v3.44.10

Fixed

• The Critical Action PIN is now asked for a service call however the tool names the service (#837). The gate read a service-calling tool's domain and service arguments only. A tool that named the service another way ran with no PIN: {"action": "lock.unlock", "entity_id": "lock.front_door"}, {"action": "scene.apply", "entities": {"lock.front_door": "unlocked"}}, a dotted service ("service": "lock.unlock"), a domain with the service under action, or a tool named after the service (lock.unlock, or scene__apply the way Home Assistant names an action's tool, with or without a namespace). Each of these is now screened like the domain/service form, as is an action without a domain ({"action": "unlock", "entity_id": "lock.front_door"}, read in the target's domain) and a list of services. A call that names more than one service (service and action both, or a tool name and its arguments) is held when any of them is critical. A dotted name in the arguments counts even if this Home Assistant lacks that service, since a tool may send it elsewhere. A tool name counts when Home Assistant has that service or its domain is one critical actions live in (lock, cover, alarm panel, script, scene and the like, or any domain a rule names), so other tools are not affected. A bare action in a domain the call declares or a rule names counts the same way. A service call whose service cannot be read (a template, or something other than text) is held, including when the call is nested inside action; an action field in a tool that takes one for its own use, naming no service, entity or target, is not. A tool for a script service (script__turn_off) is no longer mistaken for a script's own tool. The PIN prompt names the service too (unlock "Front Door" (lock.front_door)) instead of "call service an unnamed device". Whether a given MCP server sends these shapes depends on the server.
• A script, intent script or service tool now runs with the arguments it was given (#836). Every tool call was rebuilt as a Home Assistant intent payload before it ran. A tool given domain: "lock" kept only name, entity_id, area and floor (domain: "alarm_control_panel" kept only the alarm fields), so a script with a door field that unlocks {{ door | default('lock.garage') }}, called for the front door, unlocked the garage. A lock name was also looked up and filled in for such a tool, and its domain was turned into a list. Only Home Assistant's own intents (HassTurnOn, HassTurnOff and the like) are reshaped now, on the normal path and when a PIN confirms the call; every other tool gets its arguments as given, minus empty values, and the PIN prompt names the targets from those arguments. An intent script keeps its own slots too, including one that takes over a built-in intent's name, and an entity id it is given is sent as the name (Home Assistant matches an intent script's targets by name, so domain: lock with only an entity id matched every lock). A script taking a numeric code is no longer sent to the alarm tool. If an intent script takes over a tool, or gives it back, between the PIN prompt and the reply, the held request is dropped and has to be asked again, since the prompt no longer names what would run.
• The Critical Action PIN prompt now says which device it will act on in three cases where it was vague (#784, #786, #787). A named device limited to an area or floor read the same as any other device of that name: with two locks named "Door", the prompt now says unlock "Door" in Garage. A scene.apply sent through a tool that calls services by name read as "apply an unnamed device"; it now names every state it sets (set "Front Door" (lock.front_door) to unlocked), and a scene.create names the scene and what it stores. Targets such a tool nests under target or data are named too. A script run through its own tool named only the script; the prompt now adds what the agent passed to the script's entity, area, device, floor, label or target fields (turn on "Open door" ("Garage Door" (cover.garage))), resolved as Home Assistant resolves them. Nothing is cut short with "and N more"; when a call also reaches devices the prompt cannot name (an area alongside a device, all, an id Home Assistant does not know), it says "and other devices". Model-written text (free-text fields, a state that is not a plain state) never appears in the prompt.