Fixed
- An automation watching a template sensor or helper computed from what the agent changes now asks for the Critical Action PIN when it would unlock or open something (#820). Since 3.44.7 a change the agent makes is checked against the automations watching that entity, but not those watching an entity computed from it: turning on an input boolean read by a template binary sensor, whose automation unlocked the front door, ran with no PIN. Entities computed from the changed one are now followed the way Home Assistant tracks them: template entities whose templates read it at their last render, trigger-based template entities it triggers, and helpers subscribed to its changes (min/max, threshold, bayesian, statistics, filter, utility meter, switch_as_x and others, YAML or UI), through several steps. If a Home Assistant update renames what this reads, a warning is logged.
- A change the agent makes that starts an automation which unlocks or opens something now asks for the Critical Action PIN (#814). Turning on an input boolean, a switch or a light, running a script or scene, or (through a service tool) marking a phone home or publishing to MQTT can start an automation you wrote, and the PIN check looked only at the call: turning on an input boolean whose automation unlocked the front door ran with no PIN. Each entity a call changes, and any group holding it, is now checked against the automations that may react to it (by its id, or through a trigger that cannot be tied to entities ahead, such as a
state_changedevent), and the call is held when one of them would unlock or open something. The PIN prompt names that automation. Your own automations are held only for what can be read as protected (including a scene, script or automation they run), so one that fires an event or calls a REST command does not make a light ask for the PIN; disabled automations' triggers, and waits in scripts or automations that are not running, do not count. Automations started by other events (a phone notification's button, a remote) or watching other entities are not counted; automations on entities computed from the changed one, such as a template sensor, are not yet followed (#820).
This is a safety hotfix on top of 3.44.7; it contains nothing else. Field-tested: turning on a helper read by a template binary sensor, and one read by a template sensor feeding a min/max helper, each asks for the PIN when an automation on that sensor unlocks a lock; turning on an ordinary light does not.