ha-mcp-dev 7.9.0.dev761__tar.gz → 7.9.0.dev763__tar.gz

{ha_mcp_dev-7.9.0.dev761 → ha_mcp_dev-7.9.0.dev763}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.9.0.dev761
+Version: 7.9.0.dev763
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT
@@ -13,9 +13,10 @@ Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Home Automation
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: <3.14,>=3.13
+Requires-Python: <3.15,>=3.13
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: fastmcp==3.4.2
@@ -24,7 +25,7 @@ Requires-Dist: pydantic==2.13.4
 Requires-Dist: python-dotenv==1.2.2
 Requires-Dist: truststore==0.10.4
 Requires-Dist: websockets==16.0
-Requires-Dist: cryptography==49.0.0
+Requires-Dist: cryptography<50,>=48.0.0
 Requires-Dist: pydantic-monty==0.0.18
 Requires-Dist: tzdata>=2024.1
 Requires-Dist: packaging>=24.0
@@ -92,6 +93,21 @@ Running Home Assistant OS? Run ha-mcp **inside** Home Assistant — no access to
 
 > ⚠️ **Two ways to run ha-mcp — don't mix them.** The add-on above is the recommended path. The local **stdio** path below runs ha-mcp on your own computer; it is more advanced, has fewer features, and is behind most connection problems. If you use the add-on, your Claude Desktop config points at the add-on URL through `mcp-proxy` with **no token** — do **not** also keep a local `uvx ha-mcp@latest` entry (with `HOMEASSISTANT_URL` / `HOMEASSISTANT_TOKEN`) in your Claude Desktop config. Running both at once is a known cause of connection hangs.
 
+<details>
+<summary><b>Run inside Home Assistant (Container / Core — no add-on)</b></summary>
+
+Not on Home Assistant OS? Home Assistant **Container** and **Core** installs can't run add-ons, but the **HA-MCP Custom Component** (`ha_mcp_tools`) can run the **full ha-mcp server in-process**, inside Home Assistant — no separate Docker container, no token to manage. It works on Home Assistant OS too, and coexists with the add-on. The connect URL is a Home Assistant webhook, so it reaches remote MCP clients through **Nabu Casa** (or any reverse proxy) with no extra tunnel.
+
+1. Install **HA-MCP Custom Component** from HACS (the same repository you use for ha-mcp), or copy `custom_components/ha_mcp_tools` from this repository into your Home Assistant `config/custom_components/` directory; then restart Home Assistant
+2. Add the integration (**Settings → Devices & Services → Add Integration → HA-MCP Custom Component**) and choose **HA-MCP Server** from the menu, then submit — creating the entry starts the server
+3. Copy the connect URL from the **HA-MCP Server** notification (also shown on the entry's Configure screen)
+4. Manage the server from the **HA-MCP** sidebar panel (admin-only web settings UI)
+5. Connect your AI client to that URL
+
+[Full in-process server documentation →](docs/in-process-server.md)
+
+</details>
+
 ### 💻 Run locally with Claude Desktop (stdio · advanced)
 
 *No paid subscription required.* This runs ha-mcp on your own machine over stdio.
@@ -298,7 +314,7 @@ These tools also require feature flags: `HAMCP_ENABLE_FILESYSTEM_TOOLS=true` (fi
 
 To add manually: open **HACS** > **Integrations** > three-dot menu > **Custom repositories** > add `https://github.com/homeassistant-ai/ha-mcp` (category: Integration) > **Download**.
 
-After installing, restart Home Assistant. Then open **Settings** > **Devices & Services** > **Add Integration** and search for **Home Assistant MCP Server Custom Component**.
+After installing, restart Home Assistant. Then open **Settings** > **Devices & Services** > **Add Integration** and search for **HA-MCP Custom Component**.
 
 On **Home Assistant OS / Supervised**, the integration offers to add the add-on repository and install and start the **Home Assistant MCP Server** add-on for you — no need to add the add-on repository by hand. On **Container / Core** installs (no Supervisor) there is no add-on; run the server via Docker or pip and the integration just sets up the file/YAML services.
 
@@ -306,6 +322,19 @@ On **Home Assistant OS / Supervised**, the integration offers to add the add-on
 
 Copy `custom_components/ha_mcp_tools/` from this repository into your HA `config/custom_components/` directory. Restart Home Assistant, then add the integration as described above.
 
+### Run the MCP server inside Home Assistant (in-process server entry)
+
+The **HA-MCP Custom Component** offers a second config-entry type, **HA-MCP Server**, that runs the **full ha-mcp server in-process**, inside Home Assistant, and exposes it remotely through a Home Assistant webhook. This is a full install method in its own right — useful for **Home Assistant Container / Core** users who can't run add-ons, and available on Home Assistant OS too (it coexists with the add-on on a different default port, `9584` vs `9583`).
+
+- **Install:** install **HA-MCP Custom Component** from HACS, or copy `custom_components/ha_mcp_tools` into your `config/custom_components/` directory and restart Home Assistant. Then **Add Integration → HA-MCP Custom Component → HA-MCP Server** and submit — creating the entry starts the server.
+- **Connect URL:** appears in the **HA-MCP Server** notification and on the entry's Configure screen. It's a Home Assistant webhook — `https://<nabu-casa-domain>/api/webhook/<id>` remotely (through Nabu Casa or any reverse proxy) or `http://<home-assistant-host>:8123/api/webhook/<id>` locally. The server is also reachable directly on its own port by default (set **Network access** to `127.0.0.1` to turn direct access off).
+- **Settings panel:** while the server runs, an admin-only **HA-MCP** panel in the Home Assistant sidebar opens its web settings UI (enable/disable/pin tools, feature flags, backups, themes) through Home Assistant itself — no loopback URL needed, the same idea as the add-on's "Open Web UI" button.
+- **Authentication:** by default the secret webhook URL is the credential; optionally require Home Assistant account sign-in (`ha_auth`) for clients that support it.
+- **Release channel:** the entry options let you pick `stable` (the pinned release) or `dev` (the latest development build, refreshed on every reload/restart).
+- **The HA MCP Tools services entry is optional but recommended alongside it** — that second entry type of the same component provides the privileged file/YAML services the server's file tools use, exactly as with the add-on, Docker, and pip installs.
+
+[Full in-process server documentation →](docs/in-process-server.md)
+
 ---
 
 ## 🧠 Better Results with Agent Skills

ha_mcp_dev-7.9.0.dev761/src/ha_mcp_dev.egg-info/PKG-INFO → ha_mcp_dev-7.9.0.dev763/README.md

@@ -1,35 +1,3 @@
-Metadata-Version: 2.4
-Name: ha-mcp-dev
-Version: 7.9.0.dev761
-Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
-Author-email: Julien <github@qc-h.net>
-License: MIT
-Project-URL: Homepage, https://github.com/homeassistant-ai/ha-mcp
-Project-URL: Bug Tracker, https://github.com/homeassistant-ai/ha-mcp/issues
-Project-URL: Repository, https://github.com/homeassistant-ai/ha-mcp
-Keywords: mcp,home-assistant,ai,automation,smart-home
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Topic :: Home Automation
-Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: <3.14,>=3.13
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: fastmcp==3.4.2
-Requires-Dist: httpx[socks]==0.28.1
-Requires-Dist: pydantic==2.13.4
-Requires-Dist: python-dotenv==1.2.2
-Requires-Dist: truststore==0.10.4
-Requires-Dist: websockets==16.0
-Requires-Dist: cryptography==49.0.0
-Requires-Dist: pydantic-monty==0.0.18
-Requires-Dist: tzdata>=2024.1
-Requires-Dist: packaging>=24.0
-Dynamic: license-file
-
 > **Breaking change (v7.3.0):** `ha_config_set_yaml` has been moved to [beta](docs/beta.md).
 
 <div align="center">
@@ -92,6 +60,21 @@ Running Home Assistant OS? Run ha-mcp **inside** Home Assistant — no access to
 
 > ⚠️ **Two ways to run ha-mcp — don't mix them.** The add-on above is the recommended path. The local **stdio** path below runs ha-mcp on your own computer; it is more advanced, has fewer features, and is behind most connection problems. If you use the add-on, your Claude Desktop config points at the add-on URL through `mcp-proxy` with **no token** — do **not** also keep a local `uvx ha-mcp@latest` entry (with `HOMEASSISTANT_URL` / `HOMEASSISTANT_TOKEN`) in your Claude Desktop config. Running both at once is a known cause of connection hangs.
 
+<details>
+<summary><b>Run inside Home Assistant (Container / Core — no add-on)</b></summary>
+
+Not on Home Assistant OS? Home Assistant **Container** and **Core** installs can't run add-ons, but the **HA-MCP Custom Component** (`ha_mcp_tools`) can run the **full ha-mcp server in-process**, inside Home Assistant — no separate Docker container, no token to manage. It works on Home Assistant OS too, and coexists with the add-on. The connect URL is a Home Assistant webhook, so it reaches remote MCP clients through **Nabu Casa** (or any reverse proxy) with no extra tunnel.
+
+1. Install **HA-MCP Custom Component** from HACS (the same repository you use for ha-mcp), or copy `custom_components/ha_mcp_tools` from this repository into your Home Assistant `config/custom_components/` directory; then restart Home Assistant
+2. Add the integration (**Settings → Devices & Services → Add Integration → HA-MCP Custom Component**) and choose **HA-MCP Server** from the menu, then submit — creating the entry starts the server
+3. Copy the connect URL from the **HA-MCP Server** notification (also shown on the entry's Configure screen)
+4. Manage the server from the **HA-MCP** sidebar panel (admin-only web settings UI)
+5. Connect your AI client to that URL
+
+[Full in-process server documentation →](docs/in-process-server.md)
+
+</details>
+
 ### 💻 Run locally with Claude Desktop (stdio · advanced)
 
 *No paid subscription required.* This runs ha-mcp on your own machine over stdio.
@@ -298,7 +281,7 @@ These tools also require feature flags: `HAMCP_ENABLE_FILESYSTEM_TOOLS=true` (fi
 
 To add manually: open **HACS** > **Integrations** > three-dot menu > **Custom repositories** > add `https://github.com/homeassistant-ai/ha-mcp` (category: Integration) > **Download**.
 
-After installing, restart Home Assistant. Then open **Settings** > **Devices & Services** > **Add Integration** and search for **Home Assistant MCP Server Custom Component**.
+After installing, restart Home Assistant. Then open **Settings** > **Devices & Services** > **Add Integration** and search for **HA-MCP Custom Component**.
 
 On **Home Assistant OS / Supervised**, the integration offers to add the add-on repository and install and start the **Home Assistant MCP Server** add-on for you — no need to add the add-on repository by hand. On **Container / Core** installs (no Supervisor) there is no add-on; run the server via Docker or pip and the integration just sets up the file/YAML services.
 
@@ -306,6 +289,19 @@ On **Home Assistant OS / Supervised**, the integration offers to add the add-on
 
 Copy `custom_components/ha_mcp_tools/` from this repository into your HA `config/custom_components/` directory. Restart Home Assistant, then add the integration as described above.
 
+### Run the MCP server inside Home Assistant (in-process server entry)
+
+The **HA-MCP Custom Component** offers a second config-entry type, **HA-MCP Server**, that runs the **full ha-mcp server in-process**, inside Home Assistant, and exposes it remotely through a Home Assistant webhook. This is a full install method in its own right — useful for **Home Assistant Container / Core** users who can't run add-ons, and available on Home Assistant OS too (it coexists with the add-on on a different default port, `9584` vs `9583`).
+
+- **Install:** install **HA-MCP Custom Component** from HACS, or copy `custom_components/ha_mcp_tools` into your `config/custom_components/` directory and restart Home Assistant. Then **Add Integration → HA-MCP Custom Component → HA-MCP Server** and submit — creating the entry starts the server.
+- **Connect URL:** appears in the **HA-MCP Server** notification and on the entry's Configure screen. It's a Home Assistant webhook — `https://<nabu-casa-domain>/api/webhook/<id>` remotely (through Nabu Casa or any reverse proxy) or `http://<home-assistant-host>:8123/api/webhook/<id>` locally. The server is also reachable directly on its own port by default (set **Network access** to `127.0.0.1` to turn direct access off).
+- **Settings panel:** while the server runs, an admin-only **HA-MCP** panel in the Home Assistant sidebar opens its web settings UI (enable/disable/pin tools, feature flags, backups, themes) through Home Assistant itself — no loopback URL needed, the same idea as the add-on's "Open Web UI" button.
+- **Authentication:** by default the secret webhook URL is the credential; optionally require Home Assistant account sign-in (`ha_auth`) for clients that support it.
+- **Release channel:** the entry options let you pick `stable` (the pinned release) or `dev` (the latest development build, refreshed on every reload/restart).
+- **The HA MCP Tools services entry is optional but recommended alongside it** — that second entry type of the same component provides the privileged file/YAML services the server's file tools use, exactly as with the add-on, Docker, and pip installs.
+
+[Full in-process server documentation →](docs/in-process-server.md)
+
 ---
 
 ## 🧠 Better Results with Agent Skills

{ha_mcp_dev-7.9.0.dev761 → ha_mcp_dev-7.9.0.dev763}/pyproject.toml

@@ -4,10 +4,13 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.9.0.dev761"
+version = "7.9.0.dev763"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
-requires-python = ">=3.13,<3.14"
+# Upper bound widened to <3.15 so the package installs on Home Assistant's
+# interpreter when run in-process by the ha_mcp_tools component (HA
+# core-2026.7 ships Python 3.14). src/ stays 3.13-compatible.
+requires-python = ">=3.13,<3.15"
 license = {text = "MIT"}
 authors = [
     {name = "Julien", email = "github@qc-h.net"}
@@ -19,6 +22,7 @@ classifiers = [
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Topic :: Home Automation",
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
@@ -30,7 +34,13 @@ dependencies = [
     "python-dotenv==1.2.2",
     "truststore==0.10.4",
     "websockets==16.0",
-    "cryptography==49.0.0",
+    # Range (not a hard pin) so the resolver can satisfy Home Assistant's own
+    # cryptography constraint when ha-mcp is installed into the HA venv for
+    # in-process embedding (HA 2026.6 pins cryptography==48.0.0, 2026.7 pins
+    # 48.0.1 — the floor must admit every supported core's pin; live-found on
+    # the embedded e2e lane against the HA 2026.6.4 image).
+    # cryptography is a transitive dependency only — never imported in src/.
+    "cryptography>=48.0.0,<50",
     "pydantic-monty==0.0.18",
     "tzdata>=2024.1",
     "packaging>=24.0",
@@ -194,6 +204,9 @@ dev = [
     "pytest-cov>=5.0.0",
     "pytest-timeout>=2.3.0",
     "pytest-rerunfailures>=15.0",
+    # Real voluptuous for the config-flow tests (the component's
+    # config_flow imports it; HA provides it at runtime, tests need it here).
+    "voluptuous>=0.15.2",
     "pytest-xdist>=3.8.0",
     "requests>=2.25.0",
     "lefthook>=1.10.0",
@@ -208,6 +221,11 @@ dev = [
 version_toml = ["pyproject.toml:project.version"]
 version_variables = [
     "src/ha_mcp/__init__.py:__version__",
+    # Keeps the in-process server's stable-channel pin in lockstep with the
+    # released server/add-on version - a hand-edited pin would drift the
+    # moment a release ships (owner: the server entry must always match the
+    # add-on version to avoid confusion).
+    "custom_components/ha_mcp_tools/const.py:PINNED_HA_MCP_VERSION",
 ]
 build_command = """
 pip install uv && uv lock

{ha_mcp_dev-7.9.0.dev761 → ha_mcp_dev-7.9.0.dev763}/src/ha_mcp/_version.py

@@ -48,14 +48,34 @@ def is_dev_version(version: str) -> bool:
     return ".dev" in version
 
 
+def is_embedded() -> bool:
+    """Return True when ha-mcp runs in-process inside Home Assistant core.
+
+    Set to ``1`` by the ha_mcp_tools custom component's in-process server entry
+    (``HA_MCP_EMBEDDED``) before the first ``ha_mcp`` import. On HAOS the
+    HA core container itself carries ``SUPERVISOR_TOKEN``, so without this flag
+    :func:`is_running_in_addon` would report True in-process and route log,
+    add-on-management, and settings-persistence logic down the add-on path. The
+    embedded server is an ordinary admin client of HA core (loopback URL +
+    provisioned token), so those call sites must take their non-add-on branch.
+    """
+    return bool(os.environ.get("HA_MCP_EMBEDDED"))
+
+
 def is_running_in_addon() -> bool:
     """Return True when running inside a Home Assistant add-on container.
 
     The HA Supervisor injects ``SUPERVISOR_TOKEN`` into every add-on's env.
     Checked so the standalone-Docker ``:stable`` banner isn't shown to add-on
     users, who already see the dev/stable distinction in the HAOS add-on UI.
+
+    Returns False in embedded mode (:func:`is_embedded`) even though the HA core
+    container carries ``SUPERVISOR_TOKEN``: the in-process server is a plain
+    admin client of HA core, not a Supervisor-managed add-on, so add-on-only
+    behavior (Supervisor-direct log fetch, add-on settings routing) must not
+    apply.
     """
-    return bool(os.environ.get("SUPERVISOR_TOKEN"))
+    return bool(os.environ.get("SUPERVISOR_TOKEN")) and not is_embedded()
 
 
 def get_supervisor_base_url() -> str:

{ha_mcp_dev-7.9.0.dev761 → ha_mcp_dev-7.9.0.dev763}/src/ha_mcp/config.py

@@ -14,7 +14,7 @@ from dotenv import load_dotenv
 from pydantic import Field, ValidationInfo, field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
-from ha_mcp._version import get_version
+from ha_mcp._version import get_version, is_running_in_addon
 
 logger = logging.getLogger(__name__)
 
@@ -913,7 +913,12 @@ def get_feature_flag_origin(env_name: str) -> str:
     )
     is_master = field_name == "enable_beta_features"
     is_beta_sub = field_name in BETA_FEATURE_FIELDS
-    in_addon = bool(os.environ.get("SUPERVISOR_TOKEN"))
+    # is_running_in_addon() (not a raw SUPERVISOR_TOKEN read) so the in-process
+    # embedded server — which carries SUPERVISOR_TOKEN on HAOS but is not an
+    # add-on — is treated as a standalone deployment: its settings-UI edits
+    # persist to override files under HA_MCP_CONFIG_DIR instead of being routed
+    # to a Supervisor add-on that does not exist.
+    in_addon = is_running_in_addon()
 
     if in_addon:
         if is_master or is_beta_sub:
@@ -1034,7 +1039,11 @@ def _apply_feature_flag_overrides(settings: "Settings") -> None:
        env var still needs to flip the master before the flag takes
        effect.
     """
-    in_addon = bool(os.environ.get("SUPERVISOR_TOKEN"))
+    # is_running_in_addon() (not a raw SUPERVISOR_TOKEN read) so the in-process
+    # embedded server — which carries SUPERVISOR_TOKEN on HAOS but is not an
+    # add-on — applies its settings-UI feature-flag saves like a standalone
+    # deployment instead of short-circuiting here as if start.py owned the env.
+    in_addon = is_running_in_addon()
     overrides = _read_feature_flag_override_file()
 
     known = {fname: (ename, ftype) for fname, ename, ftype in FEATURE_FLAG_FIELDS}
@@ -1268,6 +1277,48 @@ def _apply_advanced_overrides(settings: "Settings") -> None:
 # Global settings instance
 _settings: Settings | None = None
 
+# In-process (embedded) HA connection, set only when ha-mcp runs inside Home
+# Assistant core via the ha_mcp_tools custom component's in-process server entry.
+# The component hands the loopback URL + a provisioned admin token to ha-mcp
+# THROUGH THIS DICT — never
+# via os.environ — so the admin token can't be read from the shared HA process
+# environment. Applied onto the Settings singleton in ``get_global_settings``.
+_EMBEDDED_CONNECTION: dict[str, str] = {}
+
+
+def set_embedded_connection(url: str, token: str) -> None:
+    """Register the in-process HA connection for embedded mode.
+
+    Embedded-mode only: called by the ha_mcp_tools custom component's in-process
+    server entry inside its server worker thread, before the server is
+    constructed, so the loopback URL
+    and admin token reach ``Settings`` in memory instead of through ``os.environ``.
+    The values survive ``_reset_global_settings()``: the settings-UI reset+rebuild
+    path re-applies them on the next ``get_global_settings()`` call.
+
+    Also applies to an ALREADY-BUILT singleton: importing ``ha_mcp`` runs the
+    package's eager import chain, and ``tools/smart_search/_config.py`` builds
+    the settings singleton at import time (its documented read-once budgets).
+    Registration therefore cannot assume it runs before the first build — the
+    integration imports this function from the very package whose import
+    creates the singleton.
+    """
+    _EMBEDDED_CONNECTION["url"] = url
+    _EMBEDDED_CONNECTION["token"] = token
+    if _settings is not None:
+        _apply_embedded_connection(_settings)
+
+
+def _reset_embedded_connection() -> None:
+    """Drop the registered embedded connection (test seam).
+
+    Sibling to :func:`_reset_global_settings`; lets suites that exercise the
+    in-process token channel isolate state between tests. Not used in production —
+    the connection is registered once per worker thread and is meant to persist.
+    """
+    _EMBEDDED_CONNECTION.clear()
+
+
 # Names of beta sub-flags the master gate has already logged a
 # force-False line for in this process. Used to dedup the gate's
 # INFO log so we don't spam addon logs on every Settings rebuild
@@ -1332,7 +1383,11 @@ def get_backup_setting_origin(env_name: str) -> str:
     - ``"default"``: no env var and no override file entry; the
       pydantic field default applies. Web UI edits create the file.
     """
-    if os.environ.get("SUPERVISOR_TOKEN"):
+    # is_running_in_addon() rather than a raw SUPERVISOR_TOKEN read so the
+    # embedded in-process server (SUPERVISOR_TOKEN present on HAOS, but not an
+    # add-on) is labeled a standalone deployment and its backup settings persist
+    # to the override file instead of a non-existent Supervisor add-on.
+    if is_running_in_addon():
         return "addon"
     if os.environ.get(env_name) is not None:
         return "env"
@@ -1424,7 +1479,10 @@ def _apply_backup_overrides(settings: "Settings") -> None:
     corrupt override file can't push values out of range; out-of-range
     or untypable entries are silently skipped.
     """
-    if os.environ.get("SUPERVISOR_TOKEN"):
+    # is_running_in_addon() (embedded-aware) so the in-process server applies
+    # its backup override file like a standalone deployment; see the matching
+    # rationale in _apply_feature_flag_overrides / get_backup_setting_origin.
+    if is_running_in_addon():
         return
     overrides = _read_backup_override_file()
     if not overrides:
@@ -1522,6 +1580,22 @@ def _apply_backup_overrides(settings: "Settings") -> None:
             continue
 
 
+def _apply_embedded_connection(settings: "Settings") -> None:
+    """Apply the in-process embedded HA connection (url/token) if registered.
+
+    No-op outside embedded mode. Plain ``setattr`` (``validate_assignment`` is off
+    on ``Settings``, mirroring ``_apply_backup_overrides``), so the loopback URL
+    and admin token are set in memory without ever passing through ``os.environ``.
+    Applied last so it wins over any env/override-file connection values.
+    """
+    url = _EMBEDDED_CONNECTION.get("url")
+    token = _EMBEDDED_CONNECTION.get("token")
+    if url:
+        settings.homeassistant_url = url.rstrip("/")
+    if token:
+        settings.homeassistant_token = token
+
+
 def get_global_settings() -> Settings:
     """Get global settings instance (singleton pattern).
 
@@ -1531,6 +1605,10 @@ def get_global_settings() -> Settings:
 
     - Feature flags persisted to ``<data_dir>/feature_flags.json``
     - Auto-backup settings persisted to ``<data_dir>/backup_settings.json``
+
+    In embedded mode, the in-process HA connection registered via
+    ``set_embedded_connection`` is applied last (so a settings-UI reset+rebuild
+    re-picks it up).
     """
     global _settings
     if _settings is None:
@@ -1538,9 +1616,22 @@ def get_global_settings() -> Settings:
         _apply_feature_flag_overrides(_settings)
         _apply_backup_overrides(_settings)
         _apply_advanced_overrides(_settings)
+        _apply_embedded_connection(_settings)
     return _settings
 
 
+def reset_global_settings() -> None:
+    """Public seam to drop the cached settings singleton.
+
+    The in-process (embedded) server calls this at every start: a config-entry
+    reload reuses the same Python process, so without an explicit reset the
+    singleton built on the FIRST start would keep serving stale feature-flag /
+    override values forever (the add-on gets fresh settings for free from its
+    process restart).
+    """
+    _reset_global_settings()
+
+
 def _reset_global_settings() -> None:
     """Drop the cached settings singleton.
 

{ha_mcp_dev-7.9.0.dev761 → ha_mcp_dev-7.9.0.dev763}/src/ha_mcp/settings_ui/settings.css

@@ -156,7 +156,7 @@
   main {
     max-width: 1280px;
     margin: 0 auto;
-    padding: 0 16px 32px;
+    padding: 0 16px 40px;
   }
 
   /* ── SKIP LINK ───────────────────────────────────────────────────────── */
@@ -209,7 +209,7 @@
   }
   .tab:hover { color: var(--text); background: rgba(255, 255, 255, 0.04); }
   .tab.active { color: var(--accent); border-bottom-color: var(--accent); }
-  .panel { display: none; padding-top: 16px; }
+  .panel { display: none; padding-top: 24px; }
   .panel.active { display: block; }
 
   /* ── ALERTS (HA ha-alert) ────────────────────────────────────────────── */
@@ -309,7 +309,7 @@
   .group {
     background: var(--surface);
     border-radius: 12px;
-    margin-bottom: 8px;
+    margin-bottom: 12px;
     overflow: hidden;
     border: var(--card-border);
     box-shadow: var(--card-shadow);
@@ -336,7 +336,7 @@
   /* ── INDIVIDUAL TOOLS ────────────────────────────────────────────────── */
   .tool {
     display: flex; align-items: center; justify-content: space-between;
-    padding: 10px 16px; border-bottom: 1px solid var(--border);
+    padding: 12px 16px; border-bottom: 1px solid var(--border);
     transition: background 0.1s;
   }
   .tool:last-child { border-bottom: none; }
@@ -463,18 +463,29 @@
 
   /* ── SERVER SETTINGS FEATURES ────────────────────────────────────────── */
   .features-sub {
-    font-size: 0.75rem; color: var(--text-secondary);
+    font-size: 0.8125rem; color: var(--text-secondary);
     margin-bottom: 12px; line-height: 1.5;
   }
+  /* Server Settings feature list, grouped into a card (parity with the tool
+     groups + accessibility sections) so the tab reads as organized cards
+     rather than a flat wall of borderless rows. */
+  #featuresBody {
+    background: var(--surface);
+    border: var(--card-border);
+    box-shadow: var(--card-shadow);
+    border-radius: 12px;
+    padding: 4px 16px;
+    margin-bottom: 8px;
+  }
   .feature-row {
     display: flex; align-items: flex-start; justify-content: space-between;
-    gap: 16px; padding: 14px 0; border-top: 1px solid var(--border);
+    gap: 16px; padding: 16px 0; border-top: 1px solid var(--border);
   }
   .feature-row:first-of-type { border-top: none; }
   .feature-info { flex: 1; min-width: 0; }
   .feature-name { font-size: 0.875rem; font-weight: 500; }
   .feature-help {
-    font-size: 0.75rem; color: var(--text-secondary);
+    font-size: 0.8125rem; color: var(--text-secondary);
     margin-top: 4px; line-height: 1.5;
   }
   .feature-help code {
@@ -509,7 +520,7 @@
   /* ── ADVANCED SETTINGS ───────────────────────────────────────────────── */
   .adv-section-title {
     font-size: 0.75rem; font-weight: 500; color: var(--text-secondary);
-    margin: 24px 0 4px; text-transform: uppercase; letter-spacing: 0.08em;
+    margin: 28px 0 8px; text-transform: uppercase; letter-spacing: 0.08em;
   }
   .adv-section-title.beta-section-title {
     color: var(--warning); font-size: 0.8rem; margin-top: 32px;
@@ -530,7 +541,17 @@
   .adv-save-btn:hover { background: var(--accent-hover); }
   .adv-save-btn:active { filter: brightness(0.9); }
   .adv-save-btn:disabled { opacity: 0.38; cursor: not-allowed; }
-  .adv-section { border-top: 1px solid var(--border); }
+  .adv-section {
+    background: var(--surface);
+    border: var(--card-border);
+    box-shadow: var(--card-shadow);
+    border-radius: 12px;
+    padding: 4px 16px;
+    margin-bottom: 8px;
+  }
+  /* A flag-gated section can render with no fields; hide the empty <div> so it
+     doesn't show as a hollow card (its overline title above stays as a label). */
+  .adv-section:empty { display: none; }
   .adv-section.dimmed { opacity: 0.38; }
   .adv-section.dimmed input,
   .adv-section.dimmed select { cursor: not-allowed; }
@@ -538,13 +559,13 @@
   .adv-section-note { font-size: 0.72rem; color: var(--text-secondary); margin: 4px 0 8px; line-height: 1.5; }
   .adv-row {
     display: flex; align-items: flex-start; justify-content: space-between;
-    gap: 16px; padding: 12px 0; border-top: 1px solid var(--border);
+    gap: 16px; padding: 14px 0; border-top: 1px solid var(--border);
   }
   .adv-row:first-child { border-top: none; }
   .adv-row.locked .adv-name { color: var(--text-secondary); }
   .adv-info { flex: 1; min-width: 0; }
   .adv-name { font-size: 0.875rem; font-weight: 500; }
-  .adv-help { font-size: 0.75rem; color: var(--text-secondary); margin-top: 4px; line-height: 1.5; }
+  .adv-help { font-size: 0.8125rem; color: var(--text-secondary); margin-top: 4px; line-height: 1.5; }
   .adv-help code {
     background: var(--code-bg); padding: 1px 5px; border-radius: 3px;
     font-size: 0.7rem; font-family: 'Roboto Mono', 'Courier New', monospace;
@@ -663,6 +684,11 @@
   .diff-hdr { color: var(--diff-hdr); }
 
   /* ── TOOL SECURITY POLICIES ──────────────────────────────────────────── */
+  /* Bare tab title (no class hook in the markup): give it a defined heading
+     size so it doesn't fall back to the oversized browser default h2. */
+  #panel-tool-security-policies > h2 {
+    font-size: 1.125rem; font-weight: 500; margin-bottom: 8px;
+  }
   .policy-rule-card {
     background: var(--surface); border: var(--card-border); border-radius: 12px;
     padding: 14px 16px; margin: 8px 0;
@@ -721,7 +747,7 @@
     padding: 16px; margin-bottom: 12px;
   }
   .a11y-section-title { font-size: 0.9375rem; font-weight: 500; margin-bottom: 4px; }
-  .a11y-section-help { font-size: 0.8rem; color: var(--text-secondary); margin-bottom: 12px; }
+  .a11y-section-help { font-size: 0.8125rem; color: var(--text-secondary); margin-bottom: 12px; }
   .a11y-options { display: flex; flex-wrap: wrap; gap: 8px; }
   fieldset.a11y-options { border: 0; padding: 0; margin: 0; min-inline-size: auto; }
   .visually-hidden {
@@ -889,3 +915,41 @@
     border-bottom-color: var(--accent);
     box-shadow: inset 0 -1px 0 0 var(--accent);
   }
+
+  /* ── NARROW SCREENS (phones / small tablets) ─────────────────────────────
+     The layout was desktop-only (label left, control right on one line). On a
+     phone the label + help + control were crammed into a sliver. Below 640px,
+     stack each setting row so the control sits on its own line under the help,
+     make text fields fill the width, tighten the page gutters, and drop the
+     decorative header icon. Nothing here changes hooks or semantics. */
+  @media (max-width: 640px) {
+    main { padding: 0 12px 40px; }
+    .header { padding: 0 12px; }
+    .header-icon { display: none; }
+    .header h1 { font-size: 1.0625rem; }
+    .panel { padding-top: 20px; }
+
+    /* One control per line, aligned under its label + help. */
+    .feature-row,
+    .adv-row {
+      flex-direction: column;
+      align-items: stretch;
+      gap: 10px;
+    }
+    .feature-control,
+    .adv-control { width: 100%; justify-content: flex-start; }
+    .adv-control input[type="text"],
+    .adv-control select { width: 100%; }
+
+    /* Backups: stack the row body above its actions; drop the desktop indents. */
+    .backup-row { flex-direction: column; align-items: stretch; }
+    .backup-row-actions { flex-wrap: wrap; }
+    .backup-field-label { min-width: 0; }
+    .backup-field-help { margin-left: 0; }
+
+    /* Policy predicate form: the desktop hint indent has no room here. */
+    .policy-predicate-form .policy-form-hint { padding-left: 0; }
+
+    /* Modal fills the small viewport instead of floating in a sliver. */
+    .modal { max-height: 94vh; }
+  }