ha-mcp-dev 8.2.0.dev2352__tar.gz → 8.2.0.dev2354__tar.gz

{ha_mcp_dev-8.2.0.dev2352/src/ha_mcp_dev.egg-info → ha_mcp_dev-8.2.0.dev2354}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.2.0.dev2352
+Version: 8.2.0.dev2354
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-8.2.0.dev2352 → ha_mcp_dev-8.2.0.dev2354}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.2.0.dev2352"
+version = "8.2.0.dev2354"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-8.2.0.dev2352 → ha_mcp_dev-8.2.0.dev2354}/src/ha_mcp/client/rest_client.py

@@ -36,9 +36,21 @@ def _is_ssl_error(exc: BaseException) -> bool:
 logger = logging.getLogger(__name__)
 
 # Transient gateway statuses from a reverse proxy / Supervisor ingress — HA Core
-# restarting or briefly overloaded behind it. The upstream couldn't be reached,
-# so the request did not execute and retrying is safe even for writes.
-_RETRYABLE_STATUS = frozenset({502, 503, 504})
+# restarting or briefly overloaded behind it. Retried for SAFE METHODS ONLY.
+#
+# None of them proves Home Assistant did not execute the request: RFC 9110 has
+# 502 as "received an invalid response from an inbound server", which a proxy
+# only sends after reaching it, and 504 as the upstream answering too slowly.
+# #1623 extended the retry to writes on the premise that "a gateway 5xx means
+# the request never reached the backend"; that premise is false, and replaying
+# a write can double-apply it — fire an event twice, run a script twice, or
+# turn a completed DELETE into a misleading 404 on the replay.
+#
+# The flake class #1623 fixed was a 502 storm failing ~190 tests at once, which
+# is overwhelmingly reads; those keep the retry. A write that fails loudly is
+# recoverable by the caller, which a silent double-apply is not.
+_RETRYABLE_GATEWAY_STATUS = frozenset({502, 503, 504})
+_SAFE_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
 _MAX_REQUEST_ATTEMPTS = 3
 # Journald window requested for the Core error log on Supervisor-backed
 # installs. Both such branches of get_error_log() build their request from this
@@ -304,7 +316,8 @@ class HomeAssistantClient:
         Handles auth, HTTP 4xx/5xx, and transport errors in one place.
         Callers parse the body themselves (JSON via `_request`, text via
         `get_addon_logs`, etc.). Transient gateway errors (502/503/504) are
-        retried with bounded exponential backoff before surfacing.
+        retried with bounded exponential backoff for safe methods only; a write
+        is never replayed.
 
         Raises:
             HomeAssistantAuthError: 401 response.
@@ -323,10 +336,11 @@ class HomeAssistantClient:
                 if response.status_code >= 400:
                     message, error_data = self._error_message_from_response(response)
 
-                    if (
-                        response.status_code in _RETRYABLE_STATUS
-                        and attempt < _MAX_REQUEST_ATTEMPTS
-                    ):
+                    retryable = (
+                        response.status_code in _RETRYABLE_GATEWAY_STATUS
+                        and method.upper() in _SAFE_METHODS
+                    )
+                    if retryable and attempt < _MAX_REQUEST_ATTEMPTS:
                         logger.warning(
                             f"Transient {response.status_code} from Home Assistant "
                             f"(attempt {attempt}/{_MAX_REQUEST_ATTEMPTS}), retrying "
@@ -1211,6 +1225,28 @@ class HomeAssistantClient:
         logger.debug(f"Starting config flow for handler: {handler}")
         return await self._request("POST", "/config/config_entries/flow", json=payload)
 
+    async def start_reconfigure_flow(
+        self, handler: str, entry_id: str
+    ) -> dict[str, Any]:
+        """Start Home Assistant's official reconfigure flow for an entry.
+
+        Home Assistant selects ``SOURCE_RECONFIGURE`` when ``entry_id`` is
+        included in the config-flow start payload. The integration's
+        ``async_step_reconfigure`` then owns validation and updates the
+        existing entry in place; this method deliberately does not edit
+        storage or delete/recreate entries.
+        """
+        logger.debug(
+            "Starting reconfigure flow for handler %s and entry %s",
+            handler,
+            entry_id,
+        )
+        return await self._request(
+            "POST",
+            "/config/config_entries/flow",
+            json={"handler": handler, "entry_id": entry_id},
+        )
+
     async def submit_config_flow_step(
         self, flow_id: str, user_input: dict[str, Any]
     ) -> dict[str, Any]:
@@ -1228,6 +1264,10 @@ class HomeAssistantClient:
             HomeAssistantAPIError: If flow submission fails
         """
         logger.debug(f"Submitting flow step for flow_id: {flow_id}")
+        # POST, so no gateway retry — see _RETRYABLE_GATEWAY_STATUS. This is
+        # the call that motivated the rule: HA consumes the flow_id on success,
+        # so a replay returns 404 "Invalid flow specified", a definitive-looking
+        # 4xx that hides a first attempt which may already have committed.
         return await self._request(
             "POST", f"/config/config_entries/flow/{flow_id}", json=user_input
         )
@@ -1382,6 +1422,43 @@ class HomeAssistantClient:
             }
         )
 
+    async def list_config_entries(self) -> list[dict[str, Any]]:
+        """List all config entries from Home Assistant."""
+        logger.debug("Listing Home Assistant config entries")
+        entries: Any = await self._request("GET", "/config/config_entries/entry")
+        if not isinstance(entries, list):
+            raise HomeAssistantAPIError(
+                "Unexpected response format from config entries API",
+                status_code=500,
+            )
+        return [dict(entry) for entry in entries if isinstance(entry, dict)]
+
+    async def _list_registry(self, ws_type: str, label: str) -> list[dict[str, Any]]:
+        """Read a registry list, raising rather than returning a partial one.
+
+        Callers use "empty" to mean the entry genuinely has nothing registered,
+        so a malformed response must never degrade to [].
+        """
+        response = await self.send_websocket_message({"type": ws_type})
+        result: Any = response.get("result") if isinstance(response, dict) else None
+        if not isinstance(result, list) or not all(
+            isinstance(item, dict) for item in result
+        ):
+            detail = response.get("error") if isinstance(response, dict) else response
+            raise HomeAssistantAPIError(
+                f"Unexpected response from {label} registry API: {detail!r}",
+                status_code=500,
+            )
+        return [dict(item) for item in result]
+
+    async def list_entity_registry(self) -> list[dict[str, Any]]:
+        """List Home Assistant's entity registry through the official WebSocket API."""
+        return await self._list_registry("config/entity_registry/list", "entity")
+
+    async def list_device_registry(self) -> list[dict[str, Any]]:
+        """List Home Assistant's device registry through the official WebSocket API."""
+        return await self._list_registry("config/device_registry/list", "device")
+
     async def get_config_entry(self, entry_id: str) -> dict[str, Any]:
         """
         Get config entry details.
@@ -1393,25 +1470,17 @@ class HomeAssistantClient:
             entry_id: Config entry ID
 
         Returns:
-            Full config entry data
+            Home Assistant's config-entry fragment (``ConfigEntry.as_json_fragment``):
+            identity, state and capability flags. It carries NO ``data`` key, so the
+            entry's connection settings and credentials are not in it.
 
         Raises:
             HomeAssistantAPIError: If entry not found or API error
         """
         logger.debug(f"Getting config entry: {entry_id}")
-        # List all entries and filter by entry_id.
-        # Typed as Any because _request returns dict[str, Any] generically,
-        # but this endpoint actually returns a list.
-        entries: Any = await self._request("GET", "/config/config_entries/entry")
-
-        if not isinstance(entries, list):
-            raise HomeAssistantAPIError(
-                "Unexpected response format from config entries API",
-                status_code=500,
-            )
-
+        entries = await self.list_config_entries()
         found: dict[str, Any] | None = next(
-            (dict(e) for e in entries if e.get("entry_id") == entry_id), None
+            (entry for entry in entries if entry.get("entry_id") == entry_id), None
         )
         if found is None:
             raise HomeAssistantAPIError(

{ha_mcp_dev-8.2.0.dev2352 → ha_mcp_dev-8.2.0.dev2354}/src/ha_mcp/tools/backup.py

@@ -255,7 +255,11 @@ async def _backup_prep_via_component(
     if not component_supports(caps, "backup_prep"):
         return None
     try:
-        ws = await get_websocket_client(url=client.base_url, token=client.token)
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
         raw = await ws.send_command(WS_BACKUP_PREP)
     except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
         if is_unknown_command(exc):

ha_mcp_dev-8.2.0.dev2354/src/ha_mcp/tools/component_config_entries.py

@@ -0,0 +1,224 @@
+"""Config-entry reads over the ``ha_mcp_tools`` component gate.
+
+Exists for one field: ``unique_id``. Home Assistant deliberately withholds it
+from every config-entry endpoint — the REST list, ``config_entries/get`` and
+``config_entries/get_single`` all serialize ``ConfigEntry.as_json_fragment``,
+which has no ``unique_id`` key — so a server that wants it as an identity
+anchor has no source but the component, which holds the live ``ConfigEntry``.
+
+The component's ``config_entries`` command returns that field as a deliberate
+superset of the fragment. This module owns the caps-gated fetch, following the
+routing discipline the sibling component modules established: probe caps, send
+one frame, invalidate on ``unknown_command``, fall back on any component error.
+
+**Three states, and callers must keep them apart.** ``unique_id`` is not a
+two-valued field here:
+
+- **known, with a value** — the component answered and the entry has one.
+- **known to be absent** — the component answered and the entry has none
+  (MQTT-style entries genuinely have no unique_id). The key is present, the
+  value is ``None``.
+- **unknown** — no component, an older component predating the field, or a
+  transport failure. Nothing can be concluded.
+
+:func:`fetch_config_entry_unique_id` returns exactly that distinction so a
+caller never mistakes "we could not read it" for "the entry has none". That is
+what lets the field be additive within ``schema_version`` 1 with no version
+gate: an older component omits the KEY, which is distinguishable from sending
+it as ``None`` — the same discipline as ``device_get``'s opt-in entities join.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any, NamedTuple
+
+from ..client.rest_client import (
+    HomeAssistantCommandError,
+    HomeAssistantCommandTimeout,
+)
+from ..client.websocket_client import get_websocket_client
+from .component_api import (
+    component_supports,
+    get_component_caps,
+    invalidate_caps,
+    is_unknown_command,
+)
+
+logger = logging.getLogger(__name__)
+
+WS_CONFIG_ENTRIES = "ha_mcp_tools/config_entries"
+
+
+class EntryUniqueId(NamedTuple):
+    """A config entry's ``unique_id``, and whether it could be read at all."""
+
+    #: False when no component answered, or the component predates the field.
+    known: bool
+    #: The value when ``known``; always ``None`` when not.
+    value: str | None
+
+
+UNKNOWN_UNIQUE_ID = EntryUniqueId(known=False, value=None)
+
+
+async def _config_entry_rows(client: Any, **query: Any) -> list[dict[str, Any]] | None:
+    """One ``config_entries`` read; ``None`` when the answer cannot be trusted."""
+    caps = await get_component_caps(client)
+    if not component_supports(caps, "config_entries"):
+        return None
+    try:
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            # verify_ssl keys the client pool, so omitting it hands back a
+            # DIFFERENT pooled client than the capability probe used and a
+            # self-signed setup fails the read after passing detection.
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
+        raw = await ws.send_command(WS_CONFIG_ENTRIES, **query)
+    except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
+        if is_unknown_command(exc):
+            invalidate_caps(client)
+        else:
+            logger.warning("%s failed: %r", WS_CONFIG_ENTRIES, exc)
+        return None
+    except Exception as exc:
+        logger.warning("%s connection error: %r", WS_CONFIG_ENTRIES, exc)
+        return None
+    result = raw.get("result") if isinstance(raw, dict) else None
+    entries = result.get("entries") if isinstance(result, dict) else None
+    if not isinstance(entries, list):
+        return None
+    if any(not isinstance(row, dict) for row in entries):
+        logger.debug("%s returned a malformed row", WS_CONFIG_ENTRIES)
+        return None
+    return list(entries)
+
+
+async def fetch_domain_unique_ids(client: Any, domain: str) -> dict[str, str] | None:
+    """Map ``entry_id -> unique_id`` for one domain, or ``None`` if unreadable.
+
+    One read, not one per candidate. The duplicate scan needs the unique_id of
+    every same-domain entry, and Home Assistant's own config-entry rows carry
+    none — so without this the scan can only ever compare entry_ids and must
+    not claim it checked unique_ids.
+
+    A genuinely ``None`` ``unique_id`` is the ONLY value omitted from the map,
+    so a present key always means a real value. Anything malformed returns
+    ``None`` for the whole map instead: the duplicate scan reads a returned map
+    as a COMPLETED check, so an incomplete one could drop the very duplicate
+    row it exists to catch.
+    """
+    rows = await _config_entry_rows(client, domain=domain)
+    if rows is None:
+        return None
+    mapping: dict[str, str] = {}
+    for row in rows:
+        if "unique_id" not in row:
+            # An older component: the field is missing wholesale.
+            logger.debug(
+                "%s rows for domain %s predate the unique_id field",
+                WS_CONFIG_ENTRIES,
+                domain,
+            )
+            return None
+        entry_id = row.get("entry_id")
+        unique_id = row["unique_id"]
+        if not isinstance(entry_id, str) or (
+            unique_id is not None and not isinstance(unique_id, str)
+        ):
+            # A partial map would be read as a COMPLETED scan by the duplicate
+            # check, so a malformed duplicate row could be dropped and let
+            # verification pass. Incomplete must be indistinguishable from
+            # unreadable.
+            logger.debug(
+                "%s returned a malformed row for domain %s; map unusable",
+                WS_CONFIG_ENTRIES,
+                domain,
+            )
+            return None
+        # unique_id None is a valid answer (the entry has none) and is the one
+        # value legitimately omitted from the map.
+        if unique_id is not None:
+            mapping[entry_id] = unique_id
+    return mapping
+
+
+async def fetch_config_entry_unique_id(client: Any, entry_id: str) -> EntryUniqueId:
+    """Read one config entry's ``unique_id`` through the component.
+
+    Returns :data:`UNKNOWN_UNIQUE_ID` whenever the answer cannot be trusted —
+    no ``config_entries`` capability, a downgraded component, a transport
+    failure, a malformed payload, or a row that predates the field. Never
+    raises: an unreadable ``unique_id`` degrades the anchor, and the caller
+    decides what that means, rather than failing the whole reconfigure here.
+    """
+    caps = await get_component_caps(client)
+    if not component_supports(caps, "config_entries"):
+        return UNKNOWN_UNIQUE_ID
+    try:
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            # verify_ssl keys the client pool, so omitting it hands back a
+            # DIFFERENT pooled client than the capability probe used and a
+            # self-signed setup fails the read after passing detection.
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
+        raw = await ws.send_command(WS_CONFIG_ENTRIES, entry_id=entry_id)
+    except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
+        if is_unknown_command(exc):
+            invalidate_caps(client)
+        else:
+            logger.warning(
+                "%s failed; unique_id unavailable: %r", WS_CONFIG_ENTRIES, exc
+            )
+        return UNKNOWN_UNIQUE_ID
+    except Exception as exc:
+        logger.warning(
+            "%s connection error; unique_id unavailable: %r", WS_CONFIG_ENTRIES, exc
+        )
+        return UNKNOWN_UNIQUE_ID
+
+    result = raw.get("result") if isinstance(raw, dict) else None
+    entries = result.get("entries") if isinstance(result, dict) else None
+    if not isinstance(entries, list) or not entries:
+        logger.debug(
+            "%s returned no row for %s; unique_id unavailable",
+            WS_CONFIG_ENTRIES,
+            entry_id,
+        )
+        return UNKNOWN_UNIQUE_ID
+    row = entries[0]
+    # Key presence is the capability probe: a component older than the field
+    # omits it entirely, which must not read as "this entry has no unique_id".
+    if not isinstance(row, dict) or "unique_id" not in row:
+        logger.debug(
+            "%s row for %s predates the unique_id field; unique_id unavailable",
+            WS_CONFIG_ENTRIES,
+            entry_id,
+        )
+        return UNKNOWN_UNIQUE_ID
+    if row.get("entry_id") != entry_id:
+        # Reading another entry's anchor would be worse than reading none.
+        logger.debug(
+            "%s answered for %r when %r was asked; unique_id unavailable",
+            WS_CONFIG_ENTRIES,
+            row.get("entry_id"),
+            entry_id,
+        )
+        return UNKNOWN_UNIQUE_ID
+    value = row["unique_id"]
+    if value is not None and not isinstance(value, str):
+        # Malformed is unknown, NOT known-absent: silently turning junk into
+        # "this entry has no unique_id" is the exact conflation this type
+        # exists to prevent.
+        logger.debug(
+            "%s returned a non-string unique_id (%r) for %s; unique_id unavailable",
+            WS_CONFIG_ENTRIES,
+            value,
+            entry_id,
+        )
+        return UNKNOWN_UNIQUE_ID
+    return EntryUniqueId(known=True, value=value)

{ha_mcp_dev-8.2.0.dev2352 → ha_mcp_dev-8.2.0.dev2354}/src/ha_mcp/tools/component_config_reads.py

@@ -117,7 +117,11 @@ async def fetch_entity_lookup_via_component(
     if domain is not None:
         kwargs["domain"] = domain
     try:
-        ws = await get_websocket_client(url=client.base_url, token=client.token)
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
         raw = await ws.send_command(WS_ENTITY_LOOKUP, **kwargs)
     except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
         if is_unknown_command(exc):
@@ -177,7 +181,11 @@ async def fetch_reference_data_via_component(
     if not include_states:
         kwargs["include_states"] = False
     try:
-        ws = await get_websocket_client(url=client.base_url, token=client.token)
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
         raw = await ws.send_command(WS_REFERENCE_DATA, **kwargs)
     except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
         if is_unknown_command(exc):

{ha_mcp_dev-8.2.0.dev2352 → ha_mcp_dev-8.2.0.dev2354}/src/ha_mcp/tools/component_devices.py

@@ -91,7 +91,14 @@ async def fetch_device_via_component(
     if include_entities:
         kwargs["include_entities"] = True
     try:
-        ws = await get_websocket_client(url=client.base_url, token=client.token)
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            # verify_ssl keys the client pool, so omitting it hands back a
+            # DIFFERENT pooled client than the capability probe used and a
+            # self-signed setup fails the read after passing detection.
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
         raw = await ws.send_command(WS_DEVICE_GET, **kwargs)
     except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
         if is_unknown_command(exc):
@@ -163,7 +170,14 @@ async def fetch_device_list_via_component(client: Any) -> dict[str, Any] | None:
     if not component_supports(caps, "device_list"):
         return None
     try:
-        ws = await get_websocket_client(url=client.base_url, token=client.token)
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            # verify_ssl keys the client pool, so omitting it hands back a
+            # DIFFERENT pooled client than the capability probe used and a
+            # self-signed setup fails the read after passing detection.
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
         raw = await ws.send_command(WS_DEVICE_LIST)
     except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
         if is_unknown_command(exc):

{ha_mcp_dev-8.2.0.dev2352 → ha_mcp_dev-8.2.0.dev2354}/src/ha_mcp/tools/component_registries.py

@@ -117,7 +117,14 @@ async def fetch_registries_via_component(
     if category_scopes:
         kwargs["category_scopes"] = list(category_scopes)
     try:
-        ws = await get_websocket_client(url=client.base_url, token=client.token)
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            # verify_ssl keys the client pool, so omitting it hands back a
+            # DIFFERENT pooled client than the capability probe used and a
+            # self-signed setup fails the read after passing detection.
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
         raw = await ws.send_command(WS_REGISTRIES, **kwargs)
     except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
         if is_unknown_command(exc):

{ha_mcp_dev-8.2.0.dev2352 → ha_mcp_dev-8.2.0.dev2354}/src/ha_mcp/tools/component_registry_lookup.py

@@ -85,7 +85,14 @@ async def fetch_entities_for_config_entry_via_component(
     if not component_supports(caps, "registry_lookup"):
         return None
     try:
-        ws = await get_websocket_client(url=client.base_url, token=client.token)
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            # verify_ssl keys the client pool, so omitting it hands back a
+            # DIFFERENT pooled client than the capability probe used and a
+            # self-signed setup fails the read after passing detection.
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
         raw = await ws.send_command(WS_REGISTRY_LOOKUP, config_entry_id=config_entry_id)
     except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
         if is_unknown_command(exc):
@@ -133,7 +140,14 @@ async def resolve_entities_via_component(
     if not component_supports(caps, "registry_lookup"):
         return None
     try:
-        ws = await get_websocket_client(url=client.base_url, token=client.token)
+        ws = await get_websocket_client(
+            url=client.base_url,
+            token=client.token,
+            # verify_ssl keys the client pool, so omitting it hands back a
+            # DIFFERENT pooled client than the capability probe used and a
+            # self-signed setup fails the read after passing detection.
+            verify_ssl=getattr(client, "verify_ssl", None),
+        )
         raw = await ws.send_command(WS_REGISTRY_LOOKUP, entity_ids=entity_ids)
     except (HomeAssistantCommandError, HomeAssistantCommandTimeout) as exc:
         if is_unknown_command(exc):

{ha_mcp_dev-8.2.0.dev2352 → ha_mcp_dev-8.2.0.dev2354}/src/ha_mcp/tools/config_entry_flow.py

@@ -11,9 +11,12 @@ for the 17 helper types listed in FLOW_HELPER_TYPES.
 
 The same flow walkers drive every other config-entry surface, not just
 helpers: ``ha_set_integration`` creates entries for arbitrary domains through
-``create_config_entry`` and edits them through ``update_config_entry_options``,
-and ``ha_config_set_helper(helper_type="config_subentry")`` drives subentry
-flows through ``set_config_subentry``.
+``create_config_entry`` and edits them through ``update_config_entry_options``;
+``ha_config_set_helper(helper_type="config_subentry")`` drives subentry flows
+through ``set_config_subentry``. Changing a live entry's connection settings is
+a different problem — it commits in place and Home Assistant reloads afterwards
+— and lives in ``config_entry_reconfigure``, which depends on this module for
+the shared flow-abort and sentinel-rejection helpers.
 
 The step machinery those entry points drive lives in three sibling modules,
 imported in one direction only (menu <- form <- walker <- here):
@@ -25,13 +28,17 @@ imported in one direction only (menu <- form <- walker <- here):
 """
 
 import asyncio
+import json
 import logging
 from typing import Any, Literal
 
+from fastmcp.exceptions import ToolError
+
 from ..errors import ErrorCode, create_error_response
 from ..redaction import sentinel_option_keys
 from .config_entry_flow_form import _extract_schema_field_names
 from .config_entry_flow_walker import (
+    POST_COMMIT_STATUSES,
     _FlowType,
     _handle_config_subentry_flow_steps,
     _handle_flow_steps,
@@ -41,6 +48,26 @@ from .helpers import raise_tool_error
 logger = logging.getLogger(__name__)
 
 
+async def _abort_flow_best_effort(client: Any, flow_id: str) -> None:
+    """Abort a still-pending flow without hiding the original failure."""
+    try:
+        await asyncio.wait_for(client.abort_config_flow(flow_id), timeout=5.0)
+    except Exception as abort_err:
+        logger.warning("Failed to abort flow %s after error: %s", flow_id, abort_err)
+
+
+async def _abort_subentry_flow_best_effort(client: Any, flow_id: str) -> None:
+    """Abort a pending subentry flow without hiding the original failure."""
+    try:
+        await asyncio.wait_for(client.abort_config_subentry_flow(flow_id), timeout=5.0)
+    except Exception as abort_err:
+        logger.warning(
+            "Failed to abort config subentry flow %s after error: %s",
+            flow_id,
+            abort_err,
+        )
+
+
 def _reject_redaction_sentinels(config_dict: dict[str, Any]) -> None:
     """Reject config values that are redaction placeholders (#2157).
 
@@ -138,6 +165,11 @@ async def set_config_subentry(
     subentry, provided reconfigures that existing subentry.
     ``show_advanced_options`` is a no-op on HA 2026.6+ and kept only for older
     HA versions pending removal before HA 2027.6.
+
+    The reconfigure branch fails when the flow leaves any supplied config key
+    unconsumed, where it previously returned success plus a warning — see
+    :func:`_handle_config_subentry_flow_steps` for why. The create branch is
+    unchanged.
     """
     _reject_redaction_sentinels(config_dict)
     flow_result = await client.start_config_subentry_flow(
@@ -174,17 +206,21 @@ async def set_config_subentry(
             config_dict,
             is_reconfigure=subentry_id is not None,
         )
-    except Exception:
-        try:
-            await asyncio.wait_for(
-                client.abort_config_subentry_flow(flow_id), timeout=5.0
-            )
-        except Exception as abort_err:
-            logger.warning(
-                "Failed to abort config subentry flow %s after error: %s",
-                flow_id,
-                abort_err,
-            )
+    except asyncio.CancelledError:
+        await _abort_subentry_flow_best_effort(client, flow_id)
+        raise
+    except Exception as flow_error:
+        payload: dict[str, Any] = {}
+        if isinstance(flow_error, ToolError):
+            try:
+                parsed_payload = json.loads(str(flow_error))
+            except (TypeError, ValueError):
+                parsed_payload = {}
+            if isinstance(parsed_payload, dict):
+                payload = parsed_payload
+        post_commit_status = payload.get("status") in POST_COMMIT_STATUSES
+        if payload.get("flow_budget_exhausted") or not post_commit_status:
+            await _abort_subentry_flow_best_effort(client, flow_id)
         raise
 
     response = {