ha-mcp-dev 7.6.0.dev641__tar.gz → 7.6.0.dev643__tar.gz

{ha_mcp_dev-7.6.0.dev641/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.6.0.dev643}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.6.0.dev641
+Version: 7.6.0.dev643
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.6.0.dev641 → ha_mcp_dev-7.6.0.dev643}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.6.0.dev641"
+version = "7.6.0.dev643"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.14"

{ha_mcp_dev-7.6.0.dev641 → ha_mcp_dev-7.6.0.dev643}/src/ha_mcp/__main__.py

@@ -825,6 +825,27 @@ def register_browser_landing(mcp_instance: "FastMCP | _DeferredMCP", path: str)
         )
 
 
+def _log_settings_url(host: str, port: int, path: str) -> None:
+    """Log the web settings-UI URL at HTTP startup.
+
+    Non-add-on operators (Docker / standalone) otherwise have no easy way to
+    discover the settings page or its secret-path URL (issue #1458). When the
+    bind host is the wildcard (``0.0.0.0`` / ``::``) the process can't know its
+    externally reachable address, so we log a ``<host>`` placeholder.
+    """
+    is_wildcard = host in ("0.0.0.0", "::")
+    if is_wildcard:
+        display_host = "<host>"
+    elif ":" in host:
+        # IPv6 literal (e.g. ::1, 2001:db8::1) needs brackets in a URL.
+        display_host = f"[{host}]"
+    else:
+        display_host = host
+    url = f"http://{display_host}:{port}{path.rstrip('/')}/settings"
+    note = "  (substitute this server's address for <host>)" if is_wildcard else ""
+    logger.info(f"Settings UI available at: {url}{note}")
+
+
 def _run_http_server(transport: str, default_port: int = 8086) -> None:
     """Common runner for HTTP-based transports.
 
@@ -837,6 +858,7 @@ def _run_http_server(transport: str, default_port: int = 8086) -> None:
     host, port, path = _get_http_runtime(default_port)
     register_browser_landing(_get_mcp(), path)
     register_settings_routes(_get_mcp(), _get_server(), secret_path=path)
+    _log_settings_url(host, port, path)
 
     _run_entrypoint(
         _run_http_with_graceful_shutdown(transport, host, port, path),
@@ -984,6 +1006,7 @@ async def _run_oauth_server(
     from ha_mcp.settings_ui import register_settings_routes
 
     register_settings_routes(mcp, _server, secret_path=path)
+    _log_settings_url(host, port, path)
 
     tools = await mcp.list_tools()
     logger.info(

{ha_mcp_dev-7.6.0.dev641 → ha_mcp_dev-7.6.0.dev643}/src/ha_mcp/settings_ui.py

@@ -3017,6 +3017,25 @@ def _ingress_only(handler: _SettingsRoute) -> _SettingsRoute:
     return _guarded
 
 
+# Mount prefix the settings UI is served under in long-lived HTTP transports
+# (Docker / standalone ha-mcp-web / OAuth / the add-on's secret-path mount).
+# Recorded by register_settings_routes so ha_get_overview can point users at
+# the settings page in modes that have no stdio sidecar URL file to surface
+# (issue #1458). Stays None in pure stdio mode, where the sidecar writes
+# ~/.ha-mcp/ui.url instead.
+_http_settings_prefix: str | None = None
+
+
+def get_http_settings_prefix() -> str | None:
+    """Return the settings-UI mount prefix for HTTP transports, or None.
+
+    Set by :func:`register_settings_routes` when the page is mounted on a
+    long-lived HTTP server. ``ha_get_overview`` reads it to hint at the
+    settings page when there is no stdio sidecar URL to hand the user.
+    """
+    return _http_settings_prefix
+
+
 def register_settings_routes(
     mcp: FastMCP,
     server: HomeAssistantSmartMCPServer,
@@ -3117,3 +3136,7 @@ def register_settings_routes(
         # need the same secret to reach the UI as they do for the MCP
         # endpoint.
         _mount(secret_prefix)
+        # Record the mount so ha_get_overview can point users at the settings
+        # page in HTTP transports that have no stdio sidecar URL file (#1458).
+        global _http_settings_prefix
+        _http_settings_prefix = secret_prefix

{ha_mcp_dev-7.6.0.dev641 → ha_mcp_dev-7.6.0.dev643}/src/ha_mcp/tools/tools_bug_report.py

@@ -293,7 +293,8 @@ def _sanitize_log_text(text: str) -> str:
     review (see ``_generate_anonymization_guide``). Rules cover the most common
     leak shapes seen in HA add-on logs:
     JWTs, bearer tokens, long hex tokens, ``key=value`` style credentials,
-    URL userinfo, and IPv4 addresses with network context.
+    URL userinfo, IPv4 addresses with network context, and the MCP connect-URL
+    secret path (the add-on's LAN auth).
     """
     # JWT tokens (header.payload.signature)
     text = re.sub(
@@ -338,6 +339,20 @@ def _sanitize_log_text(text: str) -> str:
     text = _IPV4_WITH_PORT_OR_CIDR_RE.sub("[IP]", text)
     text = _IPV4_IN_URL_RE.sub(r"\1[IP]", text)
     text = _IPV4_AFTER_KEYWORD_RE.sub(r"\1[IP]", text)
+    # MCP connect-URL secret path — the add-on's LAN auth. Redact by the
+    # configured value (catches custom paths) and the generated
+    # ``/private_<token>`` convention. Only bug-report output is scrubbed here;
+    # the raw logs this text is copied from are left intact.
+    configured = os.getenv("MCP_SECRET_PATH", "").rstrip("/")
+    if configured and configured != "/mcp":
+        # Anchor on a path-segment boundary so a short/substring-prone configured
+        # value (e.g. "/ha") cannot corrupt unrelated text (e.g. "/happy").
+        text = re.sub(
+            re.escape(configured) + r"(?![A-Za-z0-9_-])",
+            "[REDACTED_SECRET_PATH]",
+            text,
+        )
+    text = re.sub(r"/private_[A-Za-z0-9_-]+", "[REDACTED_SECRET_PATH]", text)
     return text
 
 
@@ -508,8 +523,7 @@ class BugReportTools:
         **OUTPUT:**
         Returns both templates plus diagnostic data. Key fields:
         - `runtime_bug_template`, `agent_behavior_template` — pick based on context
-        - `recent_logs` — recent ha-mcp tool calls (secret parameters redacted);
-          startup log entries are summarised in `formatted_report`, not returned raw
+        - `recent_logs`, `startup_logs` — captured ha-mcp tool/server log entries
         - `addon_logs` — addon container stdout/stderr (HA add-on installs only;
           empty string otherwise)
         - `suggested_title`, `duplicate_check_urls`, `anonymization_guide`
@@ -623,13 +637,19 @@ class BugReportTools:
         return {
             "success": True,
             "diagnostic_info": diagnostic_info,
-            # ``recent_logs`` entries are redacted at the logging chokepoint
-            # (UsageLogger.log_tool_usage), so the tool parameters here carry no
-            # secrets. ``startup_logs`` come from a separate StartupLogCollector
-            # that is NOT redacted at source, so the raw entries are
-            # intentionally omitted — the sanitized view lives in
-            # ``formatted_report`` (via ``_format_startup_logs``).
             "recent_logs": recent_logs,
+            # Scrub the startup-log *messages* — they aren't sanitized at source,
+            # so the connect-URL secret path can otherwise surface here.
+            # recent_logs is also returned, but its sensitive *parameters* are
+            # key-masked at the logging chokepoint and its error_message is
+            # returned as-is to the trusted client by design (see SECURITY.md);
+            # formatted_report and addon_logs already route through
+            # _sanitize_log_text. This copies entries — the underlying log
+            # records stay raw.
+            "startup_logs": [
+                {**entry, "message": _sanitize_log_text(entry.get("message", ""))}
+                for entry in startup_logs
+            ],
             "addon_logs": addon_logs,
             "log_count": len(recent_logs),
             "startup_log_count": len(startup_logs),

{ha_mcp_dev-7.6.0.dev641 → ha_mcp_dev-7.6.0.dev643}/src/ha_mcp/tools/tools_search.py

@@ -1136,10 +1136,11 @@ def register_search_tools(mcp: Any, client: Any, **kwargs: Any) -> None:
                     "device_types, service_availability, system_info, "
                     "notification_count, notifications, repair_count, "
                     "dismissed_repair_count, repairs, repairs_error, "
-                    "tool_discovery, settings_url. Note: ``settings_url`` "
-                    "(stdio mode only, see tool description) is emitted "
-                    "regardless of ``fields=`` projection — it is always "
-                    "included when the settings-UI sidecar is running."
+                    "tool_discovery, settings_url, settings_url_hint. Note: "
+                    "``settings_url`` (stdio mode) and ``settings_url_hint`` "
+                    "(HTTP/Docker/OAuth mode) are emitted regardless of "
+                    "``fields=`` projection so the settings page stays "
+                    "discoverable; see the tool description."
                 ),
             ),
         ] = None,
@@ -1167,6 +1168,12 @@ def register_search_tools(mcp: Any, client: Any, **kwargs: Any) -> None:
         projection (so it stays discoverable even when callers
         minimize the response) but only when the sidecar URL file
         actually exists.
+
+        In HTTP / Docker / OAuth modes there is no sidecar URL file and the
+        server can't know its externally reachable host, so the response
+        instead carries a ``settings_url_hint`` string telling the user where
+        the page is mounted and to read the full URL from the startup logs.
+        Hand whichever of the two fields is present to the user.
         """
         # Validate fields= early so a malformed value returns VALIDATION_FAILED
         # with parameter="fields" (ha_get_overview has no outer try/except, so
@@ -1368,6 +1375,24 @@ def register_search_tools(mcp: Any, client: Any, **kwargs: Any) -> None:
         sidecar_url = read_sidecar_url()
         if sidecar_url:
             projected["settings_url"] = sidecar_url
+        else:
+            # No stdio sidecar URL file. In HTTP / Docker / OAuth modes the
+            # settings page is mounted on this server, but the process binds
+            # 0.0.0.0 and can't know its externally reachable host — so hint
+            # at the page (and the startup-log URL) instead of guessing a
+            # wrong absolute URL (issue #1458).
+            from ..settings_ui import get_http_settings_prefix
+
+            http_prefix = get_http_settings_prefix()
+            if http_prefix:
+                settings_path = f"{http_prefix.rstrip('/')}/settings"
+                projected["settings_url_hint"] = (
+                    "The settings page (enable/disable/pin tools, feature "
+                    "flags, advanced settings, backups, tool-approval) is "
+                    f"served at '{settings_path}' on this MCP server. Find the "
+                    "full URL in the ha-mcp startup logs, or append it to the "
+                    "base URL your client connects to."
+                )
 
         return projected
 

{ha_mcp_dev-7.6.0.dev641 → ha_mcp_dev-7.6.0.dev643/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.6.0.dev641
+Version: 7.6.0.dev643
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT