ha-mcp-dev 7.13.0.dev2007__tar.gz → 7.13.0.dev2011__tar.gz

{ha_mcp_dev-7.13.0.dev2007/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.13.0.dev2011}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.13.0.dev2007
+Version: 7.13.0.dev2011
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.13.0.dev2007 → ha_mcp_dev-7.13.0.dev2011}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.13.0.dev2007"
+version = "7.13.0.dev2011"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-7.13.0.dev2007 → ha_mcp_dev-7.13.0.dev2011}/src/ha_mcp/client/rest_client.py

@@ -975,7 +975,11 @@ class HomeAssistantClient:
             raise
 
     async def upsert_automation_config(
-        self, config: dict[str, Any], identifier: str | None = None
+        self,
+        config: dict[str, Any],
+        identifier: str | None = None,
+        *,
+        _resolved: bool = False,
     ) -> dict[str, Any]:
         """
         Create new automation or update existing one.
@@ -983,6 +987,12 @@ class HomeAssistantClient:
         Args:
             config: Automation configuration dictionary
             identifier: Optional automation entity_id or unique_id (None = create new)
+            _resolved: When True, ``identifier`` is already the resolved unique_id
+                (the caller ran ``_resolve_automation_id``), so the redundant
+                entity_id→unique_id lookup is skipped. Ignored on the create path
+                (``identifier is None``). The #1404 config-id mismatch guard below
+                is unaffected — it still compares ``config['id']`` to the resolved
+                unique_id.
 
         Returns:
             Result with automation unique_id and status
@@ -996,7 +1006,11 @@ class HomeAssistantClient:
             operation = "created"
             logger.debug(f"Creating new automation with unique_id: {unique_id}")
         else:
-            unique_id = await self._resolve_automation_id(identifier)
+            unique_id = (
+                identifier
+                if _resolved
+                else await self._resolve_automation_id(identifier)
+            )
             operation = "updated"
             logger.debug(f"Updating automation with unique_id: {unique_id}")
 
@@ -1592,14 +1606,33 @@ class HomeAssistantClient:
             raise
 
     async def upsert_script_config(
-        self, config: dict[str, Any], script_id: str
+        self,
+        config: dict[str, Any],
+        script_id: str,
+        *,
+        resolved_id: str | None = None,
     ) -> dict[str, Any]:
-        """Create or update Home Assistant script configuration."""
-        resolved_id = await self._resolve_script_id(script_id)
+        """Create or update Home Assistant script configuration.
+
+        ``resolved_id``, when provided, is the already-resolved storage key used
+        as the write target (the caller ran :meth:`_resolve_script_id`),
+        skipping the redundant entity-registry lookup. ``script_id`` stays the
+        CALLER's identifier and is used only to default a missing ``alias`` — a
+        renamed script (whose storage key differs from the entity slug the
+        caller passed) keeps its caller-facing name rather than resetting the
+        user-visible alias to the stale storage key (#1935).
+        """
+        write_id = (
+            resolved_id
+            if resolved_id is not None
+            else await self._resolve_script_id(script_id)
+        )
         try:
-            endpoint = f"config/script/config/{resolved_id}"
+            endpoint = f"config/script/config/{write_id}"
 
-            # Validate required fields
+            # Default a missing alias from the CALLER's ``script_id`` (not
+            # ``write_id``) so a renamed script's user-visible name is preserved
+            # instead of being reset to the storage key.
             if "alias" not in config:
                 config["alias"] = script_id
 
@@ -1614,7 +1647,7 @@ class HomeAssistantClient:
 
             return {
                 "success": True,
-                "script_id": resolved_id,
+                "script_id": write_id,
                 "result": response.get("result", "ok"),
                 "operation": "created" if response.get("result") == "ok" else "updated",
             }
@@ -1722,22 +1755,39 @@ class HomeAssistantClient:
             raise
 
     async def upsert_scene_config(
-        self, config: dict[str, Any], scene_id: str, *, _resolved: bool = False
+        self,
+        config: dict[str, Any],
+        scene_id: str,
+        *,
+        resolved_id: str | None = None,
     ) -> dict[str, Any]:
         """Create or update Home Assistant scene configuration.
 
-        ``_resolved=True`` signals ``scene_id`` is already the resolved storage
-        key, skipping the redundant registry lookup (``resolve_scene_id`` is
-        idempotent, so the endpoint id is unchanged).
+        ``resolved_id``, when provided, is the already-resolved storage key used
+        as the write target (the caller ran :meth:`resolve_scene_id`), skipping
+        the redundant registry lookup. ``scene_id`` stays the CALLER's identifier
+        and is used only to default a missing ``name`` — a renamed scene (whose
+        storage key differs from the slug the caller passed) keeps its
+        caller-facing name rather than resetting to the stale storage key
+        (#1935, mirrors the script fix).
         """
-        resolved_id = scene_id if _resolved else await self.resolve_scene_id(scene_id)
+        write_id = (
+            resolved_id
+            if resolved_id is not None
+            else await self.resolve_scene_id(scene_id)
+        )
         try:
-            endpoint = f"config/scene/config/{resolved_id}"
-
-            # Default a name when missing — mirrors the script upsert behaviour
-            # so a bare config dict is still acceptable.
+            endpoint = f"config/scene/config/{write_id}"
+
+            # Default a name when missing from the CALLER's ``scene_id`` (not
+            # ``write_id``) — mirrors the script upsert behaviour so a bare
+            # config dict is acceptable, without resetting a renamed scene's
+            # name to the storage key. Strip the ``scene.`` prefix: a caller may
+            # pass the entity_id form (``resolve_scene_id`` accepts it), and HA
+            # derives the entity_id from the name slug — persisting the prefixed
+            # form would rename the scene and change its entity_id on a plain update.
             if "name" not in config:
-                config["name"] = scene_id
+                config["name"] = scene_id.removeprefix("scene.")
 
             # Validate required field. ``entities`` is a dict keyed by entity_id,
             # not a list — distinct from script ``sequence`` and automation ``action``.
@@ -1757,7 +1807,7 @@ class HomeAssistantClient:
             # activity should diff before/after via ``ha_config_get_scene``.
             return {
                 "success": True,
-                "scene_id": resolved_id,
+                "scene_id": write_id,
                 "result": response.get("result", "ok"),
             }
         except Exception as e:

{ha_mcp_dev-7.13.0.dev2007 → ha_mcp_dev-7.13.0.dev2011}/src/ha_mcp/tools/component_api.py

@@ -273,9 +273,17 @@ async def get_component_caps(client: Any) -> ComponentCaps | None:
         if not base_url or not token:
             # Not a credentialed HA client — no WS connection to negotiate over.
             return None
+        # Thread verify_ssl so a verify_ssl=False client keys (and can establish)
+        # its own pooled connection rather than failing the probe or colliding with
+        # a default-verification entry — otherwise EVERY component capability is
+        # silently unreachable on an HTTPS + verify_ssl=False install. ``None`` is
+        # the pool's settings default, so a client without the attr is unchanged.
+        verify_ssl = getattr(client, "verify_ssl", None)
 
         try:
-            ws = await get_websocket_client(url=base_url, token=token)
+            ws = await get_websocket_client(
+                url=base_url, token=token, verify_ssl=verify_ssl
+            )
             response = await ws.send_command(INFO_COMMAND)
         except HomeAssistantCommandError:
             # Old component (unknown_command) or an info handler bug: the

{ha_mcp_dev-7.13.0.dev2007 → ha_mcp_dev-7.13.0.dev2011}/src/ha_mcp/tools/tools_config_automations.py

@@ -801,9 +801,15 @@ class AutomationConfigTools:
             # (trigger -> triggers, action -> actions, condition -> conditions).
             config_dict = _normalize_automation_config(config_dict)
 
-            # Optional hash check for full config updates
+            # Optional hash check for full config updates. When it runs it
+            # resolves ``identifier`` to the storage key — thread that through so
+            # the upsert doesn't re-resolve (issue #1813 Phase 0). Stays None on
+            # the no-hash update path (raw identifier resolved once, in upsert).
+            resolved_id: str | None = None
             if identifier and config_hash:
-                await self._fetch_and_verify_hash(identifier, config_hash, "set")
+                _, resolved_id = await self._fetch_and_verify_hash(
+                    identifier, config_hash, "set"
+                )
 
             self._validate_required_fields(config_dict, identifier)
             bp_warnings = _check_best_practices(config_dict)
@@ -820,6 +826,7 @@ class AutomationConfigTools:
                 validation_meta,
                 MandatoryBPS,
                 conflict_warnings,
+                resolved_id,
             )
 
         except ToolError as te:
@@ -874,6 +881,30 @@ class AutomationConfigTools:
             augment_error_dict_with_skill_content(error, bp_warnings)
             raise_tool_error(error)
 
+    async def _upsert_automation(
+        self,
+        config: dict[str, Any],
+        identifier: str | None,
+        resolved_id: str | None,
+    ) -> dict[str, Any]:
+        """Upsert, threading a pre-resolved unique_id when available.
+
+        When ``resolved_id`` is set the caller already resolved ``identifier``
+        (via ``_fetch_and_verify_hash``); pass it with ``_resolved=True`` so the
+        REST client skips the redundant entity_id→unique_id lookup (issue #1813
+        Phase 0). Otherwise fall back to the raw ``identifier`` and let the REST
+        client resolve — the create path (``identifier is None``) and the
+        no-hash update path both land here unchanged.
+        """
+        result: dict[str, Any]
+        if resolved_id is not None:
+            result = await self._client.upsert_automation_config(
+                config, resolved_id, _resolved=True
+            )
+        else:
+            result = await self._client.upsert_automation_config(config, identifier)
+        return result
+
     async def _run_python_transform(
         self,
         identifier: str | None,
@@ -908,7 +939,7 @@ class AutomationConfigTools:
                 )
             )
 
-        current_config = await self._fetch_and_verify_hash(
+        current_config, resolved_id = await self._fetch_and_verify_hash(
             identifier, config_hash, "python_transform"
         )
 
@@ -938,8 +969,12 @@ class AutomationConfigTools:
         self._validate_required_fields(transformed_config, identifier)
         bp_warnings = _check_best_practices(transformed_config)
 
-        result = await self._client.upsert_automation_config(
-            transformed_config, identifier
+        # ``_fetch_and_verify_hash`` already resolved ``identifier`` to the
+        # storage key; thread it so the upsert skips the redundant re-resolve
+        # (issue #1813 Phase 0). Fall back to the raw identifier if the fetched
+        # body carried no ``id`` (not expected for a real automation).
+        result = await self._upsert_automation(
+            transformed_config, identifier, resolved_id
         )
         for warning in conflict_warnings:
             result.setdefault("warnings", []).append(warning)
@@ -988,9 +1023,15 @@ class AutomationConfigTools:
         validation_meta: dict[str, Any],
         MandatoryBPS: bool,
         conflict_warnings: list[str] | None = None,
+        resolved_id: str | None = None,
     ) -> dict[str, Any]:
-        """Execute config-replacement mode and return the tool response."""
-        result = await self._client.upsert_automation_config(config_dict, identifier)
+        """Execute config-replacement mode and return the tool response.
+
+        ``resolved_id`` (set only when the optional hash check pre-resolved
+        ``identifier``) is threaded to the upsert so it skips the redundant
+        re-resolve; None falls back to resolving inside the REST client.
+        """
+        result = await self._upsert_automation(config_dict, identifier, resolved_id)
 
         for warning in conflict_warnings or []:
             result.setdefault("warnings", []).append(warning)
@@ -1137,10 +1178,18 @@ class AutomationConfigTools:
 
     async def _fetch_and_verify_hash(
         self, identifier: str, config_hash: str, action: str
-    ) -> dict[str, Any]:
+    ) -> tuple[dict[str, Any], str | None]:
         """Fetch current automation config and verify config_hash for optimistic locking.
 
-        Returns the current normalized config dict.
+        Returns ``(current_normalized_config, resolved_unique_id)``. The fetch
+        already resolved ``identifier`` to the storage key inside
+        ``get_automation_config``; HA returns the stored body keyed by that
+        unique_id, so ``config['id']`` IS the resolved unique_id (the same value
+        the #1404 guard compares against). Threading it lets the caller pass
+        ``_resolved=True`` to ``upsert_automation_config`` and skip the redundant
+        second resolve (issue #1813 Phase 0). ``None`` when the stored body has
+        no ``id`` (not expected for a real automation) — the caller then falls
+        back to re-resolving.
         Raises ToolError if the hash does not match (conflict).
         """
         current_config, current_hash = await self._get_automation_config_internal(
@@ -1158,7 +1207,11 @@ class AutomationConfigTools:
                     context={"action": action, "identifier": identifier},
                 )
             )
-        return current_config
+        raw_id = current_config.get("id")
+        # Stringify to match ``_resolve_automation_id``'s ``str()`` coercion so a
+        # threaded id is byte-for-byte what the unthreaded path would produce.
+        resolved_id = str(raw_id) if raw_id is not None else None
+        return current_config, resolved_id
 
     @staticmethod
     def _parse_and_validate_config(config: str | dict[str, Any]) -> dict[str, Any]:

{ha_mcp_dev-7.13.0.dev2007 → ha_mcp_dev-7.13.0.dev2011}/src/ha_mcp/tools/tools_config_scenes.py

@@ -386,7 +386,7 @@ class ConfigSceneTools:
 
     async def _get_scene_config_internal(
         self, scene_id: str, *, _resolved: bool = False
-    ) -> tuple[dict[str, Any], str, str]:
+    ) -> tuple[dict[str, Any], str, str | None]:
         """Fetch scene config without logging or category injection.
 
         Returns ``(actual_config, config_hash, resolved_id)`` where
@@ -394,27 +394,36 @@ class ConfigSceneTools:
         ``resolved_id`` is the storage key the rest-client resolved the input
         to (issue #1168 R3 blocker 6). Used by ``_fetch_and_verify_hash``.
 
+        ``resolved_id`` is ``None`` when the envelope omits ``scene_id`` — the
+        write target must then be re-resolved from the caller's input rather
+        than defaulting to the (unresolved) caller slug, which for a renamed
+        scene would target the wrong storage key. This is a structural
+        invariant, not a live path: ``get_scene_config`` always sets the key.
+
         ``_resolved=True`` forwards to ``get_scene_config`` that ``scene_id`` is
         already a resolved storage key, so the redundant registry lookup is
         skipped (e.g. the python_transform re-fetch, which already resolved).
         """
         envelope = await self._client.get_scene_config(scene_id, _resolved=_resolved)
         actual_config = envelope.get("config", envelope)
-        resolved_id = envelope.get("scene_id", scene_id.removeprefix("scene."))
+        resolved_id = envelope.get("scene_id")
         config_hash_value = compute_config_hash(actual_config)
         return actual_config, config_hash_value, resolved_id
 
     async def _fetch_and_verify_hash(
         self, scene_id: str, config_hash: str, action: str
-    ) -> tuple[dict[str, Any], str]:
+    ) -> tuple[dict[str, Any], str | None]:
         """Fetch current scene config and verify config_hash for optimistic locking.
 
         Returns ``(actual_config, resolved_id)`` — the inner scene body and
-        the storage key the rest-client resolved the input to. Raises
-        ``ToolError`` if the hash does not match (conflict). Issue #1168 R3
-        blocker 6: callers thread ``resolved_id`` into responses so the
-        outer ``scene_id`` matches the inner body's ``id`` regardless of
-        whether the caller passed the entity_id slug or the storage key.
+        the storage key the rest-client resolved the input to. ``resolved_id``
+        is ``None`` when the envelope omitted the key, so the upsert re-resolves
+        rather than writing to the caller slug; the caller then re-binds it from
+        the upsert result. Raises ``ToolError`` if the hash does not match
+        (conflict). Issue #1168 R3 blocker 6: callers thread ``resolved_id`` into
+        responses so the outer ``scene_id`` matches the inner body's ``id``
+        regardless of whether the caller passed the entity_id slug or the
+        storage key.
         """
         (
             actual_config,
@@ -691,6 +700,12 @@ class ConfigSceneTools:
                 actual_config, resolved_id = await self._fetch_and_verify_hash(
                     scene_id, config_hash, "python_transform"
                 )
+                # Capture the scene's own ``id`` BEFORE the transform mutates the
+                # config in place — it is the stable identity the id-change guard
+                # compares against (in production it equals ``resolved_id``; it is
+                # also correct when ``resolved_id`` is None because the envelope
+                # omitted ``scene_id``).
+                original_id = actual_config.get("id")
 
                 try:
                     transformed_config = safe_execute(python_transform, actual_config)
@@ -773,23 +788,26 @@ class ConfigSceneTools:
                 # legitimate (HA treats ``id`` as optional) and should pass
                 # through. R7 blocker 24: ``transformed_config["id"] = None``
                 # is the in-place equivalent of ``del`` — normalise both
-                # by checking against ``(None, resolved_id)``, so only an
-                # explicit non-None mismatch triggers the reject.
+                # by checking against ``(None, original_id)``, so only an
+                # explicit non-None mismatch triggers the reject. Compare against
+                # the scene's own captured ``id`` (not ``resolved_id``, which may
+                # be None on the structural-invariant path) — in production the
+                # two are equal.
                 if "id" in transformed_config and transformed_config["id"] not in (
                     None,
-                    resolved_id,
+                    original_id,
                 ):
                     raise_tool_error(
                         create_error_response(
                             ErrorCode.VALIDATION_FAILED,
                             "Transform must not change ``config['id']``",
                             suggestions=[
-                                f"Original scene_id is {resolved_id!r} — keep it unchanged",
+                                f"Original scene_id is {original_id!r} — keep it unchanged",
                                 "To rename a scene, use ha_config_remove_scene + ha_config_set_scene",
                             ],
                             context={
                                 "action": "python_transform",
-                                "scene_id": resolved_id,
+                                "scene_id": original_id,
                                 "attempted_id": transformed_config.get("id"),
                             },
                         )
@@ -828,9 +846,17 @@ class ConfigSceneTools:
                 if category:
                     await self._validate_category_id(category)
 
+                # ``resolved_id`` is the storage key (write target); ``scene_id``
+                # stays the caller id so a missing ``name`` defaults caller-facing
+                # rather than to the storage key (#1935).
                 result = await self._client.upsert_scene_config(
-                    transformed_config, resolved_id, _resolved=True
+                    transformed_config, scene_id, resolved_id=resolved_id
                 )
+                # The upsert re-resolves when ``resolved_id`` was None (envelope
+                # omitted the key); re-bind to the authoritative write target it
+                # returned so the re-fetch, entity resolution, and response all
+                # use the resolved storage key rather than a possible None.
+                resolved_id = result.get("scene_id", resolved_id)
 
                 # Re-fetch to get authoritative hash (HA may normalise after save).
                 # ``resolved_id`` is already the storage key, so skip the re-resolve.
@@ -960,10 +986,18 @@ class ConfigSceneTools:
             )
 
             # ``resolved_id`` is already the storage key (from the hash-verify
-            # fetch or the resolve above), so skip the redundant re-resolve.
+            # fetch or the resolve above) — pass it as the write target to skip
+            # the redundant re-resolve. ``scene_id`` stays the caller id so a
+            # missing ``name`` defaults caller-facing, not to the storage key
+            # (#1935).
             result = await self._client.upsert_scene_config(
-                config_dict, resolved_id, _resolved=True
+                config_dict, scene_id, resolved_id=resolved_id
             )
+            # The upsert re-resolves when ``resolved_id`` was None (envelope
+            # omitted the key); re-bind to the authoritative write target it
+            # returned so entity resolution and the response use the resolved
+            # storage key rather than a possible None.
+            resolved_id = result.get("scene_id", resolved_id)
 
             # Resolve actual entity_id via registry — HA derives scene
             # entity_ids from the 'name' slug, not the scene_id storage key,

{ha_mcp_dev-7.13.0.dev2007 → ha_mcp_dev-7.13.0.dev2011}/src/ha_mcp/tools/tools_config_scripts.py

@@ -302,30 +302,48 @@ class ConfigScriptTools:
 
     async def _get_script_config_internal(
         self, script_id: str
-    ) -> tuple[dict[str, Any], str]:
+    ) -> tuple[dict[str, Any], str, str | None]:
         """Fetch script config without logging or category injection.
 
-        Returns (actual_config, config_hash) tuple where actual_config is
-        the inner script body (not the REST wrapper).
+        Returns ``(actual_config, config_hash, resolved_id)`` where
+        ``actual_config`` is the inner script body (not the REST wrapper) and
+        ``resolved_id`` is the storage key the REST client resolved the input to
+        (from the envelope's ``script_id``). Threading ``resolved_id`` lets the
+        upsert call site skip the redundant re-resolve (issue #1813 Phase 0).
         Used internally by _fetch_and_verify_hash and ha_config_get_script.
 
+        ``resolved_id`` is ``None`` when the envelope omits ``script_id`` — the
+        write target must then be re-resolved from the caller's input rather
+        than defaulting to the (unresolved) caller slug, which for a renamed
+        script would target the wrong storage key. This is a structural
+        invariant, not a live path: ``get_script_config`` always sets the key.
+
         404 responses from the REST client are mapped to a structured
         ``RESOURCE_NOT_FOUND`` ToolError via ``_fetch_script_config_envelope``.
         """
         config_result = await self._fetch_script_config_envelope(script_id)
         actual_config = config_result.get("config", config_result)
         config_hash_value = compute_config_hash(actual_config)
-        return actual_config, config_hash_value
+        resolved_id = config_result.get("script_id")
+        return actual_config, config_hash_value, resolved_id
 
     async def _fetch_and_verify_hash(
         self, script_id: str, config_hash: str, action: str
-    ) -> dict[str, Any]:
+    ) -> tuple[dict[str, Any], str | None]:
         """Fetch current script config and verify config_hash for optimistic locking.
 
-        Returns the actual script config dict (inner body).
-        Raises ToolError if the hash does not match (conflict).
+        Returns ``(actual_config, resolved_id)`` — the inner script body and the
+        storage key the REST client resolved the input to. Threading
+        ``resolved_id`` lets the upsert call site skip the redundant re-resolve
+        (issue #1813 Phase 0); it is ``None`` when the envelope omitted the key,
+        so the upsert re-resolves rather than writing to the caller slug. Raises
+        ToolError if the hash does not match (conflict).
         """
-        actual_config, current_hash = await self._get_script_config_internal(script_id)
+        (
+            actual_config,
+            current_hash,
+            resolved_id,
+        ) = await self._get_script_config_internal(script_id)
         if current_hash != config_hash:
             raise_tool_error(
                 create_error_response(
@@ -338,7 +356,24 @@ class ConfigScriptTools:
                     context={"action": action, "script_id": script_id},
                 )
             )
-        return actual_config
+        return actual_config, resolved_id
+
+    async def _upsert_script(
+        self, config: dict[str, Any], script_id: str, resolved_id: str | None
+    ) -> dict[str, Any]:
+        """Upsert, threading a pre-resolved storage key when available.
+
+        ``script_id`` is always the CALLER's identifier (used to default a
+        missing alias). ``resolved_id`` — set only when ``_fetch_and_verify_hash``
+        already resolved the storage key — is passed as the write target so the
+        REST client skips the redundant entity-registry lookup (issue #1813
+        Phase 0); None lets the REST client resolve. Passing the caller id
+        separately keeps a renamed script's alias caller-facing (#1935).
+        """
+        result: dict[str, Any] = await self._client.upsert_script_config(
+            config, script_id, resolved_id=resolved_id
+        )
+        return result
 
     @staticmethod
     def _validate_script_config(
@@ -677,7 +712,7 @@ class ConfigScriptTools:
                     )
 
                 # Fetch current config and verify hash
-                actual_config = await self._fetch_and_verify_hash(
+                actual_config, resolved_id = await self._fetch_and_verify_hash(
                     script_id, config_hash, "python_transform"
                 )
 
@@ -719,13 +754,20 @@ class ConfigScriptTools:
                     )
                 bp_warnings = _check_best_practices(transformed_config)
 
-                # Save transformed config
+                # Save transformed config. ``_fetch_and_verify_hash`` already
+                # resolved the storage key; pass it as the write target so the
+                # upsert skips the redundant re-resolve (issue #1813 Phase 0).
+                # ``script_id`` stays the caller id (the fetched config already
+                # carries an alias here, so the default is a no-op, but keep the
+                # contract consistent — #1935).
                 result = await self._client.upsert_script_config(
-                    transformed_config, script_id
+                    transformed_config, script_id, resolved_id=resolved_id
                 )
 
                 # Re-fetch to get authoritative hash (HA may normalize after save)
-                _, new_config_hash = await self._get_script_config_internal(script_id)
+                _, new_config_hash, _ = await self._get_script_config_internal(
+                    script_id
+                )
 
                 response: dict[str, Any] = {
                     "success": True,
@@ -766,9 +808,15 @@ class ConfigScriptTools:
                 category,
             )
 
-            # Optional hash check for full config updates
+            # Optional hash check for full config updates. When it runs it
+            # resolves ``script_id`` to the storage key — thread that through so
+            # the upsert doesn't re-resolve (issue #1813 Phase 0). Stays None on
+            # the no-hash path (raw script_id resolved once, inside upsert).
+            resolved_key: str | None = None
             if config_hash:
-                await self._fetch_and_verify_hash(script_id, config_hash, "set")
+                _, resolved_key = await self._fetch_and_verify_hash(
+                    script_id, config_hash, "set"
+                )
 
             # Pre-check for best-practice issues.
             bp_warnings = _check_best_practices(config_dict)
@@ -780,7 +828,7 @@ class ConfigScriptTools:
                 self._client, config_dict
             )
 
-            result = await self._client.upsert_script_config(config_dict, script_id)
+            result = await self._upsert_script(config_dict, script_id, resolved_key)
 
             # Wait for script to be queryable
             entity_id = f"script.{script_id}"