ha-mcp-dev 9.1.0.dev3350__tar.gz → 9.1.0.dev3355__tar.gz

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 9.1.0.dev3350
+Version: 9.1.0.dev3355
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Keywords: mcp,home-assistant,ai,automation,smart-home
 Author: Julien
@@ -17,6 +17,7 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Dist: anyio>=4.10 ; python_full_version >= '3.14'
 Requires-Dist: anyio>=4.9 ; python_full_version < '3.14'
 Requires-Dist: authlib>=1.6.11
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: cyclopts>=4.0.0
 Requires-Dist: exceptiongroup>=1.2.2
 Requires-Dist: griffelib>=2.0.0
@@ -445,6 +446,19 @@ Leave it off in clients with deferred tool loading (claude.ai, Claude Desktop, C
 
 For the HA app, the same option is documented in [`homeassistant-addon/DOCS.md`](homeassistant-addon/DOCS.md#enable_tool_search) along with the in-app settings UI for fine-grained tool enable/disable/pin.
 
+### Per-URL tool catalog
+
+`ENABLE_TOOL_SEARCH` defaults to off, and it sets the catalog of the main endpoint only. When several clients share one server, give each the URL for the catalog it needs: a client with built-in tool search keeps the full list, a small-context client gets the search tools. The suffixes are fixed overrides that ignore `ENABLE_TOOL_SEARCH`:
+
+```text
+Main endpoint (follows ENABLE_TOOL_SEARCH):  https://example.com/private_your_secret
+Always the full catalog:                     https://example.com/private_your_secret/catalog/full
+Always the search tools:                     https://example.com/private_your_secret/catalog/search
+Read-only, search tools:                     https://example.com/private_your_secret/readonly/catalog/search
+```
+
+Each URL keeps its catalog for the life of the connection, so a client picks its catalog only by the URL it is given. Reconnect the client after changing its URL so it refreshes its tool list. Home Assistant webhook URLs accept the same suffixes, alone or after `/readonly`: `https://your-ha.example/api/webhook/<webhook-id>/catalog/search`. This needs an embedded integration or Webhook Proxy app (add-on) release that serves them, with a matching MCP server; an older one returns 404 for a suffixed URL. Stdio runs one client per server process, so set `ENABLE_TOOL_SEARCH` in that client's server environment instead.
+
 ---
 
 ### Read-only HTTP connections

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/README.md

@@ -385,6 +385,19 @@ Leave it off in clients with deferred tool loading (claude.ai, Claude Desktop, C
 
 For the HA app, the same option is documented in [`homeassistant-addon/DOCS.md`](homeassistant-addon/DOCS.md#enable_tool_search) along with the in-app settings UI for fine-grained tool enable/disable/pin.
 
+### Per-URL tool catalog
+
+`ENABLE_TOOL_SEARCH` defaults to off, and it sets the catalog of the main endpoint only. When several clients share one server, give each the URL for the catalog it needs: a client with built-in tool search keeps the full list, a small-context client gets the search tools. The suffixes are fixed overrides that ignore `ENABLE_TOOL_SEARCH`:
+
+```text
+Main endpoint (follows ENABLE_TOOL_SEARCH):  https://example.com/private_your_secret
+Always the full catalog:                     https://example.com/private_your_secret/catalog/full
+Always the search tools:                     https://example.com/private_your_secret/catalog/search
+Read-only, search tools:                     https://example.com/private_your_secret/readonly/catalog/search
+```
+
+Each URL keeps its catalog for the life of the connection, so a client picks its catalog only by the URL it is given. Reconnect the client after changing its URL so it refreshes its tool list. Home Assistant webhook URLs accept the same suffixes, alone or after `/readonly`: `https://your-ha.example/api/webhook/<webhook-id>/catalog/search`. This needs an embedded integration or Webhook Proxy app (add-on) release that serves them, with a matching MCP server; an older one returns 404 for a suffixed URL. Stdio runs one client per server process, so set `ENABLE_TOOL_SEARCH` in that client's server environment instead.
+
 ---
 
 ### Read-only HTTP connections

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "9.1.0.dev3350"
+version = "9.1.0.dev3355"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.15"
@@ -30,6 +30,7 @@ dependencies = [
     "anyio>=4.10; python_version >= '3.14'",
     "anyio>=4.9; python_version < '3.14'",
     "authlib>=1.6.11",
+    "certifi>=2026.10.19",
     "cyclopts>=4.0.0",
     "exceptiongroup>=1.2.2",
     "griffelib>=2.0.0",

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "9.1.0.dev3350"
+version = "9.1.0.dev3355"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's
@@ -33,6 +33,7 @@ dependencies = [
     "anyio>=4.10; python_version >= '3.14'",
     "anyio>=4.9; python_version < '3.14'",
     "authlib>=1.6.11",
+    "certifi>=2026.10.19",
     "cyclopts>=4.0.0",
     "exceptiongroup>=1.2.2",
     "griffelib>=2.0.0",

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/src/ha_mcp/_vendor/fastmcp/MANIFEST.sha256

@@ -1,26 +1,26 @@
 43070e2d4e532684de521b885f385d0841030efa2b1a20bafb76133a5e1379c1  LICENSE
-57d679f7a4f2649196569bb5ba0003769c702397762f111fa00b4024b4ba81b9  REQUIRES.txt
-474cd40c2b28f8f6a25f97a09f5944b5472af172900c8525feebc90feea58989  VENDORED
-17dda54e1e9603c3ed2629f7c7cca477e79c78de2430e4b926472831154e46b0  __init__.py
+fe9ec101aa92487a88bbb7f3ea48a20b3939959092cd1e4c8f0d69828f8bdad0  REQUIRES.txt
+54732ccbab00840e1f94a527f5bcf49fa03b6b135a3af5a6ac91ac422df79be7  VENDORED
+8c0cc5871656026009215443dc7e5a896d576b143631e295d0328c7dd6cd54a4  __init__.py
 2ae9ce0d217923abf551b6f8bcf08e516529b9a6abab160bab5d8c9b7e245c3d  _compat.py
 0fe101433a655a48e5fd1dde0c75879f3a74f9092d2b935bd71fad19bcfb77a1  _install_hints.py
 a9c59fe78564360444de04484a2b0906569fb58408be3c968be3f81a5e3015a4  _warnings.py
 d0d1090ec6c6b80434d6f69d834ac018a10466834c67d119399438b8f3bd78f2  apps/__init__.py
-d5a7cf7be1b90a54cb2aa34b4c52f16a627365756bae2799f8a1e8bfc19e3be1  apps/app.py
+7d2233ed510afb5a049fafc9d100d5933fa9b43a9293d2b0d12fe52f738c4de0  apps/app.py
 43c543658ba0dfdd7622b42c6d9c1bd18ac1b5516d6f64e984bc21f5491968cc  apps/approval.py
 ebc30d58d7be55717fdd0d2c8c3691e2d42e5e7ae7a6edca6a1aaeef06a6390e  apps/choice.py
 f37ca3568e62ff272436263dba64baf712c4ee05e9c92c047c697f1fc8e6cebf  apps/config.py
 07a3af5d581a6bf8ee09d269166b46150fee8b62e46477b79b678f3124cad6e2  apps/file_upload.py
 8b2e94be32a1e5753d06cd79af72f10f73f6959069db664f25d490f16f2450fc  apps/form.py
-1912a7eb64b0c1f63c6a55a140b79da643c9bc6a7c48328e0522facebd75bd07  apps/generative.py
+05611f5811da175bafa8b6c2fe43ba3fae0d1f81409e350f8b13fa61f9ee1b88  apps/generative.py
 1f3d55a17ea1a14a11eb4f4c47ae4a23bf27180135879c4a681619c616d4c84d  cli/__init__.py
 f7e802853b93ea231afe35bf6512bb8659f6ce31f5e2d788cbec70206b73ec6c  cli/__main__.py
 4bd9a6ab3a2584ad11e1f77883dfb1c7c9f80be9fd0c31ce89cce16a31f55375  cli/apps_dev.py
 25706d223a4a0bf6aeee9d998b6c2cc35a43f599b26b8da10188ffd632488412  cli/apps_dev_security.py
 69c000d140b8cd9e48a0feddf08fd5a7d8735f719f7443f34cb89caeea58d29f  cli/auth.py
 c0b3e37538968d37ff03613bee536e83840c5a7bd6003fdac39b17e1f210fc15  cli/cimd.py
-ee711b8ba863d82485eb5be2f1b87e8b6374036e7a523959fac200d48b2f2fb1  cli/cli.py
-3f29c6258252e14ebf52a156ded11c8d2ea5b6ad111e970f0d68f8ba66b2caac  cli/client.py
+535aab471041c55ba3b617cf283d90fb4452e7343623648c1932dfca5b26538e  cli/cli.py
+82a316bd962043982cf6d885be0a0fd6e6971bc73422ee36d27f3a882497f251  cli/client.py
 e957afa2f01583177872973ad9ee3870b59353ef03aaaf716a27454c3c1be945  cli/deploy/__init__.py
 f0b119ec65bcfbadbe610b676fb3054c7dd55bd1ef8bd37325afe1f9c85e696b  cli/deploy/authentication.py
 4e8d460c536d638ed6ddf1f44e21723b5aef4df3d822a80da791f0d96bf7d50c  cli/deploy/command.py
@@ -28,9 +28,9 @@ f0b119ec65bcfbadbe610b676fb3054c7dd55bd1ef8bd37325afe1f9c85e696b  cli/deploy/aut
 d15ffc90ed6c4ee53c00bf0d3a0ecb7f73b0c5cdb2e2acb4299888bb8463f944  cli/deploy/credentials.py
 a7457cd7975c6438acbe3a576a4ef26c432256e3ce32e1b4e41778666dc10a21  cli/deploy/horizon_client.py
 ed9553af547b8efd7c518f64d0aa1d022639307d6bbf4e81411ba1a5b7011a61  cli/deploy/output.py
-815b6c10d26fdc4e7fe50d76194c0fc34c19baa0d87b31ca83494cd64d87b2ce  cli/deploy/state.py
+420d04e025bcf7dbf8f84ba86476cb2e0e78d76de2c2757f37a1fb3667b95daf  cli/deploy/state.py
 aef302e0de092a4efb277b9e44201e4b39819826b55011796b474e9ce361efc4  cli/discovery.py
-a1fc7bb7eb835b9e6bad14b9fb593d585b9f7646f59c892f0cfbd5c24959ada1  cli/generate.py
+dcea691ef69dc08a0a4e78d1387c0fe47bd91b32126f09cbff393cee12a0dbaa  cli/generate.py
 3064643d52a2ee08d78b9c9f859e7e6365841ddc8a4ee3cb32bab5adf86c241b  cli/install/__init__.py
 bed3123c8e5ef639b4aba8c12b023cd75076101e7c4ac69759fb28675ead764a  cli/install/claude_code.py
 53ccf776aee80eda7c0ade5a9e5d5e6482ef96fe76385cea302fed3969440dd3  cli/install/claude_desktop.py
@@ -48,11 +48,11 @@ f23abd973d004567dacf840728835c74bd94963ab48355990ee27879b598c7a5  client/auth/be
 e79500bab9cc766870590c9edb0cb86a89025ecf1ac99e82bc188f12c48e6596  client/auth/client_credentials.py
 6d4d27b81185455678112a4313bfffed605c511ecdb5851ebf192fde613a4528  client/auth/oauth.py
 a8b6c5f3af6420a016d5ce84647d51165c6fed3cf59c3bf3866abdd85694f8eb  client/caching.py
-b887e8bf28c691c6aa738ec3d39367bdc42988bf2113749bf2df39457707ee85  client/client.py
-ec3d69cbdc6d1331b028afad95616431d6bd02e91a2bcd76a12c30b6618f3d88  client/dependencies.py
-aab079f50b8a4d6cf0f8d90998025989558b37527fbb7e2c4ca4c583cf8d3d23  client/elicitation.py
+78d8ffb2bc74dfb8ddcc3e7c01fff0ff053d94e07d5ff468bbf7ba7ae9b17d29  client/client.py
+70d5630026a761bdc7a3c0279fef304a929c9ad7521c09d94fa1bc95b4ac8f54  client/dependencies.py
+7c6ee40dd0a54b89a65fa6c8562acde788e57a4b8f0710425faf954338a9a089  client/elicitation.py
 abdc07c2ae78249cfb095295120a982db23a7cfbbe90ec50ce5f964475c981e3  client/extension_hooks.py
-a7fe536d6fc5dbad6a2c8d34b3b8074a0c28e7572ee69c7d816ef8fd4617f2e9  client/group.py
+47f29c4cf557a5f8fc1a02b9358b33e7f2641391e1da2a8e752840073bc5b288  client/group.py
 0648016833612089c873938a63d69cded6336e8c8d9867e9412d4e2dac9c2f97  client/logging.py
 4014857ab79e71cd06f28afaa160f00d9c646c63a63bb99565174933497fc501  client/messages.py
 9c6ffca96bf49ef5f9f0d2574072c8248a8f3322067bc6d525cb866015f6a09f  client/mixins/__init__.py
@@ -70,13 +70,13 @@ e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  client/samplin
 a41ee550a4a16f8965afe7eb9e5afc4fb94e1683afab9777857dfb1917e0ab7a  client/sampling/handlers/openai.py
 dd343adbd063873c835400ae2c30dcfd451acf2712c347244bca63c0d7e1ae51  client/telemetry.py
 51f921337c5f1d3f6ec7fb01757f7f6c834b5eaf27d26f9d789a9ea5baf97cd2  client/transports/__init__.py
-fce497b3dee5365815b94eae083243a75fcb9bd53cc173303f2bed4d5ed35324  client/transports/base.py
-c3f58b1274d23f3a93cf9c1cf1835da5b54c92243d3693956cba863fb1f5ed15  client/transports/config.py
-07d57e12d14c961f9f15709bfe88bf7534a8212818e105ab90a413f2d855ca6b  client/transports/http.py
+48d2538859048fdf8edf5ee84b001628a51ffba8b7f76f566453300e1cd8ac36  client/transports/base.py
+27465acba54f99120a1d20dfe61a6199df67af4f540bddf035f51901c9b5d9e1  client/transports/config.py
+8e3d5dde419c2a0a8e79aca7e5a33f837e8b66dc93fc92d8f58541f2b9b6c029  client/transports/http.py
 a2fc0c9ba36479b0d79b53b9d43a2ddc0d054a71444437a1b6be5d02228504de  client/transports/inference.py
-cd5fdcdb90616756ed695d7d57a30cb420d06c57b776615e81bac2c596b5ec17  client/transports/memory.py
-92c95544d195ce5e49bd1f7f2853fd743bb81bbd22416db63c238227b00c0b4a  client/transports/sse.py
-fcb50bf3d338534f89f8ec4860dbe776616db48f7b5e842c2d2e61d151cddeb8  client/transports/stdio.py
+b624f0c9c65edeabbca214a208590b811e9015236e00de9fe54d21aad1889814  client/transports/memory.py
+3a6d37f56faf3b1744dc3973d987bb9c71ff4a4529da58633c5ca95da19fd381  client/transports/sse.py
+b4a42a6ba88fcbafaa17330ef429df7e2449915e7f5dbefb42de64d91e7ac690  client/transports/stdio.py
 aca9276122354f5f7652f4acceac300e5436798429c72c2b3532e88f5efb4985  contrib/README.md
 e5a5146354d214ab73d69bd32d20ea9140a41a4baa31f31936c2de68da848007  contrib/bulk_tool_caller/README.md
 c6f19249a5174d0adcdf57ab0688b51a1ec18a480e9621130e26154cfdeb2f16  contrib/bulk_tool_caller/__init__.py
@@ -97,7 +97,7 @@ e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  experimental/_
 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b  experimental/transforms/__init__.py
 a97731788c972f91efd9d789036042d14fd0732d38dff293834af8b4d41beb30  experimental/transforms/code_mode.py
 34acdc402ef277f44a92d4b3c32459a9b55c19712dac82007ec5052e92b80fc4  experimental/transforms/jev_search.py
-a08727048d5bdc6f513fd4161f1a53ae1ffbcf387cc62b6319317946814cd4c5  mcp_config.py
+4a1118eb9f55bd447126647b613ff27ed9bf0e470a297e81c40acdbe20f567c2  mcp_config.py
 353a26dc9d40c4e682ebc1411838ee0920a759ced021d264057b86c0335f1a24  prompts/__init__.py
 32e11edc2ab6c83c5c4499a7e2f12f41eace5cb522ce7a508015355425f07df8  prompts/base.py
 21d1fa531c37e5525257218d605ba73efeada2548f42ae0b86bebe731b0cee95  prompts/function_prompt.py
@@ -110,7 +110,7 @@ b5074534e408ad9f8e5a325076e1549cecd0a0c8c7ddfbf016fa3b041c3509cb  resources/__in
 35612329060fb13f468eb2998cd32500992c516ff37115db7be4ae1382ae121a  resources/types.py
 827d84d4bc780342fdbfd88101ac4f25b8a39b79ae63f8b9d9f636580cec52bb  server/__init__.py
 260232a96fb443347da645d6fa1a0d32c9599a7c00e737c285158a3267c708a9  server/auth/__init__.py
-9a430a2062aa66274a51f612d9fde1a815622cf80b1384dfd61b07bade1def06  server/auth/auth.py
+a4f0e24ea36e8fd91bb8a7585c3625a55c03de4dd9b5bb70b9b20c8db1a6f451  server/auth/auth.py
 71a9e5c1809537c98703866db245c7fb3c206c30d4203036ac19e862ace52126  server/auth/cimd.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  server/auth/handlers/__init__.py
 bd6cc8b7e5728f65e4ec8c9ee976533bfe7d712a63d4009b672c84d1a94125b9  server/auth/handlers/authorize.py
@@ -120,30 +120,30 @@ bd6cc8b7e5728f65e4ec8c9ee976533bfe7d712a63d4009b672c84d1a94125b9  server/auth/ha
 482e01b4ecc8af2714eb1bc50cc7afa0bdbadab1e583171cb9aa70fa2b270af0  server/auth/oauth_proxy/__init__.py
 5f490615f239c44e861b7860fbdabc02e4a768587e9e77259b7695b2628576d3  server/auth/oauth_proxy/consent.py
 66c2b86e445bb5e930eae7ec7c495a20e752ceec57af059fd96de66ebf2fcce0  server/auth/oauth_proxy/models.py
-5002bb9f0e4db48f4cba07168c0dee6e206282cb8ae5561922432053c54b08c4  server/auth/oauth_proxy/proxy.py
+59d35a5f8d07fdc714afa2c18a890f459355d6c65e7dd61c047b787595fa9dcf  server/auth/oauth_proxy/proxy.py
 0e44df9ec0fb91a209674a1e201345d925161e509c537e996fda7bb5b0c78677  server/auth/oauth_proxy/ui.py
-a7dfed182cd72300a09136f500738cafd81960807b474fd184143a24fa0898d9  server/auth/oauth_proxy/upstream.py
-662eebf05ebf0cade5e9dfb63b8cba4158a0ac180a6ff75f70ec96a801daf56b  server/auth/oidc_proxy.py
+ecaff7a03809e271ed40a72c22cd8d17897254f18d10482c66512e85737b62b2  server/auth/oauth_proxy/upstream.py
+4f1455c1f01eeaaff1080d8e6187b1f2469991ad67eecc0e13f66f46083362ea  server/auth/oidc_proxy.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  server/auth/providers/__init__.py
-2309357e391e3ca50f368b87581c915f5da83103d6fe8b157fc3f6365ae940f6  server/auth/providers/auth0.py
-2096389558eb1eb799a5e69379dcfffcad2ee0fe7a9bb98b632871581c456cce  server/auth/providers/aws.py
-88ffece1b8641ba180cf96e719b7b78ee8aa716e4aa13f5e3c4510fd8be47081  server/auth/providers/azure.py
-0afe32ad1950f740d1e5798444fa79a39251e1173f214cd71d1a7202d4e1b492  server/auth/providers/clerk.py
+e37b077d61f6ac5db13e03d779009d2f928e141ff6f7bda1e6076957c2c346b9  server/auth/providers/auth0.py
+9c49253b286fc76c5c19855fc223a4bbb14c29c8dfeb62b03508fbcccd6055d7  server/auth/providers/aws.py
+83325fe2b563a1f71a1cb7a5a35db98942859ae24afb3e82cd0f2022cfa488d6  server/auth/providers/azure.py
+ba77dd6fbd31091aa4709ebf956a3a5469d4f7f3ef26a5d1a925dbbf34d6e019  server/auth/providers/clerk.py
 b682ebb2419462e9bb506f2bf473d8ae33febcce4055df5dd506a4845c81e47f  server/auth/providers/debug.py
 565367bc78820801144af6a22e54e249644beacdb215812e88e3e0344c7e99a9  server/auth/providers/descope.py
-d98f08e8041870f3effa331b2837d0073c26079872dd34b501c0804669625442  server/auth/providers/discord.py
-df69c87adbdc2caee72185bdeaf55d19bf5308f94b2756343177556878f44ae2  server/auth/providers/github.py
-cd9ae180e45177b6d32444cae55ebd3c421c374ad719871e825a8a66a829b1f2  server/auth/providers/google.py
-3a76215676072a4c7e31971e3c79e57a3ea78ff10b79e5fc90cd371915ddd7ff  server/auth/providers/huggingface.py
+20e4b054f0117b2b6ba338d9928d1d912deffea58aa538fe82ac9d2188a46446  server/auth/providers/discord.py
+909b8875f192b1c0ef91339d3aaef325ec84a164084526801a69b5c7565aa34d  server/auth/providers/github.py
+546b466a35e7f6528138bab482451962b967ce5e4cd7221d334fde1d2327cfdf  server/auth/providers/google.py
+b3b7a031da3b6f1bfc105220015d2928783c8556a0c0a258eb1809f327d5d913  server/auth/providers/huggingface.py
 57fa08d818ae235752a65083d1e19daeb65c7b6354ad81c76aed0257b4ea9e61  server/auth/providers/in_memory.py
 dfb1e26a7eafca5db135f70e9b9ad586e80bc57e4642b129a8bfc22c0083ebb1  server/auth/providers/introspection.py
 49ef26ce0f7439b249c8444ed0edfe443aef3ce2ad731dbe3350474ac5f04124  server/auth/providers/jwt.py
 27e8a505f6e1cee20548a5c789ae75311a33ed1addfbba0f49f01dac29c50370  server/auth/providers/keycloak.py
-f858f390ad6ca87990e548cdca584cef57fc93a0d2d36b4f5353dad2c4c0f7bf  server/auth/providers/oci.py
+b9270ba00bd4a9b6c95a91a1140fdf54baec561166dc00e21c0fc8d30fe1f3e5  server/auth/providers/oci.py
 5fc4d64669c5c4aa673d9d640f2692e2b5a5eb99a02529cd671a8a285bcd329f  server/auth/providers/propelauth.py
 588572abde4ae90b0ef5997f23452d8e26c3f70dfe64db2cf0b478927ec85988  server/auth/providers/scalekit.py
 df16f6cf532f38b87318d06d7c0f97717699614ada54fcfb53701d5281ed6cc5  server/auth/providers/supabase.py
-062ddd47b17710cffe111c1649ce248a1a476a4d1444c57d82c5da9af1187054  server/auth/providers/workos.py
+2f8b0c706a66fd9a27051f8856018e10b2d0d86b4ca40279844bad3460b50bc3  server/auth/providers/workos.py
 9ed8d6fec5e0ca8fdb9716cd0f80f178a0814ed34b2202770f509c1fe96305e5  server/auth/redirect_validation.py
 8db12964a2f64b576d72858ad4d21aa27e5e8325101cd575762cb1dd56f01a22  server/auth/ssrf.py
 871c89e8a16ca2a3cd030b94108abb0bf15d8addab05b398f959da8445f4e6a9  server/caching.py
@@ -152,16 +152,16 @@ df16f6cf532f38b87318d06d7c0f97717699614ada54fcfb53701d5281ed6cc5  server/auth/pr
 2561804a41617f9c4e8d7733f46cd64e95c8f8d35455e54e8a382c39504adc32  server/dependencies.py
 e9f49b78a223cd3a76ec037f3ebaf0dade60dd775ed8533f2c0a53127c1fff0f  server/elicitation.py
 e0497cf65d8a93849bf2873b94e18abaff2d8a9a879d24db9af22d52548bb696  server/event_store.py
-3b72dd326aea6c7e534a07577cd57cc5244e6753a7dc76a9f948732c57fb0b04  server/extensions.py
+cc156e33b9a531c16bd3dd1bd470d64496cc096f48f3d681240ddf6538454b30  server/extensions.py
 e2d8f616fdd6181f9de4febaa4be5eb5901c5e961ea36fa92a1177f1d2cd39b5  server/http.py
-c939ec1886308f99257b07aaa73a4781565d5d3e170fc13b0d8b36f4735a4fda  server/lifespan.py
-88b443872d501d764b897cb272d47fd0692e6120e2160d68558aaff95aad4bcf  server/low_level.py
+4f8c624240409f1f927a40b195179c7a717f3901242ee4ec3c6120266864bd89  server/lifespan.py
+31e686c6c64565abc76a1c996d595fe74410c09975cdd9e61115f4b022d482b1  server/low_level.py
 dc669c15efc3c6bdeb531a6267860c141bb86d64e49c0ee586805c4866bd0c01  server/middleware/__init__.py
 81fd341cfd5101c7d0bf01d10356c0e2e777fed5acafcc1e002aed2331d21fe0  server/middleware/authorization.py
 f3d9c9064b56c4c8343137efd4f07a21a9ad18df8e7f447bdd6eda0e4dd478dd  server/middleware/caching.py
 32e78726614e5a69b3ec87bb6868b151ad6955f3eaac3a41b5a9d6151a0efa55  server/middleware/dereference.py
 53d015df5c8c14cabcd52a864695c4b5316b99b06d7b3444124bb640a3cdfca6  server/middleware/error_handling.py
-d55654f305388914c045482ffaea32832fdfc57f17f90f558901ab422fe04cc2  server/middleware/logging.py
+6d382f5d710cc2390c6bb517baceb521fa4eadbed4442f4274471cc854ec83a6  server/middleware/logging.py
 956de4ca44b656fa68371aa6f359ec86fd698c6d5262a0360ac3e7e6fd0b2804  server/middleware/middleware.py
 54745915b9fa8e6b8202a3a0a06d821f84fe81306d185d6f943f6b4f3797a3c8  server/middleware/ping.py
 78792942f41d9704e304c726e553d3a61ae72541b9b28ee09e7a786b6e85b60d  server/middleware/rate_limiting.py
@@ -170,14 +170,14 @@ d55654f305388914c045482ffaea32832fdfc57f17f90f558901ab422fe04cc2  server/middlew
 aefe367cf4119f62a497224bd39effb9e876a4cb15032558256e7bd749f7c1cc  server/middleware/tool_injection.py
 7dbadca2563c9c44dbd242d6f75f53df1827b5ca24e09c76a26a63c450768467  server/mixins/__init__.py
 4a0ec3b82ebfdaeac5b3ae8ff9ba063f7f8a4416b1fe55ef3e4eb5e4218dcb07  server/mixins/extensions.py
-10ccc0151a0590a6e0d1a6c611d71b6941b8942de975c094b791d201fd6f0f1e  server/mixins/lifespan.py
+c99d8a5761ed55b8dc5a7d53671a2ffb4a69fd21b50322f22cefa724de555a46  server/mixins/lifespan.py
 e6505af69e1240f9fdbfefdd8d81732b7f5ab20ced5721203f07927f1c290a5f  server/mixins/mcp_operations.py
 186b88939549a093754b66c6334f43bdef880d07900531a93659c0f70c291f6e  server/mixins/transport.py
 cd4f7cade13e4a23391117605bbbd4e9d9f66c43d949c09e4fef05ff279a5a32  server/providers/__init__.py
 60c8b27855ed49b56faf1935097a5d9cda837b3ff7e3f8c7e0f7949dddef3bf9  server/providers/addressing.py
-4c47a9a72686e7a673223ec68d838b74c7208e91a302ffda7440701da73ccf58  server/providers/aggregate.py
-f2298bc8cd240896593e83d59ac444e93d690d7305142a241a9a6b36f37cad4e  server/providers/base.py
-ef179352ecdff09a70c303773238667b1f827b6f1ea968b7074de94dadcac399  server/providers/fastmcp_provider.py
+38aa74102fd76c3378639d38187bcbc7a542402cfc4bd31e28a166386ac96eab  server/providers/aggregate.py
+d7fb26634c200c545c01a565421ea2e5e05f8523c4148d90de2aae1771530935  server/providers/base.py
+814bd2faa82685ce0593500c975f3bb24809345547d1d6a18df868df7db822a5  server/providers/fastmcp_provider.py
 9974a882682461f134ec08a3302297fd06a7f44078e38ffd72fe0be1fba9eff1  server/providers/filesystem.py
 7ac9cc96e17c22d63d96eb867a4c46557b5503c43e51c091bd3e5a7755ffd6df  server/providers/filesystem_discovery.py
 0f0702f2501537c34982eba9d930afde4d22638d1623ce6691198ce46f5c3d34  server/providers/local_provider/__init__.py
@@ -188,8 +188,8 @@ fa33cec1bf53129e7a22eb61c34b95073fe0ff1d51299ce832cac516906c07ef  server/provide
 91d662fa33ab5c71a889e5be59135dd2780758d295c616fc3b140c6e332dda34  server/providers/local_provider/local_provider.py
 11c75b6557ce98f4855c76aa0d7740df71e704d05fda8435d92f89aee4a5623e  server/providers/openapi/README.md
 9e4dd35d653c9363b7c7679b38ca3f653b53a359065507046bce94db5dfe4bd5  server/providers/openapi/__init__.py
-f5dfa26ee1ec37daac1513be47fc8376de009467a7dfad1aab0120c13f3088ff  server/providers/openapi/components.py
-c88abfd6448034a5937f51cbf1ca2d56fee62484de734f5dd883b02fcaa0c05c  server/providers/openapi/provider.py
+9a1483859add8454df9d68d80c320f7f9fbbcf85b5d00814cfe9de1e587aee76  server/providers/openapi/components.py
+4ba7c930f7478250fa36bd844c73207ae52683a96f7490683ffc1efb27acb9d0  server/providers/openapi/provider.py
 b00f94d08ce939d3aca4fb4e9d77d34633570e505640bd7c0a3a4cfb27030b05  server/providers/openapi/routing.py
 776be4ae2a017410f3b505fe5a6ade18690f396545115ba3bf4e525f30ea3164  server/providers/prefab_payload.py
 f4cee46905a912f0e52859350e8af886eadc3ba86f5a41ea248fb1638c6b11b2  server/providers/prefab_synthesis.py
@@ -200,8 +200,8 @@ ce1a7b8a0adece4168f039721d3c0d196da79ae6d8d2b7835ef13733f6c510ab  server/provide
 bd74f9be18063afb0b908d4ef750837d585f2f21bd039afa2f85fc601ab18de5  server/providers/skills/directory_provider.py
 b37927f19c02a073fa1b22338be214e74c1189f6ab210a296820e67d6bd27024  server/providers/skills/skill_provider.py
 b759c2e9f832ff7b27a9d4347a12851e235d59f7cfa0360aba5efd57377a4adb  server/providers/skills/vendor_providers.py
-ab36a66d437044cfd929d78b224d8c909296a968b3ef3670f0656af7202f3eb5  server/providers/wrapped_provider.py
-92e79927130fd62404fca11a1621b3f5a83aecacf99f7162649a73e36510e84e  server/server.py
+18465a866c33efdba51b572d84b89c443d5bc048049256e750050af33740036d  server/providers/wrapped_provider.py
+9750f34050b510f455c9aaaf48ac39f9122cbe130611b8f1ea74cf429fd914a3  server/server.py
 a50d0db0003d63db49a3ec62b18dc75e267d6e03b7165f11f02992316be4e160  server/session_scoped_event_store.py
 a172b6697b515083db1d9f2466d8c88659d37427ece0d292c26d1646c1e72e2f  server/sessions.py
 24b63d7adc0e3e7ebb5528924d9cf2e5789faad798bd39175690c8dca0742ac4  server/telemetry.py
@@ -216,7 +216,7 @@ d97ffcc125efcc4844e86b9b0d8446ed559d3519de3610619eac5399366ab68b  server/transfo
 112c0190cb32e44918643cb91aebd17e3dd796803c12754e5c469cfeada0a78f  server/transforms/search/regex.py
 e83d5c70c181f5145ebf4bd2fb4a808f6ebf4eb1ce9a052165a07d983045c44a  server/transforms/tool_transform.py
 f2e810f9769e3c51a6be6822b03c230a87e94a7b6684d41fc29cb73efe339d80  server/transforms/version_filter.py
-025fc257357db3e19e8c8f611dbcef51af625795849d5ac778664592c87ea3a8  server/transforms/visibility.py
+53789f8d49aadcde15ae4dfd318064be111f9cd0891ff6f1aca2fe61455ce8f7  server/transforms/visibility.py
 b091c4eb034cd9cdaf42d65dade7c95846c37e137c2572115a9ef6277305ba2b  settings.py
 7b83e24d81780ebe837717d2a183e78e7a2dcd30fb52bcd2d0ed9330d16204d7  skills/__init__.py
 f44adbcd9abe7eb159d63bd0de0be6ebec37a8f6f84964814180424da5d0fa62  skills/_constants.py
@@ -226,15 +226,15 @@ a324a06f09bf359781d0a11f07d0b3b13612b26ebdf5d5652e84c8710791fee2  skills/_source
 9a73f7097511e27e04d5a905d698fe763315c52490b962a3eedef95a221e5542  skills/client.py
 f5303d967eb59473eed0a960a2da4b21461706bf4b36f4038d3480fc2e05d552  skills/extension.py
 82d1853cc0c581da118608e3349574d8c18b1169c774a45076ef8c770d66dbff  skills/models.py
-1918d45032f08b689ad2d7f5df63e48b777266a81d4d0991a0415d5ff04bdfe7  telemetry.py
+f8ae471e23ff68f89ab136ce2e9c4cf7c41f0b4232e88493cd2310eb3e538ab9  telemetry.py
 fd1992e098123e61b8e2697dae56bc3d6311ea118c9dbdbac0197d7ad274b126  tools/__init__.py
 fa7628ff8dd6cd1ce632af82b39b6b1acf942dc00046c5a65fecd2ebf8898706  tools/base.py
 f7f49cfda15a22b3f3aaddeeb161986341c72e2eceb0d90ea427131e23b1dd88  tools/function_parsing.py
-317016d376666c0c08ed9e1b150123bc18e3da28d9ff07441da028c711c2f82b  tools/function_tool.py
-296be400218e0c14f9c1f88e778592541e2ea0a6ceeee72d79e44dae23f508d0  tools/tool_transform.py
+142eae17652f7ec65d577887404fe15d201ff6a9c30d3b821cab5120726c45b9  tools/function_tool.py
+1c386c696443d0d408208e9522ca5e45cdbc814a95361e949d73921792335e15  tools/tool_transform.py
 114f6988d2f7f28911d20afa9792106f76b723e8f4f8c09625e2310b7db438a3  types.py
 fa2989f12fab5e66d73167836a695d3fe7470ea00f83fc3098f573f8b357d781  utilities/__init__.py
-492b2b02870f7ae4f4cd4d07ddc26695fcdb20fb2b0ac38c062759b53a7bb2c2  utilities/asgi_transport.py
+e4fb27297f16abfce1310a21b4f6f05a79e7987ffa644352471aaf19b7f25e14  utilities/asgi_transport.py
 00947ff9dfa76176a094ba5b0c62d2d3aeb62c1ec9c2f48373ec7f1b3b482ee0  utilities/async_utils.py
 cde0af6863c7ecaf5b43c5718d5a5186ebe83df93f4faabd484dc1b4cf5a1ae5  utilities/auth.py
 756eebcba1a9eabed3eb7f522df0ef90b0709147d46cf02e01224ead9b9e99b3  utilities/authorization.py
@@ -245,19 +245,19 @@ f5ea6721e8897f13fec46b647b960652d93377db4e88f02e10b7a4edb519d5e6  utilities/cli.
 d254480ddb82cb17eab1264cb27a06e4538980efdabc70abf4f23279f3c1c3aa  utilities/http.py
 5dcf6115ecc2ceffb21874d55a736f4d844d4e62ee66517c13b452594b174bb2  utilities/inspect.py
 c1a03ed3e93f3c06a48b232304f938a00a347874987d64576326bb32fefa8cca  utilities/json_schema.py
-056b62bea870a16499e8dd34b433b4771371b5e7bdaf5143256b819e4fd3bdc0  utilities/json_schema_type.py
-41a30eee26f03f4232b3b0ab3e88bfc925feaa4c08077c80f06a7eb8b4c5e1c1  utilities/lifespan.py
-c9734ef52ddc7185828b7a51bee16cff935cc52fef29a7e5c102d76709139790  utilities/logging.py
+d31c3e782b0093cad19aa77eedf5d609004c1bce4d5a10435b4867cbc277ce33  utilities/json_schema_type.py
+73e197ca8beea9407418760cfc37d7d7dc4f1a62c5926adffc3d88a2238c67cd  utilities/lifespan.py
+c4196a1f7f90295106b4add183e440ab4beb57c366d45d5b1243c5c35504461a  utilities/logging.py
 91d04debaa395607f66912bbf108371543dd38703c8fc15ffaa8bfea0d8b8344  utilities/mcp_server_config/__init__.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  utilities/mcp_server_config/v1/__init__.py
 3e0700699264439b4f892e4005ca983f40367b8a062e50f9e5e403c996751d6a  utilities/mcp_server_config/v1/environments/__init__.py
 7db0b50b6e63235c21c172e5210b668e2e41e141072e02afc392bc34809bdf76  utilities/mcp_server_config/v1/environments/base.py
-f042a9930897b88c18b2e4f9b6858cd047b9ce4509d74dfd3e5a1362aea82c42  utilities/mcp_server_config/v1/environments/uv.py
+792ff23f11a105ecde403fe6629d2bc87c372f3a0d552a03bac7f5c6525e73f1  utilities/mcp_server_config/v1/environments/uv.py
 117b0d7366fff43b24a18086da180fe7cf82c2e5cc4fb26d2570122bd0ed5d40  utilities/mcp_server_config/v1/mcp_server_config.py
 ca60cd14e5b37299e120c7899953d3c3d6fe36d1e81e8aeef0c7345a5495c546  utilities/mcp_server_config/v1/schema.json
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  utilities/mcp_server_config/v1/sources/__init__.py
 639302c49ca80ec6b1701375cc32f4099b45e68017c53ff2a90388fb37bd6f7e  utilities/mcp_server_config/v1/sources/base.py
-8ef921abcbee3b6ec59451143f7b6f96ede60905911879fb328d8413ffcbdd85  utilities/mcp_server_config/v1/sources/filesystem.py
+6ae16c7aa4667840350b278a61001cc6864a3c600110d35f49c077a2aa1fee82  utilities/mcp_server_config/v1/sources/filesystem.py
 99526bda0a6c8523eecb550bed72a03f815e379bca1ecaa870122a5af8e9a0ad  utilities/mime.py
 6890003fe8e02d81f2c1fe4ed7866e50ebfff06b699d7308724ceaa9f413f701  utilities/openapi/README.md
 c833f7723b65b8bf55695ab67261860ce5b21532dc6d6a3c6e887cc12e35ab83  utilities/openapi/__init__.py
@@ -265,8 +265,8 @@ cc3e84e216a480d7fd5e9d7048d21d8163de76ea79f031b229b4d910a819747e  utilities/open
 9eb89249d9644ba337379bbbc8140060ea6a5b642be1961d7cb214eed0cca404  utilities/openapi/formatters.py
 2519e15b22e67f513e35826b4e8948a25e3dbf5516fac0729d374059daacb885  utilities/openapi/json_schema_converter.py
 6d833c04a3bc731a66258221e5f15826a41e265e9c80898218ae226e29f4d612  utilities/openapi/models.py
-2e58bc03dd82687ef7a843474eb65c1f644eafe2c039eb0949a61cce8b313de9  utilities/openapi/parser.py
-01c2276726002ee579299104b92d540b58684660563432c847da30df4aee1eec  utilities/openapi/schemas.py
+b35f8d893c5ed7970a1df751bf745506d94c3b78f9c04f3e0d917e6523bfc03c  utilities/openapi/parser.py
+f5c7deab8f5ad60eb1803462a4592822efddac6b24529b8760e200299318214e  utilities/openapi/schemas.py
 9db69a1b408230d652ec39d89867449d504491aeda59fbc7285a14210575b7e3  utilities/pagination.py
 634850f693e36fc0e5c877581bdb7e990bfd7541676288170c6a1d1713755d46  utilities/prefab.py
 3db58fb4f30afb73083baeb8d94c9a23d9875980f091c19592b9eff89588764c  utilities/skills.py
@@ -274,7 +274,7 @@ cc3e84e216a480d7fd5e9d7048d21d8163de76ea79f031b229b4d910a819747e  utilities/open
 257c52460866cda5280d0916d20a7356bb12a0147ccd877c6b885baa4e97d2f6  utilities/tests.py
 6e158212fb4a31e14b309c7c65aefee8861ac62f8edb2ee06ba359e37df92c37  utilities/timeout.py
 0b105f303612c242d5be4569b185a3e9780b9749f693ba5392ebad223b5aa0d6  utilities/token_cache.py
-c08f41e1d9ea048256e1d62f281d50dda27cc724f992afc88f8729516ba6c721  utilities/types.py
+a772f7e792ac31dc56ba59c2fcd2de9d34a8fe8e83ecf770aec8cde43a506797  utilities/types.py
 81c9e16bb563e31101c5dad2f3711994aa4dff8dc0433720899144be44eacea8  utilities/ui.py
 c239eb18e36c9883456f7e95cf08def998a81af0c5f19da885e753fdd036a3ee  utilities/version_check.py
 5e19b700a340ef7fd8974571de2aa190ef1acfc609547aaa1729704bfc241ae2  utilities/versions.py

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/src/ha_mcp/_vendor/fastmcp/REQUIRES.txt

@@ -1,5 +1,6 @@
 authlib>=1.6.11
 beartype>=0.23.0rc2; (python_version >= '3.15')
+certifi>=2026.10.19
 cyclopts>=4.0.0
 exceptiongroup>=1.2.2
 griffelib>=2.0.0
@@ -8,12 +9,12 @@ joserfc>=1.5.0
 jsonref>=1.1.0
 jsonschema-path>=0.3.4
 mcp-types<3.0.0,>=2.0.0
-mcp<3.0.0,>=2.2.0
+mcp<3.0.0,>=2.3.0
 openapi-pydantic>=0.6.0
 opentelemetry-api>=1.28.0
 packaging>=24.0
 platformdirs>=4.0.0
-py-key-value-aio[filetree,keyring,memory]<0.5.0,>=0.4.4
+py-key-value-aio[filetree,memory]<0.5.0,>=0.4.4
 pydantic-settings>=2.0.0
 pydantic[email]>=2.12.0
 pyperclip>=1.9.0

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/src/ha_mcp/_vendor/fastmcp/VENDORED

@@ -1,2 +1,2 @@
-fastmcp-slim==4.1.2
+fastmcp-slim==4.1.4
 Vendored by scripts/vendor_fastmcp.py — do not edit by hand.

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/src/ha_mcp/_vendor/fastmcp/__init__.py

@@ -32,7 +32,7 @@ from ha_mcp._vendor.fastmcp import _compat
 
 _compat.install()
 
-__version__ = "4.1.2"
+__version__ = "4.1.4"
 
 if settings.deprecation_warnings:
     warnings.simplefilter("default", FastMCPDeprecationWarning)

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/src/ha_mcp/_vendor/fastmcp/apps/app.py

@@ -28,7 +28,7 @@ Usage::
 from __future__ import annotations
 
 import inspect
-from collections.abc import AsyncIterator, Callable, Sequence
+from collections.abc import AsyncGenerator, Callable, Sequence
 from contextlib import asynccontextmanager
 from typing import TYPE_CHECKING, Any, Literal, TypeVar, overload
 
@@ -429,7 +429,7 @@ class FastMCPApp(Provider):
         return await self._local._get_prompt(name, version)
 
     @asynccontextmanager
-    async def lifespan(self) -> AsyncIterator[None]:
+    async def lifespan(self) -> AsyncGenerator[None, None]:
         async with self._local.lifespan():
             yield
 

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/src/ha_mcp/_vendor/fastmcp/apps/generative.py

@@ -27,7 +27,7 @@ except ImportError as _exc:
     ) from _exc
 
 import json
-from collections.abc import AsyncIterator, Sequence
+from collections.abc import AsyncGenerator, Sequence
 from contextlib import asynccontextmanager
 from typing import Any
 
@@ -194,7 +194,7 @@ class GenerativeUI(Provider):
         return None
 
     @asynccontextmanager
-    async def lifespan(self) -> AsyncIterator[None]:
+    async def lifespan(self) -> AsyncGenerator[None, None]:
         self._ensure_setup()
         async with self._local.lifespan():
             yield

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/src/ha_mcp/_vendor/fastmcp/cli/cli.py

@@ -239,13 +239,7 @@ async def inspector(
             with_requirements=with_requirements,
             project=project,
             editable=[str(p) for p in with_editable] if with_editable else None,
-            port=server_port,  # Use deployment config for server port
         )
-
-        # Get server port from config if not specified via CLI
-        if not server_port:
-            server_port = config.deployment.port
-
     except FileNotFoundError:
         sys.exit(1)
 
@@ -293,9 +287,12 @@ async def inspector(
         # Build the fastmcp run command
         fastmcp_cmd = ["fastmcp", "run", server_spec, "--no-banner"]
 
-        # Forward module mode flag
+        # The Inspector connects over stdio, so a fastmcp.json deployment
+        # must not make the child serve HTTP. Module mode ignores --transport.
         if module:
             fastmcp_cmd.append("--module")
+        else:
+            fastmcp_cmd.extend(["--transport", "stdio"])
 
         # Add reload flags if enabled - the server will handle reloading
         if reload:

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/src/ha_mcp/_vendor/fastmcp/cli/client.py

@@ -208,7 +208,9 @@ async def _terminal_elicitation_handler(
     """
     from ha_mcp._vendor.mcp_types import ElicitRequestFormParams
 
-    console.print(f"\n[bold yellow]Server asks:[/bold yellow] {message}")
+    console.print(
+        f"\n[bold yellow]Server asks:[/bold yellow] {_sanitize_untrusted_text(message)}"
+    )
 
     if not isinstance(params, ElicitRequestFormParams):
         answer = console.input(
@@ -236,9 +238,12 @@ async def _terminal_elicitation_handler(
 
     result: dict[str, Any] = {}
     for field_name, field_schema in properties.items():
-        type_hint = field_schema.get("type", "string")
+        type_hint = _sanitize_untrusted_text(str(field_schema.get("type", "string")))
         req_marker = " [red]*[/red]" if field_name in required else ""
-        prompt_text = f"  [cyan]{field_name}[/cyan] ({type_hint}){req_marker}: "
+        prompt_text = (
+            f"  [cyan]{_sanitize_untrusted_text(field_name)}[/cyan] "
+            f"({type_hint}){req_marker}: "
+        )
 
         raw = console.input(prompt_text)
         if raw.strip().lower() == "decline":

{ha_mcp_dev-9.1.0.dev3350 → ha_mcp_dev-9.1.0.dev3355}/src/ha_mcp/_vendor/fastmcp/cli/deploy/state.py

@@ -7,7 +7,7 @@ import json
 import os
 import subprocess
 import tempfile
-from collections.abc import Iterator
+from collections.abc import Generator
 from contextlib import contextmanager, suppress
 from pathlib import Path
 from typing import Any, TypeVar
@@ -94,7 +94,7 @@ def _prepare_directory(path: Path) -> None:
 
 
 @contextmanager
-def state_lock(directory: Path) -> Iterator[None]:
+def state_lock(directory: Path) -> Generator[None, None, None]:
     """Lock related CLI state changes across processes."""
     _prepare_directory(directory)
     lock_path = directory / ".state.lock"