ha-mcp-dev 9.1.0.dev3255__tar.gz → 9.1.0.dev3257__tar.gz

{ha_mcp_dev-9.1.0.dev3255 → ha_mcp_dev-9.1.0.dev3257}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 9.1.0.dev3255
+Version: 9.1.0.dev3257
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Keywords: mcp,home-assistant,ai,automation,smart-home
 Author: Julien

{ha_mcp_dev-9.1.0.dev3255 → ha_mcp_dev-9.1.0.dev3257}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "9.1.0.dev3255"
+version = "9.1.0.dev3257"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.15"

{ha_mcp_dev-9.1.0.dev3255 → ha_mcp_dev-9.1.0.dev3257}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "9.1.0.dev3255"
+version = "9.1.0.dev3257"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-9.1.0.dev3255 → ha_mcp_dev-9.1.0.dev3257}/src/ha_mcp/utils/usage_logger.py

@@ -3,8 +3,11 @@ Usage logging for MCP tool calls to track usage patterns and performance metrics
 """
 
 import copy
+import errno
 import json
 import logging
+import os
+import stat
 import threading
 import time
 from collections import deque
@@ -18,6 +21,110 @@ from typing import Any
 
 from .data_paths import get_data_dir
 
+# The usage log records tool arguments and results, so it is created owner-only.
+_PRIVATE_FILE_MODE = 0o600
+
+# O_NOFOLLOW refuses a symlink planted at the log path. O_NONBLOCK keeps a
+# planted FIFO from hanging the writer thread on open and has no effect on a
+# regular file. A FIFO with no reader then fails the open with ENXIO; one that
+# has a reader opens, and the fstat check below refuses it.
+_PRIVATE_OPEN_FLAGS = getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0)
+
+# What open(path, "a") passes to its opener. The file is opened here, not by
+# open(), so an error from the open can be told apart from one from the write.
+_APPEND_FLAGS = os.O_WRONLY | os.O_CREAT | os.O_APPEND | getattr(os, "O_CLOEXEC", 0)
+
+# Open errors that say nothing about who controls the path: the logs directory
+# is gone for now, or the process or system is out of descriptors. The entry is
+# dropped and the next one tries again; every retry still goes through
+# O_NOFOLLOW and the fstat checks.
+_TRANSIENT_OPEN_ERRNOS = frozenset({errno.ENOENT, errno.EMFILE, errno.ENFILE})
+
+
+class UnsafeLogPathError(PermissionError):
+    """The log path is not a private file and directory owned by this process."""
+
+
+def _check_private_fd(fd: int) -> None:
+    """Raise ``UnsafeLogPathError`` unless ``fd`` is our own owner-only regular file.
+
+    Checked on the opened descriptor, not the path, so a file swapped in
+    between the directory check and the open is still caught.
+    """
+    st = os.fstat(fd)
+    if not stat.S_ISREG(st.st_mode):
+        raise UnsafeLogPathError("the usage log is not a regular file")
+    if not hasattr(os, "geteuid"):
+        return  # POSIX owner and mode bits do not apply on Windows.
+    if st.st_uid != os.geteuid():
+        raise UnsafeLogPathError("the usage log is owned by another user")
+    if st.st_nlink != 1:
+        raise UnsafeLogPathError("the usage log has another hard link")
+    if st.st_mode & (stat.S_IRWXG | stat.S_IRWXO):
+        raise UnsafeLogPathError("the usage log is accessible to other users")
+
+
+def _private_opener(path: str, flags: int) -> int:
+    """``open()`` opener: creates the file owner-only and opens only our own private file."""
+    try:
+        fd = os.open(path, flags | _PRIVATE_OPEN_FLAGS, _PRIVATE_FILE_MODE)
+    except OSError as e:
+        if e.errno == errno.ELOOP:
+            raise UnsafeLogPathError("the usage log path is a symlink") from e
+        raise
+    try:
+        _check_private_fd(fd)
+    except BaseException:
+        os.close(fd)
+        raise
+    return fd
+
+
+def _chmod_or_refuse(path: Path, mode: int) -> None:
+    try:
+        path.chmod(mode)
+    except OSError as e:
+        raise UnsafeLogPathError(
+            f"could not restrict {path} to its owner ({type(e).__name__}: {e})"
+        ) from e
+
+
+def _make_private_dir(path: Path) -> None:
+    """Refuse a log directory another user controls; drop group/other write from our own.
+
+    ``mkdir(mode=0o700)`` does not touch a directory that already exists, and
+    whoever can write to it can replace the log file.
+    """
+    if not hasattr(os, "geteuid"):
+        return  # POSIX owner and mode bits do not apply on Windows.
+    st = path.lstat()
+    if not stat.S_ISDIR(st.st_mode):
+        raise UnsafeLogPathError(f"{path} is not a directory")
+    if st.st_uid != os.geteuid():
+        raise UnsafeLogPathError(f"{path} is owned by another user")
+    if st.st_mode & (stat.S_IWGRP | stat.S_IWOTH):
+        _chmod_or_refuse(
+            path, stat.S_IMODE(st.st_mode) & ~(stat.S_IWGRP | stat.S_IWOTH)
+        )
+
+
+def _make_private(path: Path) -> None:
+    """Drop group/other access from a log file an older version created 0644.
+
+    A missing file is fine: the opener creates it owner-only. Any other
+    ``OSError`` propagates, so the caller stops writing to disk rather than
+    keep appending to a file that stays readable by others.
+    """
+    try:
+        mode = path.lstat().st_mode
+    except FileNotFoundError:
+        return
+    if not stat.S_ISREG(mode):
+        raise UnsafeLogPathError(f"{path} is not a regular file")
+    if mode & (stat.S_IRWXG | stat.S_IRWXO):
+        _chmod_or_refuse(path, _PRIVATE_FILE_MODE)
+
+
 logger = logging.getLogger(__name__)
 
 # Default ring buffer size - keeps last N entries in memory
@@ -302,7 +409,9 @@ class UsageLogger:
         log_file_path: str | None = None,
         ring_buffer_size: int = DEFAULT_RING_BUFFER_SIZE,
     ):
-        self._enabled = True
+        # Only the file is gated: the in-memory ring buffer never touches disk
+        # and ha_report_issue reads it, so it keeps working when the file is off.
+        self._disk_enabled = True
 
         if log_file_path:
             self.log_file_path = Path(log_file_path)
@@ -315,19 +424,32 @@ class UsageLogger:
             self.log_file_path = get_data_dir() / "logs" / "mcp_usage.jsonl"
 
         try:
-            self.log_file_path.parent.mkdir(parents=True, exist_ok=True)
+            self.log_file_path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
         except OSError as e:
             # Directory creation failed (e.g., read-only filesystem). Surface
             # the reason instead of silently dropping every log — operators
             # otherwise see an empty mcp_usage.jsonl with no clue why.
             logger.warning(
-                "Usage logging disabled — could not create %s (%s: %s). "
+                "Usage log file disabled — could not create %s (%s: %s). "
                 "Set HA_MCP_CONFIG_DIR to a writable path to enable persistence.",
                 self.log_file_path.parent,
                 type(e).__name__,
                 e,
             )
-            self._enabled = False
+            self._disk_enabled = False
+        else:
+            try:
+                _make_private_dir(self.log_file_path.parent)
+                _make_private(self.log_file_path)
+            except OSError as e:
+                logger.warning(
+                    "Usage log file disabled — %s is not private (%s: %s). "
+                    "Set HA_MCP_CONFIG_DIR to a directory only this user can write.",
+                    self.log_file_path,
+                    type(e).__name__,
+                    e,
+                )
+                self._disk_enabled = False
 
         # In-memory ring buffer for fast access to recent logs
         # Thread-safe: deque is thread-safe for append/pop operations
@@ -338,7 +460,7 @@ class UsageLogger:
         self._log_queue: Queue[ToolUsageLog] = Queue()
         self._logger_thread: threading.Thread | None = None
         self._stop_event = threading.Event()
-        if self._enabled:
+        if self._disk_enabled:
             self._start_logger_thread()
 
     def _start_logger_thread(self) -> None:
@@ -355,7 +477,12 @@ class UsageLogger:
                 # Wait for log entry with timeout to check stop event
                 if not self._log_queue.empty():
                     log_entry = self._log_queue.get(timeout=1.0)
-                    self._write_log_entry(log_entry)
+                    try:
+                        self._write_log_entry(log_entry)
+                    finally:
+                        # Lets a caller wait until the entry is written, not
+                        # only taken off the queue.
+                        self._log_queue.task_done()
                 else:
                     # Sleep briefly to avoid busy waiting
                     threading.Event().wait(0.1)
@@ -365,8 +492,42 @@ class UsageLogger:
 
     def _write_log_entry(self, log_entry: ToolUsageLog) -> None:
         """Write single log entry to disk."""
+        if not self._disk_enabled:
+            return
+        try:
+            fd = _private_opener(str(self.log_file_path), _APPEND_FLAGS)
+        except OSError as e:
+            if (
+                not isinstance(e, UnsafeLogPathError)
+                and e.errno in _TRANSIENT_OPEN_ERRNOS
+            ):
+                logger.debug(
+                    "Usage log entry dropped, %s could not be opened (%s); "
+                    "the next entry retries.",
+                    self.log_file_path,
+                    e,
+                )
+                return
+            # The path was swapped after startup for something we will not or
+            # cannot open (a link, a FIFO, a file of another user). Stop writing
+            # instead of dropping every entry silently or retrying a path someone
+            # else controls on every tool call.
+            self._disk_enabled = False
+            logger.warning(
+                "Usage log file disabled — could not open %s privately (%s: %s).",
+                self.log_file_path,
+                type(e).__name__,
+                e,
+            )
+            return
+        # Until open() returns a file object, nothing owns fd; close it here.
         try:
-            with open(self.log_file_path, "a", encoding="utf-8") as f:
+            f = open(fd, "a", encoding="utf-8")  # noqa: SIM115 - the with below owns it
+        except Exception:  # noqa: BLE001
+            os.close(fd)
+            return
+        try:
+            with f:
                 json.dump(asdict(log_entry), f, ensure_ascii=False)
                 f.write("\n")
         except Exception:  # noqa: BLE001
@@ -384,8 +545,6 @@ class UsageLogger:
         user_context: str | None = None,
     ) -> None:
         """Log tool usage (non-blocking)."""
-        if not self._enabled:
-            return
         try:
             # Mask secrets (alarm/lock codes, tokens, passwords) before the entry
             # reaches the ring buffer or disk. Returns a copy — never mutates the
@@ -407,8 +566,8 @@ class UsageLogger:
             with self._buffer_lock:
                 self._ring_buffer.append(entry_dict)
 
-            # Queue for disk write
-            self._log_queue.put(log_entry)
+            if self._disk_enabled:
+                self._log_queue.put(log_entry)
         except Exception:  # noqa: BLE001
             # Silent error handling to never break MCP server
             pass
@@ -489,8 +648,4 @@ def get_recent_logs(max_entries: int = 20) -> list[dict[str, Any]]:
     Returns:
         List of log entries as dictionaries, ordered newest to oldest
     """
-    logger = get_usage_logger()
-    if not logger._enabled:
-        return []
-
-    return logger.get_recent_entries(max_entries)
+    return get_usage_logger().get_recent_entries(max_entries)