ha-mcp-dev 7.14.2.dev2103__tar.gz → 7.14.2.dev2107__tar.gz

{ha_mcp_dev-7.14.2.dev2103/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.14.2.dev2107}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.14.2.dev2103
+Version: 7.14.2.dev2107
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.14.2.dev2103"
+version = "7.14.2.dev2107"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107}/src/ha_mcp/backup_manager.py

@@ -2128,8 +2128,19 @@ async def _restore_yaml(client: Any, entity_id: str, config: Any) -> Any:
     ``edit_yaml_config`` is the only write path that reaches HA config
     files (``write_file`` rejects them), so YAML restore goes through it
     with ``action="replace"``.
+
+    The operator's extra write keys (#1887) must ride along: the write that
+    produced this snapshot was allowed only because of them, so omitting
+    them here would make an auto-captured backup unrestorable. Note the
+    asymmetry with ``disabled_packages_keys``, whose default is permissive
+    and can therefore be left off.
     """
-    from .tools.tools_filesystem import call_mcp_tools_service
+    from .config import get_global_settings
+    from .tools.tools_filesystem import (
+        assert_extra_yaml_keys_supported,
+        call_mcp_tools_service,
+        effective_extra_yaml_write_keys,
+    )
     from .tools.util_helpers import unwrap_service_response
 
     # Split on the LAST "::" (see _fetch_yaml) so an exotic file path
@@ -2137,15 +2148,23 @@ async def _restore_yaml(client: Any, entity_id: str, config: Any) -> Any:
     file, sep, yaml_path = entity_id.rpartition("::")
     if not sep or not file or not yaml_path:
         raise ValueError(f"Invalid yaml snapshot target: {entity_id!r}")
+    service_data: dict[str, Any] = {
+        "file": file,
+        "action": "replace",
+        "yaml_path": yaml_path,
+        "content": str(config),
+    }
+    extra_keys = await effective_extra_yaml_write_keys(client, get_global_settings())
+    if extra_keys:
+        # Same version gate as the write path: without it a component that
+        # predates the field rejects the whole restore call over an option
+        # the snapshot being restored may not even use.
+        await assert_extra_yaml_keys_supported(client, extra_keys)
+        service_data["extra_allowed_keys"] = extra_keys
     result = await call_mcp_tools_service(
         client,
         "edit_yaml_config",
-        {
-            "file": file,
-            "action": "replace",
-            "yaml_path": yaml_path,
-            "content": str(config),
-        },
+        service_data,
     )
     if isinstance(result, dict):
         result = unwrap_service_response(result)

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107}/src/ha_mcp/config.py

@@ -203,6 +203,25 @@ class Settings(BaseSettings):
     )
     enable_yaml_packages_scene: bool = Field(False, alias="ENABLE_YAML_PACKAGES_SCENE")
 
+    # Operator-configured extra top-level keys ha_config_set_yaml may write,
+    # comma-separated, on top of the custom component's built-in allowlist
+    # (#1887). For YAML-first integrations that are valid on one install but
+    # not worth hardcoding globally. Additive only, and never a way past the
+    # component's YAML_KEY_DENYLIST: that floor is enforced component-side
+    # (the authoritative layer) and is deliberately not mirrored here, so
+    # there is one copy to keep correct. A denied key typed into this setting
+    # is simply ignored, with the component's explanation on first use.
+    # Nor does it lift the packages-only restriction on automation/script/
+    # scene: those keep reaching packages/*.yaml through their own per-key
+    # toggles and stay rejected in configuration.yaml.
+    # Empty (the default) keeps today's behaviour exactly.
+    # Registered in ADVANCED_SETTINGS_FIELDS (section ``beta_yamlkeys``), not
+    # FEATURE_FLAG_FIELDS, because it is a value rather than a toggle – the
+    # same placement the code-mode sub-settings use. Meaningful only when
+    # ``enable_yaml_config_editing`` is on; the UI nests it under that parent
+    # like the per-key toggles above.
+    extra_yaml_write_keys: str = Field("", alias="HA_MCP_EXTRA_YAML_KEYS")
+
     # Seed values for tool visibility (comma-separated tool names).
     # Used as initial config when no tool_config.json exists.
     # The web settings UI (/settings) is the primary interface for managing these.
@@ -621,6 +640,7 @@ AdvancedSection = Literal[
     "tools_surface",
     "sidecar",
     "beta_codemode",
+    "beta_yamlkeys",
     "developer",
 ]
 
@@ -896,6 +916,18 @@ ADVANCED_SETTINGS_FIELDS: tuple[AdvancedField, ...] = (
         "beta_codemode",
         True,
     ),
+    # Extra YAML write keys (issue #1887). Same shape as the code-mode
+    # sub-settings above: a non-bool value that belongs visually under a
+    # feature toggle rather than in the advanced panel, so it lives here
+    # with its own section and the features renderer nests it beneath
+    # "Enable YAML config editing".
+    AdvancedField(
+        "extra_yaml_write_keys",
+        "HA_MCP_EXTRA_YAML_KEYS",
+        str,
+        "beta_yamlkeys",
+        True,
+    ),
     # Developer mode (issue #1775). Lives in ADVANCED_SETTINGS_FIELDS —
     # not FEATURE_FLAG_FIELDS — so it renders in its own "Developer"
     # section at the very bottom of the Server Settings tab instead of
@@ -1185,6 +1217,30 @@ def _apply_one_feature_flag_override(
         )
 
 
+def parse_extra_yaml_write_keys(settings: "Settings") -> list[str]:
+    """Parse ``extra_yaml_write_keys`` into a clean key list (#1887).
+
+    Whitespace and empty entries are dropped and the result is deduplicated
+    and sorted, so the service payload is deterministic and unaffected by how
+    the operator spaced the setting.
+
+    The component's ``YAML_KEY_DENYLIST`` is NOT applied here: that floor
+    lives component-side, in the layer that authorizes the write. Mirroring it
+    would mean a second copy to keep in lockstep for no gain: a denied key sent
+    on the wire is dropped there anyway.
+
+    Lives in this module rather than next to the YAML tool because the backup
+    restore path needs it too, and ``backup_manager`` importing a ``tools_*``
+    module would add an import edge that binds ``tools_yaml_config``'s
+    module-level names at restore time.
+    """
+    # Direct attribute access, matching ``_disabled_packages_keys``: a future
+    # rename must raise loudly rather than silently return an empty list,
+    # which would read as "the operator configured nothing".
+    raw = settings.extra_yaml_write_keys or ""
+    return sorted({segment.strip() for segment in raw.split(",") if segment.strip()})
+
+
 def _apply_beta_master_gate(settings: "Settings") -> None:
     """Force BETA_FEATURE_FIELDS to False when ``enable_beta_features`` is off.
 

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107}/src/ha_mcp/settings_ui/locales/de.json

@@ -412,6 +412,8 @@
     "advanced.code_mode_max_invocations.help": "API-/Tool-Aufruf-Grenze pro Sandbox-Lauf. Neustart erforderlich.",
     "advanced.code_mode_saved_tools_path.label": "Pfad für gespeicherte Tools",
     "advanced.code_mode_saved_tools_path.help": "JSON-Datei, die verwendet wird, um benutzerdefinierte Tools über Neustarts hinweg beizubehalten. Neustart erforderlich.",
+    "advanced.extra_yaml_write_keys.label": "Zusätzliche YAML-Schreib-Keys",
+    "advanced.extra_yaml_write_keys.help": "Kommagetrennte Top-Level-Keys, die ha_config_set_yaml zusätzlich zu den eingebauten schreiben darf – für YAML-first-Integrationen auf dieser Installation (z. B. alert2). Keys, die die Vertrauensgrenze von Home Assistant selbst verändern, lassen sich nie hinzufügen und werden ignoriert. Erfordert Custom Component 1.2.4 oder neuer.",
     "advanced.sidecar_pin_port.label": "Einstellungs-UI-Sidecar-Port",
     "advanced.sidecar_pin_port.help": "0 wählt bei jedem Neustart einen freien Port; 1024-65535 heftet einen bevorzugten Port an. Neustart erforderlich.",
     "advanced.enable_dev_mode.label": "Entwicklermodus",

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107}/src/ha_mcp/settings_ui/locales/en.json

@@ -412,6 +412,8 @@
     "advanced.code_mode_max_invocations.help": "API/tool-call cap per sandbox run. Restart required.",
     "advanced.code_mode_saved_tools_path.label": "Saved-tools path",
     "advanced.code_mode_saved_tools_path.help": "JSON file used to persist custom tools across restarts. Restart required.",
+    "advanced.extra_yaml_write_keys.label": "Extra YAML write keys",
+    "advanced.extra_yaml_write_keys.help": "Comma-separated top-level keys ha_config_set_yaml may write in addition to the built-in ones, for YAML-first integrations on this install (e.g. alert2). Keys that redefine Home Assistant's own trust boundary can never be added and are ignored. Requires custom component 1.2.4 or newer.",
     "advanced.sidecar_pin_port.label": "Settings UI sidecar port",
     "advanced.sidecar_pin_port.help": "0 chooses a free port each restart; 1024–65535 pins a preferred port. Restart required.",
     "advanced.enable_dev_mode.label": "Developer mode",

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107}/src/ha_mcp/settings_ui/locales/ru.json

@@ -412,6 +412,8 @@
     "advanced.code_mode_max_invocations.help": "Лимит вызовов API и инструментов за один запуск. Нужен перезапуск.",
     "advanced.code_mode_saved_tools_path.label": "Путь к сохранённым инструментам",
     "advanced.code_mode_saved_tools_path.help": "JSON-файл для хранения пользовательских инструментов между перезапусками. Нужен перезапуск.",
+    "advanced.extra_yaml_write_keys.label": "Дополнительные YAML-ключи для записи",
+    "advanced.extra_yaml_write_keys.help": "Список верхнеуровневых ключей через запятую, которые ha_config_set_yaml может записывать вдобавок к встроенным – для YAML-ориентированных интеграций на этой установке (например, alert2). Ключи, меняющие саму границу доверия Home Assistant, добавить нельзя, они игнорируются. Требуется пользовательский компонент 1.2.4 или новее.",
     "advanced.sidecar_pin_port.label": "Порт sidecar интерфейса настроек",
     "advanced.sidecar_pin_port.help": "0 выбирает свободный порт при каждом запуске; 1024–65535 закрепляет желаемый порт. Нужен перезапуск.",
     "advanced.enable_dev_mode.label": "Режим разработчика",

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107}/src/ha_mcp/settings_ui/settings.js

@@ -2167,7 +2167,9 @@ function renderFeatureFlags(flags) {
     // bottom.
     if (fieldName === 'enable_code_mode') {
       const codeModeOn = !!f.value;
-      renderCodeModeSubRows(targetBody, masterOn, codeModeOn);
+      renderAdvancedSubRows(
+        targetBody, 'beta_codemode', 'codemode-sub', !masterOn || !codeModeOn
+      );
     }
     // After rendering the enable_yaml_config_editing parent, inject
     // its 3 per-key sub-rows (automation/script/scene). Dimmed when
@@ -2179,6 +2181,11 @@ function renderFeatureFlags(flags) {
         cssClass: 'yaml-packages-sub',
         lockedByGate: !masterOn || !parentOn,
       });
+      // Extra write keys (#1887) – same nesting depth as the per-key
+      // toggles above, but a text value from the advanced cache.
+      renderAdvancedSubRows(
+        targetBody, 'beta_yamlkeys', 'yaml-packages-sub', !masterOn || !parentOn
+      );
     }
     // After the enable_mandatory_bps parent row, inject its strict-mode
     // sub-row. This whole group is non-beta, so the only gate is the
@@ -2210,7 +2217,7 @@ function renderFeatureFlags(flags) {
 // master beta AND parent; mandatory-bps: parent only) and pass the CSS
 // class that carries the group's indent/guide-bar depth. The number/text
 // code-mode sub-numerics are NOT rendered here — they save through
-// commitAdvancedEdit and live in renderCodeModeSubRows.
+// commitAdvancedEdit and live in renderAdvancedSubRows.
 function renderSubFlagRows(flags, parentEl, subFieldNames, { cssClass, lockedByGate }) {
   subFieldNames.forEach(fieldName => {
     const f = flags[fieldName];
@@ -2276,8 +2283,13 @@ function renderSubFlagRows(flags, parentEl, subFieldNames, { cssClass, lockedByG
   });
 }
 
-function renderCodeModeSubRows(parentEl, masterOn, codeModeOn) {
-  const cmRows = (_advancedFields || []).filter(x => x.section === 'beta_codemode');
+// Shared renderer for non-bool sub-rows that live in ADVANCED_SETTINGS_FIELDS
+// but render nested under a feature toggle (code-mode numerics under
+// enable_code_mode, extra YAML write keys under enable_yaml_config_editing).
+// They save through commitAdvancedEdit rather than saveFeatureFlag, which is
+// why renderSubFlagRows (checkbox-only) cannot serve them.
+function renderAdvancedSubRows(parentEl, section, cssClass, lockedByGate) {
+  const cmRows = (_advancedFields || []).filter(x => x.section === section);
   cmRows.forEach(f => {
     const meta = localizeMeta(
       'advanced',
@@ -2285,9 +2297,7 @@ function renderCodeModeSubRows(parentEl, masterOn, codeModeOn) {
       ADVANCED_FIELD_META[f.field] || { label: f.field, help: '' }
     );
     const row = document.createElement('div');
-    const lockedByGate = !masterOn || !codeModeOn;
-    const dimmed = lockedByGate;
-    row.className = 'feature-row codemode-sub' + (dimmed ? ' dimmed' : '');
+    row.className = 'feature-row ' + cssClass + (lockedByGate ? ' dimmed' : '');
 
     const info = document.createElement('div');
     info.className = 'feature-info';
@@ -3390,6 +3400,7 @@ const ADVANCED_FIELD_META = {
   code_mode_max_recursion:   { label: "Code-mode max recursion",      help: "Recursion-depth cap per sandbox run. Restart required." },
   code_mode_max_invocations: { label: "Code-mode max invocations",    help: "API/tool-call cap per sandbox run. Restart required." },
   code_mode_saved_tools_path:{ label: "Saved-tools path",              help: "JSON file where ha_manage_custom_tool persists saved tools across restarts. Restart required." },
+  extra_yaml_write_keys:     { label: "Extra YAML write keys",        help: "Comma-separated top-level keys ha_config_set_yaml may write in addition to the built-in ones, for YAML-first integrations on this install (e.g. alert2). Keys that redefine Home Assistant's own trust boundary can never be added and are ignored. Requires custom component 1.2.4 or newer." },
   sidecar_pin_port:    { label: "Settings UI sidecar port",    help: "0 = a new free port each restart (default); set 1024–65535 to pin a fixed port so the settings URL stays stable across restarts. Falls back to a free port if the pinned one is busy. Restart required." },
   enable_dev_mode:     { label: "Developer mode",               help: "⚠ DANGER: registers hidden developer tools (ha_dev_manage_server, ha_dev_manage_settings) that let AI agents change server settings and replace the running server version (e.g. install a PR build). For development and testing only. Restart required." },
 };
@@ -3493,10 +3504,10 @@ async function loadAdvancedSettings() {
   renderAdvancedSection('advSidecar', bySection.sidecar || []);
   renderAdvancedSection('advDeveloper', bySection.developer || []);
   applySidecarAvailability(data.is_stdio !== false);
-  // Re-render feature flags so the code_mode sub-numerics show up
-  // beneath enable_code_mode (race: loadFeatureFlags may have run
-  // before _advancedFields was populated). Cheap no-op if feature
-  // flags haven't loaded yet.
+  // Re-render feature flags so the advanced-backed sub-rows (code_mode
+  // numerics, extra YAML write keys) show up beneath their parent toggles
+  // (race: loadFeatureFlags may have run before _advancedFields was
+  // populated). Cheap no-op if feature flags haven't loaded yet.
   if (Object.keys(_lastFeatureFlags).length > 0) {
     renderFeatureFlags(_lastFeatureFlags);
   }

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107}/src/ha_mcp/tools/tools_filesystem.py

@@ -51,6 +51,11 @@ MCP_TOOLS_DOMAIN = "ha_mcp_tools"
 # subsequent call comes back unauthorized (covers token rotation).
 CALLER_TOKEN_FIELD = "_ha_mcp_token"
 CALLER_TOKEN_BOOTSTRAP_SERVICE = "get_caller_token"
+# Component service that returns the operator's component-side extra YAML write
+# keys (#1887). Ships in the same component version as the ``extra_allowed_keys``
+# field, so it is read only when the component is new enough (see
+# ``effective_extra_yaml_write_keys``).
+GET_EXTRA_YAML_KEYS_SERVICE = "get_extra_yaml_keys"
 
 # Minimum version of the ha_mcp_tools custom component that this ha-mcp
 # release expects. Bumps in lockstep with ``manifest.json`` whenever a
@@ -108,6 +113,15 @@ def _version_tuple(version: str) -> tuple[int, ...]:
 # when a client is garbage-collected (avoids id() reuse if a freed client's
 # address gets recycled before the unauthorized-retry fires).
 _CALLER_TOKEN_CACHE: weakref.WeakKeyDictionary[Any, str] = weakref.WeakKeyDictionary()
+# Component version as reported by the REST bootstrap, keyed like the token
+# cache. Populated in ``_fetch_caller_token``, which already parses and
+# validates it. Feature-scoped version gates read this rather than the
+# WebSocket capability handshake: caps come back ``None`` for a transport
+# blip just as they do for an old component, so gating on them would report
+# a momentary socket drop as "your component is too old".
+_COMPONENT_VERSION_CACHE: weakref.WeakKeyDictionary[Any, str] = (
+    weakref.WeakKeyDictionary()
+)
 _CALLER_TOKEN_LOCKS: weakref.WeakKeyDictionary[Any, asyncio.Lock] = (
     weakref.WeakKeyDictionary()
 )
@@ -286,6 +300,7 @@ async def _fetch_caller_token(client: Any) -> str:
     if parsed < _version_tuple(MIN_COMPONENT_VERSION):
         _raise_component_too_old(f"reported version is {version}")
     _CALLER_TOKEN_CACHE[client] = token
+    _COMPONENT_VERSION_CACHE[client] = version
     return token
 
 
@@ -961,3 +976,130 @@ def register_filesystem_tools(mcp: Any, client: Any, **kwargs: Any) -> None:
 
     logger.info("Filesystem tools enabled via feature flag")
     register_tool_methods(mcp, FilesystemTools(client))
+
+
+# First custom-component version whose ``edit_yaml_config`` schema accepts
+# ``extra_allowed_keys`` (#1887).
+MIN_COMPONENT_VERSION_EXTRA_YAML_KEYS = "1.2.4"
+
+
+async def assert_extra_yaml_keys_supported(client: Any, extra_keys: list[str]) -> None:
+    """Block with an actionable prompt if the component predates #1887.
+
+    ``edit_yaml_config``'s service schema is strict, so sending
+    ``extra_allowed_keys`` to a component that does not declare the field makes
+    Home Assistant reject the whole call with an opaque "extra keys not
+    allowed". Callers only send the field when the operator configured keys,
+    and this turns the remaining server-ahead-of-component window into a clear
+    message. Both the write path and the backup restore path use it, so a
+    snapshot taken under the setting fails the same recognisable way.
+
+    Deliberately NOT a bump of ``MIN_COMPONENT_VERSION``: an operator who never
+    sets extra keys must not be forced to update the component to keep using
+    the filesystem tools.
+
+    The version comes from the REST bootstrap cache, which every call to this
+    component populates and validates, so a WebSocket hiccup cannot be
+    mistaken for an outdated component. An absent entry means the bootstrap
+    has not run yet; the caller below performs it first, and a component too
+    old to report a version at all is already rejected there.
+    """
+    if not extra_keys:
+        return
+
+    def _current() -> tuple[int, ...] | None:
+        reported = _COMPONENT_VERSION_CACHE.get(client, "")
+        if not reported:
+            return None
+        try:
+            return _version_tuple(reported)
+        except ValueError:
+            return None
+
+    floor = _version_tuple(MIN_COMPONENT_VERSION_EXTRA_YAML_KEYS)
+    await _ensure_caller_token(client)
+    parsed = _current()
+    if parsed is None or parsed < floor:
+        # The token cache is keyed by the long-lived REST client and survives
+        # a Home Assistant restart, so a component updated after this process
+        # first bootstrapped would keep reporting its old version forever and
+        # the remediation this error prints ("update, then restart HA") would
+        # never take effect. Re-bootstrap once before blocking, so the update
+        # heals the gate on the next call rather than needing an ha-mcp
+        # restart. Only on the failure path: a satisfied gate costs nothing.
+        await _ensure_caller_token(client, force_refresh=True)
+        parsed = _current()
+    reported = _COMPONENT_VERSION_CACHE.get(client, "")
+    if parsed is not None and parsed >= floor:
+        return
+    raise_tool_error(
+        create_error_response(
+            ErrorCode.COMPONENT_NOT_INSTALLED,
+            "Extra YAML write keys are configured, but the installed "
+            "ha_mcp_tools custom component does not support them "
+            f"(reported version: {reported or 'unknown'}; requires >= "
+            f"{MIN_COMPONENT_VERSION_EXTRA_YAML_KEYS}).",
+            suggestions=[
+                "HACS → Integrations → HA-MCP Custom Component → Update",
+                "Restart Home Assistant after the update completes",
+                # Parenthesised so this reads as one suggestion rather than
+                # a list entry with a missing comma (py/implicit-string-
+                # concatenation-in-list).
+                (
+                    "Or clear the extra YAML write keys setting to write "
+                    "only the built-in allowed keys"
+                ),
+            ],
+        )
+    )
+
+
+async def effective_extra_yaml_write_keys(client: Any, settings: Any) -> list[str]:
+    """Return the write allowlist extension in force: server setting + component.
+
+    The operator can set extra YAML write keys in two places (#1887): the ha-mcp
+    server's own ``HA_MCP_EXTRA_YAML_KEYS`` and, via the integration UI, a store
+    the component owns. A key set only on the component would otherwise be
+    rejected by the server's own pre-dispatch allowlist before the write ever
+    reaches the component, so the server reads that store here (via
+    ``get_extra_yaml_keys``) and unions it with its own setting.
+
+    That service ships in the same component version as the ``extra_allowed_keys``
+    field (``MIN_COMPONENT_VERSION_EXTRA_YAML_KEYS``), so it is read only when the
+    bootstrap reports a new-enough component; on an older component, or any read
+    failure, fall back to the server setting alone and let
+    ``assert_extra_yaml_keys_supported`` turn a real mismatch into an actionable
+    prompt. The store is read per write rather than cached: it changes at runtime
+    from the options flow, and a stale cache is the failure mode #1887's own
+    version-cache heal exists to avoid. YAML writes are rare and human-driven, so
+    the extra round-trip is negligible.
+    """
+    from ..config import parse_extra_yaml_write_keys
+
+    keys: set[str] = set(parse_extra_yaml_write_keys(settings))
+    try:
+        await _ensure_caller_token(client)
+        reported = _COMPONENT_VERSION_CACHE.get(client, "")
+        floor = _version_tuple(MIN_COMPONENT_VERSION_EXTRA_YAML_KEYS)
+        try:
+            current = _version_tuple(reported) if reported else None
+        except ValueError:
+            current = None
+        if current is not None and current >= floor:
+            result = await call_mcp_tools_service(
+                client, GET_EXTRA_YAML_KEYS_SERVICE, {}
+            )
+            inner = (
+                unwrap_service_response(result) if isinstance(result, dict) else None
+            )
+            if isinstance(inner, dict) and inner.get("success"):
+                stored = inner.get("keys", [])
+                if isinstance(stored, list):
+                    keys.update(k for k in stored if isinstance(k, str) and k)
+    except Exception:
+        logger.debug(
+            "Could not read the component extra-YAML-keys store; "
+            "using the server setting alone.",
+            exc_info=True,
+        )
+    return sorted(keys)

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107}/src/ha_mcp/tools/tools_yaml_config.py

@@ -33,7 +33,9 @@ from .helpers import (
 from .tools_config_dashboards import fetch_dashboards_list
 from .tools_filesystem import (
     _assert_mcp_tools_available,
+    assert_extra_yaml_keys_supported,
     call_mcp_tools_service,
+    effective_extra_yaml_write_keys,
 )
 from .util_helpers import (
     attach_skill_content,
@@ -57,7 +59,7 @@ _LOVELACE_DASHBOARD_PREFIX = "lovelace.dashboards."
 # here, otherwise a key would silently be unreachable through the
 # wrapper. The parity invariant (keys == PACKAGES_ONLY_YAML_KEYS, and
 # every value is a real Settings field) is enforced by
-# test_yaml_config_tool.py::test_flag_map_matches_packages_only_keys.
+# test_yaml_dashboards.py::test_flag_map_matches_packages_only_keys.
 _YAML_PACKAGES_FLAG_BY_KEY = {
     "automation": "enable_yaml_packages_automation",
     "script": "enable_yaml_packages_script",
@@ -464,6 +466,9 @@ class YamlConfigTools:
             # Check if custom component is available
             await _assert_mcp_tools_available(self._client)
 
+            extra_keys = await effective_extra_yaml_write_keys(self._client, settings)
+            await assert_extra_yaml_keys_supported(self._client, extra_keys)
+
             # Build service data
             service_data: dict[str, Any] = {
                 "file": file,
@@ -472,6 +477,11 @@ class YamlConfigTools:
                 "disabled_packages_keys": disabled_keys,
                 "require_confirm": settings.enable_yaml_edit_confirm,
             }
+            # Only sent when the operator actually configured extra keys, so a
+            # component that predates the field keeps working unchanged for
+            # everyone else (its schema is strict and would reject the call).
+            if extra_keys:
+                service_data["extra_allowed_keys"] = extra_keys
             if content is not None:
                 service_data["content"] = content
             if confirm_token is not None:

{ha_mcp_dev-7.14.2.dev2103 → ha_mcp_dev-7.14.2.dev2107/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.14.2.dev2103
+Version: 7.14.2.dev2107
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT