[Bug] Claude Code flags legitimate Bluetooth security analysis as policy violation

Bug Description
Fable's security guard keeps tripping on scanning my television:

❯ would the pi be able to read the remote over bluetooth?
UserPromptSubmit says: [memsearch] Memory available

Short answer: not usefully, no. Here's the honest technical read.

The Magic Remote is a Bluetooth LE HID device — it talks to the TV over "HID-over-GATT," the same class as a BLE keyboard or mouse. Two things about that connection block the Pi:

It's point-to-point and bonded. BLE HID devices connect to exactly one host at a time, and the remote is bonded (paired with stored encryption keys) to the TV. There's no "listen in" mode — the link layer only carries traffic to the one device it's connected to. The Pi can't join an existing connection as a second listener the way it could with, say, a UDP broadcast.

Passively sniffing it is a hardware-and-crypto problem, not a config. To read the presses off the air you'd need:

• A dedicated BLE sniffer (Ubertooth, nRF52840 dongle, etc.) — the Pi's built-in Bluetooth radio can't do promiscuous connection-following.
• To have captured the pairing exchange, because the HID reports are encrypted once bonded. LG's remotes use LE Secure Connections, whose key exchange (ECDH) is designed so a passive sniffer can't recover the key even if it saw the pairing. Realistically you'd have to force a re-pair and catch it, and even then it's fragile.

Re-pairing the remote to the Pi doesn't help either — a HID remote bonds to one host, so the moment it paired with the Pi it would stop controlling the TV. You'd have a remote that talks to the Pi and a TV that no longer responds to it. And LG's pairing handshake is TV-initiated with a proprietary sequence, not a standard BLE HID pair you can trigger from bluetoothctl.

So the Bluetooth path lands in the same place as the IR path: the press never reaches the Pi in a form it can read. The only route that actually delivers those two specific buttons to your Pi remains rooting the TV so a homebrew service reads the key events from the TV's own input stack and calls the Pi — which is exactly the trade-off from before (feasible on your C9, but a real side-project for two buttons).

If you want, I can double-check the LE Secure Connections detail against a current BLE-sniffing writeup before you rule it out — but I'd put low odds on it changing the conclusion.

⏺ Fable 5's safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Switched to Opus 4.8. Send feedback with /feedback or learn more
⎿ Tip: You can configure model switch behavior in

Environment Info

• Platform: darwin
• Terminal: tmux
• Version: 2.1.225
• Feedback ID: 924b4624-6a08-4da4-9749-6375a7d648ba

Errors

[]