[Highsteads]

Summary

Fixes every finding from a fresh review of 3.2.1. Each fix is its own commit; the last one bumps the version to 3.3.0 and adds the changelog entry.

Security

• A read key could get the admin key. read_script searched Scripts/, where the deployed indigo_mcp_proxy.py carries the live bearer token. No script tool can now read, list, write, rename, delete or run the proxy; the name check ignores case and also catches links to the file. For callers without admin, read_script, get_automation, query_event_log, investigate_event and the log, trigger and schedule resources have known secret values blanked. The new redact_output registry flag does this. If the secret values can't be loaded, the reply is withheld rather than sent unredacted.
• Scope changes: send_email now needs admin, because it is data leaving the house. device_control reset_energy, which can't be undone, now needs admin. zwave enter_exclusion goes behind the delete gate. These use new per-action registry rules, action_scopes and destructive_actions, which are checked against each tool's action list at load.
• /health: key names, scopes and recent calls are shown to admin keys only.
• Origin check: the MCP endpoint refuses a request whose Origin isn't this Mac or the Indigo server (new security/origin_guard.py). A request with no Origin, such as the proxy, mcp-remote or curl, is unaffected.

Robustness

• execute_device_action waits at most 20 s, on its own thread. It refuses to target Claude Bridge itself.
• Status codes follow MCP Streamable HTTP: unknown session 404, missing session 400, an accepted notification or response 202 with no body, an unsupported protocol version 400.
  • Proxy 1.8 re-handshakes on 404 and on a session 400, and still understands the old -32600.
  • Old session ids are still let through straight after a restart, so an older proxy keeps working during the upgrade.
• Trigger and schedule lists are no longer cached. The Indigo change-subscription API for them couldn't be confirmed from api_baseline.py. audit now drops its cache after set_enabled.
• Proxy address: the proxy gets the web server's real scheme, host and port from getWebServerURL(), so a non-default port or HTTPS works.
• Webhooks try each checked address in turn, within one overall deadline.
• prompts/get with a missing required argument returns -32602 naming it.

Docs

• The rate limit is described honestly: per access key, admin keys 10×, and every key is admin without scopes.json. /health shows the effective limits. Enforcement is unchanged.
• security.md and the README now name everything that leaves the Mac (email, Pushover, webhooks). They also say what a write key can do, and what a read key can see.
• architecture.md gives the wait default as 5, not eight. device_history is described as SQLite SQL Logger only.

Behaviour changes for existing users

• A write key can no longer send email or reset energy totals.
• zwave enter_exclusion needs confirm=true and the delete preference turned on.
• Non-admin keys see redacted script and log text, and less from /health.
• A request with a non-local Origin gets 403.
• HTTPS over loopback: when the web server is HTTPS on the same Mac, the proxy doesn't verify the certificate. Indigo's certificate never names localhost, and the traffic never leaves the machine. To any other host the certificate is verified.

Test plan

• python3 -m pytest -q: 1520 passed, 6 skipped (was 1431). The new tests exercise the behaviour, and several were confirmed to fail with the fix removed.
• ruff check . is clean.
• scripts/generate_tool_doc.py --check passes.
• On a real Indigo install: check that Indigo's web server passes the Origin header through to the plugin, and that Claude Code keeps working across a plugin restart with the 202/404 responses.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XbNsZWae49j96wmP8ip2us

---

Generated by Claude Code