ha-mcp-dev 8.7.0.dev3059__tar.gz → 8.7.0.dev3060__tar.gz

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.7.0.dev3059
+Version: 8.7.0.dev3060
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Keywords: mcp,home-assistant,ai,automation,smart-home
 Author: Julien

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.7.0.dev3059"
+version = "8.7.0.dev3060"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 requires-python = ">=3.13,<3.15"

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/pyproject.toml.orig

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.7.0.dev3059"
+version = "8.7.0.dev3060"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/src/ha_mcp/tools/config_entry_flow.py

@@ -756,6 +756,52 @@ async def config_entry_of_domain(
     return config_entry
 
 
+COMPONENT_DOMAIN = "ha_mcp_tools"
+
+COMPONENT_ENTRY_SUGGESTIONS: tuple[str, ...] = (
+    "Manage it in the Home Assistant UI: Settings > Devices & services > "
+    + "HA-MCP Custom Component (Configure for options; the entry's menu for "
+    + "enable/disable, delete and debug logging).",
+    "Server settings and updates: with developer mode on, "
+    + "ha_dev_manage_settings / ha_dev_manage_server.",
+)
+
+
+def is_component_domain(domain: object) -> bool:
+    """Whether ``domain`` names ha-mcp's own ``ha_mcp_tools`` integration.
+
+    Core's integration lookup (config flows, log levels) is case-sensitive
+    today, so there a mixed-case or padded domain fails downstream anyway and
+    the normalisation is defence in depth. Core's service registry does
+    lowercase a domain, which is why ha_call_service's guard needs it.
+    """
+    return isinstance(domain, str) and domain.strip().lower() == COMPONENT_DOMAIN
+
+
+def refuse_component_entry(
+    domain: object, *, action: str, entry_id: str | None = None
+) -> None:
+    """Refuse ``action`` on a config entry of ha-mcp's own custom component.
+
+    Writing one of those entries reloads or alters the server answering the
+    call. The HA UI owns them, and the ``ha_dev_*`` tools defer writes that
+    would reload the running server (embedded mode), so the generic
+    integration tools must not become a bypass.
+    """
+    if not is_component_domain(domain):
+        return
+    raise_tool_error(
+        create_error_response(
+            ErrorCode.VALIDATION_INVALID_PARAMETER,
+            f"Cannot {action} ha-mcp's own '{COMPONENT_DOMAIN}' integration "
+            "with this tool: its config entries are the server's own and are "
+            "not managed through the generic integration tools.",
+            suggestions=list(COMPONENT_ENTRY_SUGGESTIONS),
+            context={"entry_id": entry_id, "domain": domain},
+        )
+    )
+
+
 async def _update_config_entry_options(
     client: Any,
     entry_id: str,
@@ -767,6 +813,9 @@ async def _update_config_entry_options(
     _reject_redaction_sentinels(config_dict)
     config_entry = await config_entry_of_domain(client, entry_id, expected_domain)
     actual_domain = config_entry.get("domain")
+    refuse_component_entry(
+        actual_domain, action="change the options of", entry_id=entry_id
+    )
 
     flow_result = await client.start_options_flow(entry_id)
     flow_id = flow_result.get("flow_id")

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/src/ha_mcp/tools/config_entry_identity.py

@@ -9,6 +9,9 @@ against after.
 
 Every read here raises rather than producing a half-filled identity: an empty
 list means "the entry has none", never "we could not tell".
+
+The manual rollback metadata a reconfigure reports alongside that identity is
+built here too.
 """
 
 import logging
@@ -508,3 +511,35 @@ def _verify_reconfigure_identity_fields(
             expected=expected_identity,
             status=ReconfigureStatus.APPLIED_IDENTITY_MISMATCH,
         )
+
+
+def build_reconfigure_rollback_metadata(
+    entry_id: str,
+    domain: str,
+) -> dict[str, Any]:
+    """Describe the manual rollback path for an existing config entry.
+
+    The snapshot the auto-backup layer captures is Home Assistant's config
+    entry fragment (``config_entries/get`` over WebSocket, which serializes
+    ``ConfigEntry.as_json_fragment``). That fragment carries no ``data`` key,
+    so the entry's connection settings are not in it: the snapshot is audit
+    evidence, not an automatic endpoint rollback. An operator must repeat the
+    official reconfigure flow with the known previous values.
+    """
+    return {
+        "strategy": "official_reconfigure_flow",
+        "automatic": False,
+        "operator_action_required": True,
+        "manual_required": True,
+        "manual_reason": "previous_config_unavailable",
+        "entry_id": entry_id,
+        "domain": domain,
+        "previous_config": None,
+        "backup_scope": "edits",
+        "backup_restore_supported": False,
+        "backup_restore_note": (
+            "The generic integration snapshot is audit evidence only; its shared "
+            "restore handler does not restore connection settings. Use the official "
+            "reconfigure flow instead."
+        ),
+    }

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/src/ha_mcp/tools/config_entry_reconfigure.py

@@ -24,6 +24,7 @@ from .component_config_entries import fetch_domain_unique_ids
 from .config_entry_flow import (
     _abort_flow_best_effort,
     _reject_redaction_sentinels,
+    refuse_component_entry,
 )
 from .config_entry_flow_walker import (
     POST_COMMIT_STATUSES,
@@ -40,6 +41,7 @@ from .config_entry_identity import (
     _validated_config_entry_rows,
     _verification_state,
     _verify_reconfigure_identity_fields,
+    build_reconfigure_rollback_metadata,
     cross_domain_warnings,
 )
 from .config_entry_reload_watch import (
@@ -70,38 +72,6 @@ class PreparedReconfigure:
     warnings: list[str] = field(default_factory=list)
 
 
-def build_reconfigure_rollback_metadata(
-    entry_id: str,
-    domain: str,
-) -> dict[str, Any]:
-    """Describe the manual rollback path for an existing config entry.
-
-    The snapshot the auto-backup layer captures is Home Assistant's config
-    entry fragment (``config_entries/get`` over WebSocket, which serializes
-    ``ConfigEntry.as_json_fragment``). That fragment carries no ``data`` key,
-    so the entry's connection settings are not in it: the snapshot is audit
-    evidence, not an automatic endpoint rollback. An operator must repeat the
-    official reconfigure flow with the known previous values.
-    """
-    return {
-        "strategy": "official_reconfigure_flow",
-        "automatic": False,
-        "operator_action_required": True,
-        "manual_required": True,
-        "manual_reason": "previous_config_unavailable",
-        "entry_id": entry_id,
-        "domain": domain,
-        "previous_config": None,
-        "backup_scope": "edits",
-        "backup_restore_supported": False,
-        "backup_restore_note": (
-            "The generic integration snapshot is audit evidence only; its shared "
-            "restore handler does not restore connection settings. Use the official "
-            "reconfigure flow instead."
-        ),
-    }
-
-
 def _raise_post_commit_verification_error(
     error: ToolError,
     *,
@@ -420,6 +390,7 @@ async def prepare_reconfigure_request(
                 context={"entry_id": validated_entry_id, "entry": entry},
             )
         )
+    refuse_component_entry(domain, action="reconfigure", entry_id=validated_entry_id)
     if not entry.get("supports_reconfigure", False):
         raise_tool_error(
             create_error_response(

ha_mcp_dev-8.7.0.dev3060/src/ha_mcp/tools/integration_entry_state.py

@@ -0,0 +1,118 @@
+"""The enable/disable and log-level modes of ``ha_set_integration``.
+
+Neither runs a config flow: each sends one mutating WebSocket command after
+the own-entry check (enable/disable and log level by entry look the entry up
+first), and both refuse ha-mcp's own ``ha_mcp_tools`` entries.
+"""
+
+from typing import Any
+
+from ..errors import ErrorCode, create_error_response
+from .config_entry_flow import refuse_component_entry
+from .helpers import raise_tool_error, ws_failure_code
+
+
+async def set_log_level(
+    client: Any,
+    entry_id: str | None,
+    domain: str | None,
+    log_level: str,
+    *,
+    other_modes: bool,
+) -> dict[str, Any]:
+    """Set an integration's log level through ``logger/integration_log_level``."""
+    if other_modes or (domain is None) == (entry_id is None):
+        raise_tool_error(
+            create_error_response(
+                ErrorCode.VALIDATION_INVALID_PARAMETER,
+                "log_level takes exactly one of 'domain' or 'entry_id' and "
+                "cannot be combined with config, enabled or reconfigure",
+                suggestions=[
+                    "Example: ha_set_integration(domain='zha', log_level='DEBUG')",
+                ],
+                context={"entry_id": entry_id, "domain": domain},
+            )
+        )
+    if entry_id is not None:
+        entry = await client.get_config_entry(entry_id)
+        domain = entry.get("domain")
+    refuse_component_entry(domain, action="set the log level of", entry_id=entry_id)
+    result = await client.send_websocket_message(
+        {
+            "type": "logger/integration_log_level",
+            "integration": domain,
+            # NOTSET is what the UI's Disable debug logging sends.
+            "level": "NOTSET" if log_level == "DEFAULT" else log_level,
+            "persistence": "once",
+        }
+    )
+    if not result.get("success"):
+        raise_tool_error(
+            create_error_response(
+                ws_failure_code(result),
+                f"Failed to set the log level for '{domain}': "
+                f"{result.get('error') or 'unknown error'}",
+                context={"domain": domain, "entry_id": entry_id},
+            )
+        )
+    return {
+        "success": True,
+        "action": "set_log_level",
+        "domain": domain,
+        "log_level": log_level,
+        "note": (
+            "Override cleared: the integration now logs at the inherited "
+            "default level; a level set for it in configuration.yaml returns "
+            "after the next restart."
+            if log_level == "DEFAULT"
+            else "Applies now and through the next Home Assistant restart."
+        ),
+    }
+
+
+async def set_entry_enabled(
+    client: Any, entry_id: str, enabled: bool
+) -> dict[str, Any]:
+    """Enable or disable a config entry via ``config_entries/disable``."""
+    entry = await client.get_config_entry(entry_id)
+    refuse_component_entry(
+        entry.get("domain"), action="enable or disable", entry_id=entry_id
+    )
+    message = {
+        "type": "config_entries/disable",
+        "entry_id": entry_id,
+        "disabled_by": None if enabled else "user",
+    }
+
+    result = await client.send_websocket_message(message)
+
+    if not result.get("success"):
+        error_msg = result.get("error", {})
+        if isinstance(error_msg, dict):
+            error_msg = error_msg.get("message", str(error_msg))
+        raise_tool_error(
+            create_error_response(
+                ErrorCode.SERVICE_CALL_FAILED,
+                f"Failed to {'enable' if enabled else 'disable'} integration: {error_msg}",
+                context={"entry_id": entry_id},
+            )
+        )
+
+    require_restart = (result.get("result") or {}).get("require_restart", False)
+
+    if require_restart:
+        note = "Home Assistant restart required for changes to take effect."
+    else:
+        note = (
+            "Integration has been loaded."
+            if enabled
+            else "Integration has been unloaded."
+        )
+
+    return {
+        "success": True,
+        "message": f"Integration {'enabled' if enabled else 'disabled'} successfully",
+        "entry_id": entry_id,
+        "require_restart": require_restart,
+        "note": note,
+    }

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/src/ha_mcp/tools/integration_reconfigure.py

@@ -21,10 +21,12 @@ from ..errors import ErrorCode, create_error_response
 from ..utils.config_hash import compute_config_hash
 from .auto_backup import with_auto_backup
 from .config_entry_flow_walker import ReconfigureStatus
-from .config_entry_identity import ReconfigureIdentity
+from .config_entry_identity import (
+    ReconfigureIdentity,
+    build_reconfigure_rollback_metadata,
+)
 from .config_entry_reconfigure import (
     PreparedReconfigure,
-    build_reconfigure_rollback_metadata,
     prepare_reconfigure_request,
     reconfigure_config_entry,
 )

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/src/ha_mcp/tools/tools_dev.py

@@ -39,6 +39,7 @@ from .component_api import (
     invalidate_caps,
     is_unknown_command,
 )
+from .config_entry_flow import COMPONENT_DOMAIN
 from .config_entry_flow_form import _MISSING_DEFAULT, _step_owned_submission_value
 from .helpers import (
     exception_to_structured_error,
@@ -54,11 +55,6 @@ logger = logging.getLogger(__name__)
 # section of the web settings UI (Server Settings tab, bottom).
 FEATURE_FLAG = "HAMCP_ENABLE_DEV_MODE"
 
-# Domain of the ha_mcp_tools custom component. Its "server" config entry
-# runs the ha-mcp server in-process inside HA and exposes channel /
-# pip-spec options that ha_dev_manage_server drives.
-COMPONENT_DOMAIN = "ha_mcp_tools"
-
 # The component's own in-process command for locating its "server" config
 # entry (see ``_fetch_server_entry_via_component``) — replaces probing every
 # ha_mcp_tools-domain entry's options-flow schema from the outside.

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/src/ha_mcp/tools/tools_filesystem.py

@@ -30,6 +30,7 @@ from ha_mcp._vendor.fastmcp.tools import tool
 from ..errors import ErrorCode, create_error_response
 from .auto_backup import with_auto_backup
 from .component_api import ComponentCaps, get_component_caps
+from .config_entry_flow import COMPONENT_DOMAIN as MCP_TOOLS_DOMAIN
 from .helpers import (
     exception_to_structured_error,
     log_tool_usage,
@@ -44,9 +45,6 @@ logger = logging.getLogger(__name__)
 # Feature flag - disabled by default for safety
 FEATURE_FLAG = "HAMCP_ENABLE_FILESYSTEM_TOOLS"
 
-# Domain for the custom component
-MCP_TOOLS_DOMAIN = "ha_mcp_tools"
-
 # Caller-token auth (mirrors custom_components/ha_mcp_tools).
 # The custom component's handlers reject every call that doesn't present
 # this field with the matching token. ha-mcp fetches the token once via

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/src/ha_mcp/tools/tools_integrations.py

@@ -47,7 +47,11 @@ from .config_entry_backup import (
     resolve_config_entry_backup_domain,
     skip_unless_flow_helper,
 )
-from .config_entry_flow import create_config_entry, update_config_entry_options
+from .config_entry_flow import (
+    create_config_entry,
+    refuse_component_entry,
+    update_config_entry_options,
+)
 from .config_entry_flow_form import iter_schema_fields
 from .config_helpers.registry import _get_entities_for_config_entry
 from .config_helpers.schemas import SIMPLE_HELPER_TYPES, StorageHelperType
@@ -69,6 +73,7 @@ from .helpers import (
     validate_identifier_not_empty,
     ws_failure_code,
 )
+from .integration_entry_state import set_entry_enabled, set_log_level
 from .integration_reconfigure import (
     ReconfigureRunner,
     reject_reconfigure_only_parameters,
@@ -1844,6 +1849,9 @@ class IntegrationTools:
         - Config subentries: use
           ha_config_set_helper(helper_type='config_subentry').
         - Removing an entry: use ha_remove_helpers_integrations.
+        - ha-mcp's own ha_mcp_tools entries are refused: manage them in the HA
+          UI, or (server settings, developer mode on) ha_dev_manage_settings /
+          ha_dev_manage_server.
 
         Use ha_get_integration() to find entry IDs, and
         ha_get_integration(entry_id=..., include_schema=True) to inspect the
@@ -1876,7 +1884,8 @@ class IntegrationTools:
                     expected_mac=expected_mac,
                     expected_entity_ids=expected_entity_ids,
                 )
-                return await self._set_log_level(
+                return await set_log_level(
+                    self._client,
                     entry_id,
                     domain,
                     log_level,
@@ -1918,6 +1927,7 @@ class IntegrationTools:
                         "'local_calendar'",
                     ],
                 )
+                refuse_component_entry(domain, action="add an entry for")
                 return await create_config_entry(self._client, domain, config or {})
 
             if entry_id is None:
@@ -1944,7 +1954,7 @@ class IntegrationTools:
             )
 
             if enabled is not None:
-                return await self._set_entry_enabled(entry_id, enabled)
+                return await set_entry_enabled(self._client, entry_id, enabled)
 
             if config is not None:
                 # Options mode: drive the entry's options flow.
@@ -1992,103 +2002,6 @@ class IntegrationTools:
             error_context["domain"] = domain
         return error_context
 
-    async def _set_log_level(
-        self,
-        entry_id: str | None,
-        domain: str | None,
-        log_level: str,
-        *,
-        other_modes: bool,
-    ) -> dict[str, Any]:
-        """Set an integration's log level through ``logger/integration_log_level``."""
-        if other_modes or (domain is None) == (entry_id is None):
-            raise_tool_error(
-                create_error_response(
-                    ErrorCode.VALIDATION_INVALID_PARAMETER,
-                    "log_level takes exactly one of 'domain' or 'entry_id' and "
-                    "cannot be combined with config, enabled or reconfigure",
-                    suggestions=[
-                        "Example: ha_set_integration(domain='zha', log_level='DEBUG')",
-                    ],
-                    context={"entry_id": entry_id, "domain": domain},
-                )
-            )
-        if entry_id is not None:
-            entry = await self._client.get_config_entry(entry_id)
-            domain = entry.get("domain")
-        result = await self._client.send_websocket_message(
-            {
-                "type": "logger/integration_log_level",
-                "integration": domain,
-                # NOTSET is what the UI's Disable debug logging sends.
-                "level": "NOTSET" if log_level == "DEFAULT" else log_level,
-                "persistence": "once",
-            }
-        )
-        if not result.get("success"):
-            raise_tool_error(
-                create_error_response(
-                    ws_failure_code(result),
-                    f"Failed to set the log level for '{domain}': "
-                    f"{result.get('error') or 'unknown error'}",
-                    context={"domain": domain, "entry_id": entry_id},
-                )
-            )
-        return {
-            "success": True,
-            "action": "set_log_level",
-            "domain": domain,
-            "log_level": log_level,
-            "note": (
-                "Override cleared: the integration now logs at the inherited "
-                "default level; a level set for it in configuration.yaml returns "
-                "after the next restart."
-                if log_level == "DEFAULT"
-                else "Applies now and through the next Home Assistant restart."
-            ),
-        }
-
-    async def _set_entry_enabled(self, entry_id: str, enabled: bool) -> dict[str, Any]:
-        """Enable or disable a config entry via ``config_entries/disable``."""
-        message = {
-            "type": "config_entries/disable",
-            "entry_id": entry_id,
-            "disabled_by": None if enabled else "user",
-        }
-
-        result = await self._client.send_websocket_message(message)
-
-        if not result.get("success"):
-            error_msg = result.get("error", {})
-            if isinstance(error_msg, dict):
-                error_msg = error_msg.get("message", str(error_msg))
-            raise_tool_error(
-                create_error_response(
-                    ErrorCode.SERVICE_CALL_FAILED,
-                    f"Failed to {'enable' if enabled else 'disable'} integration: {error_msg}",
-                    context={"entry_id": entry_id},
-                )
-            )
-
-        require_restart = (result.get("result") or {}).get("require_restart", False)
-
-        if require_restart:
-            note = "Home Assistant restart required for changes to take effect."
-        else:
-            note = (
-                "Integration has been loaded."
-                if enabled
-                else "Integration has been unloaded."
-            )
-
-        return {
-            "success": True,
-            "message": f"Integration {'enabled' if enabled else 'disabled'} successfully",
-            "entry_id": entry_id,
-            "require_restart": require_restart,
-            "note": note,
-        }
-
     @tool(
         name="ha_remove_helpers_integrations",
         tags={"Helper Entities", "Integrations"},
@@ -2174,6 +2087,9 @@ class IntegrationTools:
           config entry) — use `ha_remove_entity` instead.
         - YAML-configured helpers — they have no storage backend. Edit the
           YAML file and reload the relevant integration.
+        - ha-mcp's own ha_mcp_tools entries are refused: manage them in the HA
+          UI, or (server settings, developer mode on) ha_dev_manage_settings /
+          ha_dev_manage_server.
 
         ROUTING:
         - SIMPLE helper_type (input_button, input_boolean, input_select,
@@ -2344,8 +2260,18 @@ class IntegrationTools:
 
     # === Path 3: Direct config entry delete (any integration) ===
     async def _delete_direct_entry(self, entry_id: str) -> dict[str, Any]:
-        """Delete a config entry directly via the REST delete API."""
+        """Delete a config entry directly via the REST delete API.
+
+        Looks the entry up first and refuses ha-mcp's own ``ha_mcp_tools``
+        entries before any DELETE is sent.
+        """
         try:
+            entry = await self._client.get_config_entry(entry_id)
+            refuse_component_entry(
+                entry.get("domain"),
+                action="delete a config entry of",
+                entry_id=entry_id,
+            )
             result = await self._client.delete_config_entry(entry_id)
             require_restart = result.get("require_restart", False)
             return {
@@ -2366,15 +2292,16 @@ class IntegrationTools:
         except ToolError:
             raise
         except HomeAssistantAPIError as e:
-            # HA returns 404 for missing config entries (see
-            # RestClient.delete_config_entry — the REST DELETE on a
-            # nonexistent entry surfaces as HomeAssistantAPIError with
-            # status_code=404). Surface as RESOURCE_NOT_FOUND so callers
-            # can distinguish absent target from real failures; the typo
-            # case (agent passed the wrong entry_id) is the failure mode
-            # that "absent → success" would silently mask. Non-404 API
-            # errors are real failures and bubble through
-            # exception_to_structured_error below.
+            # A missing entry surfaces as HomeAssistantAPIError with
+            # status_code=404 from the own-entry lookup
+            # (RestClient.get_config_entry), before any DELETE is sent, or
+            # from the DELETE itself when the entry vanished in between
+            # (RestClient.delete_config_entry). Surface it as
+            # RESOURCE_NOT_FOUND so callers can distinguish an absent target
+            # from a real failure; the typo case (agent passed the wrong
+            # entry_id) is the failure mode that "absent → success" would
+            # silently mask. Non-404 API errors are real failures and bubble
+            # through exception_to_structured_error below.
             if e.status_code == 404:
                 raise_tool_error(
                     create_error_response(

{ha_mcp_dev-8.7.0.dev3059 → ha_mcp_dev-8.7.0.dev3060}/src/ha_mcp/tools/tools_service.py

@@ -49,6 +49,7 @@ from .component_api import (
     invalidate_caps,
     is_unknown_command,
 )
+from .config_entry_flow import is_component_domain
 from .helpers import (
     exception_to_structured_error,
     log_tool_usage,
@@ -805,14 +806,10 @@ class ServiceTools:
                 )
             )
         # ha_mcp_tools.* services are restricted to the ha-mcp server's dedicated
-        # wrappers (which inject the required caller token). Block ha_call_service
-        # from forwarding to that domain — it would otherwise be a bypass path
-        # around the dedicated tools. HA core's service registry lowercases the
-        # domain on fallback lookup (homeassistant/core.py
-        # ServiceRegistry.async_call), so normalise here to make sure a mixed-case
-        # `HA_MCP_TOOLS` can't slip past this exact-string check and still resolve
-        # downstream.
-        if domain.strip().lower() == "ha_mcp_tools":
+        # wrappers (which inject the required caller token); forwarding to that
+        # domain would bypass them. is_component_domain normalises case because
+        # HA core's service registry lowercases the domain on fallback lookup.
+        if is_component_domain(domain):
             raise_tool_error(
                 create_validation_error(
                     (