ha-mcp-dev 8.6.0.dev2837__tar.gz → 8.6.0.dev2841__tar.gz

{ha_mcp_dev-8.6.0.dev2837 → ha_mcp_dev-8.6.0.dev2841}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.6.0.dev2837
+Version: 8.6.0.dev2841
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Keywords: mcp,home-assistant,ai,automation,smart-home
 Author: Julien

{ha_mcp_dev-8.6.0.dev2837 → ha_mcp_dev-8.6.0.dev2841}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.6.0.dev2837"
+version = "8.6.0.dev2841"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.15"
@@ -160,6 +160,7 @@ select = [
     "PLC0206",
     "PLC0207",
     "PLR0402",
+    "PLR0915",
     "PLR1711",
     "PLR1714",
     "PLR1730",

{ha_mcp_dev-8.6.0.dev2837 → ha_mcp_dev-8.6.0.dev2841}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.6.0.dev2837"
+version = "8.6.0.dev2841"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's
@@ -216,6 +216,7 @@ select = [
     "PLC0206", # dict-index-missing-items
     "PLC0207", # missing-maxsplit-arg
     "PLR0402", # manual-from-import
+    "PLR0915", # too-many-statements (default limit 50)
     "PLR1711", # useless-return
     "PLR1714", # repeated-equality-comparison
     "PLR1730", # if-stmt-min-max

ha_mcp_dev-8.6.0.dev2841/src/ha_mcp/policy/server_channels.py

@@ -0,0 +1,112 @@
+"""The approval-response channel's connections, opened as the server's client.
+
+``HomeAssistantSmartMCPServer._apply_tool_security_policies`` binds these to
+the server and hands them to ``ApprovalResponseListener``.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+
+async def approval_ws_client(server: Any) -> Any:
+    """Return a WebSocket client that authenticates as ``server.client``."""
+    # Imported at call time: the WebSocket stack is only needed once a
+    # gated call is actually announced, which may never happen.
+    from ..client.websocket_client import get_websocket_client
+
+    # Keyed to the credentials the announcement itself goes out
+    # with, the way ``HomeAssistantClient.send_websocket_message``
+    # does it. In OAuth mode ``server.client`` is a proxy resolving to
+    # the current request's client, while the global settings hold
+    # only the ``oauth-mode-token`` placeholder -- so an
+    # unparameterised call would authenticate the response
+    # subscription as nobody, and a request could be announced over
+    # REST on a channel that can never carry the answer back.
+    # Read once, and catch the miss explicitly: a per-attribute
+    # ``getattr`` with a default would swallow an AttributeError
+    # raised anywhere INSIDE the OAuth proxy's resolution, hand
+    # back None, and silently authenticate as the placeholder the
+    # whole change exists to avoid. Three separate reads would also
+    # be three separate resolutions, with nothing tying them to one
+    # client. A client with no credentials at all is the token
+    # deployments' normal case: pooled default connection.
+    client = server.client
+    url: str | None
+    token: str | None
+    verify_ssl: bool | None
+    try:
+        url = client.base_url
+        token = client.token
+        verify_ssl = client.verify_ssl
+    except AttributeError:
+        logger.debug(
+            "policy decisions: %s exposes no per-request credentials; "
+            "opening the approval-response channel on the pooled "
+            "default connection",
+            type(client).__name__,
+            exc_info=True,
+        )
+        url = token = verify_ssl = None
+    return await get_websocket_client(url=url, token=token, verify_ssl=verify_ssl)
+
+
+async def emit_approval_result_as(
+    server: Any,
+    token: str,
+    decision: str,
+    *,
+    applied: bool,
+    reason: str,
+    tool_name: str | None = None,
+) -> None:
+    from ..client.rest_client import HomeAssistantClient
+    from .events import emit_approval_result
+
+    # Credentials read the way ``approval_ws_client`` reads them,
+    # and for the same reason: this runs in a bus handler, not in a
+    # request, so in OAuth mode ``server.client`` resolves to nobody
+    # and the proxy raises rather than handing back a usable client.
+    # A fresh REST client over the snapshot keeps the result going
+    # out as the same identity the request was announced with.
+    client = server.client
+    url: str | None
+    token_value: str | None
+    verify_ssl: bool | None
+    known_is_admin: bool | None
+    admin_route_refused: bool
+    try:
+        url = client.base_url
+        token_value = client.token
+        verify_ssl = client.verify_ssl
+        known_is_admin = client.known_is_admin
+        admin_route_refused = client.admin_route_refused is True
+    except Exception:
+        logger.debug(
+            "policy decisions: no credentials for the result event; "
+            "the decision itself is unaffected",
+            exc_info=True,
+        )
+        return
+    # Owned here, so closed here: this client is built per event and
+    # carries its own httpx connection pool, which nothing else will
+    # ever reclaim. A wrong PIN retried by a chatty automation would
+    # otherwise open one per attempt.
+    async with HomeAssistantClient(
+        url,
+        token_value,
+        verify_ssl=verify_ssl,
+        is_admin=known_is_admin,
+        admin_route_refused=admin_route_refused,
+    ) as result_client:
+        await emit_approval_result(
+            result_client,
+            token,
+            decision,
+            applied=applied,
+            reason=reason,
+            tool_name=tool_name,
+        )

{ha_mcp_dev-8.6.0.dev2837 → ha_mcp_dev-8.6.0.dev2841}/src/ha_mcp/server.py

@@ -10,6 +10,7 @@ Implements lazy initialization pattern for improved startup time:
 from __future__ import annotations
 
 import logging
+from functools import partial
 from pathlib import Path
 from typing import TYPE_CHECKING, Annotated, Any, ClassVar
 
@@ -1311,6 +1312,10 @@ class HomeAssistantSmartMCPServer:
             from .policy.middleware import PolicyMiddleware
             from .policy.model import Policy
             from .policy.persistence import load_policy
+            from .policy.server_channels import (
+                approval_ws_client,
+                emit_approval_result_as,
+            )
             from .utils.data_paths import get_data_dir
         except ImportError:
             logger.exception(
@@ -1330,114 +1335,15 @@ class HomeAssistantSmartMCPServer:
             # roundtrip of a gated tool call.
             return load_policy(data_dir)
 
-        async def _approval_ws_client() -> Any:
-            # Imported at call time, like the rest of this block: the
-            # WebSocket stack is only needed once a gated call is actually
-            # announced, which may never happen.
-            from .client.websocket_client import get_websocket_client
-
-            # Keyed to the credentials the announcement itself goes out
-            # with, the way ``HomeAssistantClient.send_websocket_message``
-            # does it. In OAuth mode ``self.client`` is a proxy resolving to
-            # the current request's client, while the global settings hold
-            # only the ``oauth-mode-token`` placeholder -- so an
-            # unparameterised call would authenticate the response
-            # subscription as nobody, and a request could be announced over
-            # REST on a channel that can never carry the answer back.
-            # Read once, and catch the miss explicitly: a per-attribute
-            # ``getattr`` with a default would swallow an AttributeError
-            # raised anywhere INSIDE the OAuth proxy's resolution, hand
-            # back None, and silently authenticate as the placeholder the
-            # whole change exists to avoid. Three separate reads would also
-            # be three separate resolutions, with nothing tying them to one
-            # client. A client with no credentials at all is the token
-            # deployments' normal case: pooled default connection.
-            client = self.client
-            url: str | None
-            token: str | None
-            verify_ssl: bool | None
-            try:
-                url = client.base_url
-                token = client.token
-                verify_ssl = client.verify_ssl
-            except AttributeError:
-                logger.debug(
-                    "policy decisions: %s exposes no per-request credentials; "
-                    "opening the approval-response channel on the pooled "
-                    "default connection",
-                    type(client).__name__,
-                    exc_info=True,
-                )
-                url = token = verify_ssl = None
-            return await get_websocket_client(
-                url=url, token=token, verify_ssl=verify_ssl
-            )
-
         # Reads the same policy file as the middleware, so the toggle that
         # opens this channel is the one the user flips in the settings UI,
         # with no restart in between.
-        async def _emit_approval_result(
-            token: str,
-            decision: str,
-            *,
-            applied: bool,
-            reason: str,
-            tool_name: str | None = None,
-        ) -> None:
-            from .client.rest_client import HomeAssistantClient
-            from .policy.events import emit_approval_result
-
-            # Credentials read the way ``_approval_ws_client`` reads them,
-            # and for the same reason: this runs in a bus handler, not in a
-            # request, so in OAuth mode ``self.client`` resolves to nobody
-            # and the proxy raises rather than handing back a usable client.
-            # A fresh REST client over the snapshot keeps the result going
-            # out as the same identity the request was announced with.
-            client = self.client
-            url: str | None
-            token_value: str | None
-            verify_ssl: bool | None
-            known_is_admin: bool | None
-            admin_route_refused: bool
-            try:
-                url = client.base_url
-                token_value = client.token
-                verify_ssl = client.verify_ssl
-                known_is_admin = client.known_is_admin
-                admin_route_refused = client.admin_route_refused is True
-            except Exception:
-                logger.debug(
-                    "policy decisions: no credentials for the result event; "
-                    "the decision itself is unaffected",
-                    exc_info=True,
-                )
-                return
-            # Owned here, so closed here: this client is built per event and
-            # carries its own httpx connection pool, which nothing else will
-            # ever reclaim. A wrong PIN retried by a chatty automation would
-            # otherwise open one per attempt.
-            async with HomeAssistantClient(
-                url,
-                token_value,
-                verify_ssl=verify_ssl,
-                is_admin=known_is_admin,
-                admin_route_refused=admin_route_refused,
-            ) as result_client:
-                await emit_approval_result(
-                    result_client,
-                    token,
-                    decision,
-                    applied=applied,
-                    reason=reason,
-                    tool_name=tool_name,
-                )
-
         self.approval_response_listener = ApprovalResponseListener(
             policy_provider=_policy_provider,
             queue=self.approval_queue,
             data_dir=data_dir,
-            get_ws_client=_approval_ws_client,
-            emit_result=_emit_approval_result,
+            get_ws_client=partial(approval_ws_client, self),
+            emit_result=partial(emit_approval_result_as, self),
         )
 
         try:

{ha_mcp_dev-8.6.0.dev2837 → ha_mcp_dev-8.6.0.dev2841}/src/ha_mcp/tools/bulk_selector.py

@@ -654,6 +654,33 @@ async def _load_hidden_entities(
     return visibility_hidden | registry_hidden, warnings
 
 
+def _build_operation_common(
+    action: str,
+    parameters: dict[str, Any] | None,
+    timeout_seconds: float | None,
+    validate_first: bool,
+) -> dict[str, Any]:
+    """Build the fields every resolved operation row shares."""
+    operation_common: dict[str, Any] = {
+        "action": action,
+        "validate_first": validate_first,
+    }
+    if parameters is not None:
+        # Deep copy, not the caller's own object by reference (and not a
+        # shallow `dict(...)`, which stops only top-level rebinding and
+        # still shares nested values like an `rgb_color` list): the
+        # per-row copy in BulkSelectorResolution.operations protects each
+        # DISPATCH row from cross-row mutation, but does nothing about the
+        # resolution's own stored copy -- without this, a caller that
+        # still holds `parameters` and mutates it (at any depth) after
+        # this call returns would silently rewrite the "frozen"
+        # resolution's own payload too.
+        operation_common["parameters"] = copy.deepcopy(parameters)
+    if timeout_seconds is not None:
+        operation_common["timeout_seconds"] = timeout_seconds
+    return operation_common
+
+
 async def resolve_bulk_selector(
     client: HomeAssistantClient,
     selector: Mapping[str, Any],
@@ -825,23 +852,9 @@ async def resolve_bulk_selector(
             f"The selector resolved to {len(resolved_entity_ids)} entities; "
             f"the maximum is {MAX_SELECTOR_ENTITIES}"
         )
-    operation_common: dict[str, Any] = {
-        "action": action,
-        "validate_first": validate_first,
-    }
-    if parameters is not None:
-        # Deep copy, not the caller's own object by reference (and not a
-        # shallow `dict(...)`, which stops only top-level rebinding and
-        # still shares nested values like an `rgb_color` list): the
-        # per-row copy in BulkSelectorResolution.operations protects each
-        # DISPATCH row from cross-row mutation, but does nothing about the
-        # resolution's own stored copy -- without this, a caller that
-        # still holds `parameters` and mutates it (at any depth) after
-        # this call returns would silently rewrite the "frozen"
-        # resolution's own payload too.
-        operation_common["parameters"] = copy.deepcopy(parameters)
-    if timeout_seconds is not None:
-        operation_common["timeout_seconds"] = timeout_seconds
+    operation_common = _build_operation_common(
+        action, parameters, timeout_seconds, validate_first
+    )
     excluded_and_hidden = effective_excluded & hidden
     hidden_count = len(directly_hidden | hidden_selected | excluded_and_hidden)
     warnings: list[str] = list(visibility_warnings)

{ha_mcp_dev-8.6.0.dev2837 → ha_mcp_dev-8.6.0.dev2841}/src/ha_mcp/tools/smart_search/_deep.py

@@ -100,6 +100,15 @@ def _is_no_stored_config(resp: dict[str, Any]) -> bool:
     return get_error_message(resp) in _NO_STORED_CONFIG_MESSAGES
 
 
+async def _phase_finished(
+    ctx: Context | None, phase_done: int, total_phases: int, message: str
+) -> int:
+    """Report one more finished search phase and return the new count."""
+    phase_done += 1
+    await safe_progress(ctx, progress=phase_done, total=total_phases, message=message)
+    return phase_done
+
+
 class DeepSearchMixin(SceneSearchMixin):
     """deep_search orchestration + per-type automation/script/helper/dashboard/flow search."""
 
@@ -224,9 +233,6 @@ class DeepSearchMixin(SceneSearchMixin):
             # to key reference-graph scene hits by storage id rather than slug.
             scene_storage_ids: dict[str, str] = {}
             graph_buckets = related.buckets if related else {}
-            graph_automations = graph_buckets.get("automations", set())
-            graph_scripts = graph_buckets.get("scripts", set())
-            graph_scenes = graph_buckets.get("scenes", set())
 
             # Create semaphore for limiting concurrent API calls
             semaphore = asyncio.Semaphore(concurrency_limit)
@@ -251,18 +257,13 @@ class DeepSearchMixin(SceneSearchMixin):
             # ``_skipped`` = budget exhausted before fetch; ``_failed`` =
             # fetch attempted but raised (caught at ``debug``-level);
             # ``_timeout`` = fetch exceeded the per-request timeout (#1784).
-            automation_skipped = 0
-            automation_failed = 0
-            automation_yaml_skipped = 0
-            automation_timeout = 0
+            automation_skipped = automation_failed = 0
+            automation_yaml_skipped = automation_timeout = 0
             automation_failed_sample: str | None = None
-            script_skipped = 0
-            script_failed = 0
-            script_yaml_skipped = 0
-            script_timeout = 0
+            script_skipped = script_failed = 0
+            script_yaml_skipped = script_timeout = 0
             script_failed_sample: str | None = None
-            helper_failed = 0
-            dashboard_failed = 0
+            helper_failed = dashboard_failed = 0
 
             if "automation" in search_types:
                 (
@@ -278,14 +279,13 @@ class DeepSearchMixin(SceneSearchMixin):
                     query_lower,
                     exact_match,
                     config_time_budget=config_time_budget,
-                    graph_entity_ids=graph_automations,
+                    graph_entity_ids=graph_buckets.get("automations", set()),
                 )
-                phase_done += 1
-                await safe_progress(
+                phase_done = await _phase_finished(
                     ctx,
-                    progress=phase_done,
-                    total=total_phases,
-                    message=f"automations searched ({len(results['automations'])} matches)",
+                    phase_done,
+                    total_phases,
+                    f"automations searched ({len(results['automations'])} matches)",
                 )
 
             if "script" in search_types:
@@ -301,14 +301,13 @@ class DeepSearchMixin(SceneSearchMixin):
                     query_lower,
                     exact_match,
                     config_time_budget=config_time_budget,
-                    graph_entity_ids=graph_scripts,
+                    graph_entity_ids=graph_buckets.get("scripts", set()),
                 )
-                phase_done += 1
-                await safe_progress(
+                phase_done = await _phase_finished(
                     ctx,
-                    progress=phase_done,
-                    total=total_phases,
-                    message=f"scripts searched ({len(results['scripts'])} matches)",
+                    phase_done,
+                    total_phases,
+                    f"scripts searched ({len(results['scripts'])} matches)",
                 )
 
             if "scene" in search_types:
@@ -328,14 +327,13 @@ class DeepSearchMixin(SceneSearchMixin):
                     config_time_budget=config_time_budget,
                     prefetched_registry=prefetched_registry,
                     storage_ids_out=scene_storage_ids,
-                    graph_entity_ids=graph_scenes,
+                    graph_entity_ids=graph_buckets.get("scenes", set()),
                 )
-                phase_done += 1
-                await safe_progress(
+                phase_done = await _phase_finished(
                     ctx,
-                    progress=phase_done,
-                    total=total_phases,
-                    message=f"scenes searched ({len(results['scenes'])} matches)",
+                    phase_done,
+                    total_phases,
+                    f"scenes searched ({len(results['scenes'])} matches)",
                 )
 
             if "helper" in search_types:
@@ -349,12 +347,11 @@ class DeepSearchMixin(SceneSearchMixin):
                     include_config,
                     prefetched_registry=prefetched_registry,
                 )
-                phase_done += 1
-                await safe_progress(
+                phase_done = await _phase_finished(
                     ctx,
-                    progress=phase_done,
-                    total=total_phases,
-                    message=f"helpers searched ({len(results['helpers'])} matches)",
+                    phase_done,
+                    total_phases,
+                    f"helpers searched ({len(results['helpers'])} matches)",
                 )
 
             if "dashboard" in search_types:
@@ -367,12 +364,11 @@ class DeepSearchMixin(SceneSearchMixin):
                     semaphore,
                     include_config=include_config,
                 )
-                phase_done += 1
-                await safe_progress(
+                await _phase_finished(
                     ctx,
-                    progress=phase_done,
-                    total=total_phases,
-                    message=f"dashboards searched ({len(results['dashboards'])} matches)",
+                    phase_done,
+                    total_phases,
+                    f"dashboards searched ({len(results['dashboards'])} matches)",
                 )
 
             graph_surfaces_skipped = _merge_graph_hits(

{ha_mcp_dev-8.6.0.dev2837 → ha_mcp_dev-8.6.0.dev2841}/src/ha_mcp/tools/tools_bug_report.py

@@ -1054,6 +1054,33 @@ class BugReportTools:
             "host_os": str(info.get("operating_system") or "unknown"),
         }
 
+    async def _add_home_assistant_info(self, diagnostic_info: dict[str, Any]) -> None:
+        """Fill in connection status, HA config and entity count; never raises."""
+        try:
+            config = await self._client.get_config()
+            diagnostic_info["connection_status"] = "Connected"
+            diagnostic_info["home_assistant_version"] = config.get("version", "Unknown")
+            diagnostic_info["location_name"] = config.get("location_name", "Unknown")
+            diagnostic_info["time_zone"] = config.get("time_zone", "Unknown")
+            # Only a supervised install loads the hassio integration. Probing
+            # without it only produces an "Unknown command" error.
+            if "hassio" in config.get("components", []):
+                diagnostic_info["supervisor"] = await self._detect_supervisor_info()
+            else:
+                diagnostic_info["supervisor"] = {"none": "true"}
+        except Exception as e:  # noqa: BLE001
+            logger.warning(f"Failed to get Home Assistant config: {e}")
+            diagnostic_info["connection_status"] = (
+                f"Connection Error: {_sanitize_log_text(str(e))}"
+            )
+
+        try:
+            states = await self._client.get_states()
+            if states:
+                diagnostic_info["entity_count"] = len(states)
+        except Exception as e:  # noqa: BLE001
+            logger.warning(f"Failed to get entity count: {e}")
+
     @tool(
         name="ha_report_issue",
         tags={"Utilities"},
@@ -1268,32 +1295,7 @@ class BugReportTools:
             "entity_count": 0,
         }
 
-        # Try to get Home Assistant config and connection status
-        try:
-            config = await self._client.get_config()
-            diagnostic_info["connection_status"] = "Connected"
-            diagnostic_info["home_assistant_version"] = config.get("version", "Unknown")
-            diagnostic_info["location_name"] = config.get("location_name", "Unknown")
-            diagnostic_info["time_zone"] = config.get("time_zone", "Unknown")
-            # Only a supervised install loads the hassio integration. Probing
-            # without it only produces an "Unknown command" error.
-            if "hassio" in config.get("components", []):
-                diagnostic_info["supervisor"] = await self._detect_supervisor_info()
-            else:
-                diagnostic_info["supervisor"] = {"none": "true"}
-        except Exception as e:  # noqa: BLE001
-            logger.warning(f"Failed to get Home Assistant config: {e}")
-            diagnostic_info["connection_status"] = (
-                f"Connection Error: {_sanitize_log_text(str(e))}"
-            )
-
-        # Try to get entity count
-        try:
-            states = await self._client.get_states()
-            if states:
-                diagnostic_info["entity_count"] = len(states)
-        except Exception as e:  # noqa: BLE001
-            logger.warning(f"Failed to get entity count: {e}")
+        await self._add_home_assistant_info(diagnostic_info)
 
         # Calculate how many log entries to retrieve
         # Formula: AVG_LOG_ENTRIES_PER_TOOL * 4 * tool_call_count (doubled from 2x to 4x)
@@ -1365,9 +1367,6 @@ class BugReportTools:
             issue_title, lambda cap: build_body(include_logs=False, text_cap=cap)
         )
 
-        # Anonymization instructions
-        anonymization_guide = _generate_anonymization_guide()
-
         # Generate search keywords and URLs for duplicate check
         search_keywords = _generate_search_keywords(diagnostic_info, recent_logs)
         duplicate_check_urls = [
@@ -1400,7 +1399,7 @@ class BugReportTools:
             "issue_title": issue_title,
             "issue_body": issue_body,
             "issue_url": issue_url,
-            "anonymization_guide": anonymization_guide,
+            "anonymization_guide": _generate_anonymization_guide(),
             "duplicate_check_urls": duplicate_check_urls,
             "missing_tool_hint": MISSING_TOOL_HINT,
             "known_client_issues_hint": KNOWN_CLIENT_ISSUES_HINT,