ha-mcp-dev 8.0.0.dev2233__tar.gz → 8.0.0.dev2235__tar.gz

{ha_mcp_dev-8.0.0.dev2233/src/ha_mcp_dev.egg-info → ha_mcp_dev-8.0.0.dev2235}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.0.0.dev2233
+Version: 8.0.0.dev2235
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-8.0.0.dev2233 → ha_mcp_dev-8.0.0.dev2235}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.0.0.dev2233"
+version = "8.0.0.dev2235"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-8.0.0.dev2233 → ha_mcp_dev-8.0.0.dev2235}/src/ha_mcp/__main__.py

@@ -609,6 +609,25 @@ async def _cleanup_resources() -> None:
     logger.info("Server resources cleaned up")
 
 
+def _log_cleanup_result(task: "asyncio.Future[None]") -> None:
+    """Consume the cleanup task's outcome so a failure is never silent.
+
+    ``asyncio.wait`` does not retrieve results, and the timeout path
+    deliberately abandons rather than awaits (see the ``finally`` block), so
+    without this nothing observes ``cleanup_task``. An exception left
+    unretrieved this close to loop teardown surfaces only as a GC-time "Task
+    exception was never retrieved" error, which is unstructured and not
+    guaranteed to be emitted before exit. Mirrors what ``_cancel_tasks`` does
+    for the tasks it reaps. Cancellation is the expected abandoned-timeout
+    outcome and stays silent.
+    """
+    if task.cancelled():
+        return
+    exc = task.exception()
+    if exc is not None:
+        logger.warning(f"Resource cleanup raised: {exc!r}")
+
+
 async def _cancel_tasks(*tasks: asyncio.Task) -> None:
     """Cancel tasks and wait for completion, bounding the wait.
 
@@ -697,6 +716,7 @@ async def _run_with_shutdown(server_coro: Coroutine[Any, Any, Any]) -> None:
         # guard), so a hung close handshake could block shutdown past the
         # budget. A straggler is left to the runner's own task sweep.
         cleanup_task = asyncio.ensure_future(_cleanup_resources())
+        cleanup_task.add_done_callback(_log_cleanup_result)
         _done, cleanup_pending = await asyncio.wait(
             {cleanup_task}, timeout=SHUTDOWN_TIMEOUT_SECONDS
         )
@@ -1004,6 +1024,19 @@ def _get_http_runtime(default_port: int = 8086) -> tuple[str, int, str]:
     ``run_async``, any ``FASTMCP_HOST`` value in the environment is
     ignored — ``MCP_HOST`` is the only env var that affects bind host
     for ha-mcp's CLI entry points.
+
+    The ``0.0.0.0`` default is deliberate and documented: SECURITY.md
+    § "Local network is the trusted zone for standard mode" states that the
+    HTTP entrypoints bind to all interfaces so LAN peers can reach them, and
+    its Scope section excludes "LAN-peer access to standard-mode HTTP
+    endpoints".
+
+    The default ``/mcp`` path is *not* blessed the same way once the bind
+    leaves loopback. That combination is what ``_warn_if_default_path_exposed``
+    warns about, and SECURITY.md's Scope classes it under "a misconfigured
+    deployment" — meaning such reports are declined, not that the
+    configuration is endorsed. Operators on a non-loopback bind are still
+    expected to set a high-entropy ``MCP_SECRET_PATH``.
     """
 
     host = os.getenv("MCP_HOST", "0.0.0.0")
@@ -1020,7 +1053,9 @@ def _get_http_runtime(default_port: int = 8086) -> tuple[str, int, str]:
 # Default ``MCP_SECRET_PATH`` value, shared by ``_get_http_runtime`` (the
 # read-from-env fallback) and ``_warn_if_default_path_exposed`` (the
 # hardening-nudge predicate). Single source of truth so the two sites
-# can't drift.
+# can't drift. Safe on a loopback bind; on a non-loopback bind it is the
+# misconfiguration ``_warn_if_default_path_exposed`` flags, which SECURITY.md
+# declines to action without endorsing — see ``_get_http_runtime`` above.
 DEFAULT_MCP_PATH = "/mcp"
 
 # Hostname literals (not IP addresses) treated as loopback by

{ha_mcp_dev-8.0.0.dev2233 → ha_mcp_dev-8.0.0.dev2235}/src/ha_mcp/settings_ui/__init__.py

@@ -566,6 +566,15 @@ def register_settings_routes(
     and serve the "Open Web UI" button. Stdio transports use a separate
     side-process sidecar instead — see :mod:`ha_mcp.stdio_settings_sidecar`.
 
+    The ``RequireAuthMiddleware`` bypass is the documented posture, not an
+    oversight: SECURITY.md § "OAuth Mode — Beta Warning" states that the
+    settings UI "is **not** gated by the OAuth token", and its Scope section
+    excludes "The web settings UI not being gated by the OAuth/OIDC token".
+    OAuth and OIDC modes compensate by passing a *dedicated* secret path here
+    rather than the client-known MCP path (GHSA-mx64-982r-65vg); standard mode
+    and the add-on pass the MCP secret path, which already gates the whole
+    tool surface.
+
     Args:
         mcp: The FastMCP instance to register routes on.
         server: The HomeAssistantSmartMCPServer wrapping ``mcp``.

{ha_mcp_dev-8.0.0.dev2233 → ha_mcp_dev-8.0.0.dev2235}/src/ha_mcp/tools/tools_code.py

@@ -53,8 +53,20 @@ logger = logging.getLogger(__name__)
 # boundary.
 #
 # WARNING: This is shared across all clients in the same server process.
-# In multi-user modes (OAuth, HTTP), one user's saved tools are visible to
-# all other users. Scope to per-session/user before multi-user support.
+# One client's saved tools are listable and runnable by every other client,
+# and ``save_as`` overwrites by name without an ownership check. OAuth is the
+# only mode with distinct per-user credentials for that to cross; standard,
+# OIDC and add-on modes are single-tenant already (SECURITY.md § "Standard
+# mode is single-tenant"), so every caller there shares one HA token anyway.
+#
+# That exposure is accepted design, not a pending TODO — SECURITY.md § Scope
+# excludes "Saved custom tools (code mode, off by default) visible to other
+# clients of the same server process", on the grounds that they are shared
+# scaffolding rather than per-user data, that ``run_saved`` executes with the
+# caller's own HA token (granting no access the caller lacks), and that any
+# client which can reach ha-mcp is a trusted principal (SECURITY.md § "MCP
+# clients are trusted principals"). Scoping per session/user would be a
+# feature, not a security fix.
 _saved_tools: dict[str, dict[str, str]] = {}
 
 # Tools that sandbox code must not call. Includes ``ha_manage_custom_tool``

{ha_mcp_dev-8.0.0.dev2233 → ha_mcp_dev-8.0.0.dev2235}/src/ha_mcp/transport_security.py

@@ -23,6 +23,12 @@ exactly the pre-3.4.3 behaviour without giving up the protection that matters.
 Operators who front ha-mcp differently can re-enable the guard (and pin their
 own allow-lists) via ``FASTMCP_HTTP_HOST_ORIGIN_PROTECTION=true`` plus
 ``FASTMCP_HTTP_ALLOWED_HOSTS`` / ``FASTMCP_HTTP_ALLOWED_ORIGINS``.
+
+Turning the guard off is the documented posture, not an oversight: it has its
+own SECURITY.md section, § "Host/Origin validation (DNS-rebinding guard) is off
+by default", and the Scope section there excludes "DNS rebinding against the
+HTTP entrypoints" on the grounds that URL-path secrecy is the boundary and the
+local network is already the trusted zone.
 """
 
 from __future__ import annotations

{ha_mcp_dev-8.0.0.dev2233 → ha_mcp_dev-8.0.0.dev2235/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.0.0.dev2233
+Version: 8.0.0.dev2235
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT