homeassistant-ai
diff --git a/‎src/ha_mcp/client/websocket_client.py‎
Lines changed: 25 additions & 0 deletions b/‎src/ha_mcp/client/websocket_client.py‎
Lines changed: 25 additions & 0 deletions
diff --git a/‎src/ha_mcp/tools/tools_areas.py‎
Lines changed: 9 additions & 0 deletions b/‎src/ha_mcp/tools/tools_areas.py‎
Lines changed: 9 additions & 0 deletions
diff --git a/‎src/ha_mcp/tools/tools_config_automations.py‎
Lines changed: 22 additions & 0 deletions b/‎src/ha_mcp/tools/tools_config_automations.py‎
Lines changed: 22 additions & 0 deletions
@@ -292,6 +292,12 @@ def __init__(self, url: str, token: str, verify_ssl: bool | None = None):
         # or None. Surfaced by callers so the agent sees *why* a WebSocket
         # connection failed instead of an opaque "Failed to connect" string.
         self._last_connect_error: str | None = None
+        # The exception object itself, so the connection manager can
+        # re-raise an auth failure AS an auth failure instead of collapsing
+        # every connect miss into HomeAssistantConnectionError (issue #2159
+        # review: an expired token must classify as AUTH_*, and the reason
+        # otherwise survives only inside the message string).
+        self._last_connect_exception: Exception | None = None
 
         # Parse URL to get WebSocket endpoint
         parsed = urlparse(self.base_url)
@@ -317,6 +323,7 @@ async def connect(self) -> bool:
             logger.info(f"Connecting to Home Assistant WebSocket: {self.ws_url}")
             self._state.reset_connection()
             self._last_connect_error = None
+            self._last_connect_exception = None
 
             # Only configure an SSLContext for wss://; ws:// (Supervisor
             # proxy) doesn't use TLS and gets ssl=None.
@@ -383,6 +390,7 @@ async def connect(self) -> bool:
 
         except Exception as e:
             self._last_connect_error = f"{type(e).__name__}: {e}"
+            self._last_connect_exception = e
             if _is_ssl_error(e) and self.verify_ssl:
                 logger.error(
                     "WebSocket TLS verification failed for %s: %s. "
@@ -1037,6 +1045,16 @@ def last_connect_error(self) -> str | None:
         """
         return self._last_connect_error
 
+    @property
+    def last_connect_exception(self) -> Exception | None:
+        """The exception the most recent ``connect()`` attempt failed with.
+
+        Lets the connection manager preserve the failure class — an
+        ``HomeAssistantAuthError`` re-raises as an auth error rather than
+        being collapsed into ``HomeAssistantConnectionError``.
+        """
+        return self._last_connect_exception
+
 
 MAX_POOL_SIZE = 50
 
@@ -1295,6 +1313,13 @@ async def get_client(
                 # keeps a non-str (e.g. a MagicMock in tests) from polluting
                 # the message with a repr.
                 detail = f": {reason}" if isinstance(reason, str) else ""
+                # An auth failure must classify as an auth failure — the
+                # collapsed connection error buries the cause in the message
+                # string and callers misreport it as connection guidance.
+                if isinstance(client.last_connect_exception, HomeAssistantAuthError):
+                    raise HomeAssistantAuthError(
+                        "WebSocket authentication failed" + detail
+                    )
                 raise HomeAssistantConnectionError(
                     "Failed to connect to Home Assistant WebSocket" + detail
                 )
 
@@ -23,6 +23,7 @@
     register_tool_methods,
     validate_identifier_not_empty,
 )
+from .tools_config_helpers import validate_registry_ids
 from .util_helpers import (
     JSON_STRING_COERCION,
     parse_string_list_param,
@@ -675,6 +676,14 @@ async def ha_set_area_or_floor(
                 )
             )
 
+            # Issue #2159: the area registry stores an unknown floor_id
+            # verbatim, orphaning the area. ``_validate_cross_kind_params``
+            # already rejected floor_id for kind='floor', so this only ever
+            # runs for areas; None and "" (clear) skip the lookup.
+            await validate_registry_ids(
+                self._client, None, None, None, floor_id=floor_id, fail_closed=True
+            )
+
             result = await self._client.send_websocket_message(message)
 
             if result.get("success"):
 
@@ -47,6 +47,7 @@
     validate_identifier_not_empty,
 )
 from .reference_validator import validate_config_references
+from .tools_config_helpers import validate_registry_ids
 from .util_helpers import (
     JSON_STRING_COERCION,
     apply_entity_category,
@@ -852,6 +853,17 @@ async def ha_config_set_automation(
                 self._client, config_dict
             )
 
+            # Issue #2159: the category is applied post-upsert via
+            # ``apply_entity_category``, which HA accepts unchecked. Reject an
+            # unknown one here so no automation is created under it.
+            await validate_registry_ids(
+                self._client,
+                None,
+                None,
+                {"automation": effective_category},
+                fail_closed=True,
+            )
+
             return await self._run_config_update(
                 config_dict,
                 identifier,
@@ -1017,6 +1029,16 @@ async def _run_python_transform(
         self._validate_required_fields(transformed_config, identifier)
         bp_warnings = _check_best_practices(transformed_config)
 
+        # Issue #2159: reject an unknown category before the write, so a
+        # transform never lands under a category that does not exist.
+        await validate_registry_ids(
+            self._client,
+            None,
+            None,
+            {"automation": effective_category},
+            fail_closed=True,
+        )
+
         # ``_fetch_and_verify_hash`` already resolved ``identifier`` to the
         # storage key; thread it so the upsert skips the redundant re-resolve
         # (issue #1813 Phase 0). Fall back to the raw identifier if the fetched