ha-mcp-dev 7.12.3.dev1882__tar.gz → 7.12.3.dev1885__tar.gz

{ha_mcp_dev-7.12.3.dev1882/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.12.3.dev1885}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.12.3.dev1882
+Version: 7.12.3.dev1885
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT
@@ -268,7 +268,7 @@ Spend less time configuring, more time enjoying your smart home.
 | **HACS** | `ha_get_hacs_info`, `ha_manage_hacs` |
 | **Helper Entities** | `ha_config_list_helpers`, `ha_config_set_helper`, `ha_remove_helpers_integrations` |
 | **History & Statistics** | `ha_get_automation_traces`, `ha_get_history`, `ha_get_logs` |
-| **Integrations** | `ha_get_integration`, `ha_get_system_health`, `ha_set_integration_enabled` |
+| **Integrations** | `ha_get_integration`, `ha_get_system_health`, `ha_set_integration` |
 | **Labels & Categories** | `ha_config_get_category`, `ha_config_get_label`, `ha_config_remove_category`, `ha_config_remove_label`, `ha_config_set_category`, `ha_config_set_label` |
 | **Matter** | `ha_manage_radio` |
 | **Scenes** | `ha_config_get_scene`, `ha_config_remove_scene`, `ha_config_set_scene` |

{ha_mcp_dev-7.12.3.dev1882 → ha_mcp_dev-7.12.3.dev1885}/README.md

@@ -235,7 +235,7 @@ Spend less time configuring, more time enjoying your smart home.
 | **HACS** | `ha_get_hacs_info`, `ha_manage_hacs` |
 | **Helper Entities** | `ha_config_list_helpers`, `ha_config_set_helper`, `ha_remove_helpers_integrations` |
 | **History & Statistics** | `ha_get_automation_traces`, `ha_get_history`, `ha_get_logs` |
-| **Integrations** | `ha_get_integration`, `ha_get_system_health`, `ha_set_integration_enabled` |
+| **Integrations** | `ha_get_integration`, `ha_get_system_health`, `ha_set_integration` |
 | **Labels & Categories** | `ha_config_get_category`, `ha_config_get_label`, `ha_config_remove_category`, `ha_config_remove_label`, `ha_config_set_category`, `ha_config_set_label` |
 | **Matter** | `ha_manage_radio` |
 | **Scenes** | `ha_config_get_scene`, `ha_config_remove_scene`, `ha_config_set_scene` |

{ha_mcp_dev-7.12.3.dev1882 → ha_mcp_dev-7.12.3.dev1885}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.12.3.dev1882"
+version = "7.12.3.dev1885"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-7.12.3.dev1882 → ha_mcp_dev-7.12.3.dev1885}/src/ha_mcp/config.py

@@ -237,6 +237,18 @@ class Settings(BaseSettings):
     # regardless of the per-call param or BP warnings. Default on.
     enable_mandatory_bps: bool = Field(True, alias="ENABLE_MANDATORY_BPS")
 
+    # Strict best-practices gate (issue #1779) — child flag of
+    # ``enable_mandatory_bps``. When effective, the six write tools are
+    # HARD-BLOCKED unless the call carries the acknowledgment key that is
+    # published only inside the best-practices skill content served by
+    # ``ha_get_skill_guide`` (modeled on the Hubitat MCP acknowledgment
+    # gate). Default ON so strict mode is active whenever the parent is on;
+    # inert when the parent is off — that cascade is enforced at the
+    # consumption site (``strict_bps.strict_bps_effective``), not here,
+    # because this flag is deliberately NOT a beta sub-flag and there is no
+    # config-level parent gate for non-beta flags.
+    enable_strict_mandatory_bps: bool = Field(True, alias="ENABLE_STRICT_MANDATORY_BPS")
+
     # Filesystem tools — read/write/delete/list under the HA config dir.
     # Previously gated by a direct ``os.getenv`` call in
     # ``tools/tools_filesystem.py`` so callers (and the settings UI)
@@ -656,6 +668,12 @@ FEATURE_FLAG_FIELDS: tuple[FeatureFlagField, ...] = (
     # gated by the beta master) nor in ADVANCED_SETTINGS_FIELDS (registries
     # are name-disjoint per _validate_registries()).
     FeatureFlagField("enable_mandatory_bps", "ENABLE_MANDATORY_BPS", bool),
+    # Child flag of enable_mandatory_bps (#1779). Non-beta like its
+    # parent, so it belongs here and NOT in BETA_FEATURE_FIELDS; kept out
+    # of ADVANCED_SETTINGS_FIELDS too (registries are name-disjoint).
+    FeatureFlagField(
+        "enable_strict_mandatory_bps", "ENABLE_STRICT_MANDATORY_BPS", bool
+    ),
     FeatureFlagField("enable_yaml_config_editing", "ENABLE_YAML_CONFIG_EDITING", bool),
     FeatureFlagField("enable_yaml_edit_confirm", "ENABLE_YAML_EDIT_CONFIRM", bool),
     # Per-key sub-gates beneath enable_yaml_config_editing. Nested in

{ha_mcp_dev-7.12.3.dev1882 → ha_mcp_dev-7.12.3.dev1885}/src/ha_mcp/errors.py

@@ -100,6 +100,12 @@ class ErrorCode(StrEnum):
     # because the server-wide Read Only Mode toggle is on.
     READ_ONLY_MODE = "READ_ONLY_MODE"
 
+    # Strict mandatory best-practices gate (#1779). A gated write tool was
+    # blocked because strict mode is effective and the call did not carry
+    # the acknowledgment key published only in the best-practices skill
+    # content. Fail-closed: nothing was changed.
+    BPS_ACKNOWLEDGMENT_REQUIRED = "BPS_ACKNOWLEDGMENT_REQUIRED"
+
     # Mandatory auto-backup (#1579). A write that requires a pre-write
     # snapshot was blocked because the snapshot could not be captured
     # (fetch failed, the snapshot write failed — e.g. disk full — or the

{ha_mcp_dev-7.12.3.dev1882 → ha_mcp_dev-7.12.3.dev1885}/src/ha_mcp/server.py

@@ -257,6 +257,13 @@ class HomeAssistantSmartMCPServer(EnhancedToolsMixin):
         # queues a pointless approval request.
         self._apply_read_only_middleware()
 
+        # Strict mandatory best-practices gate (#1779) — always installed,
+        # self-no-ops at call time. Registered immediately AFTER the
+        # read-only middleware so a read-only rejection wins over the
+        # strict-BPS one (a write blocked by read-only mode should not be
+        # asked for an acknowledgment key it could never usefully supply).
+        self._apply_strict_bps_middleware()
+
         # Wire tool security policies middleware (#966) — opt-in via
         # ENABLE_TOOL_SECURITY_POLICIES. Must come last so the middleware
         # wraps the final tool surface (including the search proxies).
@@ -1041,6 +1048,41 @@ class HomeAssistantSmartMCPServer(EnhancedToolsMixin):
 
         self.mcp.add_middleware(ReadOnlyMiddleware(list_tools=_list_all_tools))
 
+    def _apply_strict_bps_middleware(self) -> None:
+        """Install the strict best-practices gate (#1779).
+
+        Always installed — the middleware self-no-ops at call time
+        (consults ``strict_bps_effective()`` per call), so a toggle applies
+        live in standalone-HTTP/embedded mode like ``read_only_mode``
+        (other modes pick it up on restart).
+
+        Also emits a startup WARNING when the child flag is on while its
+        parent (``enable_mandatory_bps``) is off: strict mode is inert in
+        that configuration, and env-var users (Docker, uvx, pip) would
+        otherwise have no signal that their strict toggle does nothing.
+        Precedent: the lite-docstrings warning.
+        """
+        from .strict_bps import StrictBpsMiddleware
+
+        if self.settings.enable_strict_mandatory_bps and (
+            not self.settings.enable_mandatory_bps
+        ):
+            logger.warning(
+                "ENABLE_STRICT_MANDATORY_BPS is on but ENABLE_MANDATORY_BPS is "
+                "off — strict best-practices mode is INERT. The strict gate only "
+                "engages when the mandatory-BPS master switch is also on. Enable "
+                "ENABLE_MANDATORY_BPS to activate the acknowledgment gate."
+            )
+
+        # Unfiltered catalog lookup so the gate can pass through calls to
+        # gate-map tools that never registered (e.g. ha_config_set_yaml with
+        # yaml editing off) — those get FastMCP's unknown-tool error instead
+        # of a key-fetch misdirection (#1820 review).
+        async def _list_all_tools() -> Any:
+            return await self.mcp.local_provider._list_tools()
+
+        self.mcp.add_middleware(StrictBpsMiddleware(list_tools=_list_all_tools))
+
     # Shared action-phrased keyword block for retrieval. Some MCP clients
     # (Claude Code, others) rank candidate tools by token-overlap between
     # the user's natural-language query and each tool's `description`
@@ -1295,14 +1337,13 @@ class HomeAssistantSmartMCPServer(EnhancedToolsMixin):
                 ),
             ] = None,
         ) -> dict[str, Any]:
-            # ``skills_dir`` is captured from the enclosing scope at
-            # registration time. The current ``_get_skills_dir()`` is
-            # effectively static per process (it inspects an on-disk
-            # path that doesn't change), so the closure is fine. If a
-            # future change makes the skills location dynamic (env-var
-            # override, etc.), the closure won't pick that up — re-read
-            # via ``self._get_skills_dir()`` here instead.
-            return self._handle_skill_guide_call(skills_dir, skill, file)
+            # Re-read the skills dir live on every call (#1820 review):
+            # the strict-BPS gate also reads it live, so a registration-time
+            # capture deadlocks the one recovery path — vendor absent at
+            # boot (gate fails open), operator runs `git submodule update
+            # --init` in place, the gate flips ON, but a captured None here
+            # would keep the acknowledgment key unobtainable until restart.
+            return self._handle_skill_guide_call(self._get_skills_dir(), skill, file)
 
         self.mcp.tool(
             name=SKILL_TOOL_NAME,
@@ -1560,10 +1601,24 @@ class HomeAssistantSmartMCPServer(EnhancedToolsMixin):
         # parsing the (potentially large) content body. Scoped to the
         # best-practice skill because that's the one the write-tool
         # MandatoryBPS param gates; other skills (if any) are unrelated.
+        from .strict_bps import strict_bps_ack_line, strict_bps_effective
         from .tools.util_helpers import _HA_BEST_PRACTICES_SKILL_NAME
 
+        is_best_practices = skill == _HA_BEST_PRACTICES_SKILL_NAME
+
+        # Publish the acknowledgment key inside the best-practices content
+        # itself (#1779) when strict mode is effective — this Tier-3 read is
+        # the ONLY caller-facing surface that carries the key. Prepended to
+        # the content body so a model that reads the guide obtains the key
+        # it must pass as BestPracticeKey on gated writes. The skill://
+        # resource surface reads raw files and does NOT get this line; that
+        # is accepted — resource-preferring clients recover via the block
+        # error's suggestion, which points them back at this tool.
+        if is_best_practices and strict_bps_effective():
+            content = f"{strict_bps_ack_line()}\n\n{content}"
+
         response: dict[str, Any] = {}
-        if skill == _HA_BEST_PRACTICES_SKILL_NAME:
+        if is_best_practices:
             response["skill_content_hint"] = _SKILL_GUIDE_MANDATORYBPS_HINT
         response.update(
             {

{ha_mcp_dev-7.12.3.dev1882 → ha_mcp_dev-7.12.3.dev1885}/src/ha_mcp/settings_ui/__init__.py

@@ -19,7 +19,7 @@ import os
 import re
 import time
 import uuid
-from collections.abc import Awaitable, Callable
+from collections.abc import Awaitable, Callable, Container
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Literal, NamedTuple, NotRequired, TypedDict
 
@@ -1248,6 +1248,49 @@ def _schedule_supervisor_self_restart(
     task.add_done_callback(_BACKGROUND_RESTART_TASKS.discard)
 
 
+def _reject_child_flags_without_parent(
+    raw_flags: dict[str, Any],
+    parent_field: str,
+    child_fields: Container[str],
+    message: Callable[[list[str]], str],
+    suggestions: list[str],
+) -> JSONResponse | None:
+    """Reject a feature-flag save that enables child flags while their
+    parent stays off after the merge.
+
+    A child flag is only valid when ``parent_field`` is truthy AFTER the
+    merge. The post-merge parent is derived from the payload (if present),
+    else the live ``Settings`` value — the same value the runtime gate
+    will see. A child turned truthy against an
+    off parent would be forced back off at runtime, so reject it now
+    rather than let the user learn the save was a no-op at next startup.
+    Turning the parent off alone is NOT rejected: children absent from the
+    payload keep their persisted value and the runtime gate handles them.
+
+    Returns a 409 ``JSONResponse`` — ``message`` receives every offending
+    child, which is also echoed in ``context["rejected"]`` — or ``None``
+    when there is nothing to reject.
+    """
+    rejected = [k for k in raw_flags if k in child_fields and bool(raw_flags[k])]
+    effective_parent = bool(
+        raw_flags.get(
+            parent_field,
+            getattr(get_global_settings(), parent_field),
+        )
+    )
+    if rejected and not effective_parent:
+        return JSONResponse(
+            create_error_response(
+                ErrorCode.VALIDATION_INVALID_PARAMETER,
+                message(rejected),
+                suggestions=suggestions,
+                context={"rejected": rejected},
+            ),
+            status_code=409,
+        )
+    return None
+
+
 def build_settings_handlers(
     server: HomeAssistantSmartMCPServer | None,
     *,
@@ -1943,14 +1986,11 @@ def build_settings_handlers(
                 status_code=400,
             )
 
-        # Master beta-gate check: a sub-flag write is only valid
-        # when the master ``enable_beta_features`` is on AFTER the
-        # merge. Derive the post-merge master from the payload (if
-        # present), otherwise fall back to the live ``Settings`` value.
-        # Reject sub-flag writes that try to enable a beta when the
-        # resulting master state would still be off — the runtime gate
-        # would force them False anyway and the user should know the
-        # save was a no-op rather than learning at next startup.
+        # Master beta-gate check: a beta sub-flag may only be enabled
+        # when the master ``enable_beta_features`` is on AFTER the merge
+        # (see ``_reject_child_flags_without_parent`` for the post-merge
+        # derivation and why a parent-off-only save is not rejected). All
+        # offending sub-flags are listed in the rejection.
         #
         # Applied in BOTH standalone and addon mode.
         # The earlier "skip in addon mode" carve-out existed because
@@ -1959,43 +1999,61 @@ def build_settings_handlers(
         # one-cycle legacy bridge. On dev addon, start.py writes the
         # master env var from the schema-bound options key. On stable
         # addon, the master is not in schema and the standalone
-        # web-UI master path remains the gate (the gate read below
+        # web-UI master path remains the gate (the gate read
         # falls through to the override-file value). Either way the
         # gate is sound to apply uniformly.
         from ..config import (
             BETA_FEATURE_FIELDS as _BETA_SUB,
         )
 
-        effective_master = bool(
-            raw_flags.get(
-                "enable_beta_features",
-                getattr(get_global_settings(), "enable_beta_features", False),
-            )
+        beta_rejection = _reject_child_flags_without_parent(
+            raw_flags,
+            "enable_beta_features",
+            _BETA_SUB,
+            lambda rejected: (
+                "Cannot enable beta sub-flag(s) "
+                f"{', '.join(rejected)} while the master "
+                "'Enable beta features' toggle is off. Include "
+                "enable_beta_features=true in the same save, or "
+                "flip the master on first."
+            ),
+            [
+                "Include enable_beta_features=true in the same save "
+                + "payload as the sub-flag(s).",
+                "Or turn on the master 'Enable beta features' toggle "
+                + "first, then enable the sub-flag(s).",
+            ],
         )
-        beta_sub_writes = [
-            k for k in raw_flags if k in _BETA_SUB and bool(raw_flags[k])
-        ]
-        if beta_sub_writes and not effective_master:
-            return JSONResponse(
-                create_error_response(
-                    ErrorCode.VALIDATION_INVALID_PARAMETER,
-                    (
-                        "Cannot enable beta sub-flag(s) "
-                        f"{', '.join(beta_sub_writes)} while the master "
-                        "'Enable beta features' toggle is off. Include "
-                        "enable_beta_features=true in the same save, or "
-                        "flip the master on first."
-                    ),
-                    suggestions=[
-                        "Include enable_beta_features=true in the same save "
-                        + "payload as the sub-flag(s).",
-                        "Or turn on the master 'Enable beta features' toggle "
-                        + "first, then enable the sub-flag(s).",
-                    ],
-                    context={"rejected": beta_sub_writes},
-                ),
-                status_code=409,
-            )
+        if beta_rejection is not None:
+            return beta_rejection
+
+        # Strict-mandatory-BPS dependency gate: strict mode
+        # (``enable_strict_mandatory_bps``) is a child of
+        # ``enable_mandatory_bps`` and is inert unless the parent is on.
+        # Same post-merge derivation and no-parent-off-rejection as the
+        # beta gate above (see ``_reject_child_flags_without_parent``).
+        strict_rejection = _reject_child_flags_without_parent(
+            raw_flags,
+            "enable_mandatory_bps",
+            ("enable_strict_mandatory_bps",),
+            lambda _rejected: (
+                "Cannot enable strict best-practices mode "
+                "('enable_strict_mandatory_bps') while the parent "
+                "'Attach best-practice skills on writes' "
+                "(enable_mandatory_bps) toggle is off. Strict mode is "
+                "a child of that toggle and has no effect without it. "
+                "Include enable_mandatory_bps=true in the same save, or "
+                "turn the parent on first."
+            ),
+            [
+                "Include enable_mandatory_bps=true in the same save "
+                + "payload as enable_strict_mandatory_bps.",
+                "Or turn on the parent 'Attach best-practice skills on "
+                + "writes' toggle first, then enable strict mode.",
+            ],
+        )
+        if strict_rejection is not None:
+            return strict_rejection
 
         # Build the validated override dict. Reject unknown fields and
         # env-locked fields up front so the user gets a precise error

{ha_mcp_dev-7.12.3.dev1882 → ha_mcp_dev-7.12.3.dev1885}/src/ha_mcp/settings_ui/settings.css

@@ -504,18 +504,40 @@
 
   .feature-row.beta-master-row { font-weight: 600; padding-top: 20px; border-top: 2px solid var(--border); margin-top: 8px; }
   .feature-row.beta-master-row .feature-help { font-weight: 400; }
-  .feature-row.beta-sub { padding-left: 32px; position: relative; }
-  .feature-row.beta-sub::before { content: ""; position: absolute; left: 12px; top: 0; bottom: 0; width: 2px; background: var(--border); }
-  .feature-row.beta-sub.dimmed { opacity: 0.38; }
-  .feature-row.beta-sub.dimmed input { cursor: not-allowed; }
-  .feature-row.codemode-sub { padding-left: 56px; position: relative; }
-  .feature-row.codemode-sub::before { content: ""; position: absolute; left: 36px; top: 0; bottom: 0; width: 2px; background: var(--border); }
-  .feature-row.codemode-sub.dimmed { opacity: 0.38; }
-  .feature-row.codemode-sub.dimmed input { cursor: not-allowed; }
-  .feature-row.yaml-packages-sub { padding-left: 56px; position: relative; }
-  .feature-row.yaml-packages-sub::before { content: ""; position: absolute; left: 36px; top: 0; bottom: 0; width: 2px; background: var(--border); }
-  .feature-row.yaml-packages-sub.dimmed { opacity: 0.38; }
-  .feature-row.yaml-packages-sub.dimmed input { cursor: not-allowed; }
+  /* Nested sub-flag rows share one guide-bar treatment; only the indent
+     depth differs (see the depth-1 / depth-2 blocks below). */
+  .feature-row.beta-sub,
+  .feature-row.codemode-sub,
+  .feature-row.yaml-packages-sub,
+  .feature-row.mandatory-bps-sub { position: relative; }
+  .feature-row.beta-sub::before,
+  .feature-row.codemode-sub::before,
+  .feature-row.yaml-packages-sub::before,
+  .feature-row.mandatory-bps-sub::before {
+    content: ""; position: absolute; top: 0; bottom: 0; width: 2px; background: var(--border);
+  }
+  .feature-row.beta-sub.dimmed,
+  .feature-row.codemode-sub.dimmed,
+  .feature-row.yaml-packages-sub.dimmed,
+  .feature-row.mandatory-bps-sub.dimmed { opacity: 0.38; }
+  .feature-row.beta-sub.dimmed input,
+  .feature-row.codemode-sub.dimmed input,
+  .feature-row.yaml-packages-sub.dimmed input,
+  .feature-row.mandatory-bps-sub.dimmed input { cursor: not-allowed; }
+
+  /* Depth 1 — nested directly under a top-level toggle (beta-sub under the
+     master; strict-mode under the non-beta enable_mandatory_bps row). */
+  .feature-row.beta-sub,
+  .feature-row.mandatory-bps-sub { padding-left: 32px; }
+  .feature-row.beta-sub::before,
+  .feature-row.mandatory-bps-sub::before { left: 12px; }
+
+  /* Depth 2 — nested under a beta-sub parent (yaml packages under
+     enable_yaml_config_editing; code-mode numerics under enable_code_mode). */
+  .feature-row.codemode-sub,
+  .feature-row.yaml-packages-sub { padding-left: 56px; }
+  .feature-row.codemode-sub::before,
+  .feature-row.yaml-packages-sub::before { left: 36px; }
 
   /* ── ADVANCED SETTINGS ───────────────────────────────────────────────── */
   .adv-section-title {

{ha_mcp_dev-7.12.3.dev1882 → ha_mcp_dev-7.12.3.dev1885}/src/ha_mcp/settings_ui/settings.js

@@ -1555,6 +1555,10 @@ const FEATURE_META = {
     label: "Attach best-practice skills on writes",
     help: "Master switch for the write-tool skill content delivery feature (issue #1182). When enabled (default), the six config write tools (automations, scripts, scenes, helpers, dashboards, raw YAML) attach the canonical Home Assistant best-practice reference files under skill_content on every successful write, plus auto-embed any reference sections cited by best-practice warnings. Each tool also exposes a per-call MandatoryBPS parameter the agent can set to false on subsequent calls once it has the content. When this master switch is off, NO skill_content goes out regardless of the per-call parameter or BP warnings. Leave on if your LLM benefits from inline guidance; turn off to minimise tokens when using an LLM that has the best-practice files indexed via skills or another retrieval path. Requires restart to take effect.",
   },
+  enable_strict_mandatory_bps: {
+    label: "Strict best-practices mode",
+    help: "Strict mode: prevents the client from using the tool until it can prove that it read the best practices. While on, the six best-practice write tools (automations, scripts, scenes, helpers, dashboards, raw YAML) are blocked and return an error directing the client to read the best-practices skill via ha_get_skill_guide and pass back the acknowledgment key it obtains there. Nested under \"Attach best-practice skills on writes\" above and inert while that parent toggle is off. Requires restart to take effect (applies live in standalone HTTP mode).",
+  },
   // Master beta toggle — gates the 5 sub-flags below at runtime
   // (see config.py:_apply_feature_flag_overrides master gate). UI
   // dims sub-rows when this is off and re-renders live on flip.
@@ -1613,7 +1617,7 @@ let BETA_SUB_FLAGS = new Set();
 // Sub-flags of ``enable_yaml_config_editing`` (confirm-flow toggle +
 // per-key packages gates). They ARE in BETA_SUB_FLAGS (it mirrors
 // config.BETA_FEATURE_FIELDS verbatim), but the main render pass skips
-// them via the includes() guard below, and renderYamlPackagesSubRows
+// them via the includes() guard below, and renderSubFlagRows
 // re-renders them nested beneath their parent — so they never appear
 // as standalone beta-sub rows.
 const YAML_PACKAGES_SUB_FLAGS = [
@@ -1623,6 +1627,16 @@ const YAML_PACKAGES_SUB_FLAGS = [
   'enable_yaml_packages_scene',
 ];
 
+// Sub-flag of ``enable_mandatory_bps`` (strict best-practices mode).
+// Unlike YAML_PACKAGES_SUB_FLAGS this is NON-beta — it is NOT in
+// BETA_SUB_FLAGS and its only gate is the parent toggle. The main
+// render pass skips it via the includes() guard below, and
+// renderSubFlagRows re-renders it nested beneath its parent so
+// it never appears as a standalone top-level row.
+const MANDATORY_BPS_SUB_FLAGS = [
+  'enable_strict_mandatory_bps',
+];
+
 // Cached add-on flag. Each settings endpoint (/api/settings/features,
 // /api/settings/advanced, /api/settings/backup-config) returns
 // ``is_addon`` so the env-locked banner copy can adapt — the addon
@@ -1733,9 +1747,12 @@ function renderFeatureFlags(flags) {
     const f = flags[fieldName];
     if (!f) return;
     // Skip yaml-packages sub-rows in the main pass — they're rendered
-    // by renderYamlPackagesSubRows below right after their parent so
+    // by renderSubFlagRows below right after their parent so
     // the nesting reads in source order.
     if (YAML_PACKAGES_SUB_FLAGS.includes(fieldName)) return;
+    // Same for the strict-mode sub-row — rendered by
+    // renderSubFlagRows right after its enable_mandatory_bps parent.
+    if (MANDATORY_BPS_SUB_FLAGS.includes(fieldName)) return;
     const meta = FEATURE_META[fieldName];
     const isMaster = fieldName === 'enable_beta_features';
     const isBetaSub = BETA_SUB_FLAGS.has(fieldName);
@@ -1820,6 +1837,18 @@ function renderFeatureFlags(flags) {
             renderFeatureFlags(_lastFeatureFlags);
           }
         }
+        // Re-render on enable_mandatory_bps flip so the strict-mode
+        // sub-row dims/undims immediately. Same live-cache pattern as
+        // the master and yaml-config flips above.
+        if (fieldName === 'enable_mandatory_bps') {
+          if (_lastFeatureFlags[fieldName]) {
+            _lastFeatureFlags[fieldName] = {
+              ..._lastFeatureFlags[fieldName],
+              value: input.checked,
+            };
+            renderFeatureFlags(_lastFeatureFlags);
+          }
+        }
         saveFeatureFlag(fieldName, input.checked);
       });
       const slider = document.createElement('span');
@@ -1864,7 +1893,20 @@ function renderFeatureFlags(flags) {
     // itself is off.
     if (fieldName === 'enable_yaml_config_editing') {
       const parentOn = !!f.value;
-      renderYamlPackagesSubRows(flags, targetBody, masterOn, parentOn);
+      renderSubFlagRows(flags, targetBody, YAML_PACKAGES_SUB_FLAGS, {
+        cssClass: 'yaml-packages-sub',
+        lockedByGate: !masterOn || !parentOn,
+      });
+    }
+    // After the enable_mandatory_bps parent row, inject its strict-mode
+    // sub-row. This whole group is non-beta, so the only gate is the
+    // parent toggle (no master beta involved).
+    if (fieldName === 'enable_mandatory_bps') {
+      const parentOn = !!f.value;
+      renderSubFlagRows(flags, targetBody, MANDATORY_BPS_SUB_FLAGS, {
+        cssClass: 'mandatory-bps-sub',
+        lockedByGate: !parentOn,
+      });
     }
     // After the enable_filesystem_tools row, inject the custom-directories
     // editor (issue #1567). Dimmed when either the master beta is off or
@@ -1877,14 +1919,23 @@ function renderFeatureFlags(flags) {
   });
 }
 
-function renderYamlPackagesSubRows(flags, parentEl, masterOn, parentOn) {
-  YAML_PACKAGES_SUB_FLAGS.forEach(fieldName => {
+// Shared renderer for bool sub-flag rows nested under a parent toggle
+// (yaml-packages under enable_yaml_config_editing, strict mode under
+// enable_mandatory_bps). Each row is a checkbox+slider whose change
+// handler syncs _lastFeatureFlags and POSTs via saveFeatureFlag, dimmed
+// + input-disabled when ``lockedByGate`` is true. Callers precompute
+// lockedByGate from whatever gates apply to their group (yaml-packages:
+// master beta AND parent; mandatory-bps: parent only) and pass the CSS
+// class that carries the group's indent/guide-bar depth. The number/text
+// code-mode sub-numerics are NOT rendered here — they save through
+// commitAdvancedEdit and live in renderCodeModeSubRows.
+function renderSubFlagRows(flags, parentEl, subFieldNames, { cssClass, lockedByGate }) {
+  subFieldNames.forEach(fieldName => {
     const f = flags[fieldName];
     if (!f) return;
     const meta = FEATURE_META[fieldName] || { label: fieldName, help: '' };
-    const lockedByGate = !masterOn || !parentOn;
     const row = document.createElement('div');
-    row.className = 'feature-row yaml-packages-sub' + (lockedByGate ? ' dimmed' : '');
+    row.className = 'feature-row ' + cssClass + (lockedByGate ? ' dimmed' : '');
 
     const info = document.createElement('div');
     info.className = 'feature-info';
@@ -1900,7 +1951,7 @@ function renderYamlPackagesSubRows(flags, parentEl, masterOn, parentOn) {
         `${escapeHtml(ORIGIN_INFO_NOTE[f.origin])}</div>`
       : '';
     info.innerHTML =
-      `<div class="feature-name">${escapeHtml(meta.label)}</div>` +
+      `<div class="feature-name" id="label-feature-${fieldName}">${escapeHtml(meta.label)}</div>` +
       `<div class="feature-help">${escapeHtml(meta.help)}</div>` +
       lockedNote + infoNote;
 
@@ -1913,6 +1964,7 @@ function renderYamlPackagesSubRows(flags, parentEl, masterOn, parentOn) {
     input.name = 'feature:' + fieldName;
     input.checked = !!f.value;
     input.disabled = !f.editable || lockedByGate;
+    input.setAttribute('aria-labelledby', 'label-feature-' + fieldName);
     input.addEventListener('change', () => {
       // Keep the cached flag value in sync (parity with the parent/master
       // row handlers) so a later parent flip — which re-renders from
@@ -1980,7 +2032,7 @@ function renderCodeModeSubRows(parentEl, masterOn, codeModeOn) {
         `<div class="feature-locked-note">${envLockedNoteHtml(f.env_var, f.field)}</div>`;
     }
     info.innerHTML =
-      `<div class="feature-name">${escapeHtml(meta.label)}</div>` +
+      `<div class="feature-name" id="label-feature-${f.field}">${escapeHtml(meta.label)}</div>` +
       `<div class="feature-help">${escapeHtml(meta.help)}</div>` +
       lockedNote;
 
@@ -2003,6 +2055,7 @@ function renderCodeModeSubRows(parentEl, masterOn, codeModeOn) {
     inputEl.disabled = disabled;
     inputEl.dataset.advField = f.field;
     inputEl.name = 'adv:' + f.field;
+    inputEl.setAttribute('aria-labelledby', 'label-feature-' + f.field);
     inputEl.addEventListener('change', () => {
       let v;
       if (f.type === 'int') v = parseInt(inputEl.value, 10);