Merge branch 'pr-854' into addon-repo

Author: kingpanther13

pyproject.toml

@@ -31,6 +31,7 @@ dependencies = [
     "truststore==0.10.4",
     "websockets==16.0",
     "cryptography==46.0.6",
+    "pydantic-monty==0.0.9",
 ]
 
 [project.urls]
@@ -75,6 +76,8 @@ explicit_package_bases = true
 module = [
     "fastmcp.*",
     "jq",
+    "pydantic_monty",
+    "pydantic_monty.*",
 ]
 ignore_missing_imports = true
 

src/ha_mcp/config.py

@@ -112,6 +112,17 @@ class Settings(BaseSettings):
     # files. Disabled by default; only for YAML-only features with no UI/API path.
     enable_yaml_config_editing: bool = Field(False, alias="ENABLE_YAML_CONFIG_EDITING")
 
+    # Code Mode — sandboxed Python execution via pydantic-monty.
+    # Provides an "escape hatch" tool (ha_manage_custom_tool) that lets LLMs write
+    # custom one-off Python code when no existing tool covers the request.
+    # Disabled by default due to the inherent risk of LLM-generated code.
+    enable_code_mode: bool = Field(False, alias="ENABLE_CODE_MODE")
+    code_mode_max_duration: float = Field(30.0, alias="CODE_MODE_MAX_DURATION")
+    code_mode_max_memory: int = Field(
+        10_485_760, alias="CODE_MODE_MAX_MEMORY"
+    )  # 10 MB
+    code_mode_max_recursion: int = Field(100, alias="CODE_MODE_MAX_RECURSION")
+
     @model_validator(mode="after")
     def _skills_dependency(self) -> "Settings":
         """Auto-enable skills (resources) when skills-as-tools is on.

src/ha_mcp/server.py

@@ -424,6 +424,10 @@ def _apply_tool_search(self) -> None:
         # Build the always_visible list
         pinned = list(self._PINNED_TOOLS)
 
+        # Pin code mode tool so it gets individual permission gating
+        if self.settings.enable_code_mode:
+            pinned.append("ha_manage_custom_tool")
+
         # Pin ResourcesAsTools and skill guidance tools if skills-as-tools is enabled
         if self.settings.enable_skills_as_tools:
             pinned.extend(["list_resources", "read_resource"])