ha-mcp-dev 8.5.0.dev2799__tar.gz → 8.5.0.dev2801__tar.gz

{ha_mcp_dev-8.5.0.dev2799/src/ha_mcp_dev.egg-info → ha_mcp_dev-8.5.0.dev2801}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.5.0.dev2799
+Version: 8.5.0.dev2801
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.5.0.dev2799"
+version = "8.5.0.dev2801"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/MANIFEST.sha256

@@ -1,7 +1,7 @@
 43070e2d4e532684de521b885f385d0841030efa2b1a20bafb76133a5e1379c1  LICENSE
 21859d4324326a6fb383cfd827626db2278088d4659000a8569f55262309a894  REQUIRES.txt
-2a6cee2aa217292ce8ff58f8f3a98f0099b0ba6cbfce45b527abd8353fb90929  VENDORED
-ffd632ba9a7590a381837c71fd21f7c0bfd551b4ec3baed386a00eff89a19ff1  __init__.py
+8b4e81d4cab8dedb5288e049b552561ecd69fec834a6d5d8520cf1a2d01a4ba4  VENDORED
+d6384f05e63f59d7abb2618a31e8f419a6675552ea1a7fc73a9f5b430012e0e2  __init__.py
 2ae9ce0d217923abf551b6f8bcf08e516529b9a6abab160bab5d8c9b7e245c3d  _compat.py
 0fe101433a655a48e5fd1dde0c75879f3a74f9092d2b935bd71fad19bcfb77a1  _install_hints.py
 a9c59fe78564360444de04484a2b0906569fb58408be3c968be3f81a5e3015a4  _warnings.py
@@ -55,15 +55,15 @@ dc1d498f1d723a1447cb4fa358b3dcf786eb7f4e1b048c3238b28ced34c23b67  client/group.p
 0648016833612089c873938a63d69cded6336e8c8d9867e9412d4e2dac9c2f97  client/logging.py
 4014857ab79e71cd06f28afaa160f00d9c646c63a63bb99565174933497fc501  client/messages.py
 01e24f9b114fd85aacd62fb99631adedb23e5293e9e72cfc9b2680035364c7a9  client/mixins/__init__.py
-91c4ffeccaa231f1912668c889293eac8650ac253f7dd806e4d22bab1cf50039  client/mixins/prompts.py
-f66ad0606f95376178f817cc1ba2ff78cad45cf9d35e730f503addd625068822  client/mixins/resources.py
-e09278749f40fe83a7aafad62d5460842fd6599ef331425bae89e73a55d78730  client/mixins/tools.py
+a286df8775a6de31aa19ff6f26002a6f612a9ab36acf4e8629b52da44e406da4  client/mixins/prompts.py
+26c5c96f8ffa53ebf035667efde96418750eebeb016c6d79ab2f5f4fe087718e  client/mixins/resources.py
+c78ce42cd9e3496947d582c548d9852dad251407635b1f44ba2ff41ed60a0b6b  client/mixins/tools.py
 e418845c0228e016596d96d1a962f2d0ccb814f7b769ee0b08e9f158de44fe89  client/oauth_callback.py
 c3a98f99610d06c9b95fd9df0f7acefacbfc4756a9f62bbd0a64df880ccd01ca  client/progress.py
 5aa421cd60f10be7bdab46641ade22e90e41bf6a6226cb2d26814fb53ffcf406  client/roots.py
 d759cb6643a356a15c4537185597567349fe713beae579c48e48ed65ec35cbb0  client/sampling/__init__.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  client/sampling/handlers/__init__.py
-b5d3d0052f82f8d4d0ef053498474e403b4815b170e3522456bb4618253bdc4f  client/sampling/handlers/anthropic.py
+01c00f9d12ab4db3ec98bb032b0884b186a5aa73222e30b0fb5b88fba6e66c8a  client/sampling/handlers/anthropic.py
 74b2ef4eaf706dacbdbeb060ccfaf5036e7053a0db51e7367fd2450ce892b3f5  client/sampling/handlers/google_genai.py
 a41ee550a4a16f8965afe7eb9e5afc4fb94e1683afab9777857dfb1917e0ab7a  client/sampling/handlers/openai.py
 dd343adbd063873c835400ae2c30dcfd451acf2712c347244bca63c0d7e1ae51  client/telemetry.py
@@ -93,7 +93,7 @@ d7ec0ff66e333e21df80829ddd5a1ad9dddd955b2b8456f199e08c732ca1ea77  contrib/mcp_mi
 65d2365c668228499112fdf649f35e93f7af4dc652cd08012c67ea6abb55d46a  exceptions.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  experimental/__init__.py
 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b  experimental/transforms/__init__.py
-4461ed050c5ffd35606e53657937b77402c550e3c9039c168f1d8dcb97680dd7  experimental/transforms/code_mode.py
+15e2f6aa9dc2051af34bb5d0470adc8ec45f402a50706ff7fe950c2f2dc5184f  experimental/transforms/code_mode.py
 a08727048d5bdc6f513fd4161f1a53ae1ffbcf387cc62b6319317946814cd4c5  mcp_config.py
 353a26dc9d40c4e682ebc1411838ee0920a759ced021d264057b86c0335f1a24  prompts/__init__.py
 abddba9c78219818445f1147c21476544c55e3b994d80e8e647ea7072421f2b1  prompts/base.py
@@ -117,7 +117,7 @@ e52df6b15b5b66edad8e11c71bf32d8f9cacba628a1d7a9ed97e440f6a491296  server/auth/ha
 482e01b4ecc8af2714eb1bc50cc7afa0bdbadab1e583171cb9aa70fa2b270af0  server/auth/oauth_proxy/__init__.py
 5f490615f239c44e861b7860fbdabc02e4a768587e9e77259b7695b2628576d3  server/auth/oauth_proxy/consent.py
 66c2b86e445bb5e930eae7ec7c495a20e752ceec57af059fd96de66ebf2fcce0  server/auth/oauth_proxy/models.py
-49915a4be389f7294a77c9b5f05ce0c4d398b52373f32e5e910284b04eb7aa7c  server/auth/oauth_proxy/proxy.py
+59fdac16c65da5bacd0994f92d1e3f23dc39253d984ef16d5cc5c01a1b48380a  server/auth/oauth_proxy/proxy.py
 c20a999e75dbfbd5801ccf0172127b316f8bca1807fb3ca282cadcdc0a37295e  server/auth/oauth_proxy/ui.py
 a7dfed182cd72300a09136f500738cafd81960807b474fd184143a24fa0898d9  server/auth/oauth_proxy/upstream.py
 b44d5db31e3f760b18d97a363027d2777ec0c7ee982339eb2f5d507894bc121e  server/auth/oidc_proxy.py
@@ -151,7 +151,7 @@ df16f6cf532f38b87318d06d7c0f97717699614ada54fcfb53701d5281ed6cc5  server/auth/pr
 e0497cf65d8a93849bf2873b94e18abaff2d8a9a879d24db9af22d52548bb696  server/event_store.py
 29bc8c6a594ec12a859fcf54658bedc59e7e3a507e861b3a79a72ca5d2fdb83c  server/extensions.py
 bc157f88e7854f970ba57108745eeb72c04a95fc593a102b6c8a54f5c01e8998  server/http.py
-b0c121ea761671766b8a12fa88bdeb10e30bbce0682f9c17556ebac0afdf72f8  server/lifespan.py
+c939ec1886308f99257b07aaa73a4781565d5d3e170fc13b0d8b36f4735a4fda  server/lifespan.py
 9ad85391f6cdd905a7168a579afdf423bf9600d5067b09123ac201295e6c1126  server/low_level.py
 dc669c15efc3c6bdeb531a6267860c141bb86d64e49c0ee586805c4866bd0c01  server/middleware/__init__.py
 172f87828b7aa58bcf31e377c149c9fbc05bf6aba377e8e92a8d4757ebda5bf0  server/middleware/authorization.py
@@ -181,7 +181,7 @@ cd022ac9e2a9846c76ed95be96b136f36a1d4a9edcde1b73e62062ba43622556  server/provide
 101c860292375904bb89f3f8e4590eb9537f232f4aab4e207ac96f9bad229241  server/providers/local_provider/decorators/prompts.py
 18300b436f36bb796a530e9b3f077c5aaccb5e9eef00a00e9e618321160d8db4  server/providers/local_provider/decorators/resources.py
 793779ff2289d4281e9bca891ffb09e397445e314d0dc9c7640ec817fb999814  server/providers/local_provider/decorators/tools.py
-1490e1521191d3017ed16893a50b4b63a271b7be45f7bc4138639dadc4bd3bf7  server/providers/local_provider/local_provider.py
+0a16d7a534974141054d6cb962e7ed7907390191bf40c9f00a68bb43d6b01205  server/providers/local_provider/local_provider.py
 11c75b6557ce98f4855c76aa0d7740df71e704d05fda8435d92f89aee4a5623e  server/providers/openapi/README.md
 9e4dd35d653c9363b7c7679b38ca3f653b53a359065507046bce94db5dfe4bd5  server/providers/openapi/__init__.py
 3eedd623727b69f35c701c7f20e5ea499eee0ed43353310a33425cb32ff04798  server/providers/openapi/components.py
@@ -191,13 +191,13 @@ b00f94d08ce939d3aca4fb4e9d77d34633570e505640bd7c0a3a4cfb27030b05  server/provide
 59455808dce7fb5c90fa043ca0a1cbe7d911658f79efe92771dcc1b1109c3789  server/providers/prefab_synthesis.py
 9a73913afb1857025d489d1e7c3521058248c67ad7fa4835bf185db0f855dc46  server/providers/proxy.py
 6bb7641e4c222ff359a38f9617987cc64a8c3eaf04118346b1e96f8b336bc9da  server/providers/skills/__init__.py
-b075279c08c947a3edd568e5a71f8972ca42fac2135560961182f2b506e0c34c  server/providers/skills/_common.py
+8845d0ceb5a62372ea24f338522998282552941c29801810448444edf85b513d  server/providers/skills/_common.py
 ce1a7b8a0adece4168f039721d3c0d196da79ae6d8d2b7835ef13733f6c510ab  server/providers/skills/claude_provider.py
 571e579ffa410d5a932dc7afeeb76717171ac927450ecd408ca7b2c99e7c5150  server/providers/skills/directory_provider.py
 a427c8444b114edb0a6bf40541dd0a3c53b8adfb59ad292a3eb785711825e145  server/providers/skills/skill_provider.py
 b759c2e9f832ff7b27a9d4347a12851e235d59f7cfa0360aba5efd57377a4adb  server/providers/skills/vendor_providers.py
 59802937576af905a862e1768df1677ad07a47288b5cb31b75cca6f1090b6472  server/providers/wrapped_provider.py
-5d39de351465012b204d542579cd101fde574250551ebff34e3280b61dfc280c  server/server.py
+68d9404589d657563aa8a67211819c6d44ee846991a3f417d08f0f3947392865  server/server.py
 a50d0db0003d63db49a3ec62b18dc75e267d6e03b7165f11f02992316be4e160  server/session_scoped_event_store.py
 a172b6697b515083db1d9f2466d8c88659d37427ece0d292c26d1646c1e72e2f  server/sessions.py
 24b63d7adc0e3e7ebb5528924d9cf2e5789faad798bd39175690c8dca0742ac4  server/telemetry.py
@@ -218,7 +218,7 @@ d66e0f39358b3d410906d0c5fb6b5b09c908ebd2bb8da61130a0a6a89dafa428  settings.py
 fd1992e098123e61b8e2697dae56bc3d6311ea118c9dbdbac0197d7ad274b126  tools/__init__.py
 2fceb041133d3d9d38b172f9d87650a6a5c9a856c11a8f0c29c35a682c1a7232  tools/base.py
 d750e73263d2cd1b1fa184476d5256086858e7495ace3f26b32048eaeae39663  tools/function_parsing.py
-8805444d42bbd6b6746a7054314fa98112b19f6cd37aa224f1ebbc252159ed4c  tools/function_tool.py
+eb1f8951c3695227a91c32a9a3f52f7f68aaa1572b3ec22843b9e199774cdeaf  tools/function_tool.py
 9e7fbcfde19d838b70cf25db2cc9ffa757cc69253ff245a3d578b683db3634f5  tools/tool_transform.py
 114f6988d2f7f28911d20afa9792106f76b723e8f4f8c09625e2310b7db438a3  types.py
 fa2989f12fab5e66d73167836a695d3fe7470ea00f83fc3098f573f8b357d781  utilities/__init__.py
@@ -249,20 +249,20 @@ e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  utilities/mcp_
 99526bda0a6c8523eecb550bed72a03f815e379bca1ecaa870122a5af8e9a0ad  utilities/mime.py
 6890003fe8e02d81f2c1fe4ed7866e50ebfff06b699d7308724ceaa9f413f701  utilities/openapi/README.md
 c833f7723b65b8bf55695ab67261860ce5b21532dc6d6a3c6e887cc12e35ab83  utilities/openapi/__init__.py
-65a15c422a085e95e8f485bee3e2cdac8843bc32468d7716514fadb2dfd9a14f  utilities/openapi/director.py
+3015f816ee852d420df12d380d8b558d6e1635c12f110a210d144ce04a1b1f22  utilities/openapi/director.py
 9eb89249d9644ba337379bbbc8140060ea6a5b642be1961d7cb214eed0cca404  utilities/openapi/formatters.py
 8521f1f6091a8cef4154db5342c017fafaf48876869153380b86f7eb741ffa8b  utilities/openapi/json_schema_converter.py
-7512abae329c45ecf9a8c24720fc40589f947d9f9e81cff5b7a8932e82a75d77  utilities/openapi/models.py
-57052f479cf7f68d959683bd54a6f31c39859d95e9315261bc70f503bb22ae67  utilities/openapi/parser.py
-d8101ea69d2bbde61d696bc8bc26c85beee540e73e21835fde64476dc8ae5b2a  utilities/openapi/schemas.py
-5c576526e95b7b13235ec9dd8cb250d4d8c7eaa9d90cb71e3021e4fa9101d2cd  utilities/pagination.py
+6d833c04a3bc731a66258221e5f15826a41e265e9c80898218ae226e29f4d612  utilities/openapi/models.py
+2e58bc03dd82687ef7a843474eb65c1f644eafe2c039eb0949a61cce8b313de9  utilities/openapi/parser.py
+1db004cc712839ebdb920e7017776c743e8cd3a3e999b7fe13132d68da4a099c  utilities/openapi/schemas.py
+9db69a1b408230d652ec39d89867449d504491aeda59fbc7285a14210575b7e3  utilities/pagination.py
 634850f693e36fc0e5c877581bdb7e990bfd7541676288170c6a1d1713755d46  utilities/prefab.py
 3db58fb4f30afb73083baeb8d94c9a23d9875980f091c19592b9eff89588764c  utilities/skills.py
 66a0085646c22d1ff49b89cb218813e5b88eebf12f868423a1eab4f1a0389b98  utilities/tasks.py
 63e6d25c67609e194c5e940602ccf0562ac1617ab33e6f5b5b05a55bfca9c31c  utilities/tests.py
 6e158212fb4a31e14b309c7c65aefee8861ac62f8edb2ee06ba359e37df92c37  utilities/timeout.py
 0b105f303612c242d5be4569b185a3e9780b9749f693ba5392ebad223b5aa0d6  utilities/token_cache.py
-fe36c39ffdc8368ab586bf00109470dec5c57baa07cb7440907a3c98e929cc12  utilities/types.py
+a1ac7acb1d21720d6e2dc9094558d3ada8a50f8580154c2bf102154c62a29d5f  utilities/types.py
 81c9e16bb563e31101c5dad2f3711994aa4dff8dc0433720899144be44eacea8  utilities/ui.py
 3ec3a6eeda40bce166793f27a109c8f132b29b4125f781cfc2de220c22568b6a  utilities/version_check.py
-eb2562903a218bd86976325796d4dc29d78a619535afdf0507866b3359863354  utilities/versions.py
+5e19b700a340ef7fd8974571de2aa190ef1acfc609547aaa1729704bfc241ae2  utilities/versions.py

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/VENDORED

@@ -1,2 +1,2 @@
-fastmcp-slim==4.0.3
+fastmcp-slim==4.0.5
 Vendored by scripts/vendor_fastmcp.py — do not edit by hand.

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/__init__.py

@@ -32,7 +32,7 @@ from ha_mcp._vendor.fastmcp import _compat
 
 _compat.install()
 
-__version__ = "4.0.3"
+__version__ = "4.0.5"
 
 if settings.deprecation_warnings:
     warnings.simplefilter("default", FastMCPDeprecationWarning)

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/client/mixins/prompts.py

@@ -96,7 +96,7 @@ class ClientPromptsMixin:
         for _ in range(max_pages):
             result = await self.list_prompts_mcp(cursor=cursor)
             all_prompts.extend(result.prompts)
-            if not result.next_cursor:
+            if result.next_cursor is None:
                 break
             if result.next_cursor in seen_cursors:
                 logger.warning(

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/client/mixins/resources.py

@@ -96,7 +96,7 @@ class ClientResourcesMixin:
         for _ in range(max_pages):
             result = await self.list_resources_mcp(cursor=cursor)
             all_resources.extend(result.resources)
-            if not result.next_cursor:
+            if result.next_cursor is None:
                 break
             if result.next_cursor in seen_cursors:
                 logger.warning(
@@ -191,7 +191,7 @@ class ClientResourcesMixin:
         for _ in range(max_pages):
             result = await self.list_resource_templates_mcp(cursor=cursor)
             all_templates.extend(result.resource_templates)
-            if not result.next_cursor:
+            if result.next_cursor is None:
                 break
             if result.next_cursor in seen_cursors:
                 logger.warning(

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/client/mixins/tools.py

@@ -121,7 +121,7 @@ class ClientToolsMixin:
         for _ in range(max_pages):
             result = await self.list_tools_mcp(cursor=cursor, cache_mode=cache_mode)
             all_tools.extend(result.tools)
-            if not result.next_cursor:
+            if result.next_cursor is None:
                 break
             if result.next_cursor in seen_cursors:
                 logger.warning(

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/client/sampling/handlers/anthropic.py

@@ -135,7 +135,7 @@ class AnthropicSamplingHandler:
         if params.system_prompt is not None:
             kwargs["system"] = params.system_prompt
         if params.temperature is not None:
-            kwargs["temperature"] = params.temperature
+            kwargs["extra_body"] = {"temperature": params.temperature}
         if params.stop_sequences is not None:
             kwargs["stop_sequences"] = params.stop_sequences
         if anthropic_tools is not None:

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/experimental/transforms/code_mode.py

@@ -108,8 +108,8 @@ _DEFAULT_LIMITS: "ResourceLimits" = {
     "max_memory": 100_000_000,  # 100 MB
 }
 """Baseline limits applied when ``MontySandboxProvider`` is constructed
-without an explicit ``limits`` argument. Pass ``limits=None`` to opt out
-entirely, or a dict to override."""
+without an explicit ``limits`` argument. Pass ``limits=None`` to disable
+configurable time, memory, and GC limits, or a dict to override."""
 
 
 class MontySandboxProvider:
@@ -117,16 +117,19 @@ class MontySandboxProvider:
 
     Args:
         limits: Resource limits for sandbox execution. Supported keys:
-            ``max_duration_secs`` (float), ``max_allocations`` (int),
-            ``max_memory`` (int), ``max_recursion_depth`` (int),
-            ``gc_interval`` (int).  All are optional; omit a key to
-            leave that limit uncapped.
+            `max_duration_secs` (float), `max_memory` (int),
+            `max_recursion_depth` (int), and `gc_interval` (int).
+            Time, memory, and GC limits are optional; omit a key to disable
+            it. Recursion depth defaults to Monty's standard maximum of 1,000.
+            Unsupported keys raise `ValueError` rather than being silently
+            ignored.
 
             When the argument is omitted entirely, a conservative baseline
             is applied (``max_duration_secs=30``, ``max_memory=100 MB``) so
             the out-of-box configuration is not unbounded. Pass
-            ``limits=None`` to explicitly run without any limits, or a dict
-            to set your own.
+            ``limits=None`` to disable configurable time, memory, and GC
+            limits, or a dict to set your own. Monty's standard recursion
+            limit still applies.
     """
 
     def __init__(
@@ -156,6 +159,17 @@ class MontySandboxProvider:
                 "Install it with `fastmcp[code-mode]` or pass a custom SandboxProvider."
             ) from exc
 
+        if self.limits is not None:
+            supported_limits = pydantic_monty.ResourceLimits.__annotations__.keys()
+            unsupported_limits = self.limits.keys() - supported_limits
+            if unsupported_limits:
+                unsupported = ", ".join(repr(key) for key in sorted(unsupported_limits))
+                supported = ", ".join(sorted(supported_limits))
+                raise ValueError(
+                    f"Unsupported Monty resource limits: {unsupported}. "
+                    f"Supported limits: {supported}."
+                )
+
         # Monty currently leaves Python callbacks running when a sandbox exits:
         # https://github.com/pydantic/monty/issues/821
         # Keep their tasks alive and join them before leaving this execution.
@@ -184,10 +198,10 @@ class MontySandboxProvider:
             key: track(value) for key, value in (external_functions or {}).items()
         }
 
-        monty = pydantic_monty.Monty(code, inputs=list(inputs))
         future = asyncio.ensure_future(
             self._run_monty(
-                monty,
+                pydantic_monty,
+                code=code,
                 inputs=inputs or None,
                 external_functions=async_functions or None,
             )
@@ -195,10 +209,10 @@ class MontySandboxProvider:
         try:
             return await future
         except asyncio.CancelledError:
-            # Awaiting alone does not stop the native sandbox thread when the
+            # Awaiting alone does not stop the sandbox worker when the
             # surrounding task is cancelled (e.g. an HTTP client disconnects
             # mid-execution). Explicitly cancel so the Monty runtime tears the
-            # thread down instead of leaving it running to completion.
+            # worker down instead of leaving it running to completion.
             future.cancel()
             raise
         finally:
@@ -210,23 +224,28 @@ class MontySandboxProvider:
             with anyio.CancelScope(shield=True):
                 await asyncio.gather(*tasks, return_exceptions=True)
 
-    def _run_monty(
+    async def _run_monty(
         self,
-        monty: Any,
+        pydantic_monty: Any,
         *,
+        code: str,
         inputs: dict[str, Any] | None,
         external_functions: dict[str, Callable[..., Any]] | None,
     ) -> Any:
-        """Launch the sandbox and return its awaitable.
+        """Run code in an isolated sandbox session.
 
         Isolated so the cancellation handling in `run()` can be exercised
         without a live `pydantic-monty` runtime.
         """
-        return monty.run_async(
-            inputs=inputs,
-            external_functions=external_functions,
-            limits=self.limits,
-        )
+        async with (
+            pydantic_monty.AsyncMonty() as pool,
+            pool.checkout(limits=self.limits) as session,
+        ):
+            return await session.feed_run(
+                code,
+                inputs=inputs,
+                external_lookup=external_functions,
+            )
 
 
 # ---------------------------------------------------------------------------

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/server/auth/oauth_proxy/proxy.py

@@ -1313,6 +1313,15 @@ class OAuthProxy(OAuthProvider, ConsentMixin):
         # Get stored upstream tokens
         idp_tokens = code_model.idp_tokens
 
+        # A non-positive lifetime means the upstream access token is already
+        # unusable. Reject it as an OAuth error before consuming our one-time
+        # authorization code instead of passing an invalid TTL to storage.
+        if "expires_in" in idp_tokens and int(idp_tokens["expires_in"]) <= 0:
+            raise TokenError(
+                "invalid_grant",
+                "Upstream access token has a non-positive expires_in",
+            )
+
         # Use IdP-granted scopes when available (RFC 6749 §5.1: the IdP MUST
         # include a scope parameter when the granted scope differs from the
         # requested scope).  Fall back to requested scopes only when the IdP
@@ -1820,6 +1829,14 @@ class OAuthProxy(OAuthProvider, ConsentMixin):
             logger.error("Upstream token refresh failed: %s", e)
             raise TokenError("invalid_grant", f"Upstream refresh failed: {e}") from e
 
+        # A refresh response with a non-positive lifetime is equally unusable.
+        # Reject it before mutating stored upstream state or rotating JTI mappings.
+        if "expires_in" in token_response and int(token_response["expires_in"]) <= 0:
+            raise TokenError(
+                "invalid_grant",
+                "Upstream access token has a non-positive expires_in",
+            )
+
         # Update stored upstream token
         # In refresh flow, we know there's a refresh token, so default to 1 hour
         # (user override still applies if set)
@@ -2157,6 +2174,12 @@ class OAuthProxy(OAuthProvider, ConsentMixin):
             # swap for. Return directly from the verified claims, unless the
             # token was revoked (tracked by jti until natural expiry).
             if payload.get("fastmcp_grant") == _ID_JAG_GRANT_MARKER:
+                if self._identity_assertion is None:
+                    logger.warning(
+                        "Rejected ID-JAG token: identity assertion is not configured (jti=%s)",
+                        jti[:16],
+                    )
+                    return None
                 if jti in self._revoked_id_jag_jtis:
                     logger.info("Rejected revoked ID-JAG access token jti=%s", jti[:16])
                     return None

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/server/lifespan.py

@@ -44,9 +44,9 @@ To compose with existing `@asynccontextmanager` lifespans, wrap them explicitly:
 
 from __future__ import annotations
 
-from collections.abc import AsyncIterator, Callable
+from collections.abc import AsyncGenerator, AsyncIterator, Callable
 from contextlib import AbstractAsyncContextManager, asynccontextmanager
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, cast
 
 if TYPE_CHECKING:
     from ha_mcp._vendor.fastmcp.server.server import FastMCP
@@ -84,7 +84,11 @@ class Lifespan:
         Yields:
             The lifespan context dict.
         """
-        async with asynccontextmanager(self._fn)(server) as result:
+        generator_fn = cast(
+            Callable[["FastMCP[Any]"], AsyncGenerator[dict[str, Any] | None]],
+            self._fn,
+        )
+        async with asynccontextmanager(generator_fn)(server) as result:
             yield result if result is not None else {}
 
     def __or__(self, other: Lifespan) -> ComposedLifespan:

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/server/providers/local_provider/local_provider.py

@@ -453,7 +453,31 @@ class LocalProvider(
         This includes both FunctionTool/Resource/Prompt instances created via
         decorators and custom Tool/Resource/Prompt subclasses.
         """
-        return [c for c in self._components.values() if c.task_config.supports_tasks()]
+        components = list(self._components.values())
+
+        # Separate by component type for transform application
+        tools = [c for c in components if isinstance(c, Tool)]
+        resources = [c for c in components if isinstance(c, Resource)]
+        templates = [c for c in components if isinstance(c, ResourceTemplate)]
+        prompts = [c for c in components if isinstance(c, Prompt)]
+
+        # Apply this provider's transforms sequentially
+        for transform in self.transforms:
+            tools = await transform.list_tools(tools)
+            resources = await transform.list_resources(resources)
+            templates = await transform.list_resource_templates(templates)
+            prompts = await transform.list_prompts(prompts)
+
+        return [
+            c
+            for c in [
+                *tools,
+                *resources,
+                *templates,
+                *prompts,
+            ]
+            if c.task_config.supports_tasks()
+        ]
 
     # =========================================================================
     # Decorator methods

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/server/providers/skills/_common.py

@@ -8,6 +8,8 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
+import yaml
+
 
 @dataclass
 class SkillFileInfo:
@@ -30,14 +32,61 @@ class SkillInfo:
     frontmatter: dict[str, Any] = field(default_factory=dict)
 
 
+def _parse_frontmatter_line_based(frontmatter_text: str) -> dict[str, Any]:
+    """Legacy line-based frontmatter parser (key: value only).
+
+    Used as a fallback when full YAML parsing fails so plain scalar keys
+    (including values that contain `: `) are not discarded entirely.
+    Multiline YAML block scalars (`|` / `>`) are not supported here —
+    those require a successful `yaml.safe_load`.
+    """
+    frontmatter: dict[str, Any] = {}
+    for line in frontmatter_text.strip().split("\n"):
+        if ":" not in line:
+            continue
+        key, _, value = line.partition(":")
+        key = key.strip()
+        value = value.strip()
+
+        # Handle quoted strings
+        if (value.startswith('"') and value.endswith('"')) or (
+            value.startswith("'") and value.endswith("'")
+        ):
+            value = value[1:-1]
+
+        # Handle lists [a, b, c]
+        if value.startswith("[") and value.endswith("]"):
+            items = value[1:-1].split(",")
+            value = [item.strip().strip("\"'") for item in items if item.strip()]
+
+        frontmatter[key] = value
+    return frontmatter
+
+
 def parse_frontmatter(content: str) -> tuple[dict[str, Any], str]:
     """Parse YAML frontmatter from markdown content.
 
+    Uses `yaml.BaseLoader` so multiline block scalars (`|` / `>`) work while
+    every scalar value is returned as a plain string. `SkillInfo.frontmatter`
+    is a public mapping; letting a full loader (e.g. `safe_load`) apply
+    implicit scalar typing would silently turn `version: 1.10` into the float
+    `1.1`, `enabled: yes` into `True`, or a date-like value into
+    `datetime.date` for every skill author, which is a backwards-incompatible
+    surprise rather than an internal detail. `BaseLoader` has no such
+    constructors, so values round-trip as written. If YAML parsing fails
+    (invalid YAML, recursion limit, etc.), falls back to a line-based
+    key:value parser so plain frontmatter is not discarded.
+
     Args:
         content: Markdown content potentially starting with ---
 
     Returns:
-        Tuple of (frontmatter dict, remaining content)
+        Tuple of (frontmatter dict, remaining content). If no frontmatter
+        block is found at all (no opening/closing `---` delimiters),
+        returns `({}, content)` unchanged. If a delimited block is found
+        but is empty or does not parse to a YAML mapping (and the line-based
+        fallback also yields nothing), returns `({}, remaining)` with the
+        delimited block stripped.
     """
     content = content.removeprefix("\ufeff")
 
@@ -52,28 +101,16 @@ def parse_frontmatter(content: str) -> tuple[dict[str, Any], str]:
     frontmatter_text = content[3 : 3 + end_match.start()]
     remaining = content[3 + end_match.end() :]
 
-    # Parse YAML (simple key: value parsing, no complex types)
-    frontmatter: dict[str, Any] = {}
-    for line in frontmatter_text.strip().split("\n"):
-        if ":" in line:
-            key, _, value = line.partition(":")
-            key = key.strip()
-            value = value.strip()
-
-            # Handle quoted strings
-            if (value.startswith('"') and value.endswith('"')) or (
-                value.startswith("'") and value.endswith("'")
-            ):
-                value = value[1:-1]
-
-            # Handle lists [a, b, c]
-            if value.startswith("[") and value.endswith("]"):
-                items = value[1:-1].split(",")
-                value = [item.strip().strip("\"'") for item in items if item.strip()]
+    try:
+        parsed = yaml.load(frontmatter_text, Loader=yaml.BaseLoader)
+    except (yaml.YAMLError, RecursionError):
+        # Prefer partial recovery over discarding every key (issue #4416 review).
+        return _parse_frontmatter_line_based(frontmatter_text), remaining
 
-            frontmatter[key] = value
+    if not isinstance(parsed, dict):
+        return {}, remaining
 
-    return frontmatter, remaining
+    return parsed, remaining
 
 
 def compute_file_hash(path: Path) -> str:

{ha_mcp_dev-8.5.0.dev2799 → ha_mcp_dev-8.5.0.dev2801}/src/ha_mcp/_vendor/fastmcp/server/server.py

@@ -16,7 +16,16 @@ from contextlib import (
 )
 from functools import partial
 from pathlib import Path
-from typing import TYPE_CHECKING, Any, Generic, Literal, TypeVar, cast, overload
+from typing import (
+    TYPE_CHECKING,
+    Any,
+    Generic,
+    Literal,
+    TypeVar,
+    cast,
+    get_args,
+    overload,
+)
 
 import httpx2
 from ha_mcp._vendor import mcp_types
@@ -31,6 +40,7 @@ from ha_mcp._vendor.mcp_types import (
 from ha_mcp._vendor.mcp_types.jsonrpc import MISSING_REQUIRED_CLIENT_CAPABILITY
 from pydantic import AnyUrl
 from pydantic import ValidationError as PydanticValidationError
+from pydantic_core import ErrorType
 from starlette.routing import BaseRoute
 from typing_extensions import Self
 
@@ -112,6 +122,21 @@ if TYPE_CHECKING:
 
 logger = get_logger(__name__.removeprefix("ha_mcp._vendor."))
 
+_BUILTIN_VALIDATION_ERROR_TYPES = frozenset(get_args(ErrorType))
+
+
+def _validation_error_summary(error: PydanticValidationError) -> dict[str, Any]:
+    """Keep counts and built-in codes, never input-derived validation details."""
+    error_types = {
+        detail["type"]
+        if detail["type"] in _BUILTIN_VALIDATION_ERROR_TYPES
+        else "custom_error"
+        for detail in error.errors(
+            include_url=False, include_context=False, include_input=False
+        )
+    }
+    return {"error_count": error.error_count(), "error_types": sorted(error_types)}
+
 
 def _version_request_meta(
     version: VersionSpec | None,
@@ -1491,18 +1516,15 @@ class FastMCP(
                 try:
                     return await tool._run(arguments or {})
                 except ValidationError as e:
-                    # Argument-validation failure (a bad call). FunctionTool
-                    # converts pydantic's call-validation error into fastmcp's
-                    # ValidationError (see #4128) so it can be filtered as a
-                    # client error. Log the underlying detail without a URL or
-                    # traceback, matching the previous pydantic-error logging.
                     cause = e.__cause__
-                    detail = (
-                        cause.errors(include_url=False)
-                        if isinstance(cause, PydanticValidationError)
-                        else str(e)
-                    )
-                    logger.warning("Invalid arguments for tool %r: %s", name, detail)
+                    if isinstance(cause, PydanticValidationError):
+                        logger.warning(
+                            "Invalid arguments for tool %r: %s",
+                            name,
+                            _validation_error_summary(cause),
+                        )
+                    else:
+                        logger.warning("Invalid arguments for tool %r", name)
                     raise
                 except FastMCPError as e:
                     logger.log(
@@ -1516,7 +1538,7 @@ class FastMCP(
                     logger.warning(
                         "Invalid arguments for tool %r: %s",
                         name,
-                        e.errors(include_url=False),
+                        _validation_error_summary(e),
                     )
                     raise
                 except Exception as e: