ha-mcp-dev 7.4.1.dev504__tar.gz → 7.5.0.dev507__tar.gz

{ha_mcp_dev-7.4.1.dev504/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.5.0.dev507}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.4.1.dev504
+Version: 7.5.0.dev507
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.4.1.dev504 → ha_mcp_dev-7.5.0.dev507}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.4.1.dev504"
+version = "7.5.0.dev507"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.14"

{ha_mcp_dev-7.4.1.dev504 → ha_mcp_dev-7.5.0.dev507}/src/ha_mcp/client/rest_client.py

@@ -527,7 +527,7 @@ class HomeAssistantClient:
 
         - ``"addons/<slug>"`` for add-on container logs
         - ``"<service>"`` (where service ∈ {supervisor, host, core, dns, audio,
-          multicast, observer}) for system-service logs
+          cli, multicast, observer}) for system-service logs
 
         Bypasses ``HomeAssistantClient.httpx_client`` because the Supervisor
         endpoint uses a different base URL (``http://supervisor``) and a
@@ -645,18 +645,42 @@ class HomeAssistantClient:
         return await self._supervisor_logs_get(f"addons/{slug}")
 
     async def _get_system_service_logs(self, service: str) -> str:
-        """Fetch HA system-service logs directly from Supervisor's REST API.
-
-        Hits ``http://supervisor/{service}/logs``. ``service`` must be one of
-        the seven Supervisor-managed services: ``supervisor``, ``host``,
-        ``core``, ``dns``, ``audio``, ``multicast``, ``observer``. Caller is
-        responsible for validating ``service`` against the allowed set; this
-        helper does no validation and will raise ``HomeAssistantAPIError`` on
-        any unknown path (404 from Supervisor).
-
-        Requires ``hassio_role: manager`` like the addon-logs path.
+        """Fetch HA system-service logs.
+
+        ``service`` must be one of the eight Supervisor-managed services:
+        ``supervisor``, ``host``, ``core``, ``dns``, ``audio``, ``cli``,
+        ``multicast``, ``observer``. Caller is responsible for validating
+        ``service`` against the allowed set; this helper does no validation
+        and will raise ``HomeAssistantAPIError`` on any unknown path (404).
+
+        Branch on ``is_running_in_addon()`` — mirror of ``get_addon_logs``:
+        inside the addon container goes directly to Supervisor at
+        ``http://supervisor/{service}/logs`` with the Supervisor token
+        (``hassio_role: manager`` required). On non-addon installs (Docker
+        without Supervisor, pyinstaller, pip pointing at a normal HA URL),
+        falls back to the HA Core proxy at ``/api/hassio/{service}/logs``.
+
+        All seven slugs are whitelisted in HA Core's hassio proxy
+        (``homeassistant/components/hassio/http.py`` — ``PATHS_ADMIN``), so
+        an admin LLA is sufficient to reach any of them from outside the
+        addon.
+
+        Closes #1260: pre-fix this method had only the addon-direct branch,
+        so non-addon installs (the Docker image, uvx ha-mcp, etc.) hit the
+        ``SUPERVISOR_TOKEN``-absent fail-fast in ``_supervisor_logs_get`` for
+        every service, while the sibling ``source="supervisor"`` (addon
+        logs) call kept working through its own Core-proxy fallback.
         """
-        return await self._supervisor_logs_get(service)
+        if is_running_in_addon():
+            return await self._supervisor_logs_get(service)
+
+        logger.debug(f"Fetching {service} logs via HA Core proxy")
+        response = await self._raw_request(
+            "GET",
+            f"/hassio/{service}/logs",
+            headers={"Accept": "text/plain"},
+        )
+        return response.text
 
     async def test_connection(self) -> tuple[bool, str | None]:
         """

{ha_mcp_dev-7.4.1.dev504 → ha_mcp_dev-7.5.0.dev507}/src/ha_mcp/tools/tools_utility.py

@@ -12,6 +12,7 @@ from typing import Any, Literal
 
 from fastmcp.exceptions import ToolError
 
+from .._version import is_running_in_addon
 from ..client.rest_client import (
     HomeAssistantAPIError,
     HomeAssistantAuthError,
@@ -42,11 +43,12 @@ COMPACT_LOGBOOK_FIELDS = {
 }
 
 
-# Supervisor-managed system services exposed via /<slug>/logs. Stable set
-# in HA Core; if Supervisor adds e.g. /cli/logs in a future release, extend
-# here. See #1116.
+# Supervisor-managed system services exposed via /<slug>/logs. Set mirrors
+# HA Core's hassio HTTP proxy ``PATHS_ADMIN`` whitelist in
+# ``homeassistant/components/hassio/http.py``. See #1116 (original 7-service
+# scope) and #1260 (cli added — proxy supported it the whole time).
 SYSTEM_SERVICE_SLUGS = frozenset(
-    {"supervisor", "host", "core", "dns", "audio", "multicast", "observer"}
+    {"supervisor", "host", "core", "dns", "audio", "cli", "multicast", "observer"}
 )
 
 
@@ -145,7 +147,7 @@ def register_utility_tools(mcp: Any, client: Any, **kwargs: Any) -> None:
         - "error_log": Raw home-assistant.log text
         - "supervisor": Add-on container logs (requires slug = add-on slug)
         - "system_service": HA-Supervisor-managed system service logs (requires
-          slug ∈ {supervisor, host, core, dns, audio, multicast, observer})
+          slug ∈ {supervisor, host, core, dns, audio, cli, multicast, observer})
         - "logger": Effective log level per integration via logger/log_info (confirms logger.set_level changes took effect)
 
         **Shared params:** limit, search (keyword filter on entries/lines; matches integration domain for source='logger')
@@ -762,15 +764,29 @@ def register_utility_tools(mcp: Any, client: Any, **kwargs: Any) -> None:
         except HomeAssistantAuthError as e:
             # Listed before HomeAssistantAPIError because AuthError is a sibling,
             # not a subclass — without this explicit clause the 401 from
-            # _supervisor_logs_get propagates raw to FastMCP and surfaces
-            # without a structured `code` field.
+            # _supervisor_logs_get / _raw_request propagates raw to FastMCP and
+            # surfaces without a structured `code` field.
+            #
+            # Suggestions branch on is_running_in_addon(): addon installs go
+            # direct to Supervisor (the failure mode is a missing/rotated
+            # SUPERVISOR_TOKEN), non-addon installs hit HA Core's hassio
+            # proxy with the user's LLA (the failure mode is a non-admin or
+            # expired LLA — SUPERVISOR_TOKEN doesn't even apply).
+            if is_running_in_addon():
+                suggestions = [
+                    "Verify SUPERVISOR_TOKEN is set correctly inside the add-on",
+                    "Reinstall the add-on if the token may have rotated",
+                ]
+            else:
+                suggestions = [
+                    "Verify HOMEASSISTANT_TOKEN is a valid admin Long-Lived "
+                    "Access Token (Settings → Profile → Long-Lived Access Tokens)",
+                    "Re-create the LLAT if it has expired or been revoked",
+                ]
             exception_to_structured_error(
                 e,
                 context={"source": "supervisor", "slug": slug},
-                suggestions=[
-                    "Verify SUPERVISOR_TOKEN is set correctly inside the add-on",
-                    "Reinstall the add-on if the token may have rotated",
-                ],
+                suggestions=suggestions,
             )
         except HomeAssistantAPIError as e:
             status = getattr(e, "status_code", None)
@@ -832,13 +848,15 @@ def register_utility_tools(mcp: Any, client: Any, **kwargs: Any) -> None:
     ) -> dict[str, Any]:
         """Fetch HA system-service logs from Supervisor's per-service endpoint.
 
-        ``service`` ∈ {supervisor, host, core, dns, audio, multicast, observer}.
+        ``service`` ∈ ``SYSTEM_SERVICE_SLUGS`` (the eight Supervisor-managed
+        services: supervisor, host, core, dns, audio, cli, multicast, observer).
         Caller (``ha_get_logs(source='system_service')``) validates against
-        ``SYSTEM_SERVICE_SLUGS`` before dispatch. Hits
-        ``http://supervisor/<service>/logs`` directly via
-        ``HomeAssistantClient._get_system_service_logs`` — same direct-Supervisor
-        path #1116's add-on fix uses, just with a different URL prefix.
-        Requires ``hassio_role: manager`` in the addon manifest.
+        ``SYSTEM_SERVICE_SLUGS`` before dispatch. Routed through
+        ``HomeAssistantClient._get_system_service_logs`` which gates on
+        ``is_running_in_addon()``: addon installs hit Supervisor directly at
+        ``http://supervisor/<service>/logs`` (requires ``hassio_role: manager``
+        in the addon manifest), non-addon installs fall back to the HA Core
+        proxy at ``/api/hassio/<service>/logs`` (requires an admin LLA).
         """
         effective_limit = _coerce_limit(
             limit, default=DEFAULT_LOG_LIMIT, suggestion_example="100"
@@ -877,29 +895,53 @@ def register_utility_tools(mcp: Any, client: Any, **kwargs: Any) -> None:
         except HomeAssistantAuthError as e:
             # Listed before HomeAssistantAPIError because AuthError is a sibling,
             # not a subclass — without this explicit clause the 401 from
-            # _supervisor_logs_get propagates raw to FastMCP and surfaces
-            # without a structured `code` field.
+            # _supervisor_logs_get / _raw_request propagates raw to FastMCP and
+            # surfaces without a structured `code` field.
+            #
+            # Suggestions branch on is_running_in_addon() (see _get_supervisor_log
+            # for the rationale): SUPERVISOR_TOKEN suggestions only make sense
+            # inside the addon container; non-addon installs need admin-LLA hints.
+            if is_running_in_addon():
+                suggestions = [
+                    "Verify SUPERVISOR_TOKEN is set correctly inside the add-on",
+                    "Reinstall the add-on if the token may have rotated",
+                ]
+            else:
+                suggestions = [
+                    "Verify HOMEASSISTANT_TOKEN is a valid admin Long-Lived "
+                    "Access Token (Settings → Profile → Long-Lived Access Tokens)",
+                    "Re-create the LLAT if it has expired or been revoked",
+                ]
             exception_to_structured_error(
                 e,
                 context={"source": "system_service", "slug": service},
-                suggestions=[
-                    "Verify SUPERVISOR_TOKEN is set correctly inside the add-on",
-                    "Reinstall the add-on if the token may have rotated",
-                ],
+                suggestions=suggestions,
             )
         except HomeAssistantAPIError as e:
             status = getattr(e, "status_code", None)
             if status == 403:
-                # Same role-too-low cause as the addon-logs branch.
-                exception_to_structured_error(
-                    e,
-                    context={"source": "system_service", "slug": service},
-                    suggestions=[
+                # In-addon: Supervisor returns 403 when the addon's hassio_role
+                # is below 'manager'. Non-addon: HA Core's hassio proxy returns
+                # 403 when the LLA's user lacks admin — completely different
+                # remediation. Branch on the gate accordingly.
+                if is_running_in_addon():
+                    suggestions = [
                         "Addon's hassio_role must be 'manager' or higher to "
                         "read /<service>/logs",
                         "Verify the addon was reinstalled after the role bump "
                         "took effect",
-                    ],
+                    ]
+                else:
+                    suggestions = [
+                        "The Long-Lived Access Token must belong to a user "
+                        "with admin privileges",
+                        "Generate a new LLAT under an admin account and set "
+                        "HOMEASSISTANT_TOKEN to it",
+                    ]
+                exception_to_structured_error(
+                    e,
+                    context={"source": "system_service", "slug": service},
+                    suggestions=suggestions,
                 )
             if status == 404:
                 exception_to_structured_error(

{ha_mcp_dev-7.4.1.dev504 → ha_mcp_dev-7.5.0.dev507/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.4.1.dev504
+Version: 7.5.0.dev507
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT