ha-mcp-dev 7.14.2.dev2113__tar.gz → 7.14.2.dev2117__tar.gz

{ha_mcp_dev-7.14.2.dev2113/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.14.2.dev2117}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.14.2.dev2113
+Version: 7.14.2.dev2117
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.14.2.dev2113 → ha_mcp_dev-7.14.2.dev2117}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.14.2.dev2113"
+version = "7.14.2.dev2117"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-7.14.2.dev2113 → ha_mcp_dev-7.14.2.dev2117}/src/ha_mcp/auth/provider.py

@@ -16,9 +16,10 @@ import os
 import secrets
 import time
 from base64 import urlsafe_b64decode, urlsafe_b64encode
+from collections.abc import Awaitable, Callable
 from pathlib import Path
 from typing import Any
-from urllib.parse import urlencode
+from urllib.parse import parse_qs, urlencode, urlparse, urlunparse
 
 from fastmcp.server.auth.auth import (
     AccessToken,  # FastMCP version has claims field
@@ -370,6 +371,58 @@ class HomeAssistantOAuthProvider(OAuthProvider):
             logger.debug(f"Failed to decode token: {e}")
             return None
 
+    def _issuer(self) -> str:
+        """The issuer identifier this authorization server advertises.
+
+        Single source for the ``issuer`` field of the metadata document served
+        below and for the RFC 9207 ``iss`` authorization-response parameter,
+        which RFC 9207 §2 requires to equal the advertised issuer exactly.
+        """
+        return str(AnyHttpUrl(str(self.base_url).rstrip("/")))
+
+    def _ensure_single_iss(self, url: str) -> str:
+        """Return ``url`` carrying the RFC 9207 ``iss`` parameter exactly once.
+
+        A registered redirect URI may itself carry an ``iss`` query parameter;
+        blindly appending ours would produce an ambiguous double-``iss``
+        response — and common parsers take the FIRST value, which is precisely
+        the issuer mix-up RFC 9207 exists to prevent. Any pre-existing ``iss``
+        is dropped so the one this server stamps is authoritative.
+        """
+        parsed = urlparse(url)
+        params = [
+            (k, v) for k, vs in parse_qs(parsed.query).items() for v in vs if k != "iss"
+        ]
+        params.append(("iss", self._issuer()))
+        return urlunparse(parsed._replace(query=urlencode(params)))
+
+    def _wrap_authorize_with_iss(
+        self, endpoint: "Callable[[Request], Awaitable[Response]]"
+    ) -> "Callable[[Request], Awaitable[Response]]":
+        """Wrap the SDK's ``/authorize`` endpoint to stamp ``iss`` on its
+        error redirects.
+
+        The SDK's ``AuthorizationHandler`` builds OAuth error authorization
+        responses (invalid scope, ``authorize()`` raising after redirect-URI
+        validation) itself, without the RFC 9207 ``iss`` parameter — only our
+        consent-form success path carries it otherwise. Success on this route
+        is a same-origin redirect to the consent form (no ``error``), which is
+        not an authorization response and stays untouched.
+        """
+
+        async def authorize_with_iss(request: Request) -> Response:
+            response: Response = await endpoint(request)
+            location = response.headers.get("location", "")
+            if (
+                response.status_code in (302, 303, 307)
+                and location
+                and "error" in parse_qs(urlparse(location).query)
+            ):
+                response.headers["location"] = self._ensure_single_iss(location)
+            return response
+
+        return authorize_with_iss
+
     def get_routes(self, mcp_path: str | None = None) -> list[Route]:
         """
         Get OAuth routes including custom consent form routes.
@@ -391,12 +444,9 @@ class HomeAssistantOAuthProvider(OAuthProvider):
             """Enhanced OAuth metadata handler with Claude.ai compatibility."""
             from mcp.server.auth.routes import build_metadata
 
-            # Get base URL
-            base = str(self.base_url).rstrip("/")
-
             # Get base metadata from MCP SDK
             metadata = build_metadata(
-                issuer_url=AnyHttpUrl(base),
+                issuer_url=AnyHttpUrl(self._issuer()),
                 service_documentation_url=AnyHttpUrl(
                     "https://github.com/homeassistant-ai/ha-mcp"
                 ),
@@ -411,6 +461,11 @@ class HomeAssistantOAuthProvider(OAuthProvider):
             # Add response_modes_supported (required by some OAuth clients)
             metadata_dict["response_modes_supported"] = ["query"]
 
+            # RFC 9207 §3: advertise that authorization responses carry the
+            # ``iss`` parameter — omission means "not supported" to
+            # discovery-driven clients even though redirects now include it.
+            metadata_dict["authorization_response_iss_parameter_supported"] = True
+
             # Add "none" auth method for public clients with PKCE (used by Claude.ai)
             if "token_endpoint_auth_methods_supported" in metadata_dict:
                 if "none" not in metadata_dict["token_endpoint_auth_methods_supported"]:
@@ -448,6 +503,16 @@ class HomeAssistantOAuthProvider(OAuthProvider):
                         methods=["GET", "OPTIONS"],
                     )
                 )
+            elif isinstance(route, Route) and route.path == "/authorize":
+                # RFC 9207: the SDK handler's own error redirects must carry
+                # ``iss`` too — see _wrap_authorize_with_iss.
+                enhanced_routes.append(
+                    Route(
+                        path=route.path,
+                        endpoint=self._wrap_authorize_with_iss(route.endpoint),
+                        methods=list(route.methods or []),
+                    )
+                )
             else:
                 enhanced_routes.append(route)
 
@@ -697,11 +762,19 @@ class HomeAssistantOAuthProvider(OAuthProvider):
         # Clean up pending authorization
         del self.pending_authorizations[str(txn_id)]
 
-        # Redirect back to client with auth code
-        redirect_uri = construct_redirect_uri(
-            pending["redirect_uri"],
-            code=auth_code_value,
-            state=pending.get("state"),
+        # Redirect back to client with auth code. RFC 9207: the authorization
+        # response carries the issuer that produced it, so a client registered
+        # with several authorization servers cannot be fed a code minted by a
+        # different one. _ensure_single_iss (rather than an ``iss=`` kwarg
+        # here) collapses any ``iss`` baked into the registered redirect URI —
+        # construct_redirect_uri appends blindly, and a double ``iss`` is
+        # ambiguous to strict clients.
+        redirect_uri = self._ensure_single_iss(
+            construct_redirect_uri(
+                pending["redirect_uri"],
+                code=auth_code_value,
+                state=pending.get("state"),
+            )
         )
 
         logger.info(f"Authorization successful for client {client_id}")

{ha_mcp_dev-7.14.2.dev2113 → ha_mcp_dev-7.14.2.dev2117}/src/ha_mcp/tools/smart_search/_deep.py

@@ -9,9 +9,14 @@ from fastmcp import Context
 from fastmcp.exceptions import ToolError
 
 from ...client.rest_client import HomeAssistantAPIError
+from ...errors import get_error_code, get_error_message
+from ..component_api import component_supports, get_component_caps
 from ..config_entry_flow import FLOW_HELPER_TYPES
 from ..helpers import exception_to_structured_error, safe_info, safe_progress
-from ..tools_config_dashboards import fetch_dashboards_list
+from ..tools_config_dashboards import (
+    _dashboards_via_component,
+    fetch_dashboards_list,
+)
 from ..tools_integrations import fetch_entry_options_with_status
 from ._config import (
     AUTOMATION_CONFIG_TIME_BUDGET,
@@ -55,6 +60,40 @@ async def _scrub_results_for_enforce(
             results[category] = scrub_records(items, enforce_regex)
 
 
+# The ``lovelace/config`` messages meaning "this dashboard has no stored
+# config" — bare (nested error shape) and as ``send_websocket_message``'s
+# flat envelope prefixes it. Mirrors ``dashboard_screenshot/paths.py``.
+_NO_STORED_CONFIG_MESSAGES = frozenset(
+    {"No config found.", "Command failed: No config found."}
+)
+
+
+def _is_no_stored_config(resp: dict[str, Any]) -> bool:
+    """True when a failed ``lovelace/config`` envelope means the dashboard
+    has no stored config — an auto-generated dashboard that was never taken
+    control of — which is a clean no-match for a config scan rather than a
+    backend failure (issue #2008).
+
+    HA reports the ``config_not_found`` code for two distinct causes
+    (``homeassistant/components/lovelace/websocket.py``, ``_handle_errors``):
+    no stored config ("No config found.") and an unresolvable url_path
+    ("Unknown config specified: ..."), e.g. a dashboard deleted between the
+    registry-list snapshot and this fetch. Only the former is a clean skip,
+    so the message is matched too; the latter stays a counted failure.
+
+    ``send_websocket_message`` normalizes command failures to a flat envelope
+    (code top-level as ``error_code``, message as the ``error`` string); the
+    nested ``error.code``/``error.message`` shape is accepted defensively via
+    the canonical :func:`get_error_code` / :func:`get_error_message`
+    extractors, matching ``dashboard_screenshot/paths.py``'s detection of the
+    same HA error.
+    """
+    code = resp.get("error_code") or get_error_code(resp)
+    if code != "config_not_found":
+        return False
+    return get_error_message(resp) in _NO_STORED_CONFIG_MESSAGES
+
+
 class DeepSearchMixin(SceneSearchMixin):
     """deep_search orchestration + per-type automation/script/helper/dashboard/flow search."""
 
@@ -279,8 +318,11 @@ class DeepSearchMixin(SceneSearchMixin):
                 (
                     results["dashboards"],
                     dashboard_failed,
-                ) = await self._deep_search_dashboards(
-                    query_lower, exact_match, semaphore
+                ) = await self._search_dashboards_surface(
+                    query_lower,
+                    exact_match,
+                    semaphore,
+                    include_config=include_config,
                 )
                 phase_done += 1
                 await safe_progress(
@@ -896,6 +938,106 @@ class DeepSearchMixin(SceneSearchMixin):
         failed_type_count += flow_failed_count
         return results, failed_type_count
 
+    async def _search_dashboards_surface(
+        self,
+        query_lower: str,
+        exact_match: bool,
+        semaphore: asyncio.Semaphore,
+        *,
+        include_config: bool,
+    ) -> tuple[list[dict[str, Any]], int]:
+        """The dashboard bucket: component-first, legacy fallback.
+
+        Returns ``(records, failed_count)``. The component's in-process
+        ``search`` frame (issue #2008) serves the exact-match, no-body shape
+        — the default ``ha_search`` call — mirroring the
+        ``ha_config_get_dashboard(mode="search")`` routing; fuzzy scoring and
+        ``include_config`` bodies are legacy-only (the component walk is
+        substring and its matches carry no bodies), as is every ``None``
+        fallback case of :meth:`_component_dashboard_search` — including a
+        YAML-bearing install, so component-vs-legacy never changes which
+        dashboards a search covers.
+        """
+        if exact_match and not include_config:
+            component = await self._component_dashboard_search(query_lower)
+            if component is not None:
+                return component
+        return await self._deep_search_dashboards(query_lower, exact_match, semaphore)
+
+    async def _component_dashboard_search(
+        self, query_lower: str
+    ) -> tuple[list[dict[str, Any]], int] | None:
+        """The dashboard bucket via the component's in-process ``search`` frame.
+
+        Returns ``(records, failed_count)`` — one legacy-shaped record per
+        matching dashboard from the component's ``document_matches`` (a
+        whole-document substring verdict per storage dashboard, ported from
+        ``_search_in_dict`` leaf for leaf, so view titles and dashboard-level
+        keys match exactly as the legacy walk matches them); ``failed_count``
+        is the component's ``load_failed`` (storage dashboards whose config
+        load raised — surfaced as the same ``dashboard(s) not scanned``
+        partial the legacy scan reports). A config-less auto-generated
+        dashboard is skipped in-process (nothing to scan), consistent with
+        :func:`_is_no_stored_config`.
+
+        ``None`` ⇒ run the legacy per-dashboard walk instead: the component
+        lacks the ``dashboards_doc_search`` capability (older components
+        emit only the card-scoped ``matches``, which would silently narrow
+        coverage), any ``_dashboards_via_component`` fallback (capability
+        miss / command error / lovelace unavailable), an empty query, a
+        malformed ``document_matches`` — or a non-zero ``yaml_skipped``.
+        The component never reads YAML-mode dashboard bodies, but the legacy
+        walk this path replaces does (``lovelace/config`` loads them, and the
+        fuzzy / ``include_config`` routes still read the same resolved
+        configs), so serving the component result on a YAML-bearing install
+        would make the DEFAULT call shape permanently narrower and
+        permanently ``partial``. Falling back keeps coverage identical to
+        the pre-component behaviour; storage-only installs — where the
+        exclusion costs nothing — keep the single-frame win (review
+        follow-up on issue #2008).
+        """
+        if not query_lower:
+            return None
+        caps = await get_component_caps(self.client)
+        if not component_supports(caps, "dashboards_doc_search"):
+            return None
+        result = await _dashboards_via_component(
+            self.client, "search", query=query_lower
+        )
+        if result is None:
+            return None
+        document_matches = result.get("document_matches")
+        if not isinstance(document_matches, list):
+            return None
+        if int(result.get("yaml_skipped", 0) or 0) > 0:
+            return None
+        failed = int(result.get("load_failed", 0) or 0)
+
+        records: dict[str, dict[str, Any]] = {}
+        for match in document_matches:
+            if not isinstance(match, dict):
+                continue
+            raw_url_path = match.get("url_path")
+            url_path = raw_url_path or "default"
+            if url_path in records:
+                continue
+            # The default dashboard: the legacy walk always labels it
+            # ("default", "Default Dashboard") — a taken-control default
+            # may carry its own body title, but emitting it would change
+            # the record shape between the component and legacy paths.
+            title = (
+                "Default Dashboard"
+                if not raw_url_path
+                else (match.get("title") or url_path)
+            )
+            records[url_path] = {
+                "dashboard_url": url_path,
+                "dashboard_title": title,
+                "score": 100,
+                "match_in_config": True,
+            }
+        return list(records.values()), failed
+
     async def _search_one_dashboard(
         self,
         url_path: str,
@@ -912,6 +1054,15 @@ class DeepSearchMixin(SceneSearchMixin):
         distinct from a successful no-match. Surfacing it lets
         ``ha_search(search_types=["dashboard"])`` report ``partial`` instead
         of a complete-looking empty result.
+
+        The no-stored-config envelope (``config_not_found`` + "No config
+        found.", see :func:`_is_no_stored_config`) is the deliberate
+        exception: an auto-generated dashboard (strategy-backed, never taken
+        control of) has nothing to scan, so it reads as a clean no-match.
+        Counting it as failed made every dashboard search on a stock install
+        report ``partial`` (issue #2008). The code's other cause — "Unknown
+        config specified", a dashboard deleted since the registry-list
+        snapshot — stays a counted failure.
         """
         async with semaphore:
             try:
@@ -932,6 +1083,12 @@ class DeepSearchMixin(SceneSearchMixin):
                 # shape explicitly (``success is False``) so a missing-success
                 # raw response still falls through to the ``result`` fallback.
                 if isinstance(resp, dict) and resp.get("success") is False:
+                    if _is_no_stored_config(resp):
+                        logger.debug(
+                            f"Dashboard has no stored config ({url_path}); "
+                            "auto-generated — nothing to scan"
+                        )
+                        return [], False
                     logger.debug(
                         f"Dashboard config returned non-success ({url_path}): {resp!r}"
                     )

{ha_mcp_dev-7.14.2.dev2113 → ha_mcp_dev-7.14.2.dev2117}/src/ha_mcp/tools/tools_config_dashboards.py

@@ -813,10 +813,12 @@ def _card_matches(
 #
 # Source: homeassistant/components/lovelace/websocket.py, _handle_errors —
 # emits f"Unknown config specified: {url_path}" paired with structured
-# error.code "config_not_found". The websocket client currently surfaces only
-# the message string, so substring matching is the only signal available at
-# the tool layer. If HA reformats this string, the lazy fallback regresses
-# silently to never firing — re-verify with major HA upgrades.
+# error.code "config_not_found". The client envelope does surface that code
+# top-level (``error_code``), but HA reuses it for the no-stored-config case
+# ("No config found." — an auto-generated dashboard), so the code alone cannot
+# identify an unresolved identifier; the message substring remains the only
+# discriminating signal. If HA reformats this string, the lazy fallback
+# regresses silently to never firing — re-verify with major HA upgrades.
 _LAZY_RESOLVE_TRIGGER = "Unknown config specified"
 
 
@@ -1283,7 +1285,8 @@ async def fetch_dashboards_list(
     every fetch site rather than silently degrading.
 
     When the ``ha_mcp_tools`` component advertises the ``dashboards`` capability
-    the storage-only rows are served from one in-process ``list`` frame (the
+    the rows — YAML rows included, tagged with ``mode`` (see
+    ``_component_dashboard_rows``) — are served from one in-process ``list`` frame (the
     ``_resolve_dashboard`` / ``_lookup_existing_dashboards`` / list-mode callers
     all funnel here); otherwise the legacy ``lovelace/dashboards/list`` WS read
     runs unchanged.

{ha_mcp_dev-7.14.2.dev2113 → ha_mcp_dev-7.14.2.dev2117}/src/ha_mcp/tools/tools_search.py

@@ -917,6 +917,33 @@ def _normalize_component_config_record(
     return out
 
 
+# Body surfaces the ``ha_mcp_tools`` component's ``search`` command accepts
+# (its voluptuous allowlist also has ``entity``, appended separately by
+# ``_build_component_search_request``). ``dashboard`` is deliberately absent:
+# the component has no dashboard scanner, so a request naming it must stay on
+# the legacy path — forwarding it just bounced off the component schema into a
+# warning-laden fallback on every call (issue #2008).
+_COMPONENT_BODY_SEARCH_TYPES: frozenset[str] = frozenset(
+    {"automation", "script", "scene", "helper"}
+)
+
+
+def _component_serves_search_types(req: _ResolvedSearch) -> bool:
+    """True when the component's search command accepts every requested surface.
+
+    Only an explicit ``search_types`` list can name an unsupported surface, and
+    only the body-eligible branch forwards it to the component — a
+    body-ineligible request sends the entity surface alone, which the component
+    always accepts. Routing is all-or-nothing per command, so one unsupported
+    surface sends the whole request to the legacy path, silently — the same
+    treatment as the other route-ineligible modes, not the warning-emitting
+    failure fallback.
+    """
+    if not req.body_eligible or req.parsed_search_types is None:
+        return True
+    return all(t in _COMPONENT_BODY_SEARCH_TYPES for t in req.parsed_search_types)
+
+
 def _build_component_search_request(req: _ResolvedSearch) -> dict[str, Any]:
     """Translate resolved ha_search inputs into an ``ha_mcp_tools/search`` request.
 
@@ -1958,7 +1985,9 @@ class SearchTools:
         # response keys) — keep the legacy path: their response contracts
         # differ per mode, and after the request-dedup work they are cheap
         # registry-only calls, so the component round-trip buys nothing worth
-        # the shape risk.
+        # the shape risk. A ``search_types`` naming a surface the component
+        # lacks (``dashboard``) also stays legacy — see
+        # ``_component_serves_search_types`` (issue #2008).
         #
         # Entity-visibility gate. A plain ``search`` component applies no
         # filtering, so an install with an ACTIVE visibility filter would leak
@@ -1973,7 +2002,11 @@ class SearchTools:
         # needs no analogous gate — it re-applies the filter server-side over the
         # component's raw slices. Checked only when the component would otherwise
         # serve, so the common (no-component / filter-off) install pays nothing.
-        if req.query_text and not (req.area_filter or "").strip():
+        if (
+            req.query_text
+            and not (req.area_filter or "").strip()
+            and _component_serves_search_types(req)
+        ):
             caps = await get_component_caps(self._client)
             if component_supports(caps, "search"):
                 (

{ha_mcp_dev-7.14.2.dev2113 → ha_mcp_dev-7.14.2.dev2117/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.14.2.dev2113
+Version: 7.14.2.dev2117
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT