ha-mcp-dev 7.6.0.dev641__tar.gz → 7.6.0.dev642__tar.gz

{ha_mcp_dev-7.6.0.dev641/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.6.0.dev642}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.6.0.dev641
+Version: 7.6.0.dev642
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.6.0.dev641 → ha_mcp_dev-7.6.0.dev642}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.6.0.dev641"
+version = "7.6.0.dev642"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.14"

{ha_mcp_dev-7.6.0.dev641 → ha_mcp_dev-7.6.0.dev642}/src/ha_mcp/tools/tools_bug_report.py

@@ -293,7 +293,8 @@ def _sanitize_log_text(text: str) -> str:
     review (see ``_generate_anonymization_guide``). Rules cover the most common
     leak shapes seen in HA add-on logs:
     JWTs, bearer tokens, long hex tokens, ``key=value`` style credentials,
-    URL userinfo, and IPv4 addresses with network context.
+    URL userinfo, IPv4 addresses with network context, and the MCP connect-URL
+    secret path (the add-on's LAN auth).
     """
     # JWT tokens (header.payload.signature)
     text = re.sub(
@@ -338,6 +339,20 @@ def _sanitize_log_text(text: str) -> str:
     text = _IPV4_WITH_PORT_OR_CIDR_RE.sub("[IP]", text)
     text = _IPV4_IN_URL_RE.sub(r"\1[IP]", text)
     text = _IPV4_AFTER_KEYWORD_RE.sub(r"\1[IP]", text)
+    # MCP connect-URL secret path — the add-on's LAN auth. Redact by the
+    # configured value (catches custom paths) and the generated
+    # ``/private_<token>`` convention. Only bug-report output is scrubbed here;
+    # the raw logs this text is copied from are left intact.
+    configured = os.getenv("MCP_SECRET_PATH", "").rstrip("/")
+    if configured and configured != "/mcp":
+        # Anchor on a path-segment boundary so a short/substring-prone configured
+        # value (e.g. "/ha") cannot corrupt unrelated text (e.g. "/happy").
+        text = re.sub(
+            re.escape(configured) + r"(?![A-Za-z0-9_-])",
+            "[REDACTED_SECRET_PATH]",
+            text,
+        )
+    text = re.sub(r"/private_[A-Za-z0-9_-]+", "[REDACTED_SECRET_PATH]", text)
     return text
 
 
@@ -508,8 +523,7 @@ class BugReportTools:
         **OUTPUT:**
         Returns both templates plus diagnostic data. Key fields:
         - `runtime_bug_template`, `agent_behavior_template` — pick based on context
-        - `recent_logs` — recent ha-mcp tool calls (secret parameters redacted);
-          startup log entries are summarised in `formatted_report`, not returned raw
+        - `recent_logs`, `startup_logs` — captured ha-mcp tool/server log entries
         - `addon_logs` — addon container stdout/stderr (HA add-on installs only;
           empty string otherwise)
         - `suggested_title`, `duplicate_check_urls`, `anonymization_guide`
@@ -623,13 +637,19 @@ class BugReportTools:
         return {
             "success": True,
             "diagnostic_info": diagnostic_info,
-            # ``recent_logs`` entries are redacted at the logging chokepoint
-            # (UsageLogger.log_tool_usage), so the tool parameters here carry no
-            # secrets. ``startup_logs`` come from a separate StartupLogCollector
-            # that is NOT redacted at source, so the raw entries are
-            # intentionally omitted — the sanitized view lives in
-            # ``formatted_report`` (via ``_format_startup_logs``).
             "recent_logs": recent_logs,
+            # Scrub the startup-log *messages* — they aren't sanitized at source,
+            # so the connect-URL secret path can otherwise surface here.
+            # recent_logs is also returned, but its sensitive *parameters* are
+            # key-masked at the logging chokepoint and its error_message is
+            # returned as-is to the trusted client by design (see SECURITY.md);
+            # formatted_report and addon_logs already route through
+            # _sanitize_log_text. This copies entries — the underlying log
+            # records stay raw.
+            "startup_logs": [
+                {**entry, "message": _sanitize_log_text(entry.get("message", ""))}
+                for entry in startup_logs
+            ],
             "addon_logs": addon_logs,
             "log_count": len(recent_logs),
             "startup_log_count": len(startup_logs),

{ha_mcp_dev-7.6.0.dev641 → ha_mcp_dev-7.6.0.dev642/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.6.0.dev641
+Version: 7.6.0.dev642
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT