ha-mcp-dev 9.1.0.dev3261__tar.gz → 9.1.0.dev3267__tar.gz

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 9.1.0.dev3261
+Version: 9.1.0.dev3267
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Keywords: mcp,home-assistant,ai,automation,smart-home
 Author: Julien

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "9.1.0.dev3261"
+version = "9.1.0.dev3267"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.15"

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "9.1.0.dev3261"
+version = "9.1.0.dev3267"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/client/rest_client.py

@@ -1308,7 +1308,7 @@ class HomeAssistantClient:
     ) -> str:
         """Fetch app (add-on) container logs directly from Supervisor REST.
 
-        Distinct from ``tools_bug_report._fetch_addon_logs``: that auxiliary
+        Distinct from ``bug_report_sources._fetch_addon_logs``: that auxiliary
         helper uses the app self-service path ``/addons/self/logs`` and may skip
         failures. This helper takes arbitrary slugs and surfaces failures because
         callers (``ha_get_logs(source="supervisor", slug=...)``) need them.

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/az.json

@@ -883,7 +883,7 @@
     },
     "ha_remove_todo_item": {
       "title": "Tapşırığı çıxar",
-      "description": "Home Assistant tapşırıq siyahısından tapşırığı çıxarın."
+      "description": "Home Assistant-ın etməkli siyahısından elementləri silin."
     },
     "ha_remove_zone": {
       "title": "Zonanı çıxar",
@@ -919,7 +919,7 @@
     },
     "ha_set_todo_item": {
       "title": "Tapşırığı təyin et",
-      "description": "Home Assistant-da tapşırıq yaradın və ya yeniləyin."
+      "description": "Home Assistant-da etməkli siyahısı elementini yaradın, yeniləyin və ya yenidən sıralayın."
     },
     "ha_set_zone": {
       "title": "Zonanı təyin et",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/cs.json

@@ -852,7 +852,7 @@
     },
     "ha_remove_todo_item": {
       "title": "Odebrat položku úkolu",
-      "description": "Odebrat položku ze seznamu úkolů Home Assistant."
+      "description": "Odstranit položky z úkolového seznamu v Home Assistant."
     },
     "ha_remove_zone": {
       "title": "Odebrat zónu",
@@ -888,7 +888,7 @@
     },
     "ha_set_todo_item": {
       "title": "Nastavit položku úkolu",
-      "description": "Vytvořit nebo aktualizovat položku úkolu v Home Assistant."
+      "description": "Vytvořit, aktualizovat nebo změnit pořadí položky úkolu v Home Assistant."
     },
     "ha_set_zone": {
       "title": "Nastavit zónu",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/de.json

@@ -883,7 +883,7 @@
     },
     "ha_remove_todo_item": {
       "title": "To-do-Element entfernen",
-      "description": "Entfernt eine Aufgabe aus einer Home-Assistant-To-do-Liste."
+      "description": "Entferne Einträge aus einer Home Assistant-Todo-Liste."
     },
     "ha_remove_zone": {
       "title": "Zone entfernen",
@@ -919,7 +919,7 @@
     },
     "ha_set_todo_item": {
       "title": "To-do-Element erstellen/aktualisieren",
-      "description": "Erstellt oder aktualisiert eine Aufgabe in einer To-do-Liste."
+      "description": "Erstelle, aktualisiere oder sortiere einen Todo-Eintrag in Home Assistant neu."
     },
     "ha_set_zone": {
       "title": "Zone erstellen/aktualisieren",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/eo.json

@@ -852,7 +852,7 @@
     },
     "ha_remove_todo_item": {
       "title": "Forigi Farendaĵon",
-      "description": "Forigi eron el farendaĵa listo de Home Assistant."
+      "description": "Forigi erojn el taskolisto de Home Assistant."
     },
     "ha_remove_zone": {
       "title": "Forigi Zonon",
@@ -888,7 +888,7 @@
     },
     "ha_set_todo_item": {
       "title": "Agordi Farendaĵon",
-      "description": "Krei aŭ ĝisdatigi farendaĵon en Home Assistant."
+      "description": "Krei, ĝisdatigi aŭ reordigi taskeron en Home Assistant."
     },
     "ha_set_zone": {
       "title": "Agordi Zonon",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/es.json

@@ -883,7 +883,7 @@
     },
     "ha_remove_todo_item": {
       "title": "Eliminar tarea",
-      "description": "Elimina un elemento de una lista de tareas de Home Assistant."
+      "description": "Eliminar elementos de una lista de tareas pendientes de Home Assistant."
     },
     "ha_remove_zone": {
       "title": "Eliminar zona",
@@ -919,7 +919,7 @@
     },
     "ha_set_todo_item": {
       "title": "Definir tarea",
-      "description": "Crea o actualiza un elemento de una lista de tareas de Home Assistant."
+      "description": "Crear, actualizar o reordenar un elemento de una lista de tareas pendientes en Home Assistant."
     },
     "ha_set_zone": {
       "title": "Crear o actualizar zona",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/fr.json

@@ -883,7 +883,7 @@
     },
     "ha_remove_todo_item": {
       "title": "Supprimer un élément de tâche",
-      "description": "Supprime une tâche d'une liste de tâches Home Assistant."
+      "description": "Supprimer des éléments d'une liste de tâches Home Assistant."
     },
     "ha_remove_zone": {
       "title": "Supprimer la zone",
@@ -919,7 +919,7 @@
     },
     "ha_set_todo_item": {
       "title": "Créer/mettre à jour un élément de tâche",
-      "description": "Crée ou met à jour une tâche dans une liste de tâches."
+      "description": "Créer, mettre à jour ou réordonner un élément de liste de tâches dans Home Assistant."
     },
     "ha_set_zone": {
       "title": "Créer/mettre à jour la zone",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/it.json

@@ -883,7 +883,7 @@
     },
     "ha_remove_todo_item": {
       "title": "Rimuovi una voce dalle cose da fare",
-      "description": "Rimuove una voce da una lista delle cose da fare di Home Assistant."
+      "description": "Rimuovi elementi da un elenco di cose da fare di Home Assistant."
     },
     "ha_remove_zone": {
       "title": "Rimuovi una zona",
@@ -919,7 +919,7 @@
     },
     "ha_set_todo_item": {
       "title": "Imposta una voce delle cose da fare",
-      "description": "Crea o aggiorna una voce delle cose da fare in Home Assistant."
+      "description": "Crea, aggiorna o riordina un elemento di un elenco di cose da fare in Home Assistant."
     },
     "ha_set_zone": {
       "title": "Imposta una zona",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/ko.json

@@ -919,7 +919,7 @@
     },
     "ha_set_todo_item": {
       "title": "할 일 항목 설정",
-      "description": "Home Assistant에서 할 일 항목을 만들거나 수정합니다."
+      "description": "Home Assistant의 할 일 항목을 생성, 업데이트 또는 재정렬합니다."
     },
     "ha_set_zone": {
       "title": "구역 생성·수정",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/nl.json

@@ -852,7 +852,7 @@
     },
     "ha_remove_todo_item": {
       "title": "To-do Item Verwijderen",
-      "description": "Verwijder een item uit een Home Assistant to-do lijst."
+      "description": "Items verwijderen van een Home Assistant takenlijst."
     },
     "ha_remove_zone": {
       "title": "Zone Verwijderen",
@@ -888,7 +888,7 @@
     },
     "ha_set_todo_item": {
       "title": "To-do Item Instellen",
-      "description": "Maak een to-do item aan of werk deze bij in Home Assistant."
+      "description": "Een taak maken, bijwerken of herordenen in Home Assistant."
     },
     "ha_set_zone": {
       "title": "Zone Instellen",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/pl.json

@@ -852,7 +852,7 @@
     },
     "ha_remove_todo_item": {
       "title": "Usuń element listy zadań",
-      "description": "Usuń element z listy zadań Home Assistant."
+      "description": "Usuń pozycje z listy zadań Home Assistant."
     },
     "ha_remove_zone": {
       "title": "Usuń strefę",
@@ -888,7 +888,7 @@
     },
     "ha_set_todo_item": {
       "title": "Ustaw element listy zadań",
-      "description": "Utwórz lub zaktualizuj element listy zadań w Home Assistant."
+      "description": "Utwórz, zaktualizuj lub zmień kolejność pozycji na liście zadań w Home Assistant."
     },
     "ha_set_zone": {
       "title": "Ustaw strefę",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/ru.json

@@ -883,7 +883,7 @@
     },
     "ha_remove_todo_item": {
       "title": "Удалить задачу",
-      "description": "Удалить задачу из списка дел Home Assistant."
+      "description": "Удаление элементов из списка задач Home Assistant."
     },
     "ha_remove_zone": {
       "title": "Удалить зону",
@@ -919,7 +919,7 @@
     },
     "ha_set_todo_item": {
       "title": "Создать или изменить задачу",
-      "description": "Создать новую или обновить задачу в списке дел."
+      "description": "Создание, обновление или изменение порядка элементов списка задач в Home Assistant."
     },
     "ha_set_zone": {
       "title": "Создать или изменить зону",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/sv.json

@@ -852,7 +852,7 @@
     },
     "ha_remove_todo_item": {
       "title": "Ta bort att-göra-objekt",
-      "description": "Ta bort ett objekt från en Home Assistant-att-göra-lista."
+      "description": "Ta bort objekt från en att göra-lista i Home Assistant."
     },
     "ha_remove_zone": {
       "title": "Ta bort zon",
@@ -888,7 +888,7 @@
     },
     "ha_set_todo_item": {
       "title": "Ställ in att-göra-objekt",
-      "description": "Skapa eller uppdatera ett att-göra-objekt i Home Assistant."
+      "description": "Skapa, uppdatera eller ändra ordning på ett att göra-objekt i Home Assistant."
     },
     "ha_set_zone": {
       "title": "Ställ in zon",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/zh-Hans.json

@@ -883,7 +883,7 @@
     },
     "ha_remove_todo_item": {
       "title": "删除待办条目",
-      "description": "从 Home Assistant 待办清单中删除条目。"
+      "description": "从 Home Assistant 待办事项列表中删除项目。"
     },
     "ha_remove_zone": {
       "title": "删除区域",
@@ -919,7 +919,7 @@
     },
     "ha_set_todo_item": {
       "title": "设置待办条目",
-      "description": "在 Home Assistant 中创建或更新待办条目。"
+      "description": "在 Home Assistant 中创建、更新或重新排序待办事项。"
     },
     "ha_set_zone": {
       "title": "设置区域",

{ha_mcp_dev-9.1.0.dev3261 → ha_mcp_dev-9.1.0.dev3267}/src/ha_mcp/settings_ui/locales/zh-Hant.json

@@ -888,7 +888,7 @@
     },
     "ha_set_todo_item": {
       "title": "設定待辦事項",
-      "description": "在 Home Assistant 中建立或更新待辦事項。"
+      "description": "在 Home Assistant 中建立、更新或重新排序待辦事項項目。"
     },
     "ha_set_zone": {
       "title": "設定區域",

ha_mcp_dev-9.1.0.dev3267/src/ha_mcp/tools/bug_report_redaction.py

@@ -0,0 +1,243 @@
+"""Secret and identifier scrubbing for ha_report_issue output.
+
+Dependency-free on purpose: only the standard library, so the rules can be
+exercised in isolation.
+"""
+
+import ipaddress
+import os
+import re
+from collections.abc import Callable, Iterator
+from contextlib import contextmanager
+from contextvars import ContextVar
+from dataclasses import dataclass
+from functools import lru_cache
+
+
+@dataclass(frozen=True)
+class KnownIdentifiers:
+    """This instance's own hostnames and addresses, read from Home Assistant."""
+
+    hosts: frozenset[str] = frozenset()
+    addresses: frozenset[str] = frozenset()
+
+
+_NO_IDENTIFIERS = KnownIdentifiers()
+
+# A ContextVar rather than a parameter: the scrubber is called from a dozen
+# synchronous sites while one report is assembled.
+_known_identifiers: ContextVar[KnownIdentifiers] = ContextVar(
+    "bug_report_known_identifiers", default=_NO_IDENTIFIERS
+)
+
+
+@contextmanager
+def known_identifiers_scope(identifiers: KnownIdentifiers) -> Iterator[None]:
+    """Make ``_sanitize_log_text`` redact ``identifiers`` within the block."""
+    token = _known_identifiers.set(identifiers)
+    try:
+        yield
+    finally:
+        _known_identifiers.reset(token)
+
+
+# Two or more colon-separated hex groups, optionally ending in a dotted quad
+# (``::ffff:192.0.2.1``); ``hh:mm:ss`` and other non-addresses fail to parse in
+# the callback and are left alone. A preceding label colon (``address:``) is
+# allowed: the leftmost match always consumes a whole address, so a candidate
+# never starts inside a longer one.
+_IPV6_CANDIDATE_RE = re.compile(
+    r"(?<![\w.])(?:[0-9A-Fa-f]{0,4}:){2,7}"
+    r"(?:\d{1,3}(?:\.\d{1,3}){3}|[0-9A-Fa-f]{0,4})(?![\w:]|\.\d)"
+)
+
+
+def _parse_v6(value: str) -> ipaddress.IPv6Address | None:
+    try:
+        return ipaddress.IPv6Address(value)
+    except ValueError:
+        return None
+
+
+def _alternation(values: frozenset[str]) -> str:
+    # Longest first, so an alternative never stops short inside a longer one.
+    return "|".join(re.escape(v) for v in sorted(values, key=len, reverse=True))
+
+
+@lru_cache(maxsize=8)
+def _known_identifier_rules(
+    identifiers: KnownIdentifiers,
+) -> tuple[tuple[re.Pattern[str], str | Callable[[re.Match[str]], str]], ...]:
+    """Whole-token patterns: a known value never matches inside a longer
+    address or hostname, but does match before ``:port``, ``/``, a quote,
+    a bracket, a comma or a sentence-ending dot."""
+    rules: list[tuple[re.Pattern[str], str | Callable[[re.Match[str]], str]]] = []
+    ipv4 = frozenset(a for a in identifiers.addresses if ":" not in a)
+    ipv6 = identifiers.addresses - ipv4
+    if ipv4:
+        rules.append(
+            (
+                re.compile(rf"(?<![\w.-])(?:{_alternation(ipv4)})(?![\w-]|\.[\w-])"),
+                "[IP]",
+            )
+        )
+    if ipv6:
+        # An IPv6 address has many spellings (``::`` vs zero groups, leading
+        # zeros), so candidates are parsed and compared, not matched as text.
+        known_v6 = frozenset(_parse_v6(a) for a in ipv6) - {None}
+
+        def _redact_v6(match: re.Match[str]) -> str:
+            try:
+                parsed = ipaddress.IPv6Address(match.group(0))
+            except ValueError:
+                return match.group(0)
+            return "[IP]" if parsed in known_v6 else match.group(0)
+
+        if known_v6:
+            rules.append((_IPV6_CANDIDATE_RE, _redact_v6))
+    if identifiers.hosts:
+        rules.append(
+            (
+                re.compile(
+                    rf"(?<![\w.-])(?:{_alternation(identifiers.hosts)})(?![\w-]|\.[\w-])",
+                    re.IGNORECASE,
+                ),
+                "[HA_HOST]",
+            )
+        )
+    return tuple(rules)
+
+
+# IPv4 sanitization: only redact addresses with strong network context so that
+# four-segment version strings (e.g. "ha-mcp version 1.2.3.4") are preserved.
+_IPV4_OCTET = r"(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)"
+
+_IPV4 = rf"(?:{_IPV4_OCTET}\.){{3}}{_IPV4_OCTET}"
+
+# IP followed by :port or /CIDR — always a network address, never a version.
+_IPV4_WITH_PORT_OR_CIDR_RE = re.compile(rf"\b{_IPV4}(?::\d+|/\d{{1,2}})\b(?!\.\d)")
+
+# IP preceded by a network keyword (from, to, host=, host='...', addr=, etc.).
+_IPV4_AFTER_KEYWORD_RE = re.compile(
+    rf"\b((?:from|to|host|hostname|addr|address|ip|src|dst|server|client|peer|via)\b\s*[=:]?\s*['\"]?){_IPV4}\b(?!\.\d)",
+    re.IGNORECASE,
+)
+
+# IP appearing inside a URL (`scheme://1.2.3.4...`).
+_IPV4_IN_URL_RE = re.compile(rf"(://){_IPV4}\b(?!\.\d)")
+
+# Plex wildcard DNS puts the server address in ``1-2-3-4.<hex>.plex.direct``.
+_PLEX_DIRECT_DASHED_IPV4_RE = re.compile(
+    rf"\b(?:{_IPV4_OCTET}-){{3}}{_IPV4_OCTET}(?=\.[^\s.]+\.plex\.direct\b)",
+    re.IGNORECASE,
+)
+# Internal hostnames. A match starts only where a name starts, so a long dotted
+# run stays linear instead of being rescanned from every label.
+_LAN_HOST_RE = re.compile(
+    r"(?<![\w.-])(?:[A-Za-z0-9-]+\.)+lan(?![\w-]|\.[\w-])", re.IGNORECASE
+)
+_TAILNET_HOST_RE = re.compile(
+    r"(?<![\w.-])(?:[A-Za-z0-9-]+\.)+ts\.net(?![\w-]|\.[\w-])", re.IGNORECASE
+)
+# Microsoft Graph calendar ID in a URL path.
+_GRAPH_CALENDAR_ID_RE = re.compile(r"(/me/calendars/)[^/?#\s'\"]+", re.IGNORECASE)
+
+
+# URL userinfo, anchored on "://" rather than on the scheme: a match that began
+# at the scheme made every character of a long unbroken word a candidate start,
+# quadratic in its length (about a minute for a 200 kB base64 blob).
+_URL_USERINFO_RE = re.compile(r"(://)([^:/?#\s@]+):([^@/\s]+)@")
+
+
+def _sanitize_log_text(text: str) -> str:
+    """Best-effort secret scrubber for log text.
+
+    Defense-in-depth, not exhaustive — bug reports still pass through human
+    review (see ``_generate_anonymization_guide``). Rules cover the most common
+    leak shapes seen in HA add-on logs:
+    JWTs, bearer tokens, long hex tokens, ``key=value`` style credentials,
+    URL userinfo, IPv4 addresses with network context (including quoted and
+    ``*.plex.direct`` dashed forms), ``.lan`` and tailnet ``.ts.net`` hostnames,
+    Microsoft Graph calendar IDs, and the MCP connect-URL secret path (the
+    add-on's LAN auth). Inside known_identifiers_scope this instance's own
+    hostnames and addresses are redacted first, wherever they appear.
+    """
+    for pattern, replacement in _known_identifier_rules(_known_identifiers.get()):
+        text = pattern.sub(replacement, text)
+    # JWT tokens (header.payload.signature)
+    text = re.sub(
+        r"eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+",
+        "[REDACTED_JWT]",
+        text,
+    )
+    # Bearer tokens — match any casing (BEARER, Bearer, bearer, BeArEr, …)
+    # via re.IGNORECASE, but preserve the original casing in the output by
+    # echoing m.group(1) back through the lambda.
+    text = re.sub(
+        r"\b(bearer)\s+\S+",
+        lambda m: f"{m.group(1)} [REDACTED]",
+        text,
+        flags=re.IGNORECASE,
+    )
+    # Authorization values in any other scheme (Basic, Digest, ...). The
+    # Bearer rule above has already handled Bearer, so it is skipped here.
+    text = re.sub(
+        r"\b(authorization['\"]?\s*[:=]\s*['\"]?)(?!bearer\b)(?:[A-Za-z]+\s+)?[^\s'\",}]+",
+        r"\1[REDACTED]",
+        text,
+        flags=re.IGNORECASE,
+    )
+    # Generic key=value credentials (api_key, token, secret, password, etc.).
+    # Negative lookbehind for a letter so OPENAI_API_KEY=... still matches
+    # (underscore is a word-char, so \b doesn't fire there).
+    # "authorization" has its own rule above.
+    # A quoted key and value, as in JSON or a Python dict repr, are covered
+    # too: {"token": "a b"} and {'password': 'x'}.
+    text = re.sub(
+        r"(?<![A-Za-z])(api[_-]?key|access[_-]?key|secret[_-]?key|token|secret|password|passwd)\b"
+        r"(['\"]?\s*[:=]\s*)(?:\"[^\"]*\"|'[^']*'|[^\s,}]+)",
+        r"\1\2[REDACTED]",
+        text,
+        flags=re.IGNORECASE,
+    )
+    # URL userinfo: scheme://user:password@host -> scheme://user:[REDACTED]@host
+    text = _URL_USERINFO_RE.sub(r"\1\2:[REDACTED]@", text)
+    # Long hex strings (API keys, tokens) - 32+ contiguous hex chars
+    text = re.sub(
+        r"(?<![a-fA-F0-9])[a-fA-F0-9]{32,}(?![a-fA-F0-9])",
+        "[REDACTED_HEX]",
+        text,
+    )
+    # IPv4 addresses — only when there's strong network context, so that
+    # four-segment version strings (e.g. "version 1.2.3.4") survive intact.
+    text = _IPV4_WITH_PORT_OR_CIDR_RE.sub("[IP]", text)
+    text = _IPV4_IN_URL_RE.sub(r"\1[IP]", text)
+    text = _IPV4_AFTER_KEYWORD_RE.sub(r"\1[IP]", text)
+    text = _PLEX_DIRECT_DASHED_IPV4_RE.sub("[IP]", text)
+    text = _TAILNET_HOST_RE.sub("[TAILNET_HOST]", text)
+    text = _LAN_HOST_RE.sub("[HOST]", text)
+    text = _GRAPH_CALENDAR_ID_RE.sub(r"\1[CALENDAR_ID]", text)
+    # MCP connect-URL secret path — the add-on's LAN auth. Redact by the
+    # configured value (catches custom paths) and the generated
+    # ``/private_<token>`` convention. Only bug-report output is scrubbed here;
+    # the raw logs this text is copied from are left intact.
+    # The dedicated settings-UI secret path (OAuth/OIDC) is a second secret whose
+    # leak grants the same unauthenticated settings access, so redact a custom
+    # value the same way. The auto-generated /private_<token> form is caught by
+    # the generic pattern below.
+    for env_name in ("MCP_SECRET_PATH", "MCP_SETTINGS_SECRET_PATH"):
+        # Strip before rstrip: the resolver strips MCP_SETTINGS_SECRET_PATH before
+        # mounting, so a whitespace-bearing value mounts at the stripped path — the
+        # redaction pattern must match that, not the raw value (GHSA-mx64-982r-65vg).
+        configured = os.getenv(env_name, "").strip().rstrip("/")
+        if configured and configured != "/mcp":
+            # Anchor on a path-segment boundary so a short/substring-prone
+            # configured value (e.g. "/ha") cannot corrupt unrelated text
+            # (e.g. "/happy").
+            text = re.sub(
+                re.escape(configured) + r"(?![A-Za-z0-9_-])",
+                "[REDACTED_SECRET_PATH]",
+                text,
+            )
+    text = re.sub(r"/private_[A-Za-z0-9_-]+", "[REDACTED_SECRET_PATH]", text)
+    return text