ha-mcp-dev 7.6.0.dev640__tar.gz → 7.6.0.dev642__tar.gz

{ha_mcp_dev-7.6.0.dev640/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.6.0.dev642}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.6.0.dev640
+Version: 7.6.0.dev642
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.6.0.dev640 → ha_mcp_dev-7.6.0.dev642}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.6.0.dev640"
+version = "7.6.0.dev642"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.14"

{ha_mcp_dev-7.6.0.dev640 → ha_mcp_dev-7.6.0.dev642}/src/ha_mcp/tools/tools_bug_report.py

@@ -293,7 +293,8 @@ def _sanitize_log_text(text: str) -> str:
     review (see ``_generate_anonymization_guide``). Rules cover the most common
     leak shapes seen in HA add-on logs:
     JWTs, bearer tokens, long hex tokens, ``key=value`` style credentials,
-    URL userinfo, and IPv4 addresses with network context.
+    URL userinfo, IPv4 addresses with network context, and the MCP connect-URL
+    secret path (the add-on's LAN auth).
     """
     # JWT tokens (header.payload.signature)
     text = re.sub(
@@ -338,6 +339,20 @@ def _sanitize_log_text(text: str) -> str:
     text = _IPV4_WITH_PORT_OR_CIDR_RE.sub("[IP]", text)
     text = _IPV4_IN_URL_RE.sub(r"\1[IP]", text)
     text = _IPV4_AFTER_KEYWORD_RE.sub(r"\1[IP]", text)
+    # MCP connect-URL secret path — the add-on's LAN auth. Redact by the
+    # configured value (catches custom paths) and the generated
+    # ``/private_<token>`` convention. Only bug-report output is scrubbed here;
+    # the raw logs this text is copied from are left intact.
+    configured = os.getenv("MCP_SECRET_PATH", "").rstrip("/")
+    if configured and configured != "/mcp":
+        # Anchor on a path-segment boundary so a short/substring-prone configured
+        # value (e.g. "/ha") cannot corrupt unrelated text (e.g. "/happy").
+        text = re.sub(
+            re.escape(configured) + r"(?![A-Za-z0-9_-])",
+            "[REDACTED_SECRET_PATH]",
+            text,
+        )
+    text = re.sub(r"/private_[A-Za-z0-9_-]+", "[REDACTED_SECRET_PATH]", text)
     return text
 
 
@@ -623,7 +638,18 @@ class BugReportTools:
             "success": True,
             "diagnostic_info": diagnostic_info,
             "recent_logs": recent_logs,
-            "startup_logs": startup_logs,
+            # Scrub the startup-log *messages* — they aren't sanitized at source,
+            # so the connect-URL secret path can otherwise surface here.
+            # recent_logs is also returned, but its sensitive *parameters* are
+            # key-masked at the logging chokepoint and its error_message is
+            # returned as-is to the trusted client by design (see SECURITY.md);
+            # formatted_report and addon_logs already route through
+            # _sanitize_log_text. This copies entries — the underlying log
+            # records stay raw.
+            "startup_logs": [
+                {**entry, "message": _sanitize_log_text(entry.get("message", ""))}
+                for entry in startup_logs
+            ],
             "addon_logs": addon_logs,
             "log_count": len(recent_logs),
             "startup_log_count": len(startup_logs),

{ha_mcp_dev-7.6.0.dev640 → ha_mcp_dev-7.6.0.dev642}/src/ha_mcp/utils/usage_logger.py

@@ -94,6 +94,72 @@ def get_startup_logs() -> list[dict[str, Any]]:
     return _startup_collector.get_logs()
 
 
+# Parameter keys whose values are masked before a tool call is recorded to the
+# in-memory ring buffer or persisted to disk. Tool kwargs can carry secrets
+# (alarm/lock ``code``, tokens, passwords); these must never reach the usage
+# log, which ``ha_report_issue`` surfaces and which is written verbatim to
+# plaintext ``mcp_usage.jsonl``. Matching is by key name (case-insensitive) and
+# recursive, so a secret nested under a non-sensitive key — e.g.
+# ``ha_call_service(data={"code": ...})`` — is caught while ``data`` siblings
+# like ``entity_id``/``brightness`` survive for debugging.
+_SENSITIVE_PARAM_KEYS = frozenset(
+    {
+        "code",
+        "pin",
+        "password",
+        "passwd",
+        "secret",
+        "token",
+        "access_token",
+        "refresh_token",
+        "api_key",
+        "apikey",
+        "client_secret",
+        "authorization",
+    }
+)
+# Suffix match only for families with a low false-positive rate. Deliberately
+# excludes ``_code``/``_key`` so ``status_code``/``cache_key`` stay readable;
+# the exact ``code``/``pin``/``api_key`` entries above already cover the real
+# Home Assistant service-call surface.
+_SENSITIVE_KEY_SUFFIXES = ("_token", "_secret", "_password", "_passwd")
+_REDACTED_VALUE = "[REDACTED]"
+_MAX_REDACT_DEPTH = 6
+
+
+def _is_sensitive_key(key: Any) -> bool:
+    """Return True if a parameter key's value should be masked."""
+    if not isinstance(key, str):
+        return False
+    lowered = key.lower()
+    return lowered in _SENSITIVE_PARAM_KEYS or lowered.endswith(_SENSITIVE_KEY_SUFFIXES)
+
+
+def _redact_parameters(value: Any, _depth: int = 0) -> Any:
+    """Return a copy of ``value`` with sensitive values masked by key name.
+
+    Never mutates the input: it is the live tool ``kwargs`` dict, still
+    referenced by the caller after this returns. Recurses through nested
+    dicts/lists/tuples so secrets nested under non-sensitive keys are caught
+    (a tuple is returned as a list). Fails closed past ``_MAX_REDACT_DEPTH`` —
+    a subtree too deep to walk is masked wholesale rather than returned verbatim.
+    """
+    if _depth > _MAX_REDACT_DEPTH:
+        return _REDACTED_VALUE
+    if isinstance(value, dict):
+        return {
+            key: (
+                _REDACTED_VALUE
+                if _is_sensitive_key(key)
+                else _redact_parameters(item, _depth + 1)
+            )
+            for key, item in value.items()
+        }
+    if isinstance(value, (list, tuple)):
+        return [_redact_parameters(item, _depth + 1) for item in value]
+    return value
+
+
 @dataclass
 class ToolUsageLog:
     """Single tool usage log entry."""
@@ -201,10 +267,14 @@ class UsageLogger:
         if not self._enabled:
             return
         try:
+            # Mask secrets (alarm/lock codes, tokens, passwords) before the entry
+            # reaches the ring buffer or disk. Returns a copy — never mutates the
+            # caller's live kwargs dict.
+            redacted_parameters = _redact_parameters(parameters)
             log_entry = ToolUsageLog(
                 timestamp=datetime.now(UTC).isoformat(),
                 tool_name=tool_name,
-                parameters=parameters,
+                parameters=redacted_parameters,
                 execution_time_ms=execution_time_ms,
                 success=success,
                 error_message=error_message,

{ha_mcp_dev-7.6.0.dev640 → ha_mcp_dev-7.6.0.dev642/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.6.0.dev640
+Version: 7.6.0.dev642
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT