ha-mcp-dev 8.0.0.dev2230__tar.gz → 8.0.0.dev2235__tar.gz

{ha_mcp_dev-8.0.0.dev2230/src/ha_mcp_dev.egg-info → ha_mcp_dev-8.0.0.dev2235}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.0.0.dev2230
+Version: 8.0.0.dev2235
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-8.0.0.dev2230 → ha_mcp_dev-8.0.0.dev2235}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.0.0.dev2230"
+version = "8.0.0.dev2235"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-8.0.0.dev2230 → ha_mcp_dev-8.0.0.dev2235}/src/ha_mcp/__main__.py

@@ -609,6 +609,25 @@ async def _cleanup_resources() -> None:
     logger.info("Server resources cleaned up")
 
 
+def _log_cleanup_result(task: "asyncio.Future[None]") -> None:
+    """Consume the cleanup task's outcome so a failure is never silent.
+
+    ``asyncio.wait`` does not retrieve results, and the timeout path
+    deliberately abandons rather than awaits (see the ``finally`` block), so
+    without this nothing observes ``cleanup_task``. An exception left
+    unretrieved this close to loop teardown surfaces only as a GC-time "Task
+    exception was never retrieved" error, which is unstructured and not
+    guaranteed to be emitted before exit. Mirrors what ``_cancel_tasks`` does
+    for the tasks it reaps. Cancellation is the expected abandoned-timeout
+    outcome and stays silent.
+    """
+    if task.cancelled():
+        return
+    exc = task.exception()
+    if exc is not None:
+        logger.warning(f"Resource cleanup raised: {exc!r}")
+
+
 async def _cancel_tasks(*tasks: asyncio.Task) -> None:
     """Cancel tasks and wait for completion, bounding the wait.
 
@@ -690,11 +709,19 @@ async def _run_with_shutdown(server_coro: Coroutine[Any, Any, Any]) -> None:
             logger.error("Server task cancelled without a shutdown signal")
             raise
     finally:
-        try:
-            await asyncio.wait_for(
-                _cleanup_resources(), timeout=SHUTDOWN_TIMEOUT_SECONDS
-            )
-        except TimeoutError:
+        # Cancel-and-abandon, not wait_for: wait_for awaits the cancelled
+        # coroutine before raising, and the cleanup stack swallows
+        # CancelledError at several layers (per-client in
+        # WebSocketManager.disconnect, in client.disconnect's own task-cancel
+        # guard), so a hung close handshake could block shutdown past the
+        # budget. A straggler is left to the runner's own task sweep.
+        cleanup_task = asyncio.ensure_future(_cleanup_resources())
+        cleanup_task.add_done_callback(_log_cleanup_result)
+        _done, cleanup_pending = await asyncio.wait(
+            {cleanup_task}, timeout=SHUTDOWN_TIMEOUT_SECONDS
+        )
+        if cleanup_pending:
+            cleanup_task.cancel()
             logger.warning("Resource cleanup timed out")
 
         try:
@@ -997,6 +1024,19 @@ def _get_http_runtime(default_port: int = 8086) -> tuple[str, int, str]:
     ``run_async``, any ``FASTMCP_HOST`` value in the environment is
     ignored — ``MCP_HOST`` is the only env var that affects bind host
     for ha-mcp's CLI entry points.
+
+    The ``0.0.0.0`` default is deliberate and documented: SECURITY.md
+    § "Local network is the trusted zone for standard mode" states that the
+    HTTP entrypoints bind to all interfaces so LAN peers can reach them, and
+    its Scope section excludes "LAN-peer access to standard-mode HTTP
+    endpoints".
+
+    The default ``/mcp`` path is *not* blessed the same way once the bind
+    leaves loopback. That combination is what ``_warn_if_default_path_exposed``
+    warns about, and SECURITY.md's Scope classes it under "a misconfigured
+    deployment" — meaning such reports are declined, not that the
+    configuration is endorsed. Operators on a non-loopback bind are still
+    expected to set a high-entropy ``MCP_SECRET_PATH``.
     """
 
     host = os.getenv("MCP_HOST", "0.0.0.0")
@@ -1013,7 +1053,9 @@ def _get_http_runtime(default_port: int = 8086) -> tuple[str, int, str]:
 # Default ``MCP_SECRET_PATH`` value, shared by ``_get_http_runtime`` (the
 # read-from-env fallback) and ``_warn_if_default_path_exposed`` (the
 # hardening-nudge predicate). Single source of truth so the two sites
-# can't drift.
+# can't drift. Safe on a loopback bind; on a non-loopback bind it is the
+# misconfiguration ``_warn_if_default_path_exposed`` flags, which SECURITY.md
+# declines to action without endorsing — see ``_get_http_runtime`` above.
 DEFAULT_MCP_PATH = "/mcp"
 
 # Hostname literals (not IP addresses) treated as loopback by

{ha_mcp_dev-8.0.0.dev2230 → ha_mcp_dev-8.0.0.dev2235}/src/ha_mcp/client/websocket_client.py

@@ -1251,10 +1251,31 @@ class WebSocketManager:
                 self._last_used[key] = time.monotonic()
                 return existing
 
-            # Remove stale client if present
+            # Remove stale client if present. Disconnect it too: a client
+            # whose connection dropped can still own a parked reader task and
+            # a half-open socket, and simply dropping the reference abandons
+            # both to garbage collection — the GC's asyncgen finalizer then
+            # acloses the reader's ``Connection.__aiter__`` mid-``__anext__``
+            # and logs ``aclose(): asynchronous generator is already
+            # running`` (issue #2127). Same-loop by construction: a loop
+            # change already detached the pool above, so ``existing`` was
+            # built on ``current_loop`` and can be awaited here.
             if existing:
                 self._clients.pop(key, None)
                 self._last_used.pop(key, None)
+                try:
+                    await existing.disconnect()
+                except asyncio.CancelledError:
+                    # The caller itself was cancelled mid-cleanup: propagate.
+                    # Swallowing here would let a cancelled operation keep
+                    # doing network I/O and leave a fresh connection retained
+                    # in the pool.
+                    raise
+                except (OSError, RuntimeError):
+                    logger.warning(
+                        "Error disconnecting stale WebSocket client",
+                        exc_info=True,
+                    )
 
             factory = self._client_factory or HomeAssistantWebSocketClient
             client = (
@@ -1291,7 +1312,14 @@ class WebSocketManager:
         if stale:
             try:
                 await stale.disconnect()
-            except (OSError, RuntimeError, asyncio.CancelledError):
+            except asyncio.CancelledError:
+                # The caller itself was cancelled mid-eviction: propagate.
+                # Eviction runs after the fresh client was pooled, so a
+                # swallow here would hand a connected client back to a
+                # cancelled caller (mirror of the stale-replacement clause
+                # in get_client).
+                raise
+            except (OSError, RuntimeError):
                 logger.warning(
                     "Error disconnecting evicted WebSocket client",
                     exc_info=True,

{ha_mcp_dev-8.0.0.dev2230 → ha_mcp_dev-8.0.0.dev2235}/src/ha_mcp/settings_ui/__init__.py

@@ -566,6 +566,15 @@ def register_settings_routes(
     and serve the "Open Web UI" button. Stdio transports use a separate
     side-process sidecar instead — see :mod:`ha_mcp.stdio_settings_sidecar`.
 
+    The ``RequireAuthMiddleware`` bypass is the documented posture, not an
+    oversight: SECURITY.md § "OAuth Mode — Beta Warning" states that the
+    settings UI "is **not** gated by the OAuth token", and its Scope section
+    excludes "The web settings UI not being gated by the OAuth/OIDC token".
+    OAuth and OIDC modes compensate by passing a *dedicated* secret path here
+    rather than the client-known MCP path (GHSA-mx64-982r-65vg); standard mode
+    and the add-on pass the MCP secret path, which already gates the whole
+    tool surface.
+
     Args:
         mcp: The FastMCP instance to register routes on.
         server: The HomeAssistantSmartMCPServer wrapping ``mcp``.

{ha_mcp_dev-8.0.0.dev2230 → ha_mcp_dev-8.0.0.dev2235}/src/ha_mcp/tools/tools_code.py

@@ -53,8 +53,20 @@ logger = logging.getLogger(__name__)
 # boundary.
 #
 # WARNING: This is shared across all clients in the same server process.
-# In multi-user modes (OAuth, HTTP), one user's saved tools are visible to
-# all other users. Scope to per-session/user before multi-user support.
+# One client's saved tools are listable and runnable by every other client,
+# and ``save_as`` overwrites by name without an ownership check. OAuth is the
+# only mode with distinct per-user credentials for that to cross; standard,
+# OIDC and add-on modes are single-tenant already (SECURITY.md § "Standard
+# mode is single-tenant"), so every caller there shares one HA token anyway.
+#
+# That exposure is accepted design, not a pending TODO — SECURITY.md § Scope
+# excludes "Saved custom tools (code mode, off by default) visible to other
+# clients of the same server process", on the grounds that they are shared
+# scaffolding rather than per-user data, that ``run_saved`` executes with the
+# caller's own HA token (granting no access the caller lacks), and that any
+# client which can reach ha-mcp is a trusted principal (SECURITY.md § "MCP
+# clients are trusted principals"). Scoping per session/user would be a
+# feature, not a security fix.
 _saved_tools: dict[str, dict[str, str]] = {}
 
 # Tools that sandbox code must not call. Includes ``ha_manage_custom_tool``

{ha_mcp_dev-8.0.0.dev2230 → ha_mcp_dev-8.0.0.dev2235}/src/ha_mcp/transport_security.py

@@ -23,6 +23,12 @@ exactly the pre-3.4.3 behaviour without giving up the protection that matters.
 Operators who front ha-mcp differently can re-enable the guard (and pin their
 own allow-lists) via ``FASTMCP_HTTP_HOST_ORIGIN_PROTECTION=true`` plus
 ``FASTMCP_HTTP_ALLOWED_HOSTS`` / ``FASTMCP_HTTP_ALLOWED_ORIGINS``.
+
+Turning the guard off is the documented posture, not an oversight: it has its
+own SECURITY.md section, § "Host/Origin validation (DNS-rebinding guard) is off
+by default", and the Scope section there excludes "DNS rebinding against the
+HTTP entrypoints" on the grounds that URL-path secrecy is the boundary and the
+local network is already the trusted zone.
 """
 
 from __future__ import annotations

{ha_mcp_dev-8.0.0.dev2230 → ha_mcp_dev-8.0.0.dev2235/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.0.0.dev2230
+Version: 8.0.0.dev2235
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT