fix: standard-mode console logging + relay-stub upstream contract pins (#2039)

* fix: make standard-mode console logging effective; pin relay-timeout upstream contracts

usage_logger's StartupLogCollector attaches to the root logger at import
time, so _setup_logging's basicConfig was a no-op in ha-mcp-web/stdio
modes (root stayed at WARNING with no console handler — INFO lines like
the annotated 405 probe never surfaced). force=True is now the default,
wrapped in preserve_startup_collector() so the collector survives the
force sweep un-closed — which also repairs OAuth/OIDC modes, whose
explicit force=True has been silently destroying ha_report_issue's
startup-log capture on every start.

Pin the upstream facts the relay timeout tests rely on: real aiohttp
(new dev dependency, floored at HA 2026.6's pin) is compared field-by-
field against both ClientTimeout stubs in a pristine subprocess, and
sse-starlette's 15 s keepalive default plus the MCP SDK's omission of a
ping override are asserted so a drift fails loud instead of leaving
tests green while production moves.

Also: FAQ migration note for the removed ha-mcp-sse entry point, and
component escalated to 1.3.0 (pending minor per AGENTS.md — the merged
RFC 9207 iss feature warrants more than a patch).

Closes #2031.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017iTWsCSMPqSHm7Po8yGzfk

* test: pin the force=True default with a foreign-root-handler case

Patch76's review: the collector-only test state let a force=False flip
stay green (the wrapper empties the handler list, so basicConfig acts
regardless), and the docstring blamed the collector for a no-op the
wrapper already prevents. The new case installs a non-collector root
handler first — red on a default flip — and the docstring now states
what force actually guards: foreign root handlers and repeat
reconfiguration. Verified by mutation both ways.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017iTWsCSMPqSHm7Po8yGzfk

* docs: correct the force-default docstring against the call graph

Patch76's residual: OAuth/OIDC pass force=True explicitly and never
exercise the default; the default's users are exactly the post-settings
standard paths, and no entry point reconfigures twice. The docstring
now says what the suite proves — foreign handlers from a test runner or
dependency — and notes the default is defensive at today's call sites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017iTWsCSMPqSHm7Po8yGzfk

---------

Co-authored-by: kingpanther13 <kingpanther13@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: kingpanther13

custom_components/ha_mcp_tools/const.py

@@ -25,7 +25,7 @@
 # in CI. The
 # capability negotiation — not this version — gates each WS command (see
 # ``websocket_api.CAPABILITIES``).
-COMPONENT_VERSION = "1.2.4"
+COMPONENT_VERSION = "1.3.0"
 
 # Config-entry discriminator (``entry.data[CONF_ENTRY_TYPE]``). A missing value
 # means "tools" so the pre-existing services entry keeps working across the

custom_components/ha_mcp_tools/manifest.json

@@ -22,5 +22,5 @@
     "requirements": [
         "ruamel.yaml>=0.18.0"
     ],
-    "version": "1.2.4"
+    "version": "1.3.0"
 }

docs/FAQ.md

@@ -46,6 +46,15 @@ The demo environment resets weekly. Your changes won't persist.
 
 ## Troubleshooting
 
+### `ha-mcp-sse` is gone / my SSE config stopped connecting
+
+The legacy `ha-mcp-sse` entry point (deprecated HTTP+SSE transport on port 8087)
+was removed — the MCP specification deprecated the HTTP+SSE transport. Switch to
+`ha-mcp-web`, which serves Streamable HTTP at `/mcp` on port 8086, and change any
+SSE-style client config accordingly (Gemini CLI users: use the `httpUrl` key, not
+`url`). An SSE / `--transport sse` client config pointed at `ha-mcp-web` returns
+`405` and won't connect.
+
 ### OAuth stopped working after upgrading to v7.0.0
 
 v7.0.0 removed the Home Assistant URL field from the OAuth consent form to fix security vulnerabilities (SSRF and XSS). Set `HOMEASSISTANT_URL` as a server-side environment variable before starting ha-mcp. See the [OAuth migration guide](OAUTH.md#migrating-from-v6x) for instructions.

pyproject.toml

@@ -198,6 +198,13 @@ asyncio_mode = "auto"
 
 [dependency-groups]
 dev = [
+    # Real aiohttp so tests can pin the ClientTimeout defaults the custom
+    # component's relay and the webhook-proxy addon rely on (both are stubbed
+    # in unit tests; nothing else would catch stub drift). NOT a runtime
+    # dependency — src/ never imports aiohttp; HA core provides it in-process.
+    # Floor = the aiohttp HA core 2026.6 pins (2026.7 pins 3.14.1, 2026.8.dev
+    # pins 3.14.3), so the version tested here is one a supported HA runs.
+    "aiohttp>=3.13.5",
     "build>=1.2.2",
     "docker>=7.1.0",
     "httpx2>=2.4.0",

src/ha_mcp/__main__.py

@@ -478,14 +478,36 @@ def filter(self, record: logging.LogRecord) -> bool:
         return not (status == 405 and path == self._mcp_path)
 
 
-def _setup_logging(log_level_str: str, force: bool = False) -> None:
-    """Configure root logger with consistent timestamp format."""
-    logging.basicConfig(
-        level=getattr(logging, log_level_str),
-        format="%(asctime)s %(name)s %(levelname)s: %(message)s",
-        datefmt=_LOG_DATE_FORMAT,
-        force=force,
-    )
+def _setup_logging(log_level_str: str, force: bool = True) -> None:
+    """Configure root logger with consistent timestamp format.
+
+    ``force`` defaults to True so the reconfiguration is deterministic: with
+    ANY root handler present, ``basicConfig`` is a silent no-op — neither the
+    console handler nor the level is applied. Since
+    ``preserve_startup_collector`` detaches the collector before
+    ``basicConfig`` runs, the default guards against FOREIGN root handlers —
+    a test runner's or a dependency's. At the two call sites that use the
+    default (``main`` and ``_setup_standard_mode``) the only root handler
+    attached anywhere in ``src/`` is the collector, which the wrapper detaches
+    first — so today the default is defensive rather than load-bearing. The
+    OAuth/OIDC entry points pass ``force=True`` explicitly and never exercise
+    the default.
+
+    The historical standard-mode bug was ``usage_logger``'s
+    ``StartupLogCollector`` (attached to root at import time) triggering that
+    same no-op; the wrapper now detaches it for the duration — keeping it out
+    of the sweep ``force`` performs (which removes *and closes* every root
+    handler) so ``ha_report_issue`` keeps its startup diagnostics.
+    """
+    from ha_mcp.utils.usage_logger import preserve_startup_collector
+
+    with preserve_startup_collector():
+        logging.basicConfig(
+            level=getattr(logging, log_level_str),
+            format="%(asctime)s %(name)s %(levelname)s: %(message)s",
+            datefmt=_LOG_DATE_FORMAT,
+            force=force,
+        )
     logging.getLogger("mcp.server.streamable_http").addFilter(
         StatelessSessionLogFilter()
     )

src/ha_mcp/utils/usage_logger.py

@@ -7,6 +7,8 @@
 import threading
 import time
 from collections import deque
+from collections.abc import Iterator
+from contextlib import contextmanager
 from dataclasses import asdict, dataclass
 from datetime import UTC, datetime
 from pathlib import Path
@@ -94,6 +96,30 @@ def get_startup_logs() -> list[dict[str, Any]]:
     return _startup_collector.get_logs()
 
 
+@contextmanager
+def preserve_startup_collector() -> Iterator[None]:
+    """Keep the startup collector attached across a logging reconfiguration.
+
+    ``logging.basicConfig(force=True)`` removes *and closes* every handler on
+    the root logger. The collector is attached there at import time and is the
+    source of ``ha_report_issue``'s startup diagnostics, so it is detached for
+    the duration of the block — leaving nothing for the sweep to close — and
+    re-attached afterwards.
+    """
+    collector = _startup_collector
+    root = logging.getLogger()
+    if collector is None or collector not in root.handlers:
+        yield
+        return
+
+    root.removeHandler(collector)
+    try:
+        yield
+    finally:
+        if collector not in root.handlers:
+            root.addHandler(collector)
+
+
 # Parameter keys whose values are masked before a tool call is recorded to the
 # in-memory ring buffer or persisted to disk. Tool kwargs can carry secrets
 # (alarm/lock ``code``, tokens, passwords); these must never reach the usage

tests/src/unit/test_component_ws_search.py

@@ -779,7 +779,7 @@ def test_manifest_version_parity(self):
                 _REPO_ROOT / "custom_components" / "ha_mcp_tools" / "manifest.json"
             ).read_text(encoding="utf-8")
         )
-        assert manifest["version"] == COMPONENT_VERSION == "1.2.4"
+        assert manifest["version"] == COMPONENT_VERSION == "1.3.0"
 
 
 # =============================================================================