ha-mcp-dev 8.1.0.dev2247__tar.gz → 8.1.1.dev2254__tar.gz

{ha_mcp_dev-8.1.0.dev2247/src/ha_mcp_dev.egg-info → ha_mcp_dev-8.1.1.dev2254}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.1.0.dev2247
+Version: 8.1.1.dev2254
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-8.1.0.dev2247 → ha_mcp_dev-8.1.1.dev2254}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.1.0.dev2247"
+version = "8.1.1.dev2254"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-8.1.0.dev2247 → ha_mcp_dev-8.1.1.dev2254}/src/ha_mcp/config.py

@@ -302,6 +302,29 @@ class Settings(BaseSettings):
     # schemas so it stays out of the add-on Configuration page.
     enable_dev_mode: bool = Field(False, alias="HAMCP_ENABLE_DEV_MODE")
 
+    # Dev-tools access to tool-security policy state (issue #2141).
+    # Developer mode may stay on while this stays off: the dev tools'
+    # policy-override surfaces — set_policy, set_tool(gated=...),
+    # approve/deny of queued approvals, and set/reset of
+    # enable_tool_security_policies — are refused while it is off, so a
+    # connected agent cannot rewrite the rules that gate it nor click
+    # "accept" on its own gated calls. The guard reads env var + override
+    # file fresh per call (NOT this cached Settings object), so a change
+    # applies live without a restart even in stdio mode, where the web
+    # settings UI runs in a detached sidecar process whose POST cannot
+    # reset this process' settings singleton. Editable
+    # from the web settings UI (Developer section) or the env var ONLY —
+    # the dev tools' own settings surfaces refuse to write this field, in
+    # either direction, and it is absent from the add-on config schemas
+    # like enable_dev_mode. A leash on those surfaces, NOT a sandbox: dev
+    # mode's update_source/restart can still replace the running server
+    # build, and in add-on mode ha_manage_addon can reach the add-on's
+    # own options and ingress — gate those tools with policy rules (or
+    # keep dev mode off) where that boundary matters.
+    dev_tools_security_policy_access: bool = Field(
+        False, alias="HAMCP_DEV_SECURITY_POLICY_ACCESS"
+    )
+
     # Code Mode — sandboxed Python execution via pydantic-monty.
     # Provides an "escape hatch" tool (ha_manage_custom_tool) that lets LLMs write
     # custom one-off Python code when no existing tool covers the request.
@@ -912,6 +935,17 @@ ADVANCED_SETTINGS_FIELDS: tuple[AdvancedField, ...] = (
     # among the feature toggles, and stays independent of the beta
     # master gate.
     AdvancedField("enable_dev_mode", "HAMCP_ENABLE_DEV_MODE", bool, "developer", True),
+    # Dev-tools security-policy access (issue #2141). Renders directly
+    # below the dev-mode toggle in the same Developer section. Editable
+    # here and via the env var; the dev tools themselves refuse to write
+    # it, so the AI cannot grant itself policy access.
+    AdvancedField(
+        "dev_tools_security_policy_access",
+        "HAMCP_DEV_SECURITY_POLICY_ACCESS",
+        bool,
+        "developer",
+        True,
+    ),
 )
 
 

{ha_mcp_dev-8.1.0.dev2247 → ha_mcp_dev-8.1.1.dev2254}/src/ha_mcp/policy/middleware.py

@@ -41,7 +41,9 @@ PROXY_META_TOOLS = frozenset(
 # itself require approval — creating a second pending entry instead of
 # deciding the first, so nothing can ever be approved through the tool.
 # Only the queue-management actions are exempt; update_source / restart
-# remain gateable like any other high-stakes action.
+# remain gateable like any other high-stakes action. The exemption is not
+# a free self-approval: approve/deny separately require the
+# dev_tools_security_policy_access setting (off by default, issue #2141).
 _APPROVAL_MANAGEMENT_TOOL = "ha_dev_manage_server"
 _APPROVAL_MANAGEMENT_ACTIONS = frozenset({"list_pending", "approve", "deny"})
 

{ha_mcp_dev-8.1.0.dev2247 → ha_mcp_dev-8.1.1.dev2254}/src/ha_mcp/settings_ui/locales/en.json

@@ -289,6 +289,7 @@
     "advanced.errors.json": "Advanced settings response was not valid JSON.",
     "advanced.sidecar.stdio_only": "Available in stdio mode only. This HTTP server has no settings-UI sidecar to pin.",
     "advanced.enable_dev_mode.confirm": "⚠ Enable developer mode?\n\nAfter restart, hidden developer tools will be exposed to connected AI agents. Enable only for development and testing.",
+    "advanced.dev_tools_security_policy_access.confirm": "⚠ Let developer tools change security policies?\n\nWhile developer mode is on, connected AI agents will be able to rewrite tool security policies, add or remove per-tool approval gates, and approve or deny pending approvals — including their own gated calls. Enable only while testing policies.",
     "advanced.code_mode_saved_tools_path.addon_locked": "Hardcoded to <code>/data/saved_tools.json</code> in App (add-on) mode so saved tools survive updates.",
     "advanced.code_mode_saved_tools_path.blank_warning": "If blank, custom tools are kept in memory only and lost on restart.",
     "policies.errors.conflict": "{operation} failed: policy was modified in another tab or session. Reload and re-apply your changes.",
@@ -423,6 +424,8 @@
     "advanced.sidecar_pin_port.help": "0 picks a free port on first start and keeps it for later restarts; 1024–65535 pins a preferred port (falls back to a free one if taken). Restart required.",
     "advanced.enable_dev_mode.label": "Developer mode",
     "advanced.enable_dev_mode.help": "⚠ Registers hidden tools that can change settings and replace the running server. Development and testing only. Restart required.",
+    "advanced.dev_tools_security_policy_access.label": "Dev tools security policy access",
+    "advanced.dev_tools_security_policy_access.help": "⚠ While developer mode is on, lets the developer tools rewrite tool security policies, add or remove per-tool approval gates, and approve or deny pending approvals on your behalf — an AI agent can accept its own gated calls. Policy testing only. Takes effect without a restart.",
     "addon.backup_hint.name": "Full-HA snapshot suggestion level (LLM-facing)",
     "addon.backup_hint.description": "Tunes the wording of the hint the LLM sees in the\n`ha_manage_backup(scope='snapshot')` tool description for when to\nsuggest a full Home Assistant tarball backup before risky operations\n(e.g. mass device deletes). Affects ONLY this one LLM-facing prompt\nsentence.\n\nFor per-edit automatic snapshots of automations / scripts / helpers /\netc., use the separate **Enable auto-backup of edits** toggle below.",
     "addon.secret_path.name": "Secret path override",

{ha_mcp_dev-8.1.0.dev2247 → ha_mcp_dev-8.1.1.dev2254}/src/ha_mcp/settings_ui/settings.js

@@ -3536,6 +3536,7 @@ const ADVANCED_FIELD_META = {
   extra_yaml_write_keys:     { label: "Extra YAML write keys",        help: "Comma-separated top-level keys ha_config_set_yaml may write in addition to the built-in ones, for YAML-first integrations on this install (e.g. alert2). Keys that redefine Home Assistant's own trust boundary can never be added and are ignored. Requires custom component 1.2.4 or newer." },
   sidecar_pin_port:    { label: "Settings UI sidecar port",    help: "0 picks a free port on first start and keeps it for later restarts; 1024–65535 pins a preferred port (falls back to a free one if taken). Restart required." },
   enable_dev_mode:     { label: "Developer mode",               help: "⚠ DANGER: registers hidden developer tools (ha_dev_manage_server, ha_dev_manage_settings) that let AI agents change server settings and replace the running server version (e.g. install a PR build). For development and testing only. Restart required." },
+  dev_tools_security_policy_access: { label: "Dev tools security policy access", help: "⚠ DANGER: while developer mode is on, lets the developer tools rewrite tool security policies, add or remove per-tool approval gates, and approve or deny pending approvals on your behalf — an AI agent can accept its own gated calls. For policy testing only. Takes effect without a restart." },
 };
 
 // Fields that require an MCP-host restart to take effect when changed
@@ -3754,6 +3755,20 @@ function renderAdvancedSection(containerId, fields) {
         input.checked = false;
         return;
       }
+      // Policy access hands the same agents the security policies that
+      // gate them (and the approval queue) — its own confirm, since it
+      // is stored independently of the dev-mode toggle above (it only
+      // takes effect while dev mode is on).
+      if (fname === 'dev_tools_security_policy_access' && input.checked && !confirm(
+        t(
+          'advanced.dev_tools_security_policy_access.confirm',
+          {},
+          '⚠ Let developer tools change security policies?\n\nWhile developer mode is on, connected AI agents will be able to rewrite tool security policies, add or remove per-tool approval gates, and approve or deny pending approvals — including their own gated calls. Enable only while testing policies.'
+        )
+      )) {
+        input.checked = false;
+        return;
+      }
       let v;
       if (input.type === 'checkbox') v = input.checked;
       else if (input.type === 'number') v = (f.type === 'float') ? parseFloat(input.value) : parseInt(input.value, 10);

{ha_mcp_dev-8.1.0.dev2247 → ha_mcp_dev-8.1.1.dev2254}/src/ha_mcp/tools/tools_dev.py

@@ -124,6 +124,129 @@ def is_dev_mode_enabled() -> bool:
     return bool(getattr(get_global_settings(), "enable_dev_mode", False))
 
 
+def _security_policy_access_enabled() -> bool:
+    """Check whether dev tools may change tool-security policy state.
+
+    Deliberately NOT read through the ``get_global_settings()`` singleton:
+    in stdio deployments the web settings UI runs in a detached sidecar
+    process, so its POST resets only the sidecar's own cached settings —
+    this process would keep serving the stale value until restart. Reading
+    the env var, then the override file, fresh per call keeps the toggle
+    live in every deployment mode, in the same env-over-file ORDER the
+    settings loader applies. Coercion is per source: an env string is
+    parsed with pydantic's truthy set (matching what ``Settings`` would
+    have read from the same var), and a file value goes through the
+    loader's own ``_coerce_advanced_override_value`` — so the guard can
+    never disagree with what Settings and the web UI checkbox read from
+    the same file (a hand-edited ``"true"`` string, which the loader
+    rejects and renders as OFF, must fail closed here too). The read is a
+    tiny synchronous stat/parse; guard call sites take it inline, and the
+    ``_settings_rows`` caller already runs on a worker thread.
+    """
+    import os
+
+    from ..config import (
+        _coerce_advanced_override_value,
+        _read_feature_flag_override_file,
+    )
+
+    env_raw = os.environ.get("HAMCP_DEV_SECURITY_POLICY_ACCESS")
+    if env_raw is not None:
+        return env_raw.strip().lower() in ("1", "true", "t", "yes", "y", "on")
+    # The override file is keyed by FIELD name (see
+    # _apply_one_advanced_override), not env-var name.
+    raw = _read_feature_flag_override_file().get("dev_tools_security_policy_access")
+    if raw is None:
+        return False
+    ok, coerced = _coerce_advanced_override_value(
+        "dev_tools_security_policy_access", bool, raw
+    )
+    return bool(coerced) if ok else False
+
+
+def _apply_policy_guard_row_locks(fname: str, row: dict[str, Any]) -> None:
+    """Reflect the policy-access write guards in the ``list`` matrix rows.
+
+    Without this, agents reading the matrix to choose writable settings
+    see ``editable: true`` on rows whose set/reset the guards refuse:
+    ``enable_tool_security_policies`` while access is off, and
+    ``dev_tools_security_policy_access`` always (web UI / env var only).
+    A row that is ALREADY non-editable (env-pinned) keeps its plain env
+    story: the pin refuses the write before these guards would, and
+    stamping a policy reason there would misdirect the fix toward the
+    wrong lock. The toggle's displayed value is also re-read fresh so a
+    sidecar-process edit shows here without a restart, matching what the
+    guard enforces.
+    """
+    if fname == "enable_tool_security_policies":
+        if row["editable"] and not _security_policy_access_enabled():
+            row["editable"] = False
+            row["locked_reason"] = "policy_access_required"
+    elif fname == "dev_tools_security_policy_access":
+        if row["editable"]:
+            row["editable"] = False
+            row["locked_reason"] = "web_ui_or_env_only"
+        row["value"] = _security_policy_access_enabled()
+
+
+def _require_security_policy_access(operation: str) -> None:
+    """Refuse ``operation`` unless security-policy access is enabled (#2141).
+
+    Guards every dev-tools surface that can weaken the tool-security
+    policies gating the agent itself, so dev mode can stay on for
+    everything else while policy override stays off.
+    """
+    if _security_policy_access_enabled():
+        return
+    raise_tool_error(
+        create_error_response(
+            ErrorCode.AUTH_INSUFFICIENT_PERMISSIONS,
+            f"Dev tools may not {operation}: security-policy access is "
+            "disabled (dev_tools_security_policy_access=false).",
+            context={
+                "operation": operation,
+                "setting": "dev_tools_security_policy_access",
+            },
+            suggestions=[
+                "Enable 'Dev tools security policy access' in the web "
+                "settings UI (Server Settings tab, Developer section), or set "
+                "HAMCP_DEV_SECURITY_POLICY_ACCESS=true — it takes effect "
+                "without a restart.",
+            ],
+        )
+    )
+
+
+def _guard_security_policy_setting(setting: str) -> None:
+    """Gate set/reset of the two settings that define the dev tools' leash.
+
+    ``dev_tools_security_policy_access`` is refused unconditionally — even
+    with access ON — so the agent can neither grant itself policy access
+    nor revoke it; that toggle belongs to the web settings UI and the env
+    var alone. ``enable_tool_security_policies`` is the whole gating
+    engine's master switch, so writing it needs access.
+    """
+    if setting == "dev_tools_security_policy_access":
+        raise_tool_error(
+            create_error_response(
+                ErrorCode.AUTH_INSUFFICIENT_PERMISSIONS,
+                "'dev_tools_security_policy_access' cannot be changed by dev "
+                "tools: it is the toggle governing their own access to tool "
+                "security policies.",
+                context={"setting": setting},
+                suggestions=[
+                    "Change it in the web settings UI (Server Settings tab, "
+                    "Developer section) or via the "
+                    "HAMCP_DEV_SECURITY_POLICY_ACCESS env var.",
+                ],
+            )
+        )
+    if setting == "enable_tool_security_policies":
+        _require_security_policy_access(
+            "enable or disable the tool-security-policy engine"
+        )
+
+
 def _spawn_background(coro: Any) -> None:
     """Run ``coro`` as a strongly-referenced fire-and-forget task."""
     task = asyncio.get_running_loop().create_task(coro)
@@ -410,6 +533,7 @@ class DevTools:
             bounds = _FEATURE_FLAG_INT_BOUNDS.get(fname)
             if bounds is not None:
                 row["min"], row["max"] = bounds
+            _apply_policy_guard_row_locks(fname, row)
             rows.append(row)
         for (
             fname,
@@ -443,6 +567,7 @@ class DevTools:
             choices = _ADVANCED_SETTINGS_CHOICES.get(fname)
             if choices is not None:
                 row["choices"] = list(choices)
+            _apply_policy_guard_row_locks(fname, row)
             rows.append(row)
         return rows
 
@@ -698,7 +823,8 @@ class DevTools:
                 default=None,
                 description=(
                     "set_policy: the full policy object "
-                    "{wait_seconds, approval_ttl_minutes, rules, version}"
+                    "{wait_seconds, approval_ttl_minutes, rules, version, "
+                    "schema_version}"
                 ),
             ),
         ] = None,
@@ -742,7 +868,13 @@ class DevTools:
         LLM-API exposure, security gates, and policy edits apply live.
         Env-pinned settings/tools are read-only until the env var is unset.
         These actions can flip security-sensitive state — treat with the
-        same care as editing the web UI.
+        same care as editing the web UI. The policy-override surfaces
+        (set_policy, set_tool with gated=, and set/reset of
+        enable_tool_security_policies) additionally require the
+        'dev_tools_security_policy_access' setting, which is off by
+        default; reads are always available. That setting itself is never
+        writable by these tools — change it in the web settings UI or via
+        HAMCP_DEV_SECURITY_POLICY_ACCESS.
 
         EXAMPLES:
         ha_dev_manage_settings("list_tools")
@@ -808,6 +940,8 @@ class DevTools:
                     f"'setting' is required for action={action!r}",
                 )
             )
+        # set/reset only; 'list' returned above, and reads are never gated.
+        _guard_security_policy_setting(setting)
 
         from ..config import (
             _ADVANCED_SETTINGS_BOUNDS,
@@ -1027,6 +1161,11 @@ class DevTools:
                     "set_tool needs at least one of state / llm_api / gated",
                 )
             )
+        # The gate flag writes a security-policy rule (#2141); state /
+        # llm_api changes stay available without policy access. Checked
+        # before any write so a combined state+gated call is refused whole.
+        if gated is not None:
+            _require_security_policy_access("change a tool's security gate")
         # Reject unknown tool names BEFORE persisting anything: a typo'd
         # security gate ("ha_call_servce") would otherwise save a rule for a
         # nonexistent tool and report success while the intended tool stays
@@ -1387,6 +1526,8 @@ class DevTools:
         self, policy: dict[str, Any] | None, expected_version: int | None
     ) -> dict[str, Any]:
         """Write the full tool-security policy (validated, version-guarded)."""
+        _require_security_policy_access("rewrite the tool security policy")
+
         from pydantic import ValidationError
 
         from ..policy.model import Policy
@@ -1796,11 +1937,12 @@ class DevTools:
         arrives just before the server goes down) and supports those
         two deployments only (standalone processes must be restarted
         externally). list_pending/approve/deny are exempt from policy
-        gating (gating queue management would deadlock approvals) —
-        and since gated-call errors include the approval token, an
-        agent can self-approve its own gated calls while dev mode is
-        on. Dev mode is a trusted-operator feature; leave it off
-        otherwise.
+        gating (gating queue management would deadlock approvals), so
+        approve/deny instead require the separate
+        'dev_tools_security_policy_access' setting — off by default,
+        because gated-call errors carry the approval token and an agent
+        could otherwise self-approve its own gated calls. Dev mode is a
+        trusted-operator feature; leave it off otherwise.
 
         EXAMPLES:
         ha_dev_manage_server("info")
@@ -2277,6 +2419,10 @@ class DevTools:
         self, token: str | None, *, approve: bool
     ) -> dict[str, Any]:
         """Approve or deny one blocked tool call by token."""
+        # Deciding an approval is the agent clicking "accept" on its own
+        # gated call — the surface #2141 exists to close. list_pending
+        # stays open: reading the queue decides nothing.
+        _require_security_policy_access("decide a pending approval")
         if not token:
             raise_tool_error(
                 create_error_response(
@@ -2326,9 +2472,12 @@ def register_dev_tools(mcp: Any, client: Any, **kwargs: Any) -> None:
         logger.debug(f"Dev tools disabled (set {FEATURE_FLAG}=true to enable)")
         return
 
+    access = "on" if _security_policy_access_enabled() else "off"
     logger.warning(
-        "Developer mode is ON: ha_dev_manage_server / ha_dev_manage_settings "
-        "are registered. These tools can change server settings, tool "
-        "visibility, security policies, and replace the running server version."
+        f"Developer mode is ON: ha_dev_manage_server / ha_dev_manage_settings "
+        f"are registered. These tools can change server settings, tool "
+        f"visibility, and replace the running server version. Rewriting tool "
+        f"security policies and deciding approvals additionally require "
+        f"dev_tools_security_policy_access (currently {access})."
     )
     register_tool_methods(mcp, DevTools(client, server=kwargs.get("server")))

{ha_mcp_dev-8.1.0.dev2247 → ha_mcp_dev-8.1.1.dev2254/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.1.0.dev2247
+Version: 8.1.1.dev2254
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT