ha-mcp-dev 9.2.0.dev3467__tar.gz → 9.2.0.dev3469__tar.gz

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 9.2.0.dev3467
+Version: 9.2.0.dev3469
 Summary: Configure and automate Home Assistant with Claude, ChatGPT, and other AI assistants.
 Keywords: mcp,home-assistant,ai,automation,smart-home
 Author: Julien

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "9.2.0.dev3467"
+version = "9.2.0.dev3469"
 description = "Configure and automate Home Assistant with Claude, ChatGPT, and other AI assistants."
 readme = "README.md"
 requires-python = ">=3.13,<3.15"

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "9.2.0.dev3467"
+version = "9.2.0.dev3469"
 description = "Configure and automate Home Assistant with Claude, ChatGPT, and other AI assistants."
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/requirements.txt

@@ -5,7 +5,7 @@
 # scripts/vendor_fastmcp.py (fastmcp-slim, mcp, mcp-types) before committing
 # a bump; tests/src/unit/test_vendored_*.py reject stale or altered trees.
 # For a manual pin change, run the same generator and commit its outputs.
-websockets==17.2
+websockets==17.4
 fastmcp-slim==4.1.6
 mcp==2.3.0
 mcp-types==2.3.0

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/MANIFEST.sha256

@@ -1,25 +1,25 @@
 3d6a0c050d8bec52fabad502e45fb25bd02bcadbd70dea34d447b6a0ff4e6da8  LICENSE
-a6c00001a575dfb862e0d167e507325c4639b0c87ee7a337b0c734422727a404  VENDORED
-ce6042263ec421ae99244403a787487739dfcc025403c756e35fa3ec49be4034  __init__.py
+85472f7f77c3ac0108711ab756774070b0218425f9e9f3d8b5ed26746ad658c1  VENDORED
+96901d1c200b5df20d9b2443b4ee68a51b69155ca13fbbab9b18a4ca3e3fbad1  __init__.py
 c2ee4ddb093c9af060cafaf68219907f8a6b7b301ed3f8bea75db7555adec987  __main__.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  asyncio/__init__.py
 581192ec6ae3781ac4968b6ec38e64502ff1acfe38f72ba2a7d4c2066d7216b1  asyncio/client.py
-f2eb6ad56371fab33839a7ad2694e4b5610bea839bf92ae1f76e6d0a63f1e346  asyncio/connection.py
-bc13ddf7722e2f72c4d0e4b179a202223cefca886de7792687efd9868f9b1b35  asyncio/messages.py
+115ae298e176d5fe06132fee86147ccd98466ff0c7956e2305166ac8e3dcb06e  asyncio/connection.py
+ab9bc4bd8b8c9dbd45ffc56fd8fa6b9bc979d73dd4727329e417858ad1bfa6e6  asyncio/messages.py
 2453543482e4001e4ff5fb7a3cba2035a66aea9f765b3d7dbc89717f1d434e58  asyncio/router.py
-f5aab916ff9bf604c77c8635879e80e223489ba05eaf921002471d5421316373  asyncio/server.py
+df978af9c191841999655480f71d062bc4c6b92e0095ba3d5b6503ec7aff46d2  asyncio/server.py
 53f2709a7e7d65143a11e7293af322cd0086fd96c0be051fd6293b85a6510b77  auth.py
 7d87f462aad6231fe224303e45675cce1e6f8cef69e99c59be613beb56d4420d  cli.py
 eaf4e66220a92297bc794adc98494e63ea0aae21fa394c72a7e846a535af3cc7  client.py
 38b88c56435ddb9ffceac07c43b0ab0b00685f2f6703438281d80b440f16511f  connection.py
 5c64efbe015d6527af355fd3ebe2e8f83c66d951f125c80a9789750cd43a7d4f  datastructures.py
-b69d3f132a907ddec260d3879b102278e1fc11df4f49016dd7c7be0ae45e4ce6  exceptions.py
+18783b89d7eb01220a2236152ab86321fa6ddb1deed351e2b6d22ef35e33124e  exceptions.py
 42466cc5a255965552a75ba1743e6e3c689b75bc7fd3dd46ad555f4b92d7729c  extensions/__init__.py
 24d7f2939e370bb56e3c7d103a86e2a8aa06af38c920b8deeaccf920bbce3e5e  extensions/base.py
 d97d5fdd3e47b8e4176d89e61d7f8c937ab5b76d67f94fc585f8d2ea81c189bc  extensions/permessage_deflate.py
 62cb106e8c23dbadf19bb5e74006a18dc4650381ddcb5592058b61b1fc7c10fb  frames.py
-c909cf963559c15d7f57ea4e49128d2c6feef36ef0142d61ef671c8a88dc43c3  headers.py
-b4b56e36f3400f0b7c775ba2e4a305299099313b49e82a9766f7a880b68f6dfd  http11.py
+c7f645f6743ec5190c351e78072373cf1f06b11812ac97e8093a7b7f165c9912  headers.py
+da6463e1f27f1e37b2c517d4b607f94ed917c29fcc874a1640b38e6496249d07  http11.py
 4ff07d4d4987a1c78a310f8f36985d410007d97771031c1240d790120a882e41  imports.py
 c10e7344810d1944bfe5e28d017f42444ef1d53c0a6a92a29ab40515637d4b1b  legacy/__init__.py
 0dc41c09279578ff7725c1fcbc5584d072092fe5fe7f6dcb6740ec2696afd52a  legacy/auth.py
@@ -28,28 +28,28 @@ e6826ead47333dd7578bc45d7b97c0da10f7578a67bfffd9eb8a514573fa1c1b  legacy/client.
 6f4c0cc7cdd74c85d56683bad299770226ca1db4250dbeeb040ca114491a3029  legacy/framing.py
 d8dcebe40376c6f0c2e4474d3fe901de539cac069436562e8fffa1aff8efee93  legacy/handshake.py
 e51bb9a87d5dc09f440c0879f82089688eca021ae4e63edf554ffadf2e4a7de2  legacy/http.py
-dcc4e1d7ed24b564ad4425f4d252d5ebd80bcc5ffd8009fc60b144fdb664cd8c  legacy/protocol.py
+544de39900bdd9e18df03beb8976e65bfa126b45cbb1bcad7c2d804ae4f61b74  legacy/protocol.py
 8529389c54ec23778c45bbb925c2388177a2f546f0d3b452ad28ed2f878cda07  legacy/server.py
-dc7b8204c2d324cc69f491dde49301aad4c5f384ac636f62b871f4cb39ee0ff4  protocol.py
+356dcca7cf7a459bccc7c6bfda3a67135eff3c609506b6cd137cf32f4f8cbc5e  protocol.py
 83276f75aa0972dc7219166e91dd6f2a29aec65e046214f579ef5a3c7aa39193  proxy.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  py.typed
 ee41092f540414ef294c1f74c0fe1f51b9336060dc6e44daee34ef762499b509  server.py
 ac9ac33522fd872dc42587353c51e3631e2b75dd6f10b0ae6b40b074588737ff  streams.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  sync/__init__.py
 0265d98a4c558359b7f727e5d4ebe6f4a637c5a4dfcd7797350dfacaf60c1ea4  sync/client.py
-dd9c4c859f4fcc8ccaccd168f02efc24b2567e39e1d10ccf78c93a87f94fe044  sync/connection.py
-abc2b5bf176ba959356ef9f7cd6d49c74f5395a908592c9870e1c2eee7854269  sync/messages.py
+c03a5e12fc879efc34f0c6fa4747915eaae71767649d46ae283ae2cf1156a878  sync/connection.py
+ddbcb6a00489bb571fe518aec06afd5d880a1e7db54d40ef548e18897fa6416d  sync/messages.py
 c0e180bc66cac17caa98d1050425993f77da1efcbfd8c28deced977842fc9c62  sync/router.py
-a316c9f5bb35f1264e636b9256b4e176d2cef06386c88279838c8541cabe5858  sync/server.py
+fb98217246d4384723942292cd55668f1ccf9e990f48b6f2e97c52926ea09f23  sync/server.py
 4ed5be9dc605bc99a2496da03bcea7804d8156c9e705d2fee07f3c91634361b8  sync/utils.py
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  trio/__init__.py
 951e2e225679024d6027c09b720f371b7a773db90ed3400c2500ae9f9d8505b6  trio/client.py
-d571c39156caddefccf75a4e186798793d286b350ce4d8ea1cea30d0590dae06  trio/connection.py
-4a66c0d64fe58c41ae10764d2741cf0def3ea231ed313897191db41eb3c9b8a9  trio/messages.py
+d0034e74663729fb87f77a678b77517e0010a6666dcdb6417215e2481512ef6e  trio/connection.py
+94ef1e56330c8b734e95988302fde66fd1eeef86d9577667d5b18811d819fa80  trio/messages.py
 a992fdfb8e268bd48e393194dc22c13ee68237369f406a99f9f265f61569bfeb  trio/router.py
 0275d2a1425c780c854caa937060db6a3ac406ddaf9033289305af5925d4bb7f  trio/server.py
 035d8d6143ce8d06a21aeb1a938de85b33c8702c618a429390024b5ed649bdc6  trio/utils.py
 72ef3d9ff5d05e7a3f83da8fa459a12db6f39c4f8c2956b3500a30b36bb926a5  typing.py
 4cd1600ef343a207c44b0fbbf17f140e487da49174dda7be76e8eda7113c04eb  uri.py
 59db6c876a908872eb5d40449e9dcb6ad30b253663076084adb78e16fadd5ef1  utils.py
-15757e2221681ad967e40fe2e5a612a46bdb4c11a25948114aca2ba4dbfcde1a  version.py
+7a71c96a059a913dd8e0b3d1e8b8ec9366c80f879b20677f306339d967391c4c  version.py

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/VENDORED

@@ -1,2 +1,2 @@
-websockets==17.2
+websockets==17.4
 Vendored by scripts/vendor_websockets.py — do not edit by hand.

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/__init__.py

@@ -60,6 +60,7 @@ __all__ = [
     "RequestLineTooLong",
     "SecurityError",
     "StatusLineTooLong",
+    "TooManyFragments",
     "TooManyHeaders",
     "WebSocketException",
     # .frames
@@ -131,6 +132,7 @@ if TYPE_CHECKING:
         RequestLineTooLong,
         SecurityError,
         StatusLineTooLong,
+        TooManyFragments,
         TooManyHeaders,
         WebSocketException,
     )
@@ -203,6 +205,7 @@ else:
             "RequestLineTooLong": ".exceptions",
             "SecurityError": ".exceptions",
             "StatusLineTooLong": ".exceptions",
+            "TooManyFragments": ".exceptions",
             "TooManyHeaders": ".exceptions",
             "WebSocketException": ".exceptions",
             # .frames

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/asyncio/connection.py

@@ -18,6 +18,7 @@ from ..exceptions import (
     ConnectionClosed,
     ConnectionClosedOK,
     ProtocolError,
+    TooManyFragments,
 )
 from ..frames import DATA_OPCODES, PONG, CloseCode, Frame
 from ..http11 import Request, Response
@@ -115,9 +116,9 @@ class Connection(asyncio.Protocol):
         # Task that sends keepalive pings. None when ping_interval is None.
         self.keepalive_task: asyncio.Task[None] | None = None
 
-        # Exception raised while reading from the connection, to be chained to
-        # ConnectionClosed in order to show why the TCP connection dropped.
-        self.recv_exc: BaseException | None = None
+        # Exception that caused the connection to drop, to chain to
+        # ConnectionClosed.
+        self.connection_exc: BaseException | None = None
 
         # Completed when the TCP connection is closed and the WebSocket
         # connection state becomes CLOSED.
@@ -304,7 +305,12 @@ class Connection(asyncio.Protocol):
                 "cannot call recv while another coroutine "
                 "is already running recv or recv_streaming"
             ) from None
+        except TooManyFragments as exc:
+            self.set_connection_exc(exc)
+            async with self.send_context():
+                self.protocol.fail(CloseCode.MESSAGE_TOO_BIG, "too many fragments")
         except UnicodeDecodeError as exc:
+            self.set_connection_exc(exc)
             async with self.send_context():
                 self.protocol.fail(
                     CloseCode.INVALID_DATA,
@@ -314,7 +320,7 @@ class Connection(asyncio.Protocol):
 
         # Wait for the protocol state to be CLOSED before accessing close_exc.
         await asyncio.shield(self.connection_lost_waiter)
-        raise self.protocol.close_exc from self.recv_exc
+        raise self.close_exc
 
     @overload
     def recv_streaming(self, decode: Literal[True]) -> AsyncIterator[str]: ...
@@ -382,6 +388,7 @@ class Connection(asyncio.Protocol):
                 "is already running recv or recv_streaming"
             ) from None
         except UnicodeDecodeError as exc:
+            self.set_connection_exc(exc)
             async with self.send_context():
                 self.protocol.fail(
                     CloseCode.INVALID_DATA,
@@ -391,7 +398,7 @@ class Connection(asyncio.Protocol):
 
         # Wait for the protocol state to be CLOSED before accessing close_exc.
         await asyncio.shield(self.connection_lost_waiter)
-        raise self.protocol.close_exc from self.recv_exc
+        raise self.close_exc
 
     async def send(
         self,
@@ -881,9 +888,6 @@ class Connection(asyncio.Protocol):
         wait_for_close = False
         # Should we close the transport and raise ConnectionClosed?
         raise_close_exc = False
-        # What exception should we chain ConnectionClosed to?
-        original_exc: BaseException | None = None
-
         if self.protocol.state is expected_state:
             # Let the caller interact with the protocol.
             try:
@@ -898,7 +902,7 @@ class Connection(asyncio.Protocol):
                 # connection and raise the exception to the caller.
                 wait_for_close = False
                 raise_close_exc = True
-                original_exc = exc
+                self.set_connection_exc(exc)
             else:
                 # Check if the connection is expected to close soon.
                 if self.protocol.close_expected():
@@ -923,7 +927,7 @@ class Connection(asyncio.Protocol):
                     # other exceptions would be treated identically.
                     wait_for_close = False
                     raise_close_exc = True
-                    original_exc = exc
+                    self.set_connection_exc(exc)
 
         else:  # self.protocol.state is not expected_state
             # Minor layering violation: we assume that the connection
@@ -942,14 +946,12 @@ class Connection(asyncio.Protocol):
                 async with asyncio.timeout_at(self.close_deadline):
                     await asyncio.shield(self.connection_lost_waiter)
             except TimeoutError:
-                # There's no risk of overwriting another error because
-                # original_exc is never set when wait_for_close is True.
-                assert original_exc is None
-                original_exc = TimeoutError("timed out while closing connection")
-                # Set recv_exc before closing the transport in order to get
-                # proper exception reporting.
+                # Set connection_exc before closing the transport in order to
+                # get proper exception reporting.
                 raise_close_exc = True
-                self.set_recv_exc(original_exc)
+                self.set_connection_exc(
+                    TimeoutError("timed out while closing connection")
+                )
 
         # If an error occurred, close the transport to terminate the connection and
         # raise an exception.
@@ -957,7 +959,7 @@ class Connection(asyncio.Protocol):
             self.transport.abort()
             # Wait for the protocol state to be CLOSED before accessing close_exc.
             await asyncio.shield(self.connection_lost_waiter)
-            raise self.protocol.close_exc from original_exc
+            raise self.close_exc
 
     def send_data(self) -> None:
         """
@@ -984,15 +986,20 @@ class Connection(asyncio.Protocol):
                         self.logger.debug("x closing TCP connection")
                     self.transport.close()
 
-    def set_recv_exc(self, exc: BaseException | None) -> None:
-        """
-        Set recv_exc, if not set yet.
+    @property
+    def close_exc(self) -> ConnectionClosed:
+        exc = self.protocol.close_exc
+        if self.connection_exc is not None:
+            exc.__cause__ = self.connection_exc
+        return exc
 
-        This method must be called only from connection callbacks.
+    def set_connection_exc(self, exc: BaseException | None) -> None:
+        """
+        Set connection_exc, if not set yet.
 
         """
-        if self.recv_exc is None:
-            self.recv_exc = exc
+        if self.connection_exc is None:
+            self.connection_exc = exc
 
     # asyncio.Protocol methods
 
@@ -1018,7 +1025,7 @@ class Connection(asyncio.Protocol):
         self.protocol.receive_eof()
         assert self.protocol.state is CLOSED
 
-        self.set_recv_exc(exc)
+        self.set_connection_exc(exc)
 
         # Abort recv() and pending pings with a ConnectionClosed exception.
         self.recv_messages.close()
@@ -1092,7 +1099,7 @@ class Connection(asyncio.Protocol):
         except Exception as exc:
             if self.debug:
                 self.logger.debug("! error while sending data", exc_info=True)
-            self.set_recv_exc(exc)
+            self.set_connection_exc(exc)
 
         # If needed, set the close deadline based on the close timeout.
         if self.protocol.close_expected():

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/asyncio/messages.py

@@ -3,10 +3,11 @@ from __future__ import annotations
 import asyncio
 import codecs
 import collections
-from collections.abc import AsyncIterator, Iterable
+import os
+from collections.abc import AsyncIterator, Sequence
 from typing import Any, Callable, Generic, Literal, TypeVar, overload
 
-from ..exceptions import ConcurrencyError
+from ..exceptions import ConcurrencyError, TooManyFragments
 from ..frames import BINARY, CONT, TEXT, Frame
 from ..typing import Data
 
@@ -15,6 +16,8 @@ __all__ = ["Assembler"]
 
 UTF8Decoder = codecs.getincrementaldecoder("utf-8")
 
+MAX_FRAGMENTS = int(os.environ.get("WEBSOCKETS_MAX_FRAGMENTS", "4096"))
+
 T = TypeVar("T")
 
 
@@ -54,11 +57,10 @@ class SimpleQueue(Generic[T]):
                 self.get_waiter = None
         return self.queue.popleft()
 
-    def reset(self, items: Iterable[T]) -> None:
-        """Put back items into an empty, idle queue."""
-        assert self.get_waiter is None, "cannot reset() while get() is running"
-        assert not self.queue, "cannot reset() while queue isn't empty"
-        self.queue.extend(items)
+    def put_back(self, items: Sequence[T]) -> None:
+        """Put back items at the front of the queue."""
+        assert self.get_waiter is None, "cannot put_back() while get() is running"
+        self.queue.extendleft(reversed(items))
 
     def abort(self) -> None:
         """Close the queue, raising EOFError in get() if necessary."""
@@ -167,12 +169,16 @@ class Assembler:
                 try:
                     frame = await self.frames.get(not self.closed)
                 except asyncio.CancelledError:
-                    # Put frames already received back into the queue
-                    # so that future calls to get() can return them.
-                    self.frames.reset(frames)
+                    # Put frames already received back into the queue so that
+                    # future calls to get() can return them. The queue may be
+                    # non-empty if put() added frames in the same iteration of
+                    # the event loop where get() was canceled.
+                    self.frames.put_back(frames)
                     raise
                 self.maybe_resume()
                 assert frame.opcode is CONT
+                if len(frames) >= MAX_FRAGMENTS:
+                    raise TooManyFragments(MAX_FRAGMENTS)
                 frames.append(frame)
 
         finally:

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/asyncio/server.py

@@ -870,7 +870,10 @@ def basic_auth(
                 expected_password = credentials_dict[username]
             except KeyError:
                 return False
-            return hmac.compare_digest(expected_password, password)
+            return hmac.compare_digest(
+                expected_password.encode(errors="surrogateescape"),
+                password.encode(errors="surrogateescape"),
+            )
 
     assert check_credentials is not None  # help mypy
 

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/exceptions.py

@@ -34,6 +34,7 @@
         * :exc:`RedirectHandshake` (legacy)
     * :exc:`ProtocolError` (Sans-I/O)
     * :exc:`PayloadTooBig` (Sans-I/O)
+    * :exc:`TooManyFragments`
     * :exc:`InvalidState` (Sans-I/O)
     * :exc:`ConcurrencyError`
 
@@ -59,6 +60,7 @@ __all__ = [
     "StatusLineTooLong",
     "HeaderLineTooLong",
     "TooManyHeaders",
+    "TooManyFragments",
     "ProxyError",
     "InvalidProxyMessage",
     "InvalidProxyStatus",
@@ -498,6 +500,13 @@ class PayloadTooBig(WebSocketException):
             self.current_size = current_size
 
 
+class TooManyFragments(WebSocketException):
+    """Raised when reassembling message that contains too many frames."""
+
+    def __init__(self, max_fragments: int) -> None:
+        super().__init__(f"fragmented message exceeds limit of {max_fragments} frames")
+
+
 class InvalidState(WebSocketException, AssertionError):
     """
     Raised when sending a frame is forbidden in the current state.

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/headers.py

@@ -530,6 +530,8 @@ def parse_authorization_basic(header: str) -> tuple[str, str]:
 
     Return a ``(username, password)`` tuple.
 
+    Non-UTF-8 data is represented with surrogate code points.
+
     Args:
         header: Value of the ``Authorization`` header.
 
@@ -555,12 +557,13 @@ def parse_authorization_basic(header: str) -> tuple[str, str]:
     parse_end(header, pos, "Authorization")
 
     try:
-        user_pass = base64.b64decode(basic_credentials.encode()).decode()
+        user_pass_bytes = base64.b64decode(basic_credentials.encode())
     except binascii.Error:
         raise InvalidHeaderValue(
             "Authorization",
             "expected base64-encoded credentials",
         ) from None
+    user_pass = user_pass_bytes.decode(errors="surrogateescape")
     try:
         username, password = user_pass.split(":", 1)
     except ValueError:
@@ -578,9 +581,12 @@ def build_authorization_basic(username: str, password: str) -> str:
 
     This is the reverse of :func:`parse_authorization_basic`.
 
+    Non-UTF-8 data can be represented with surrogate code points.
+
     """
     # https://datatracker.ietf.org/doc/html/rfc7617#section-2
     assert ":" not in username
     user_pass = f"{username}:{password}"
-    basic_credentials = base64.b64encode(user_pass.encode()).decode()
+    user_pass_bytes = user_pass.encode(errors="surrogateescape")
+    basic_credentials = base64.b64encode(user_pass_bytes).decode()
     return "Basic " + basic_credentials

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/http11.py

@@ -80,6 +80,19 @@ _token_re = re.compile(rb"[-!#$%&\'*+.^_`|~0-9a-zA-Z]+")
 
 _value_re = re.compile(rb"[\x09\x20-\x7e\x80-\xff]*")
 
+# Regexes for validating status codes and numeric header values.
+# Set a lower limit than default_max_str_digits; 1 EB is plenty.
+
+# Content-Length = 1*DIGIT
+# See https://datatracker.ietf.org/doc/html/rfc9110#section-8.6
+
+_digits_re = re.compile(rb"[0-9]{1,18}")
+
+# chunk-size = 1*HEXDIG
+# See https://datatracker.ietf.org/doc/html/rfc9112#section-7.1
+
+_hexdigits_re = re.compile(rb"[0-9a-fA-F]{1,15}")
+
 
 @dataclasses.dataclass
 class Request:
@@ -147,6 +160,7 @@ class Request:
             TooManyHeaders: If there are too many headers.
             UnicodeDecodeError: If the request method or path isn't ASCII.
             ValueError: If the request isn't well formatted.
+            NotImplementedError: If the request uses Transfer-Encoding.
 
         """
         # https://datatracker.ietf.org/doc/html/rfc7230#section-3.1.1
@@ -183,11 +197,11 @@ class Request:
         if "Transfer-Encoding" in headers:
             raise NotImplementedError("transfer codings aren't supported")
 
-        if "Content-Length" in headers:
-            # Some devices send a Content-Length header with a value of 0.
-            # This raises ValueError if Content-Length isn't an integer too.
-            if int(headers["Content-Length"]) != 0:
-                raise ValueError("unsupported request body")
+        # Some devices send a Content-Length header with a value of 0.
+        # Reject any other value. For technical correctness, accept
+        # multiple Content-Length headers, all with a value of 0.
+        if not set(headers.get_all("Content-Length")) <= {"0"}:
+            raise ValueError("unsupported request body")
 
         return cls(path, headers, method, protocol)
 
@@ -274,6 +288,8 @@ class Response:
             SecurityError: If the response body exceeds a security limit.
             LookupError: If the response isn't well formatted.
             ValueError: If the response isn't well formatted.
+            NotImplementedError: If the response uses Transfer-Encoding, and
+                it isn't "chunked".
 
         """
         # https://datatracker.ietf.org/doc/html/rfc7230#section-3.1.2
@@ -298,12 +314,11 @@ class Response:
                 raise ValueError(
                     f"unsupported protocol; expected HTTP/1.1: {d(status_line)}"
                 )
-        try:
-            status_code = int(raw_status_code)
-        except ValueError:  # invalid literal for int() with base 10
+        if not _digits_re.fullmatch(raw_status_code):
             raise ValueError(
                 f"invalid status code; expected integer; got {d(raw_status_code)}"
-            ) from None
+            )
+        status_code = int(raw_status_code)
         if not 100 <= status_code < 600:
             raise ValueError(
                 f"invalid status code; expected 100–599; got {d(raw_status_code)}"
@@ -452,7 +467,7 @@ def read_body(
     # MultipleValuesError is sufficiently unlikely that we don't attempt to
     # handle it when accessing headers. Instead we document that its parent
     # class, LookupError, may be raised.
-    # Conversions from str to int are protected by sys.set_int_max_str_digits..
+    # Conversions from str to int are protected by sys.set_int_max_str_digits.
 
     elif (coding := headers.get("Transfer-Encoding")) is not None:
         if coding != "chunked":
@@ -462,10 +477,8 @@ def read_body(
         while True:
             chunk_size_line = yield from parse_line(read_line, SecurityError)
             raw_chunk_size = chunk_size_line.split(b";", 1)[0]
-            # Set a lower limit than default_max_str_digits; 1 EB is plenty.
-            if len(raw_chunk_size) > 15:
-                str_chunk_size = raw_chunk_size.decode(errors="backslashreplace")
-                raise SecurityError(f"chunk too large: 0x{str_chunk_size} bytes")
+            if not _hexdigits_re.fullmatch(raw_chunk_size):
+                raise SecurityError(f"invalid chunk size: {d(raw_chunk_size)}")
             chunk_size = int(raw_chunk_size, 16)
             if chunk_size == 0:
                 break
@@ -481,9 +494,8 @@ def read_body(
         return body
 
     elif (raw_content_length := headers.get("Content-Length")) is not None:
-        # Set a lower limit than default_max_str_digits; 1 EiB is plenty.
-        if len(raw_content_length) > 18:
-            raise SecurityError(f"body too large: {raw_content_length} bytes")
+        if not _digits_re.fullmatch(raw_content_length.encode("iso-8859-1")):
+            raise SecurityError(f"invalid content length: {raw_content_length}")
         content_length = int(raw_content_length)
         if content_length > MAX_BODY_SIZE:
             raise SecurityError(f"body too large: {content_length} bytes")

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/legacy/protocol.py

@@ -4,6 +4,7 @@ import asyncio
 import codecs
 import collections
 import logging
+import os
 import random
 import ssl
 import struct
@@ -23,6 +24,7 @@ from ..exceptions import (
     InvalidState,
     PayloadTooBig,
     ProtocolError,
+    TooManyFragments,
 )
 from ..extensions import Extension
 from ..frames import (
@@ -44,6 +46,8 @@ from .framing import Frame, prepare_ctrl, prepare_data
 
 __all__ = ["WebSocketCommonProtocol"]
 
+MAX_FRAGMENTS = int(os.environ.get("WEBSOCKETS_MAX_FRAGMENTS", "4096"))
+
 
 # In order to ensure consistency, the code always checks the current value of
 # WebSocketCommonProtocol.state before assigning a new value and never yields
@@ -991,6 +995,10 @@ class WebSocketCommonProtocol(asyncio.Protocol):
             self.transfer_data_exc = exc
             self.fail_connection(CloseCode.MESSAGE_TOO_BIG)
 
+        except TooManyFragments as exc:
+            self.transfer_data_exc = exc
+            self.fail_connection(CloseCode.MESSAGE_TOO_BIG, "too many fragments")
+
         except Exception as exc:
             # This shouldn't happen often because exceptions expected under
             # regular circumstances are handled above. If it does, consider
@@ -1071,6 +1079,8 @@ class WebSocketCommonProtocol(asyncio.Protocol):
                 raise ProtocolError("incomplete fragmented message")
             if frame.opcode != OP_CONT:
                 raise ProtocolError("unexpected opcode")
+            if len(fragments) >= MAX_FRAGMENTS:
+                raise TooManyFragments(MAX_FRAGMENTS)
             append(frame)
 
         return ("" if text else b"").join(fragments)

{ha_mcp_dev-9.2.0.dev3467 → ha_mcp_dev-9.2.0.dev3469}/src/ha_mcp/_vendor/websockets/protocol.py

@@ -155,6 +155,8 @@ class Protocol:
         self.writes: list[bytes] = []
         self.parser = self.parse()
         next(self.parser)  # start coroutine
+
+        # Exception that caused the parser to stop, chained to ConnectionClosed.
         self.parser_exc: Exception | None = None
 
     @property