Added
- User-configurable custom filesystem directories for the file tools (closes #1567)
(#1568) - Expose all user-tunable env vars in the settings UI (add-on parity)
(#1554) - Warn when default MCP_SECRET_PATH is bound non-loopback
(#1472) - search: Consolidate ha_search_entities + ha_deep_search into ha_search
(#1529) - addon: Install the MCP Server add-on from the ha_mcp_tools integration
(#1528) - Add opt-in dashboard screenshot mode
(#1510) - Add Linux support for install & docs
(#1096) - Surface the web settings page for non-add-on installs (#1458)
(#1511) - Convert Pydantic arg-validation errors to actionable ToolErrors
(#1491) - Per-key toggles for automation/script/scene in packages/*.yaml
(#1476) - Direct skills retrieval for write tools + improved best practice checker warnings with embedded skills responses (#1182)
(#1448) - Detect last_changed/last_updated duration math and suggest for: field (#1157)
(#1264) - Advanced settings panel + nested beta master toggle (#1164)
(#1431) - Allow automation/script/scene yaml_path in packages/*.yaml only
(#1452) - Restrict ha_mcp_tools services to ha-mcp callers (caller token + ha_call_service refusal)
(#1459)
Changed
- security: Soften vulnerability-response SLA to best-effort
(a24e7da) - Update contributors list [contributors-updated]
(7cc187f) - Telemetry wording — follow HA analytics setting, not opt-in-only
(#1481) - security: Note that security-advisory disposition is API-blind (UI-only)
(#1561) - tools: Sharpen ha_eval_template usage routing for compute-from-state queries
(#1550) - Differentiate ha-mcp from Home Assistant's built-in MCP Server
(#1542) - Update advanced mode notes
(#1533) - #1157: Scripts native-for: guidance + fix numeric_state-condition for: overclaim
(#1480) - Clarify add-on vs uvx; add Codex + HTTP-native client setup
(#1478) - security: Explicit threat model for trusted clients, LAN, sandbox, and OAuth tokens
(#1463) - Clarify telemetry is a planned future feature, not implemented
(#1469)
Fixed
- tools: Bring HA API field names to 2026.6 — stale docstrings, automation plural canonicalization, fan speed (closes #1540)
(#1566) - energy: Accept "water" energy source in ha_manage_energy_prefs
(#1553) - tools: Use action: not service: in automation docstring examples
(#1539) - security: Narrow GHSA-mc92-ww4q-6fg4 to the masker and log redaction
(#1512) - addon: Restrict settings UI root routes to HA ingress
(#1508) - Add name attributes to generated settings-UI form controls (a11y)
(#1497) - Add-on-aware code-mode locked note + suppress settings-UI favicon 404
(#1494) - Surface the real reason a WebSocket connection failed
(#1495) - Remove str from ha_bulk_control.operations schema + fix wrong-reason test
(#1492) - Remove str from bool/int param schemas across all tools
(#1490) - addon: Expose non-beta tool options on the stable add-on
(#1488) - addon: Enable ingress so the stable add-on shows the Open Web UI / Settings UI
(#1486) - Refine last_changed/last_updated duration-math detector (#1157)
(#1483) - Remove str from config param schema on service and entity tools
(#1487) - Surface flow-helper config to agents reading UI-created templates
(#1474) - Remove str from config param schema on set tools
(#1485) - Route malformed ha_mcp_tools version to a distinct reinstall error
(#1484) - Persist DCR client registrations and HMAC secret across restarts (#1261)
(#1265) - Stop dev builds from publishing the :latest Docker tag
(#1477) - Subscribe to HACS dispatch signal instead of 10x1s blind poll
(#1455) - Reject python_transform while loops
(#1462)
Performance Improvements
Refactoring
- Add display title to ha_get_skill_guide tool
(#1543) - Fold ha_check_config into ha_get_system_health include="config_check"
(#1516) - c901: Smart_search.py below C901 threshold
(#1507) - hacs: Consolidate HACS tools into ha_get_hacs + ha_manage_hacs (#1045)
(#1502) - c901: Tools_config_helpers.py below C901 threshold
(#1498) - complexity: Reduce C901 in tools_addons.py via class-based pattern
(#1432)
Internal Changes
Changed
- Trim AGENTS.md below 40k + improve subdirectory CLAUDE.md files
(#1499)
Chores
- addon: Publish dev addon version 7.6.0.dev415 [skip ci]
(2c0148b) - deps: Update ghcr.io/home-assistant/home-assistant docker tag to v2026.6.1
(#1571) - deps: Update ghcr.io/astral-sh/uv docker tag to v0.11.19
(#1570) - addon: Publish dev addon version 7.6.0.dev414 [skip ci]
(0bf9e39) - Sync tool docs after merge [skip ci]
(8f5e037) - addon: Publish dev addon version 7.6.0.dev413 [skip ci]
(6729327) - Sync tool docs after merge [skip ci]
(4341e95) - addon: Publish dev addon version 7.6.0.dev412 [skip ci]
(148f506) - addon: Publish dev addon version 7.6.0.dev411 [skip ci]
(287fe55) - Sync tool docs after merge [skip ci]
(b642b8e) - addon: Publish dev addon version 7.6.0.dev410 [skip ci]
(29e34dd) - addon: Publish dev addon version 7.6.0.dev409 [skip ci]
(dec16a1) - Sync tool docs after merge [skip ci]
(dd72535) - addon: Publish dev addon version 7.6.0.dev408 [skip ci]
(c3c89f1) - addon: Publish dev addon version 7.6.0.dev407 [skip ci]
(94195ee) - addon: Publish dev addon version 7.6.0.dev406 [skip ci]
(f439424) - Sync tool docs after merge [skip ci]
(7464277) - addon: Publish dev addon version 7.6.0.dev405 [skip ci]
(146eb07) - addon: Publish dev addon version 7.6.0.dev404 [skip ci]
(6a707bb) - Sync tool docs after merge [skip ci]
(85f3935) - addon: Publish dev addon version 7.6.0.dev403 [skip ci]
(be1fa1d) - Sync tool docs after merge [skip ci]
(d9adbd2) - addon: Publish dev addon version 7.6.0.dev402 [skip ci]
(41ad7ca) - addon: Publish dev addon version 7.6.0.dev401 [skip ci]
(8205034) - deps: Update ghcr.io/astral-sh/uv docker tag to v0.11.18
(#1523) - addon: Publish dev addon version 7.6.0.dev400 [skip ci]
(532cdc4) - Sync tool docs after merge [skip ci]
(e2c08ff) - addon: Publish dev addon version 7.6.0.dev399 [skip ci]
(9501348) - Sync tool docs after merge [skip ci]
(e70a050) - addon: Publish dev addon version 7.6.0.dev398 [skip ci]
(0b61424) - Sync tool docs after merge [skip ci]
(6df7987) - addon: Publish dev addon version 7.6.0.dev397 [skip ci]
(c34915f) - Sync tool docs after merge [skip ci]
(6f88e7e) - addon: Publish dev addon version 7.6.0.dev396 [skip ci]
(1490e19) - Sync tool docs after merge [skip ci]
(ac2c7d0) - addon: Publish dev addon version 7.6.0.dev395 [skip ci]
(11e5ee8) - addon: Publish dev addon version 7.6.0.dev394 [skip ci]
(5fc3e0f) - Flag untrusted third-party content in HACS and add-on tool responses
(#1509) - addon: Publish dev addon version 7.6.0.dev393 [skip ci]
(9a37c28) - addon: Publish dev addon version 7.6.0.dev392 [skip ci]
(4f737ac) - addon: Publish dev addon version 7.6.0.dev391 [skip ci]
(fd5d3f2) - addon: Publish dev addon version 7.6.0.dev390 [skip ci]
(28dedf4) - addon: Publish dev addon version 7.6.0.dev389 [skip ci]
(9443446) - Sync tool docs after merge [skip ci]
(94fcbeb) - addon: Publish dev addon version 7.6.0.dev388 [skip ci]
(ccc1816) - Drop dead entity_cache attr + ruff-format fuzzy_search.py
(#1503) - addon: Publish dev addon version 7.6.0.dev387 [skip ci]
(057c108) - addon: Publish dev addon version 7.6.0.dev386 [skip ci]
(66f4ac6) - addon: Publish dev addon version 7.6.0.dev385 [skip ci]
(f331f11) - addon: Publish dev addon version 7.6.0.dev384 [skip ci]
(17c319e) - Sync tool docs after merge [skip ci]
(f36cbb7) - addon: Publish dev addon version 7.6.0.dev383 [skip ci]
(782ba3b) - addon: Publish dev addon version 7.6.0.dev382 [skip ci]
(b647ab6) - addon: Publish dev addon version 7.6.0.dev381 [skip ci]
(e999c24) - Sync tool docs after merge [skip ci]
(50d76b0) - addon: Publish dev addon version 7.6.0.dev380 [skip ci]
(ebdc69b) - Sync tool docs after merge [skip ci]
(1f03967) - addon: Publish dev addon version 7.6.0.dev379 [skip ci]
(7cabb2e) - addon: Publish dev addon version 7.6.0.dev378 [skip ci]
(7b631c7) - addon: Publish dev addon version 7.6.0.dev377 [skip ci]
(ea7b614) - addon: Publish dev addon version 7.6.0.dev376 [skip ci]
(fd33ecd) - Sync tool docs after merge [skip ci]
(ba8fae3) - addon: Publish dev addon version 7.6.0.dev375 [skip ci]
(afcd0d8) - Sync tool docs after merge [skip ci]
(f9b55ad) - addon: Publish dev addon version 7.6.0.dev374 [skip ci]
(eecdf8b) - Sync tool docs after merge [skip ci]
(ef16a8a) - addon: Publish dev addon version 7.6.0.dev373 [skip ci]
(9a93703) - addon: Publish dev addon version 7.6.0.dev372 [skip ci]
(7352ce8) - addon: Publish dev addon version 7.6.0.dev371 [skip ci]
(d7601f5) - Sync tool docs after merge [skip ci]
(d0a4482) - addon: Publish dev addon version 7.6.0.dev370 [skip ci]
(f83c32c) - addon: Publish dev addon version 7.6.0.dev369 [skip ci]
(ea16661) - addon: Publish dev addon version 7.6.0.dev368 [skip ci]
(af49ea5) - addon: Publish dev addon version 7.6.0.dev367 [skip ci]
(7dd5f4c) - addon: Publish dev addon version 7.6.0.dev366 [skip ci]
(6273b7e) - Sync tool docs after merge [skip ci]
(4e3fd5f) - addon: Publish dev addon version 7.6.0.dev365 [skip ci]
(f3bf17b) - Sync tool docs after merge [skip ci]
(5307b60) - addon: Publish dev addon version 7.6.0.dev364 [skip ci]
(76ec1ae) - Sync tool docs after merge [skip ci]
(be864b5) - addon: Publish dev addon version 7.6.0.dev363 [skip ci]
(da10c75) - addon: Publish dev addon version 7.6.0.dev362 [skip ci]
(69f4527) - addon: Publish version 7.6.0 [skip ci]
(086d75d)
Continuous Integration
- Vendor Puppet add-on as a pinned submodule + retry transient add-on builds
(#1565) - Make sync-tool-docs push resilient to concurrent master advances
(#1564) - Fix stale token-cap comment and harden triage budget tests (#1514)
(#1560) - deps: Bump the github-actions group with 2 updates
(#1556) - Budget triage prompt dynamically under the GitHub Models cap (#1514)
(#1522) - Reduce Docker Hub pulls in performance-tests workflow
(#1549) - Add JavaScript to the CodeQL code-quality gate
(#1548) - Add CodeQL code-quality CI gate and clear all code-quality findings
(#1526) - Drop tool list from evaluate prompt + tighten caps to fit 8K token limit
(6f47c92) - Remove broken maintainer check (GITHUB_TOKEN lacks read:org)
(010ec58) - Switch evaluate step to gpt-4o-mini (16K token free tier vs 8K on gpt-4.1)
(#1496) - Issue bot v2 — GitHub Models triage, needs-info auto-close, duplicate detection
(#1442)
Refactoring
- Extract settings-UI JavaScript and CSS to separate files
(#1505) - Collapse settings-UI route registration into one table
(#1504)
Testing
- oauth: Add HTTP smoke tests for OAuth metadata-discovery endpoints
(#1562) - uat: Relabel c01 as a mode-discrimination probe (taxonomy consistency)
(#1563) - uat: Rework c01 routing probe to ha_search registry-listing mode after #1529
(#1559) - uat: Add response_contains_any check and always log agent responses
(#1537) - uat: Treat request timeout as per-story failure, not suite abort
(#1536) - uat: Harden BAT story runner against agent crashes
(#1535) - uat: Log model and quantization in BAT story results
(#1525) - Capture reasoning tokens and detect inert --no-think in BAT openai agent
(#1524)