do -# you want to pair with X?" confirmation popup is the consent step; once -# the user accepts on the badge, the BLE handshake completes silently. -_IO_NO_INPUT_NO_OUTPUT = 3 +# Security config — LE Secure Connections with Numeric Comparison. +# Both the badge (DISPLAY_YESNO IO caps) and a modern phone (also +# DISPLAY_YESNO) end up running the SMP "numeric comparison" method: +# the stack hands us a 6-digit confirmation value, the phone shows the +# same one, the user taps YES on both sides. This is the strongest +# pairing method available on consumer BLE and the only one that gives +# us a real on-badge consent prompt. +# +# Older phones / odd peers that can't negotiate Secure Connections fall +# back to legacy pairing; we keep mitm=True so the stack picks the most +# secure method available rather than silently dropping to JustWorks. +_IO_DISPLAY_YESNO = 1 +_IO_NO_INPUT_NO_OUTPUT = 3 + +# Passkey-action codes the stack hands back in _IRQ_PASSKEY_ACTION. +_PASSKEY_ACTION_NONE = 0 +_PASSKEY_ACTION_INPUT = 1 # peer-side: we'd need a keyboard +_PASSKEY_ACTION_DISP = 2 # legacy: display passkey, peer enters +_PASSKEY_ACTION_NUMCMP = 4 # Secure-Connections numeric comparison + +_IRQ_PASSKEY_ACTION = 31 + +# Inbound pair-prompt state. Populated by _IRQ_PASSKEY_ACTION and +# polled by oreoOS.pair_prompt to drive the on-screen confirmation +# overlay. Cleared by accept_pair_prompt() / reject_pair_prompt(). +_pair_prompt = None # {"conn", "action", "passkey", "name", "mac"} class _RxState: @@ -531,14 +714,83 @@ def __init__(self): def _irq(event, data): - global _conn, _rx_state + global _conn, _rx_state, _conn_started_ms + global _conn_addr_type, _conn_addr_bytes if event == _IRQ_CENTRAL_CONNECT: conn_handle, _addr_type, _addr = data + # Single-connection policy: if we already have a peer, reject + # the second one by disconnecting it immediately. MicroPython + # is compiled with MAX_CONNECTIONS=3, but the UX we want is + # "one badge ↔ one peer at a time" so the user doesn't get a + # rats' nest of half-connected phones. (A true firmware change + # would set CONFIG_BT_NIMBLE_MAX_CONNECTIONS=1, but that + # requires recompiling the MicroPython port.) + if _conn is not None and conn_handle != _conn: + try: + _get_ble().gap_disconnect(conn_handle) + print("[bt] rejected 2nd connect handle=%d (busy with %d)" % + (conn_handle, _conn)) + except Exception: + pass + return _conn = conn_handle _rx_state = _RxState() + # Stash addr so a successful inbound bond can be saved into the + # bond store. Without this we'd only persist outbound (we- + # initiated) pairs, and the user would see "phone paired" on + # their phone but no entry in the badge's Paired list. + _conn_addr_type = _addr_type + try: + _conn_addr_bytes = bytes(_addr) + except Exception: + _conn_addr_bytes = None + try: + import time as _t + _conn_started_ms = _t.ticks_ms() + print("[bt] central connect handle=%d type=%d" % + (conn_handle, _addr_type)) + except Exception: + _conn_started_ms = None + # Surface the new peer in the notification panel so the user + # knows something connected even if they're not on the BT + # page. Best-effort: notifications module may not be importable + # in the IRQ context on some builds, so swallow errors. + try: + mac = _mac_str(bytes(_addr)) + from oreoOS import notifications as _n + _n.push("bt", "BT connected", mac, target=None) + except Exception: + pass + # Stop advertising while a peer is connected. With single- + # connection policy in force, continuing to advertise just + # invites failed connects from other devices. + try: + _get_ble().gap_advertise(None) + except Exception: + pass + # Try to push a larger MTU. Phones almost always request one; + # missing this exchange has caused some stacks to drop the link + # after the first GATT read returns an undersized ATT response. + try: + _get_ble().gattc_exchange_mtu(conn_handle) + except Exception: + # Older MicroPython builds don't expose gattc_exchange_mtu + # from the peripheral side — silently fine, the central + # drives MTU negotiation in that case. + pass elif event == _IRQ_CENTRAL_DISCONNECT: + try: + import time as _t + held = _t.ticks_diff(_t.ticks_ms(), _conn_started_ms) \ + if _conn_started_ms else -1 + print("[bt] central disconnect held=%d ms" % held) + except Exception: + pass _conn = None _rx_state = None + _conn_started_ms = None + _conn_addr_type = None + _conn_addr_bytes = None # Restart advertising so the next peer can find us. try: _start_advertising(_get_ble()) @@ -557,26 +809,67 @@ def _irq(event, data): # merge into the dict so the most recent RSSI + any newly # discovered name wins. bytes(addr) copies out of the IRQ-scoped # buffer so we can keep the dict entry around. - mac = _mac_str(bytes(addr)) - name, appearance, services = _parse_adv(bytes(adv_data)) + mac = _mac_str(bytes(addr)) + name, appearance, services, mfr_id = _parse_adv(bytes(adv_data)) + # Best-effort label when the peer suppresses its name (common + # on iOS — and on Android in privacy mode). Cascade of + # fallbacks: real name → manufacturer tag → MAC tail. The MAC + # tail "device EE:FF" beats "(unknown)" because the user can + # at least see how many distinct anonymous peers are nearby. + if not name and mfr_id is not None: + tag = _MFR_TAGS.get(mfr_id) + if tag: + name = tag + " device" + if not name: + tail = mac[-5:] if len(mac) >= 5 else mac + # addr_type 1 = Random — tag it so the user knows the name + # won't stick even after a successful association. + if addr_type == 1: + name = "device " + tail + " (R)" + else: + name = "device " + tail cur = _scan_results.get(mac) if cur is None: cur = {"mac": mac, - "name": name or "(unknown)", + "name": name, "rssi": rssi, "appearance": appearance, "services": services, - "type": _classify_appearance(appearance)} + "type": _classify_appearance(appearance), + # Capture addr_type so start_pair() can pass the + # correct type to gap_connect — defaulting to 0 + # (PUBLIC) was breaking every iPhone connection + # because iOS uses Random Resolvable addresses. + "addr_type": addr_type, + "addr": bytes(addr), + "mfr_id": mfr_id} _scan_results[mac] = cur else: - cur["rssi"] = rssi - if name and (cur["name"] == "(unknown)" or len(name) > len(cur["name"])): + cur["rssi"] = rssi + cur["addr_type"] = addr_type + cur["addr"] = bytes(addr) + # Names from active scan responses are usually more complete + # than the ones in the initial adv. Prefer real names over + # our manufacturer-tag / MAC-tail fallbacks; among real + # names prefer the longer one. + cur_name = cur["name"] or "" + cur_is_fallback = (cur_name.startswith("device ") or + cur_name.endswith("device")) + new_is_fallback = (name and (name.startswith("device ") or + name.endswith("device"))) + if name and not new_is_fallback and ( + cur_is_fallback or len(name) > len(cur_name)): + cur["name"] = name + elif name and new_is_fallback and cur_is_fallback and \ + len(name) > len(cur_name): cur["name"] = name if appearance and not cur["appearance"]: cur["appearance"] = appearance cur["type"] = _classify_appearance(appearance) if services: cur["services"] = services + if mfr_id and not cur.get("mfr_id"): + cur["mfr_id"] = mfr_id elif event == _IRQ_SCAN_DONE: global _scan_active _scan_active = False @@ -607,28 +900,86 @@ def _irq(event, data): conn_handle, encrypted, _auth, bonded, _ks = data except (ValueError, TypeError): return - if _pair_target is None: - return if encrypted: - # Persist the bond record (separate from BLE secrets, which - # arrive via _IRQ_SET_SECRET as their own events). + if _pair_target is not None: + # OUTBOUND pair (we initiated via start_pair). The + # target dict already holds the friendly name / kind + # from the scan result, so the bond record is rich. + try: + from oreoOS import bonds + bonds.add(_pair_target["mac"], + _pair_target.get("name", ""), + _pair_target.get("kind", "other")) + except Exception: + pass + _set_pair_state(PAIR_DONE, + "paired" + (" + bonded" if bonded else "")) + elif _conn_addr_bytes is not None: + # INBOUND pair (phone initiated). We don't know the + # peer's friendly name — we never scanned it — so the + # bond entry gets a MAC-derived placeholder name that + # the user can rename later. This is what fixes the + # "phone says paired but Paired list is empty" bug. + try: + from oreoOS import bonds + mac = _mac_str(_conn_addr_bytes) + bonds.add(mac, "BT peer " + mac[-5:], "other") + print("[bt] inbound bond saved: %s" % mac) + except Exception as e: + try: + print("[bt] inbound bond save failed: %s" % e) + except Exception: + pass + # Keep the link open. We used to gap_disconnect here on the + # theory that the bond record was the thing the user wanted + # — but to the user it read as "I tried to connect and it + # immediately hung up." Leave the link up so the peer's + # GATT exchange (file transfer, etc.) can proceed, and let + # whichever side actually finishes its work close it. + else: + if _pair_target is not None: + _set_pair_state(PAIR_FAILED, "encryption rejected") + elif event == _IRQ_PASSKEY_ACTION: + # data = (conn_handle, action, passkey) + # Fired during inbound pairing when the SMP method needs user + # interaction. We only handle NUMCMP (the path Secure Connections + # takes when both sides are DISPLAY_YESNO) — for DISP we'd need + # to render a 6-digit code and have the user type it on the + # phone, which we can support later; for now we treat anything + # other than NUMCMP as a silent accept so legacy pairing still + # completes for older peers. + try: + conn_handle, action, passkey = data + except (ValueError, TypeError): + return + if action == _PASSKEY_ACTION_NUMCMP: + global _pair_prompt + # Resolve a friendly name for the prompt — _scan_results is + # keyed by MAC, but we don't actually know the MAC of an + # inbound connection at this point. Best we can do is show + # the conn handle alongside the number; the BT app's + # connect notification already surfaced the MAC. + _pair_prompt = { + "conn": conn_handle, + "action": action, + "passkey": int(passkey), + "name": "BT peer", + "mac": "", + } try: - from oreoOS import bonds - bonds.add(_pair_target["mac"], - _pair_target.get("name", ""), - _pair_target.get("kind", "other")) + print("[bt] pair prompt passkey=%06d conn=%d" % + (int(passkey), conn_handle)) except Exception: pass - _set_pair_state(PAIR_DONE, - "paired" + (" + bonded" if bonded else "")) - # Politely disconnect now that bonding's stashed — the user - # doesn't need an active link sitting open. + else: + # Legacy / unsupported action — silently approve so we + # don't strand the peer. They'll either succeed via legacy + # JustWorks-ish fallback or the encryption update will + # later flag failure. try: - _get_ble().gap_disconnect(conn_handle) + _get_ble().gap_passkey(conn_handle, action, passkey) except Exception: pass - else: - _set_pair_state(PAIR_FAILED, "encryption rejected") elif event == _IRQ_SET_SECRET: sec_type, key, value = data try: @@ -657,6 +1008,170 @@ def _notify(status_byte): pass +# ── transfer-progress notification (throttled) ────────────────────────── +# Emits "BT receiving 30%" notifications during a long file transfer so +# the notification panel reflects live progress. Updates fire at most +# every PROGRESS_STEP_BYTES of fresh payload to keep the LCD redraw cost +# bounded (the panel ticks the BT icon as a side effect of the push). +PROGRESS_STEP_BYTES = 64 * 1024 +_last_progress_bytes = 0 + + +def _emit_progress(received, total, type_byte): + global _last_progress_bytes + if total <= 0: + return + if received == total: + _last_progress_bytes = 0 + return + if (received - _last_progress_bytes) < PROGRESS_STEP_BYTES: + return + _last_progress_bytes = received + pct = int((received * 100) // total) + kind = "image" if type_byte == b"I" else \ + "text" if type_byte == b"T" else \ + "markdown" if type_byte == b"M" else "file" + try: + from oreoOS import notifications as _n + _n.push("bt", + "Receiving %s" % kind, + "%d%% · %d/%d KB" % (pct, received // 1024, total // 1024), + target=None) + except Exception: + pass + + +def is_busy(): + """True iff a peer is currently connected. Used by the notif panel + to drive the blinking BT icon while a transfer is live.""" + return _conn is not None + + +def disconnect_peer(): + """Force-disconnect the currently connected peer, if any. Called + by the BT app's "Disconnect" action on a paired-but-active row.""" + if _conn is None: + return False + try: + _get_ble().gap_disconnect(_conn) + return True + except Exception: + return False + + +def is_advertising(): + """Best-effort introspection — MicroPython doesn't expose a direct + 'is advertising' getter, so we infer: BLE is active AND no peer is + currently connected (we stop adv on connect).""" + try: + return bool(_get_ble().active()) and _conn is None + except Exception: + return False + + +def force_readvertise(): + """Stop + restart advertising. Used as a watchdog kick when a + bonded peer claims it can't see us — also re-applies security + config + service registration in case either got cleared after a + failed connection attempt.""" + try: + ble = _get_ble() + if not ble.active(): + return False + try: + ble.gap_advertise(None) + except Exception: + pass + _apply_security_config(ble) + _register_service(ble) + _start_advertising(ble) + return True + except Exception: + return False + + +# ── advertising watchdog ──────────────────────────────────────────────── +# A bonded phone expects the badge to be findable whenever it's nearby. +# In practice we've seen the badge stop advertising on a transient stack +# glitch (failed connect attempt, RX queue overflow, etc.) and the phone +# then just shows "paired, not connected" with no recovery. The watchdog +# is called by the OS run loop on a slow cadence and forces a re-adv any +# time we should be discoverable but apparently aren't. + +_watchdog_last_ms = 0 +_WATCHDOG_INTERVAL_MS = 30 * 1000 + + +def watchdog_tick(): + """Called from the OS run loop. Cheap when nothing's wrong.""" + global _watchdog_last_ms + try: + import time as _t + now = _t.ticks_ms() + except Exception: + return + if _t.ticks_diff(now, _watchdog_last_ms) < _WATCHDOG_INTERVAL_MS: + return + _watchdog_last_ms = now + # If BT is on AND nobody's connected, we MUST be advertising. There + # is no way for MicroPython to tell us "advertising stopped" — the + # only safe action is to nudge gap_advertise periodically. Cheap: + # calling gap_advertise with a payload identical to the running one + # is effectively a no-op inside NimBLE. + if not is_active(): + return + if _conn is not None: + return + try: + _start_advertising(_get_ble()) + except Exception: + pass + + +# ── inbound pair-confirm prompt API ───────────────────────────────────── +# Surfaces the SMP Numeric Comparison value to oreoOS.pair_prompt so it +# can render the on-screen confirmation overlay. Three calls cover the +# state machine: peek to read the live prompt, accept to confirm, reject +# to refuse. + +def peek_pair_prompt(): + """Return the live pair-prompt dict, or None if no prompt is + pending. Caller MUST NOT mutate the returned dict.""" + return _pair_prompt + + +def accept_pair_prompt(): + """User tapped YES on the confirm overlay. Pass our agreement back + to the SMP layer; encryption completes asynchronously and + _IRQ_ENCRYPTION_UPDATE fires when it's done.""" + global _pair_prompt + p = _pair_prompt + _pair_prompt = None + if p is None: + return False + try: + _get_ble().gap_passkey(p["conn"], p["action"], p["passkey"]) + return True + except Exception: + return False + + +def reject_pair_prompt(): + """User tapped NO. Drop the link — SMP will tear itself down once + the connection's gone, and the peer sees an explicit refusal + instead of a silent timeout.""" + global _pair_prompt + p = _pair_prompt + _pair_prompt = None + if p is None: + return False + try: + _get_ble().gap_disconnect(p["conn"]) + return True + except Exception: + return False + + def _feed(chunk): """Push bytes into the active reassembler. May complete one transfer per call (or part of one — we resume across chunks).""" @@ -717,6 +1232,14 @@ def _feed(chunk): take = chunk[pos:pos + remaining] st.buf.extend(take) pos += len(take) + # Progress hook — best-effort throttled notification update so + # the user can watch a large image come in. We post at most + # every ~64 KB of fresh data; finer granularity would spam the + # notification panel and the SPI bus the LCD uses. + try: + _emit_progress(len(st.buf), st.length, st.type_byte) + except Exception: + pass if len(st.buf) < st.length: return diff --git a/oreoWare/wifi.py b/oreoWare/wifi.py index 5d784f0..afe8592 100644 --- a/oreoWare/wifi.py +++ b/oreoWare/wifi.py @@ -77,9 +77,40 @@ def _apply_power_cap(wlan): pass +MDNS_HOSTNAME = "oreo" + + +def _apply_hostname(wlan): + """Set the WiFi hostname so the ESP-IDF mDNS responder advertises + `oreo.local` to the LAN. MicroPython builds vary in which kwarg key + actually takes effect (`hostname` vs `dhcp_hostname`) so we try both. + + On most ESP32 IDF builds this is enough — IDF auto-spins up an mDNS + responder for the configured hostname. Older builds that don't have + the responder enabled will silently ignore this and `oreo.local` + won't resolve; the badge will still be reachable by IP. + """ + for key in ("hostname", "dhcp_hostname"): + try: + wlan.config(**{key: MDNS_HOSTNAME}) + except Exception: + pass + # Some forks expose a top-level mdns start. Best-effort. + try: + import network as _net + if hasattr(_net, "hostname"): + _net.hostname(MDNS_HOSTNAME) + except Exception: + pass + + def connect(ssid, password, timeout_ms=12000): wlan = _get_wlan() wlan.active(True) + # Hostname must be set BEFORE associate — the DHCP REQUEST carries + # the hostname as Option 12 and the IDF mDNS service uses the same + # name. Setting it after gets ignored by some routers. + _apply_hostname(wlan) _apply_power_cap(wlan) if wlan.isconnected() and wlan.config("essid") == ssid: return True @@ -89,9 +120,11 @@ def connect(ssid, password, timeout_ms=12000): if time.ticks_diff(time.ticks_ms(), start) > timeout_ms: return False time.sleep_ms(200) - # Re-apply power-save AFTER association — some IDF versions reset PM - # state on connect and need it set again to actually take effect. + # Re-apply power-save + hostname AFTER association — some IDF + # versions reset PM/hostname state on connect and need it set + # again to actually take effect for the live link. _apply_power_cap(wlan) + _apply_hostname(wlan) return True @@ -321,15 +354,23 @@ def ping(host="8.8.8.8", port=53, timeout_s=2): pass -def speed_test(bytes_=500_000, timeout_s=15): +def speed_test(bytes_=200_000, timeout_s=10, pump_cb=None): """Throughput probe: download `bytes_` from speed.cloudflare.com - and report observed kbps. Cloudflare's __down endpoint serves an - arbitrary number of bytes without auth and is geo-routed. + and report observed kbps. + + `pump_cb` is called between every recv() so the caller can keep + the OS run loop alive — typically passes a closure that re-reads + the button matrix and bumps the screen. The socket is set to a + 50-ms recv timeout so each blocked read can't freeze the UI for + more than that. If pump_cb returns True the test aborts cleanly + (used by the WiFi app's "cancel by any keypress" UX). + + Default size dropped from 500 KB → 200 KB. The handshake is + still amortised but the test finishes in ~1–2 s on home WiFi + and ~5 s on weak links, both well within user attention span. - Returns (ok, kbps, elapsed_ms). On failure, (False, 0, elapsed). - Default size is 500 KB — enough to amortise SSL handshake on - typical home WiFi, small enough to finish in seconds on EDGE/3G - tethering. + Returns (ok, kbps, elapsed_ms). On failure or cancel, + (False, 0, elapsed). """ try: import socket as _s @@ -344,19 +385,38 @@ def speed_test(bytes_=500_000, timeout_s=15): addr = _s.getaddrinfo(host, 443)[0][-1] except Exception: return (False, 0, 0) + raw = None s = None deadline = time.ticks_add(time.ticks_ms(), int(timeout_s * 1000)) t0 = time.ticks_ms() received = 0 body_started = False + cancelled = False + + # 50 ms recv timeout caps each blocking read so the run loop + # can resume between reads. This is the difference between + # "buttons frozen for 5 s" and "buttons responsive throughout". + PER_READ_S = 0.05 + + def _pump(): + """Run the caller's pump callback if any; flag cancel.""" + nonlocal cancelled + if pump_cb is None: + return + try: + if pump_cb(): + cancelled = True + except Exception: + pass + try: raw = _s.socket() - try: raw.settimeout(timeout_s) + try: raw.settimeout(timeout_s) # connect can take a while except Exception: pass raw.connect(addr) s = _ssl.wrap_socket(raw, server_hostname=host) - try: s.settimeout(timeout_s) + try: s.settimeout(PER_READ_S) except Exception: pass req = ("GET %s HTTP/1.1\r\nHost: %s\r\n" "User-Agent: OreoBadge-Speed\r\n" @@ -364,13 +424,19 @@ def speed_test(bytes_=500_000, timeout_s=15): "Connection: close\r\n\r\n") % (path, host) s.write(req.encode()) head = b"" - # Read headers — we don't care about chunked decoding for the - # bytes-counted speed metric; raw byte volume is what matters. + # Read headers. With the short PER_READ_S timeout each recv + # bails fast on no-data; we loop until the separator arrives + # or the overall deadline blows. while b"\r\n\r\n" not in head: + if cancelled: + break if time.ticks_diff(deadline, time.ticks_ms()) <= 0: break try: chunk = s.read(2048) + except OSError: + _pump() + continue except Exception: break if not chunk: @@ -378,22 +444,28 @@ def speed_test(bytes_=500_000, timeout_s=15): head += chunk if len(head) > 16 * 1024: break - # Count any payload bytes that arrived alongside the headers. + _pump() sep = head.find(b"\r\n\r\n") if sep >= 0: body_started = True - received = len(head) - (sep + 4) - # Drain the rest of the body counting bytes. + received = len(head) - (sep + 4) + # Drain the body. while body_started: + if cancelled: + break if time.ticks_diff(deadline, time.ticks_ms()) <= 0: break try: chunk = s.read(4096) + except OSError: + _pump() + continue except Exception: break if not chunk: break received += len(chunk) + _pump() if received >= bytes_: break except Exception: @@ -406,6 +478,8 @@ def speed_test(bytes_=500_000, timeout_s=15): except Exception: pass elapsed = max(1, time.ticks_diff(time.ticks_ms(), t0)) + if cancelled: + return (False, 0, elapsed) if received <= 0: return (False, 0, elapsed) kbps = int((received * 8) // elapsed) # bytes*8 / ms = kbps diff --git a/tools/build_release.py b/tools/build_release.py index 830e92d..9de77c1 100644 --- a/tools/build_release.py +++ b/tools/build_release.py @@ -56,6 +56,8 @@ "oreoOS/store.py", "oreoOS/notifications.py", "oreoOS/notif_panel.py", + "oreoOS/pair_prompt.py", + "oreoOS/http_server.py", "oreoOS/pixelfont.py", "oreoOS/power.py", "oreoOS/splash.py", diff --git a/tools/deploy.py b/tools/deploy.py index 13f6420..35c89ca 100644 --- a/tools/deploy.py +++ b/tools/deploy.py @@ -151,6 +151,8 @@ def bump_patch_version(): ("oreoOS/store.py", "oreoOS/store.py"), ("oreoOS/notifications.py", "oreoOS/notifications.py"), ("oreoOS/notif_panel.py", "oreoOS/notif_panel.py"), + ("oreoOS/pair_prompt.py", "oreoOS/pair_prompt.py"), + ("oreoOS/http_server.py", "oreoOS/http_server.py"), ("oreoOS/gestures.py", "oreoOS/gestures.py"), # Hardware drivers