ha-mcp-dev 7.6.0.dev675__tar.gz → 7.6.0.dev677__tar.gz

{ha_mcp_dev-7.6.0.dev675/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.6.0.dev677}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.6.0.dev675
+Version: 7.6.0.dev677
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT
@@ -372,7 +372,7 @@ For comprehensive testing documentation, see **[tests/README.md](tests/README.md
 
 Ha-mcp runs **locally** on your machine. Your smart home data stays on your network.
 
-- **No telemetry today** — anonymous usage stats are a planned future feature (as of May 2026); users will be notified when it lands and it will be opt-in only
+- **No telemetry today** — anonymous usage stats are a planned future feature (as of June 2026); when it lands it will follow your Home Assistant analytics/telemetry setting (which you can override), announced prominently in the release notes and the web Settings UI at least one month beforehand
 - **No personal data collection** — we never collect entity names, configs, or device data
 - **User-controlled bug reports** — only sent with your explicit approval
 
@@ -435,13 +435,15 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
 - **[@griffinmartin](https://github.com/griffinmartin)** — Added OpenCode (by Anomaly) as a selectable AI client in the setup wizard, with both stdio and streamable HTTP support.
 - **[@hhopke](https://github.com/hhopke)** — Fixed addon API calls to route through HA Core ingress proxy instead of direct container connections, fixing `ha_manage_addon` proxy mode on addon installs.
 - **[@tomwilkie](https://github.com/tomwilkie)** — JMESPath middleware exploration (#1147) whose review-time token-measurement data informed the design of #1199 and #1225.
-- **[@SealKan](https://github.com/SealKan)** — `fields=`/`attribute_keys=` projection on six read-heavy tools (#1225), `ha_call_event` tool (#1239), and dashboards-list helper refactor (#1207).
+- **[@SealKan](https://github.com/SealKan)** — `fields=`/`attribute_keys=` projection on six read-heavy tools (#1225), `ha_call_event` tool (#1239), dashboards-list helper refactor (#1207), `for:`-field duration-math detector in the best-practice checker (#1264), persistent DCR OAuth client registrations across restarts (#1265), and issue-triage prompt token-budgeting (#1522).
 - **[@KarelTestSpecial](https://github.com/KarelTestSpecial)** — Cached YAML instance to prevent CPU spikes during bulk edits (#1371).
 - **[@corgan2222](https://github.com/corgan2222)** — HA brand assets for custom integration (#1317).
 - **[@drseanwing](https://github.com/drseanwing)** — Progress emission via FastMCP `Context` in long-running tools (#1124); tool-discovery / categorized-search docs (#1123).
 - **[@fnordpig](https://github.com/fnordpig)** — Config subentry support (#1393) and Assist pipeline management tool (#1392).
 - **[@paul43210](https://github.com/paul43210)** — `array_patch` mode in `ha_manage_addon` for atomic GET-modify-POST (#1063).
 - **[@L1AD](https://github.com/L1AD)** — Filed #966 proposing tool security policies; pointed to PolicyLayer's MCP-security work as prior art that inspired the predicate DSL shape.
+- **[@nightcityblade](https://github.com/nightcityblade)** — Updated stale Home Assistant Advanced Mode references after HA 2026.6 made formerly advanced options available by default (#1533).
+- **[@emmelutzer](https://github.com/emmelutzer)** — Financial support via [GitHub Sponsors](https://github.com/sponsors/julienld). Thank you! ☕
 
 ---
 

{ha_mcp_dev-7.6.0.dev675 → ha_mcp_dev-7.6.0.dev677}/README.md

@@ -342,7 +342,7 @@ For comprehensive testing documentation, see **[tests/README.md](tests/README.md
 
 Ha-mcp runs **locally** on your machine. Your smart home data stays on your network.
 
-- **No telemetry today** — anonymous usage stats are a planned future feature (as of May 2026); users will be notified when it lands and it will be opt-in only
+- **No telemetry today** — anonymous usage stats are a planned future feature (as of June 2026); when it lands it will follow your Home Assistant analytics/telemetry setting (which you can override), announced prominently in the release notes and the web Settings UI at least one month beforehand
 - **No personal data collection** — we never collect entity names, configs, or device data
 - **User-controlled bug reports** — only sent with your explicit approval
 
@@ -405,13 +405,15 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
 - **[@griffinmartin](https://github.com/griffinmartin)** — Added OpenCode (by Anomaly) as a selectable AI client in the setup wizard, with both stdio and streamable HTTP support.
 - **[@hhopke](https://github.com/hhopke)** — Fixed addon API calls to route through HA Core ingress proxy instead of direct container connections, fixing `ha_manage_addon` proxy mode on addon installs.
 - **[@tomwilkie](https://github.com/tomwilkie)** — JMESPath middleware exploration (#1147) whose review-time token-measurement data informed the design of #1199 and #1225.
-- **[@SealKan](https://github.com/SealKan)** — `fields=`/`attribute_keys=` projection on six read-heavy tools (#1225), `ha_call_event` tool (#1239), and dashboards-list helper refactor (#1207).
+- **[@SealKan](https://github.com/SealKan)** — `fields=`/`attribute_keys=` projection on six read-heavy tools (#1225), `ha_call_event` tool (#1239), dashboards-list helper refactor (#1207), `for:`-field duration-math detector in the best-practice checker (#1264), persistent DCR OAuth client registrations across restarts (#1265), and issue-triage prompt token-budgeting (#1522).
 - **[@KarelTestSpecial](https://github.com/KarelTestSpecial)** — Cached YAML instance to prevent CPU spikes during bulk edits (#1371).
 - **[@corgan2222](https://github.com/corgan2222)** — HA brand assets for custom integration (#1317).
 - **[@drseanwing](https://github.com/drseanwing)** — Progress emission via FastMCP `Context` in long-running tools (#1124); tool-discovery / categorized-search docs (#1123).
 - **[@fnordpig](https://github.com/fnordpig)** — Config subentry support (#1393) and Assist pipeline management tool (#1392).
 - **[@paul43210](https://github.com/paul43210)** — `array_patch` mode in `ha_manage_addon` for atomic GET-modify-POST (#1063).
 - **[@L1AD](https://github.com/L1AD)** — Filed #966 proposing tool security policies; pointed to PolicyLayer's MCP-security work as prior art that inspired the predicate DSL shape.
+- **[@nightcityblade](https://github.com/nightcityblade)** — Updated stale Home Assistant Advanced Mode references after HA 2026.6 made formerly advanced options available by default (#1533).
+- **[@emmelutzer](https://github.com/emmelutzer)** — Financial support via [GitHub Sponsors](https://github.com/sponsors/julienld). Thank you! ☕
 
 ---
 

{ha_mcp_dev-7.6.0.dev675 → ha_mcp_dev-7.6.0.dev677}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.6.0.dev675"
+version = "7.6.0.dev677"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.14"

{ha_mcp_dev-7.6.0.dev675 → ha_mcp_dev-7.6.0.dev677}/src/ha_mcp/settings.js

@@ -888,6 +888,149 @@ async function saveBackupConfig() {
   }
 }
 
+// ---- Custom filesystem directories (issue #1567) ---------------------------
+// The list lives in the ha_mcp_tools custom component; the GET/POST endpoints
+// proxy to it via authenticated HA service calls. Cached so the sub-form
+// re-renders synchronously when the beta master / filesystem-tools toggle
+// flips, without re-fetching.
+// Consumed fields of the GET response: {available, paths, deny_floor, reason}
+// (the endpoint also returns builtin_read_dirs/builtin_write_dirs, unused here).
+let _fsCustomPathsData = null;
+
+async function loadFsCustomPaths() {
+  try {
+    const resp = await fetch('./api/settings/fs-custom-paths');
+    if (!resp.ok) {
+      _fsCustomPathsData = {
+        available: false,
+        reason: `HTTP ${resp.status}`,
+        paths: [],
+        deny_floor: [],
+      };
+    } else {
+      _fsCustomPathsData = await resp.json();
+    }
+  } catch (err) {
+    _fsCustomPathsData = {
+      available: false,
+      reason: 'Network error: ' + String(err),
+      paths: [],
+      deny_floor: [],
+    };
+  }
+  // Re-render the feature panel so the sub-form reflects the loaded data.
+  if (Object.keys(_lastFeatureFlags).length) renderFeatureFlags(_lastFeatureFlags);
+}
+
+// Injected beneath the enable_filesystem_tools row in renderFeatureFlags.
+// Second-level nested (under filesystem tools, itself beta-sub-nested under
+// the master), dimmed when either the master beta or filesystem tools is off.
+function renderFsCustomPathsSubForm(parentEl, masterOn, fsOn) {
+  const lockedByGate = !masterOn || !fsOn;
+  const d = _fsCustomPathsData;
+  const row = document.createElement('div');
+  row.className =
+    'feature-row fs-custom-paths-sub' + (lockedByGate ? ' dimmed' : '');
+
+  const info = document.createElement('div');
+  info.className = 'feature-info';
+  const denyList =
+    d && Array.isArray(d.deny_floor) && d.deny_floor.length
+      ? d.deny_floor.join(', ')
+      : '.storage, secrets.yaml';
+  info.innerHTML =
+    `<div class="feature-name">Custom filesystem directories (advanced)</div>` +
+    `<div class="feature-help">Extra directories (one per line, relative to your config dir) that the file tools may READ and WRITE — e.g. <code>pyscript</code>, <code>python_scripts</code>. Each entry grants both read and write. Applies immediately; no restart needed.</div>` +
+    `<div class="feature-help">Always blocked (cannot be added): <code>${escapeHtml(denyList)}</code>, path traversal (<code>..</code>), and absolute paths.</div>`;
+
+  const control = document.createElement('div');
+  control.className = 'feature-control';
+
+  if (lockedByGate) {
+    const note = document.createElement('div');
+    note.className = 'feature-locked-note';
+    note.textContent =
+      'Enable beta features and filesystem tools above to edit.';
+    control.appendChild(note);
+  } else if (!d) {
+    const note = document.createElement('div');
+    note.className = 'feature-help';
+    note.textContent = 'Loading…';
+    control.appendChild(note);
+  } else if (!d.available) {
+    const note = document.createElement('div');
+    note.className = 'feature-locked-note';
+    note.textContent =
+      d.reason || 'Custom directories are currently unavailable.';
+    control.appendChild(note);
+  } else {
+    const ta = document.createElement('textarea');
+    ta.id = 'fsCustomPathsInput';
+    ta.rows = 4;
+    ta.value = (d.paths || []).join('\n');
+    const btn = document.createElement('button');
+    btn.id = 'fsCustomPathsSave';
+    btn.className = 'adv-save-btn';
+    btn.textContent = 'Save directories';
+    btn.addEventListener('click', saveFsCustomPaths);
+    const status = document.createElement('div');
+    status.id = 'fsCustomPathsStatus';
+    status.className = 'feature-help';
+    control.appendChild(ta);
+    control.appendChild(btn);
+    control.appendChild(status);
+  }
+
+  row.appendChild(info);
+  row.appendChild(control);
+  parentEl.appendChild(row);
+}
+
+async function saveFsCustomPaths() {
+  const ta = document.getElementById('fsCustomPathsInput');
+  const btn = document.getElementById('fsCustomPathsSave');
+  const statusEl = document.getElementById('fsCustomPathsStatus');
+  if (!ta || !btn || !statusEl) return;
+  const paths = ta.value
+    .split('\n')
+    .map(s => s.trim())
+    .filter(s => s.length);
+  btn.disabled = true;
+  statusEl.textContent = 'Saving…';
+  try {
+    const resp = await fetch('./api/settings/fs-custom-paths', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ paths }),
+    });
+    const data = await resp.json();
+    btn.disabled = false;
+    if (!resp.ok || !data.success) {
+      let msg = 'Save failed';
+      if (data && data.error) {
+        if (typeof data.error === 'string') msg = data.error;
+        else if (data.error.message) msg = data.error.message;
+      }
+      statusEl.textContent = msg;
+      return;
+    }
+    // Reflect the component's canonical normalized list; drop any rejected.
+    _fsCustomPathsData = {
+      ...(_fsCustomPathsData || {}),
+      available: true,
+      paths: data.paths || [],
+    };
+    ta.value = (data.paths || []).join('\n');
+    const rejected = data.rejected || [];
+    statusEl.textContent = rejected.length
+      ? `Saved. Rejected (blocked or invalid): ${rejected.join(', ')}`
+      : 'Saved.';
+  } catch (err) {
+    btn.disabled = false;
+    statusEl.textContent = 'Network error: ' + String(err);
+  }
+}
+
 async function loadBackups() {
   const params = new URLSearchParams();
   const d = document.getElementById('backupDomain').value.trim();
@@ -1351,6 +1494,14 @@ function renderFeatureFlags(flags) {
       const parentOn = !!f.value;
       renderYamlPackagesSubRows(flags, targetBody, masterOn, parentOn);
     }
+    // After the enable_filesystem_tools row, inject the custom-directories
+    // editor (issue #1567). Dimmed when either the master beta is off or
+    // filesystem tools itself is off. The list is component-owned and fetched
+    // separately via loadFsCustomPaths(); this renders from that cache.
+    if (fieldName === 'enable_filesystem_tools') {
+      const fsOn = !!f.value;
+      renderFsCustomPathsSubForm(targetBody, masterOn, fsOn);
+    }
   });
 }
 
@@ -2718,6 +2869,7 @@ document.getElementById('advSaveBtn').addEventListener('click', saveAdvancedSett
 loadFeatureFlags();
 loadAdvancedSettings();
 loadTools();
+loadFsCustomPaths();
 
 // Auto-activate tab from ?tab=<name> query string (used by approval URLs
 // generated by the policy middleware: /settings?tab=tool-security-policies&token=...).

{ha_mcp_dev-7.6.0.dev675 → ha_mcp_dev-7.6.0.dev677}/src/ha_mcp/settings_ui.py

@@ -2912,6 +2912,159 @@ def build_settings_handlers(
             }
         )
 
+    async def _fs_custom_paths_call(service: str, data: dict[str, Any]) -> Any:
+        """Invoke a ha_mcp_tools component service for the custom-paths editor,
+        in any deployment mode (issue #1567).
+
+        Uses the live server's HA client in HTTP/add-on modes; in the stdio
+        sidecar (``server is None``) builds a transient ``HomeAssistantClient``
+        from the HA URL/token the sidecar inherits, and closes it afterward.
+        The caller wraps this in try/except so an unreachable HA / missing
+        token (e.g. OAuth mode, where ``server.client`` has no request-scoped
+        token) degrades to an "unavailable" envelope rather than a 500.
+        """
+        from .tools.tools_filesystem import call_mcp_tools_service
+
+        own_client = None
+        try:
+            if server is not None:
+                client = server.client
+            else:
+                from .client.rest_client import HomeAssistantClient
+
+                client = own_client = HomeAssistantClient()
+            return await call_mcp_tools_service(client, service, data)
+        finally:
+            if own_client is not None and hasattr(own_client, "close"):
+                with contextlib.suppress(Exception):
+                    await own_client.close()
+
+    async def _get_fs_custom_paths(_: Request) -> JSONResponse:
+        """Return the user-configured extra filesystem directories from the
+        ha_mcp_tools component, plus the non-overridable deny floor for the UI
+        blurb (issue #1567).
+
+        Always 200s with an ``available`` flag: when filesystem tools are off,
+        the component is missing/too old, or HA is unreachable, ``available``
+        is False with a human-readable ``reason`` so the UI can show a disabled
+        section instead of an error.
+        """
+        from .tools.tools_filesystem import is_filesystem_tools_enabled
+        from .tools.util_helpers import unwrap_service_response
+
+        def _unavailable(reason: str) -> JSONResponse:
+            return JSONResponse(
+                {
+                    "success": True,
+                    "available": False,
+                    "reason": reason,
+                    "paths": [],
+                    "deny_floor": [],
+                }
+            )
+
+        if not is_filesystem_tools_enabled():
+            return _unavailable(
+                "Filesystem tools are disabled. Enable them (beta) to "
+                "configure custom directories."
+            )
+        try:
+            result = await _fs_custom_paths_call("get_allowed_paths", {})
+        except Exception as exc:
+            logger.warning("fs-custom-paths GET could not reach ha_mcp_tools: %s", exc)
+            return _unavailable(f"Could not reach the ha_mcp_tools component: {exc}")
+
+        data = unwrap_service_response(result) if isinstance(result, dict) else {}
+        if not isinstance(data, dict) or not data.get("success", False):
+            reason = (
+                data.get("error") if isinstance(data, dict) else None
+            ) or "ha_mcp_tools returned an unexpected response."
+            return _unavailable(str(reason))
+        return JSONResponse(
+            {
+                "success": True,
+                "available": True,
+                "paths": data.get("paths", []),
+                "deny_floor": data.get("deny_floor", []),
+                "builtin_read_dirs": data.get("builtin_read_dirs", []),
+                "builtin_write_dirs": data.get("builtin_write_dirs", []),
+            }
+        )
+
+    async def _save_fs_custom_paths(request: Request) -> JSONResponse:
+        """Replace the user-configured extra filesystem directories via the
+        ha_mcp_tools component (issue #1567).
+
+        The component validates each entry and drops anything that hits the
+        deny floor or escapes the config dir; the dropped entries come back in
+        ``rejected``. ``restart_required`` is False — the component applies the
+        new allowlist live.
+        """
+        from .tools.tools_filesystem import is_filesystem_tools_enabled
+        from .tools.util_helpers import unwrap_service_response
+
+        if not is_filesystem_tools_enabled():
+            return JSONResponse(
+                create_error_response(
+                    ErrorCode.VALIDATION_INVALID_PARAMETER,
+                    "Filesystem tools are disabled; enable them (beta) before "
+                    "configuring custom directories.",
+                ),
+                status_code=409,
+            )
+        try:
+            body = await request.json()
+        except (ValueError, TypeError):
+            return JSONResponse(
+                create_error_response(
+                    ErrorCode.VALIDATION_INVALID_JSON,
+                    "Request body must be valid JSON.",
+                ),
+                status_code=400,
+            )
+        paths = body.get("paths") if isinstance(body, dict) else None
+        if paths is None:
+            paths = []
+        if not isinstance(paths, list) or not all(isinstance(p, str) for p in paths):
+            return JSONResponse(
+                create_error_response(
+                    ErrorCode.VALIDATION_INVALID_PARAMETER,
+                    "'paths' must be a list of directory strings.",
+                ),
+                status_code=400,
+            )
+        try:
+            result = await _fs_custom_paths_call("set_allowed_paths", {"paths": paths})
+        except Exception as exc:
+            logger.warning("fs-custom-paths POST could not reach ha_mcp_tools: %s", exc)
+            return JSONResponse(
+                create_error_response(
+                    ErrorCode.SERVICE_CALL_FAILED,
+                    f"Could not reach the ha_mcp_tools component: {exc}",
+                ),
+                status_code=502,
+            )
+
+        data = unwrap_service_response(result) if isinstance(result, dict) else {}
+        if not isinstance(data, dict) or not data.get("success", False):
+            reason = (
+                data.get("error") if isinstance(data, dict) else None
+            ) or "ha_mcp_tools rejected the update."
+            return JSONResponse(
+                create_error_response(ErrorCode.SERVICE_CALL_FAILED, str(reason)),
+                status_code=502,
+            )
+        return JSONResponse(
+            {
+                "success": True,
+                "applied": data.get("paths", []),
+                "paths": data.get("paths", []),
+                "rejected": data.get("rejected", []),
+                "mode": "component",
+                "restart_required": False,
+            }
+        )
+
     handlers: dict[str, Any] = {
         "root_page": _root_page,
         "settings_page": _settings_page,
@@ -2931,6 +3084,8 @@ def build_settings_handlers(
         "delete_backups_bulk": _delete_backups_bulk,
         "get_backup_config": _get_backup_config,
         "save_backup_config": _save_backup_config,
+        "get_fs_custom_paths": _get_fs_custom_paths,
+        "save_fs_custom_paths": _save_fs_custom_paths,
     }
 
     # Tool security policies. The main server attaches an
@@ -3100,6 +3255,9 @@ def register_settings_routes(
         ("/api/settings/backups/{name}", ["DELETE"], "delete_backup"),
         ("/api/settings/backup-config", ["GET"], "get_backup_config"),
         ("/api/settings/backup-config", ["POST"], "save_backup_config"),
+        # Custom filesystem directories (issue #1567) — component-owned list
+        ("/api/settings/fs-custom-paths", ["GET"], "get_fs_custom_paths"),
+        ("/api/settings/fs-custom-paths", ["POST"], "save_fs_custom_paths"),
         # Tool security policies endpoints
         ("/api/policy/config", ["GET"], "policy_get_config"),
         ("/api/policy/config", ["PUT"], "policy_put_config"),

{ha_mcp_dev-7.6.0.dev675 → ha_mcp_dev-7.6.0.dev677}/src/ha_mcp/stdio_settings_sidecar.py

@@ -602,6 +602,21 @@ def _build_app(
             handlers["save_feature_flags"],
             methods=["POST"],
         ),
+        # Custom filesystem directories (issue #1567). The sub-form is rendered
+        # in the features panel, so the stdio sidecar must serve these too — its
+        # route list is hand-maintained and does NOT derive from
+        # register_settings_routes. The handler builds a transient HA client
+        # from the inherited env when server is None (sidecar mode).
+        Route(
+            f"{secret_prefix}/api/settings/fs-custom-paths",
+            handlers["get_fs_custom_paths"],
+            methods=["GET"],
+        ),
+        Route(
+            f"{secret_prefix}/api/settings/fs-custom-paths",
+            handlers["save_fs_custom_paths"],
+            methods=["POST"],
+        ),
         # Tool security policies endpoints (#966). Pending/approve/deny
         # are wired as stubs that return 503 in sidecar mode — the
         # in-memory ApprovalQueue lives in the main server process, so

{ha_mcp_dev-7.6.0.dev675 → ha_mcp_dev-7.6.0.dev677}/src/ha_mcp/tools/best_practice_checker.py

@@ -197,14 +197,24 @@ def check_automation_config(
 
     warnings = BestPracticeCheckResult()
 
+    # Read the canonical 2024.10+ plural root keys, falling back to the singular
+    # aliases. The internal pipeline always pre-normalizes to plural, so the
+    # fallback is defensive for direct/public callers of check_automation_config
+    # (HA accepts both forms). Mirrors _check_triggers' platform/trigger tolerance.
     # Condition templates
-    _check_condition_templates(config.get("condition", []), warnings, skill_prefix)
+    _check_condition_templates(
+        config.get("conditions", config.get("condition", [])), warnings, skill_prefix
+    )
 
     # Action tree (wait_template + nested conditions + target templates)
-    _check_action_tree(config.get("action", []), warnings, skill_prefix)
+    _check_action_tree(
+        config.get("actions", config.get("action", [])), warnings, skill_prefix
+    )
 
     # Trigger templates + device_id
-    _check_triggers(config.get("trigger", []), warnings, skill_prefix)
+    _check_triggers(
+        config.get("triggers", config.get("trigger", [])), warnings, skill_prefix
+    )
 
     # Mode vs motion pattern
     _check_mode_motion(config, warnings, skill_prefix)
@@ -738,7 +748,7 @@ def _check_mode_motion(
     if mode != "single":
         return
 
-    triggers = _as_list(config.get("trigger", []))
+    triggers = _as_list(config.get("triggers", config.get("trigger", [])))
     has_motion = any(
         isinstance(t, dict)
         and any(
@@ -750,7 +760,7 @@ def _check_mode_motion(
     if not has_motion:
         return
 
-    if _has_delay_or_wait(config.get("action", [])):
+    if _has_delay_or_wait(config.get("actions", config.get("action", []))):
         _emit(
             warnings,
             "Automation uses motion trigger with delay/wait but "