ha-mcp-dev 7.14.2.dev2100__tar.gz → 7.14.2.dev2105__tar.gz

{ha_mcp_dev-7.14.2.dev2100/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.14.2.dev2105}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.14.2.dev2100
+Version: 7.14.2.dev2105
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.14.2.dev2100 → ha_mcp_dev-7.14.2.dev2105}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.14.2.dev2100"
+version = "7.14.2.dev2105"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-7.14.2.dev2100 → ha_mcp_dev-7.14.2.dev2105}/src/ha_mcp/backup_manager.py

@@ -2128,8 +2128,19 @@ async def _restore_yaml(client: Any, entity_id: str, config: Any) -> Any:
     ``edit_yaml_config`` is the only write path that reaches HA config
     files (``write_file`` rejects them), so YAML restore goes through it
     with ``action="replace"``.
+
+    The operator's extra write keys (#1887) must ride along: the write that
+    produced this snapshot was allowed only because of them, so omitting
+    them here would make an auto-captured backup unrestorable. Note the
+    asymmetry with ``disabled_packages_keys``, whose default is permissive
+    and can therefore be left off.
     """
-    from .tools.tools_filesystem import call_mcp_tools_service
+    from .config import get_global_settings
+    from .tools.tools_filesystem import (
+        assert_extra_yaml_keys_supported,
+        call_mcp_tools_service,
+        effective_extra_yaml_write_keys,
+    )
     from .tools.util_helpers import unwrap_service_response
 
     # Split on the LAST "::" (see _fetch_yaml) so an exotic file path
@@ -2137,15 +2148,23 @@ async def _restore_yaml(client: Any, entity_id: str, config: Any) -> Any:
     file, sep, yaml_path = entity_id.rpartition("::")
     if not sep or not file or not yaml_path:
         raise ValueError(f"Invalid yaml snapshot target: {entity_id!r}")
+    service_data: dict[str, Any] = {
+        "file": file,
+        "action": "replace",
+        "yaml_path": yaml_path,
+        "content": str(config),
+    }
+    extra_keys = await effective_extra_yaml_write_keys(client, get_global_settings())
+    if extra_keys:
+        # Same version gate as the write path: without it a component that
+        # predates the field rejects the whole restore call over an option
+        # the snapshot being restored may not even use.
+        await assert_extra_yaml_keys_supported(client, extra_keys)
+        service_data["extra_allowed_keys"] = extra_keys
     result = await call_mcp_tools_service(
         client,
         "edit_yaml_config",
-        {
-            "file": file,
-            "action": "replace",
-            "yaml_path": yaml_path,
-            "content": str(config),
-        },
+        service_data,
     )
     if isinstance(result, dict):
         result = unwrap_service_response(result)

{ha_mcp_dev-7.14.2.dev2100 → ha_mcp_dev-7.14.2.dev2105}/src/ha_mcp/client/rest_client.py

@@ -8,7 +8,8 @@ import logging
 import os
 import ssl
 import time
-from typing import Any
+from dataclasses import dataclass
+from typing import Any, NoReturn
 
 import httpx
 from websockets.exceptions import WebSocketException
@@ -97,6 +98,54 @@ class HomeAssistantAPIError(HomeAssistantError):
         self.response_data = response_data
 
 
+@dataclass(frozen=True)
+class SceneResolution:
+    """Outcome of resolving a scene identifier via the entity registry.
+
+    ``registry_hit`` records whether ``config/entity_registry/get`` returned a
+    usable ``unique_id`` - i.e. the entity actually EXISTS. It is the signal that
+    separates a genuinely-missing scene from one that exists but is not editable
+    through HA's scene config API (a Hue/vendor scene, or a raw-YAML scene): both
+    resolve fine yet 404 on ``config/scene/config/{id}``, because that endpoint is
+    backed only by the managed ``scenes.yaml`` (issue #1971). ``platform`` carries
+    the registry entry's integration domain (``"hue"``, ``"homeassistant"``, …)
+    for error-message enrichment only - it never drives the classification, since
+    a raw-YAML scene is ``platform="homeassistant"`` yet still 404s.
+    """
+
+    storage_key: str
+    registry_hit: bool
+    platform: str | None
+
+
+class SceneStorageConfigNotFoundError(HomeAssistantAPIError):
+    """A scene entity resolved in the registry, but ``config/scene/config/{id}``
+    (backed by ``scenes.yaml``) has no matching entry.
+
+    The entity EXISTS; it is simply not an editable Home Assistant storage scene
+    (Hue/vendor scene, or a raw-YAML scene). Raised instead of a bare 404 so the
+    tools layer can surface ``CONFIG_NOT_FOUND`` rather than the misleading
+    ``ENTITY_NOT_FOUND``/``RESOURCE_NOT_FOUND`` (issue #1971). Subclasses
+    ``HomeAssistantAPIError`` so existing ``except HomeAssistantAPIError`` sites
+    keep treating it as the 404 it is.
+    """
+
+    def __init__(
+        self,
+        scene_id: str,
+        *,
+        platform: str | None = None,
+        storage_key: str | None = None,
+    ):
+        self.scene_id = scene_id
+        self.platform = platform
+        self.storage_key = storage_key
+        msg = f"Scene not found in editable storage: {scene_id}"
+        if storage_key and storage_key != scene_id:
+            msg += f" (resolved storage key: {storage_key})"
+        super().__init__(msg, status_code=404)
+
+
 class HomeAssistantCommandError(HomeAssistantError):
     """WebSocket command returned success=False.
 
@@ -1773,20 +1822,23 @@ class HomeAssistantClient:
                 ) from e
             raise
 
-    async def resolve_scene_id(self, identifier: str) -> str:
-        """
-        Resolve a scene identifier to its storage key via the entity registry.
+    async def _resolve_scene(self, identifier: str) -> SceneResolution:
+        """Resolve a scene identifier to its storage key AND registry metadata.
 
-        Scenes may be renamed in the HA UI, changing the entity_id but keeping
-        the original storage key. Mirrors :meth:`_resolve_script_id` — scenes
-        likewise need a WebSocket entity registry lookup; their state attributes
-        do not surface the storage key.
+        Backs :meth:`resolve_scene_id`. Returns the storage key together with
+        ``registry_hit`` (did the entity actually resolve?) and ``platform`` - the
+        two signals a bare storage key throws away. Callers that hit a config-API
+        404 need ``registry_hit`` to tell "entity missing" from "entity exists but
+        has no editable storage config", and ``platform`` to name the owning
+        integration in the resulting error (issue #1971).
 
         Args:
             identifier: Scene ID (with or without ``scene.`` prefix)
 
         Returns:
-            The storage key for the configuration API
+            A :class:`SceneResolution`. On any lookup failure it falls back to the
+            bare id with ``registry_hit=False`` - a write path must not treat the
+            guessed bare id as a confirmed resolve.
         """
         bare_id = identifier.removeprefix("scene.")
         entity_id = f"scene.{bare_id}"
@@ -1795,13 +1847,18 @@ class HomeAssistantClient:
                 {"type": "config/entity_registry/get", "entity_id": entity_id}
             )
             if result.get("success") is not False:
-                unique_id = result.get("result", {}).get("unique_id")
+                entry = result.get("result") or {}
+                unique_id = entry.get("unique_id")
                 if unique_id:
                     if unique_id != bare_id:
                         logger.debug(
                             f"Resolved scene entity_id {entity_id} to storage key {unique_id}"
                         )
-                    return str(unique_id)
+                    return SceneResolution(
+                        storage_key=str(unique_id),
+                        registry_hit=True,
+                        platform=entry.get("platform"),
+                    )
         except HomeAssistantConnectionError:
             # A dead transport must not become a silent guess: the fallback
             # below assumes the storage key equals the bare entity_id, which is
@@ -1814,19 +1871,111 @@ class HomeAssistantClient:
                 f"Entity registry lookup failed for {entity_id}, using bare id: {bare_id}",
                 exc_info=True,
             )
-        return bare_id
+        return SceneResolution(storage_key=bare_id, registry_hit=False, platform=None)
+
+    async def resolve_scene_id(self, identifier: str) -> str:
+        """
+        Resolve a scene identifier to its storage key via the entity registry.
+
+        Scenes may be renamed in the HA UI, changing the entity_id but keeping
+        the original storage key. Like :meth:`_resolve_script_id`, this returns
+        the bare storage key and needs a WebSocket entity registry lookup because
+        the state attributes do not surface it; the parity ends there, since the
+        underlying :meth:`_resolve_scene` additionally carries registry metadata
+        (``registry_hit``/``platform``) that the script resolver has no analogue for.
+
+        Thin wrapper over :meth:`_resolve_scene` for callers that only need the
+        storage key (e.g. the write path); the read/delete paths use the richer
+        :class:`SceneResolution` directly.
+
+        Args:
+            identifier: Scene ID (with or without ``scene.`` prefix)
+
+        Returns:
+            The storage key for the configuration API
+        """
+        return (await self._resolve_scene(identifier)).storage_key
+
+    async def _scene_state_exists(self, storage_key: str) -> bool:
+        """Return True if ``scene.<storage_key>`` exists in the state machine.
+
+        An ``id``-less YAML scene has no registry ``unique_id`` (so
+        ``registry_hit`` is False) yet still registers a state-machine entity.
+        This one-shot existence check separates that real-but-not-storage scene
+        from a genuinely-absent one after a config-API 404 (issue #1971). A 404
+        here is a clean "absent"; a transport failure propagates (fail loud).
+        """
+        try:
+            await self.get_entity_state(f"scene.{storage_key}")
+            return True
+        except HomeAssistantAPIError as e:
+            if e.status_code == 404:
+                return False
+            raise
+
+    async def _raise_scene_config_404(
+        self,
+        scene_id: str,
+        resolved_id: str,
+        resolution: SceneResolution | None,
+    ) -> NoReturn:
+        """Translate a scene config-API 404 into the right exception.
+
+        When the registry resolve succeeded (``registry_hit``), the entity exists
+        and the 404 means "no editable storage config" → raise
+        :class:`SceneStorageConfigNotFoundError` carrying the platform. On a
+        registry miss the entity may still be an ``id``-less YAML scene, which has
+        no registry ``unique_id`` yet exists in the state machine: a state hit
+        upgrades the 404 to the same not-storage-scene case with ``platform=None``
+        (issue #1971). Only a state miss too is the historic genuinely-absent bare
+        404. The state check is skipped when ``resolution`` is None (the internal
+        ``_resolved`` re-fetch fast path, where a 404 is a genuine disappearance).
+        Always raises.
+        """
+        if resolution is not None:
+            if resolution.registry_hit:
+                raise SceneStorageConfigNotFoundError(
+                    scene_id, platform=resolution.platform, storage_key=resolved_id
+                )
+            if await self._scene_state_exists(resolved_id):
+                raise SceneStorageConfigNotFoundError(
+                    scene_id, platform=None, storage_key=resolved_id
+                )
+        msg = f"Scene not found: {scene_id}"
+        if resolved_id != scene_id:
+            msg += f" (resolved storage key: {resolved_id})"
+        raise HomeAssistantAPIError(msg, status_code=404)
 
     async def get_scene_config(
-        self, scene_id: str, *, _resolved: bool = False
+        self,
+        scene_id: str,
+        *,
+        _resolved: bool = False,
+        resolution: SceneResolution | None = None,
     ) -> dict[str, Any]:
         """Get Home Assistant scene configuration by scene_id.
 
+        ``resolution`` lets a caller that already ran :meth:`_resolve_scene` pass
+        the full outcome through: the endpoint uses its ``storage_key`` and its
+        ``registry_hit``/``platform`` drive the config-404 classification (issue
+        #1971) with no extra lookup. It takes precedence over ``_resolved``.
+
         ``_resolved=True`` signals ``scene_id`` is already the resolved storage
         key (the caller ran :meth:`resolve_scene_id`), skipping the redundant
         registry lookup. ``resolve_scene_id`` is idempotent, so the result is
-        identical either way.
+        identical either way. This fast path is the internal re-fetch of an
+        already-resolved scene (its sole caller is the post-write re-fetch), where
+        a subsequent 404 is a genuine disappearance, not the not-storage-scene
+        case; the ``registry_hit``/``platform`` signals a config 404 needs are
+        deliberately unavailable there.
         """
-        resolved_id = scene_id if _resolved else await self.resolve_scene_id(scene_id)
+        if resolution is not None:
+            resolved_id = resolution.storage_key
+        elif _resolved:
+            resolved_id = scene_id
+        else:
+            resolution = await self._resolve_scene(scene_id)
+            resolved_id = resolution.storage_key
         try:
             endpoint = f"config/scene/config/{resolved_id}"
             response = await self._request("GET", endpoint)
@@ -1834,10 +1983,7 @@ class HomeAssistantClient:
             return {"success": True, "scene_id": resolved_id, "config": response}
         except HomeAssistantAPIError as e:
             if e.status_code == 404:
-                msg = f"Scene not found: {scene_id}"
-                if resolved_id != scene_id:
-                    msg += f" (resolved storage key: {resolved_id})"
-                raise HomeAssistantAPIError(msg, status_code=404) from e
+                await self._raise_scene_config_404(scene_id, resolved_id, resolution)
             raise
         except Exception as e:
             logger.error(f"Failed to get scene config for {scene_id}: {e}")
@@ -1904,15 +2050,24 @@ class HomeAssistantClient:
             raise
 
     async def delete_scene_config(
-        self, scene_id: str, *, _resolved: bool = False
+        self,
+        scene_id: str,
+        *,
+        resolution: SceneResolution | None = None,
     ) -> dict[str, Any]:
         """Delete Home Assistant scene configuration.
 
-        ``_resolved=True`` signals ``scene_id`` is already the resolved storage
-        key, skipping the redundant registry lookup (``resolve_scene_id`` is
-        idempotent, so the endpoint id is unchanged).
+        ``resolution`` lets a caller that already ran :meth:`_resolve_scene` pass
+        the full outcome through - the endpoint uses its ``storage_key`` while
+        ``scene_id`` stays the caller's slug for messages, and its ``registry_hit``
+        drives the config-404 classification (issue #1971) with no extra lookup.
+        Otherwise the id is resolved here.
         """
-        resolved_id = scene_id if _resolved else await self.resolve_scene_id(scene_id)
+        if resolution is not None:
+            resolved_id = resolution.storage_key
+        else:
+            resolution = await self._resolve_scene(scene_id)
+            resolved_id = resolution.storage_key
         try:
             endpoint = f"config/scene/config/{resolved_id}"
             response = await self._request("DELETE", endpoint)
@@ -1925,10 +2080,7 @@ class HomeAssistantClient:
             }
         except HomeAssistantAPIError as e:
             if e.status_code == 404:
-                msg = f"Scene not found: {scene_id}"
-                if resolved_id != scene_id:
-                    msg += f" (resolved storage key: {resolved_id})"
-                raise HomeAssistantAPIError(msg, status_code=404) from e
+                await self._raise_scene_config_404(scene_id, resolved_id, resolution)
             elif e.status_code == 405:
                 raise HomeAssistantAPIError(
                     f"Cannot delete scene '{scene_id}': The HTTP DELETE method is blocked. "

{ha_mcp_dev-7.14.2.dev2100 → ha_mcp_dev-7.14.2.dev2105}/src/ha_mcp/config.py

@@ -203,6 +203,25 @@ class Settings(BaseSettings):
     )
     enable_yaml_packages_scene: bool = Field(False, alias="ENABLE_YAML_PACKAGES_SCENE")
 
+    # Operator-configured extra top-level keys ha_config_set_yaml may write,
+    # comma-separated, on top of the custom component's built-in allowlist
+    # (#1887). For YAML-first integrations that are valid on one install but
+    # not worth hardcoding globally. Additive only, and never a way past the
+    # component's YAML_KEY_DENYLIST: that floor is enforced component-side
+    # (the authoritative layer) and is deliberately not mirrored here, so
+    # there is one copy to keep correct. A denied key typed into this setting
+    # is simply ignored, with the component's explanation on first use.
+    # Nor does it lift the packages-only restriction on automation/script/
+    # scene: those keep reaching packages/*.yaml through their own per-key
+    # toggles and stay rejected in configuration.yaml.
+    # Empty (the default) keeps today's behaviour exactly.
+    # Registered in ADVANCED_SETTINGS_FIELDS (section ``beta_yamlkeys``), not
+    # FEATURE_FLAG_FIELDS, because it is a value rather than a toggle – the
+    # same placement the code-mode sub-settings use. Meaningful only when
+    # ``enable_yaml_config_editing`` is on; the UI nests it under that parent
+    # like the per-key toggles above.
+    extra_yaml_write_keys: str = Field("", alias="HA_MCP_EXTRA_YAML_KEYS")
+
     # Seed values for tool visibility (comma-separated tool names).
     # Used as initial config when no tool_config.json exists.
     # The web settings UI (/settings) is the primary interface for managing these.
@@ -621,6 +640,7 @@ AdvancedSection = Literal[
     "tools_surface",
     "sidecar",
     "beta_codemode",
+    "beta_yamlkeys",
     "developer",
 ]
 
@@ -896,6 +916,18 @@ ADVANCED_SETTINGS_FIELDS: tuple[AdvancedField, ...] = (
         "beta_codemode",
         True,
     ),
+    # Extra YAML write keys (issue #1887). Same shape as the code-mode
+    # sub-settings above: a non-bool value that belongs visually under a
+    # feature toggle rather than in the advanced panel, so it lives here
+    # with its own section and the features renderer nests it beneath
+    # "Enable YAML config editing".
+    AdvancedField(
+        "extra_yaml_write_keys",
+        "HA_MCP_EXTRA_YAML_KEYS",
+        str,
+        "beta_yamlkeys",
+        True,
+    ),
     # Developer mode (issue #1775). Lives in ADVANCED_SETTINGS_FIELDS —
     # not FEATURE_FLAG_FIELDS — so it renders in its own "Developer"
     # section at the very bottom of the Server Settings tab instead of
@@ -1185,6 +1217,30 @@ def _apply_one_feature_flag_override(
         )
 
 
+def parse_extra_yaml_write_keys(settings: "Settings") -> list[str]:
+    """Parse ``extra_yaml_write_keys`` into a clean key list (#1887).
+
+    Whitespace and empty entries are dropped and the result is deduplicated
+    and sorted, so the service payload is deterministic and unaffected by how
+    the operator spaced the setting.
+
+    The component's ``YAML_KEY_DENYLIST`` is NOT applied here: that floor
+    lives component-side, in the layer that authorizes the write. Mirroring it
+    would mean a second copy to keep in lockstep for no gain: a denied key sent
+    on the wire is dropped there anyway.
+
+    Lives in this module rather than next to the YAML tool because the backup
+    restore path needs it too, and ``backup_manager`` importing a ``tools_*``
+    module would add an import edge that binds ``tools_yaml_config``'s
+    module-level names at restore time.
+    """
+    # Direct attribute access, matching ``_disabled_packages_keys``: a future
+    # rename must raise loudly rather than silently return an empty list,
+    # which would read as "the operator configured nothing".
+    raw = settings.extra_yaml_write_keys or ""
+    return sorted({segment.strip() for segment in raw.split(",") if segment.strip()})
+
+
 def _apply_beta_master_gate(settings: "Settings") -> None:
     """Force BETA_FEATURE_FIELDS to False when ``enable_beta_features`` is off.
 

{ha_mcp_dev-7.14.2.dev2100 → ha_mcp_dev-7.14.2.dev2105}/src/ha_mcp/settings_ui/locales/de.json

@@ -412,6 +412,8 @@
     "advanced.code_mode_max_invocations.help": "API-/Tool-Aufruf-Grenze pro Sandbox-Lauf. Neustart erforderlich.",
     "advanced.code_mode_saved_tools_path.label": "Pfad für gespeicherte Tools",
     "advanced.code_mode_saved_tools_path.help": "JSON-Datei, die verwendet wird, um benutzerdefinierte Tools über Neustarts hinweg beizubehalten. Neustart erforderlich.",
+    "advanced.extra_yaml_write_keys.label": "Zusätzliche YAML-Schreib-Keys",
+    "advanced.extra_yaml_write_keys.help": "Kommagetrennte Top-Level-Keys, die ha_config_set_yaml zusätzlich zu den eingebauten schreiben darf – für YAML-first-Integrationen auf dieser Installation (z. B. alert2). Keys, die die Vertrauensgrenze von Home Assistant selbst verändern, lassen sich nie hinzufügen und werden ignoriert. Erfordert Custom Component 1.2.4 oder neuer.",
     "advanced.sidecar_pin_port.label": "Einstellungs-UI-Sidecar-Port",
     "advanced.sidecar_pin_port.help": "0 wählt bei jedem Neustart einen freien Port; 1024-65535 heftet einen bevorzugten Port an. Neustart erforderlich.",
     "advanced.enable_dev_mode.label": "Entwicklermodus",

{ha_mcp_dev-7.14.2.dev2100 → ha_mcp_dev-7.14.2.dev2105}/src/ha_mcp/settings_ui/locales/en.json

@@ -412,6 +412,8 @@
     "advanced.code_mode_max_invocations.help": "API/tool-call cap per sandbox run. Restart required.",
     "advanced.code_mode_saved_tools_path.label": "Saved-tools path",
     "advanced.code_mode_saved_tools_path.help": "JSON file used to persist custom tools across restarts. Restart required.",
+    "advanced.extra_yaml_write_keys.label": "Extra YAML write keys",
+    "advanced.extra_yaml_write_keys.help": "Comma-separated top-level keys ha_config_set_yaml may write in addition to the built-in ones, for YAML-first integrations on this install (e.g. alert2). Keys that redefine Home Assistant's own trust boundary can never be added and are ignored. Requires custom component 1.2.4 or newer.",
     "advanced.sidecar_pin_port.label": "Settings UI sidecar port",
     "advanced.sidecar_pin_port.help": "0 chooses a free port each restart; 1024–65535 pins a preferred port. Restart required.",
     "advanced.enable_dev_mode.label": "Developer mode",

{ha_mcp_dev-7.14.2.dev2100 → ha_mcp_dev-7.14.2.dev2105}/src/ha_mcp/settings_ui/locales/ru.json

@@ -412,6 +412,8 @@
     "advanced.code_mode_max_invocations.help": "Лимит вызовов API и инструментов за один запуск. Нужен перезапуск.",
     "advanced.code_mode_saved_tools_path.label": "Путь к сохранённым инструментам",
     "advanced.code_mode_saved_tools_path.help": "JSON-файл для хранения пользовательских инструментов между перезапусками. Нужен перезапуск.",
+    "advanced.extra_yaml_write_keys.label": "Дополнительные YAML-ключи для записи",
+    "advanced.extra_yaml_write_keys.help": "Список верхнеуровневых ключей через запятую, которые ha_config_set_yaml может записывать вдобавок к встроенным – для YAML-ориентированных интеграций на этой установке (например, alert2). Ключи, меняющие саму границу доверия Home Assistant, добавить нельзя, они игнорируются. Требуется пользовательский компонент 1.2.4 или новее.",
     "advanced.sidecar_pin_port.label": "Порт sidecar интерфейса настроек",
     "advanced.sidecar_pin_port.help": "0 выбирает свободный порт при каждом запуске; 1024–65535 закрепляет желаемый порт. Нужен перезапуск.",
     "advanced.enable_dev_mode.label": "Режим разработчика",

{ha_mcp_dev-7.14.2.dev2100 → ha_mcp_dev-7.14.2.dev2105}/src/ha_mcp/settings_ui/settings.js

@@ -2167,7 +2167,9 @@ function renderFeatureFlags(flags) {
     // bottom.
     if (fieldName === 'enable_code_mode') {
       const codeModeOn = !!f.value;
-      renderCodeModeSubRows(targetBody, masterOn, codeModeOn);
+      renderAdvancedSubRows(
+        targetBody, 'beta_codemode', 'codemode-sub', !masterOn || !codeModeOn
+      );
     }
     // After rendering the enable_yaml_config_editing parent, inject
     // its 3 per-key sub-rows (automation/script/scene). Dimmed when
@@ -2179,6 +2181,11 @@ function renderFeatureFlags(flags) {
         cssClass: 'yaml-packages-sub',
         lockedByGate: !masterOn || !parentOn,
       });
+      // Extra write keys (#1887) – same nesting depth as the per-key
+      // toggles above, but a text value from the advanced cache.
+      renderAdvancedSubRows(
+        targetBody, 'beta_yamlkeys', 'yaml-packages-sub', !masterOn || !parentOn
+      );
     }
     // After the enable_mandatory_bps parent row, inject its strict-mode
     // sub-row. This whole group is non-beta, so the only gate is the
@@ -2210,7 +2217,7 @@ function renderFeatureFlags(flags) {
 // master beta AND parent; mandatory-bps: parent only) and pass the CSS
 // class that carries the group's indent/guide-bar depth. The number/text
 // code-mode sub-numerics are NOT rendered here — they save through
-// commitAdvancedEdit and live in renderCodeModeSubRows.
+// commitAdvancedEdit and live in renderAdvancedSubRows.
 function renderSubFlagRows(flags, parentEl, subFieldNames, { cssClass, lockedByGate }) {
   subFieldNames.forEach(fieldName => {
     const f = flags[fieldName];
@@ -2276,8 +2283,13 @@ function renderSubFlagRows(flags, parentEl, subFieldNames, { cssClass, lockedByG
   });
 }
 
-function renderCodeModeSubRows(parentEl, masterOn, codeModeOn) {
-  const cmRows = (_advancedFields || []).filter(x => x.section === 'beta_codemode');
+// Shared renderer for non-bool sub-rows that live in ADVANCED_SETTINGS_FIELDS
+// but render nested under a feature toggle (code-mode numerics under
+// enable_code_mode, extra YAML write keys under enable_yaml_config_editing).
+// They save through commitAdvancedEdit rather than saveFeatureFlag, which is
+// why renderSubFlagRows (checkbox-only) cannot serve them.
+function renderAdvancedSubRows(parentEl, section, cssClass, lockedByGate) {
+  const cmRows = (_advancedFields || []).filter(x => x.section === section);
   cmRows.forEach(f => {
     const meta = localizeMeta(
       'advanced',
@@ -2285,9 +2297,7 @@ function renderCodeModeSubRows(parentEl, masterOn, codeModeOn) {
       ADVANCED_FIELD_META[f.field] || { label: f.field, help: '' }
     );
     const row = document.createElement('div');
-    const lockedByGate = !masterOn || !codeModeOn;
-    const dimmed = lockedByGate;
-    row.className = 'feature-row codemode-sub' + (dimmed ? ' dimmed' : '');
+    row.className = 'feature-row ' + cssClass + (lockedByGate ? ' dimmed' : '');
 
     const info = document.createElement('div');
     info.className = 'feature-info';
@@ -3390,6 +3400,7 @@ const ADVANCED_FIELD_META = {
   code_mode_max_recursion:   { label: "Code-mode max recursion",      help: "Recursion-depth cap per sandbox run. Restart required." },
   code_mode_max_invocations: { label: "Code-mode max invocations",    help: "API/tool-call cap per sandbox run. Restart required." },
   code_mode_saved_tools_path:{ label: "Saved-tools path",              help: "JSON file where ha_manage_custom_tool persists saved tools across restarts. Restart required." },
+  extra_yaml_write_keys:     { label: "Extra YAML write keys",        help: "Comma-separated top-level keys ha_config_set_yaml may write in addition to the built-in ones, for YAML-first integrations on this install (e.g. alert2). Keys that redefine Home Assistant's own trust boundary can never be added and are ignored. Requires custom component 1.2.4 or newer." },
   sidecar_pin_port:    { label: "Settings UI sidecar port",    help: "0 = a new free port each restart (default); set 1024–65535 to pin a fixed port so the settings URL stays stable across restarts. Falls back to a free port if the pinned one is busy. Restart required." },
   enable_dev_mode:     { label: "Developer mode",               help: "⚠ DANGER: registers hidden developer tools (ha_dev_manage_server, ha_dev_manage_settings) that let AI agents change server settings and replace the running server version (e.g. install a PR build). For development and testing only. Restart required." },
 };
@@ -3493,10 +3504,10 @@ async function loadAdvancedSettings() {
   renderAdvancedSection('advSidecar', bySection.sidecar || []);
   renderAdvancedSection('advDeveloper', bySection.developer || []);
   applySidecarAvailability(data.is_stdio !== false);
-  // Re-render feature flags so the code_mode sub-numerics show up
-  // beneath enable_code_mode (race: loadFeatureFlags may have run
-  // before _advancedFields was populated). Cheap no-op if feature
-  // flags haven't loaded yet.
+  // Re-render feature flags so the advanced-backed sub-rows (code_mode
+  // numerics, extra YAML write keys) show up beneath their parent toggles
+  // (race: loadFeatureFlags may have run before _advancedFields was
+  // populated). Cheap no-op if feature flags haven't loaded yet.
   if (Object.keys(_lastFeatureFlags).length > 0) {
     renderFeatureFlags(_lastFeatureFlags);
   }