Not sure if this is helpful but I just found this in the device's instructions manual:
So, apparently only (?) lux value is reported upon short button press with original Tuya firmware. Would it be possible to sniff some useful data during this process?
It is also said that a long button press reports both battery level and illuminance.
It actually CAN be helpful to read those manuals every now and then.. 😅 I usually leave them in the package because most of the time they seem useless.
Furthermore, the manual states that the lux sensor range is 0-10000. If this represents the actual sensor's range, it could help narrowing down the search for the SMD component.
I wonder if the button press and the sensors are actually connected physically, independent from the firmware, or if the firmware does the job of connecting them and initialise the sensor read and send of the value report... if I have time, I will use GPIO doctor to see if there is any reaction on P26, P7 or P6 if I press the button.
Added after 1 [hours] 39 [minutes]:
....and.. one more thing. a while ago I had found some datasheet during my research for this light sensor (I think it was actually through google picture results).. the sensor looks similar from the product picture on the PDF.. the name is "Ambient Light Sensor with I2C Interface EAALSDIC2020A2" (Everlight Americas)
Now with scrolling through the sheet, I found that the Slave Address is 0x38!!!
And the pinout seems to match as well, at least SDA and SCL have the same position as we found here in our analysis, and the middle pin (--> P26) is labelled as INT ("Interrupt pin")
I'll attach the PDF here for those of you who understand more about electronics. Maybe we are very close to a solution now!

So, apparently only (?) lux value is reported upon short button press with original Tuya firmware. Would it be possible to sniff some useful data during this process?
It is also said that a long button press reports both battery level and illuminance.
It actually CAN be helpful to read those manuals every now and then.. 😅 I usually leave them in the package because most of the time they seem useless.
Furthermore, the manual states that the lux sensor range is 0-10000. If this represents the actual sensor's range, it could help narrowing down the search for the SMD component.
I wonder if the button press and the sensors are actually connected physically, independent from the firmware, or if the firmware does the job of connecting them and initialise the sensor read and send of the value report... if I have time, I will use GPIO doctor to see if there is any reaction on P26, P7 or P6 if I press the button.
Added after 1 [hours] 39 [minutes]:
....and.. one more thing. a while ago I had found some datasheet during my research for this light sensor (I think it was actually through google picture results).. the sensor looks similar from the product picture on the PDF.. the name is "Ambient Light Sensor with I2C Interface EAALSDIC2020A2" (Everlight Americas)

Now with scrolling through the sheet, I found that the Slave Address is 0x38!!!

And the pinout seems to match as well, at least SDA and SCL have the same position as we found here in our analysis, and the middle pin (--> P26) is labelled as INT ("Interrupt pin")

I'll attach the PDF here for those of you who understand more about electronics. Maybe we are very close to a solution now!