fix(home-assistant): describe compacted history rows and guard the entity filter

The get_history output schema reused the /api/states shape, which requires
entity_id and last_updated. Home Assistant does not return those for the rows
between the first and last of a period once minimal_response is set, so the
declared contract rejected real responses. A live 7846-point response validates
against the corrected schema and fails against the previous one. History rows
now use their own schema where only state and last_changed are required, and
/api/states keeps the strict shape.

Also normalize the entity filter before sending it. Home Assistant reads a
missing filter_entity_id as every entity and queryParams drops empty strings, so
a list that normalizes to nothing would silently widen a scoped query into a
whole-instance dump. The schema's minItems already rejects an empty array, but
the request should not depend on that alone, and a whitespace-only id passes the
schema while still being unusable.

Author: reopenpilot

src/providers/home_assistant/actions.ts

@@ -11,17 +11,27 @@ const contextSchema = s.looseObject("The Home Assistant context attached to a st
   user_id: s.nullableString("The optional Home Assistant user identifier."),
 });
 
-const stateSchema = s.looseRequiredObject(
-  "One Home Assistant entity state object.",
-  {
-    entity_id: s.string("The Home Assistant entity identifier."),
-    state: s.string("The current state value."),
-    attributes: s.looseObject("The integration-specific attributes for the entity state."),
-    last_changed: s.string("The timestamp when the state last changed."),
-    last_updated: s.string("The timestamp when the state object was last updated."),
-    context: contextSchema,
-  },
-  { optional: ["attributes", "context"] },
+const stateProperties = {
+  entity_id: s.string("The Home Assistant entity identifier."),
+  state: s.string("The current state value."),
+  attributes: s.looseObject("The integration-specific attributes for the entity state."),
+  last_changed: s.string("The timestamp when the state last changed."),
+  last_updated: s.string("The timestamp when the state object was last updated."),
+  context: contextSchema,
+};
+
+const stateSchema = s.looseRequiredObject("One Home Assistant entity state object.", stateProperties, {
+  optional: ["attributes", "context"],
+});
+
+// History rows are not full state objects. With minimal_response, Home Assistant
+// returns only state and last_changed for the entries between the first and last
+// of the period, dropping entity_id, attributes, and last_updated; no_attributes
+// drops attributes on every row. Only state and last_changed are always present.
+const historyStateSchema = s.looseRequiredObject(
+  "One recorded Home Assistant state. Fields other than state and last_changed are omitted for compacted rows.",
+  stateProperties,
+  { optional: ["entity_id", "attributes", "last_updated", "context"] },
 );
 
 const emptyInputSchema = s.actionInput({}, [], "No input is required for this action.");
@@ -238,7 +248,7 @@ export const homeAssistantActions: ActionDefinition[] = [
       {
         history: s.array(
           "One list of state objects per requested entity, in the order Home Assistant returns them.",
-          s.array("The recorded states for one entity.", stateSchema),
+          s.array("The recorded states for one entity.", historyStateSchema),
         ),
       },
       "The recorded Home Assistant state history.",

src/providers/home_assistant/runtime.ts

@@ -128,7 +128,7 @@ export const homeAssistantActionHandlers: Record<HomeAssistantRestActionName, Ho
         path: startTime ? `/api/history/period/${encodeURIComponent(startTime)}` : "/api/history/period",
         method: "GET",
         query: queryParams({
-          filter_entity_id: requiredStringArray(input.entityIds, "entityIds", badHomeAssistantRequest).join(","),
+          filter_entity_id: readHistoryEntityIds(input.entityIds),
           end_time: optionalString(input.endTime),
           minimal_response: presenceFlag(input.minimalResponse),
           no_attributes: presenceFlag(input.noAttributes),
@@ -210,6 +210,27 @@ function presenceFlag(value: unknown): string | undefined {
   return optionalBoolean(value) === true ? "1" : undefined;
 }
 
+/**
+ * Build the `filter_entity_id` value, rejecting an entity list that carries no
+ * usable id.
+ *
+ * Home Assistant treats a missing `filter_entity_id` as "every entity", and
+ * `queryParams` drops empty strings, so a list that normalizes to nothing would
+ * turn a scoped query into a whole-instance history dump. The action schema
+ * already requires at least one non-empty id, but the request must not depend on
+ * that alone, and a whitespace-only id passes the schema while still being
+ * unusable.
+ */
+function readHistoryEntityIds(value: unknown): string {
+  const entityIds = requiredStringArray(value, "entityIds", badHomeAssistantRequest)
+    .map((entityId) => entityId.trim())
+    .filter((entityId) => entityId.length > 0);
+  if (entityIds.length === 0) {
+    throw badHomeAssistantRequest("entityIds must contain at least one entity id");
+  }
+  return entityIds.join(",");
+}
+
 export function validateHomeAssistantCredential(input: { values: Record<string, string> }): {
   profile: { accountId: string; displayName: string };
   grantedScopes: string[];