Fixed
- Opening a garage door, gate or door cover now asks for the Critical Action PIN when its entity id doesn't say so (#773). The recommended rules looked for
door,gateorgaragein the cover's entity id only. A cover with a plain id (such ascover.msg100_abc) opened with no PIN even when its device class was garage, gate or door, or its name was "Garage Door", and so did a cover group likecover.all_covers("All Covers") holding the garage door. That held whether the agent opened it directly, by name through "turn on", in a scene it activated, or in an automation it wrote. A rule's word now also matches a cover whose device class is that word (the one Home Assistant reports, the one set under "Show as", or the integration's own, so a garage door shown as a blind is still held), or whose name, alias or device name has it (or its plural) with no letter next to it ("Garage Door", "Driveway Gates", "Gate1", not "Indoor Blinds"), unless its integration says it is a blind, shade, curtain, awning or window (setting "Show as", orcustomizein YAML, does not turn this off). Any group holding a matching cover (cover group, MQTT or ZHA group, or old-style group, nested to any depth) is held too. Covers and groups that are not set up yet count, since an automation the agent writes runs later: a cover not set up yet that its integration does not class as a blind, shade, curtain, awning or window, a group member Home Assistant does not know yet, and a group helper whose members can't be read are held; a disabled entity is not. Each extra match names one entity exactly, socover.abeing a garage door does not holdcover.awning. Rules you added yourself get the same reach: one formsg100now also holds a group containing that cover, and one written like an id (garage_door) matches the name "Garage Door". The security audit's list of public webhook automations that perform a critical action uses the same rules. Group membership and device class are read when the automation is written, so a garage door added to a group later is not checked again. Still not held, so add a rule naming part of the entity id: a cover with no device class whose id and name both lack the words (including a name in another language or a run-together word like "GarageDoor"), a cover whose only link to the words is its area's name, and the switch a garage cover is built on, switched directly (#794).
This is a safety fix and ships on its own. Everything else waiting on main ships in the next monthly release.