fix: route addon and HA core log fetches directly to Supervisor on addon installs

homeassistant-addon-dev/DOCS.md

@@ -27,6 +27,15 @@ The dev add-on uses the same configuration as the stable version. See the main a
 
 Beta options are hidden under "Show unused optional configuration options" in the add-on Configuration tab. See [beta.md](https://github.com/homeassistant-ai/ha-mcp/blob/master/docs/beta.md) for details.
 
+### Permissions
+
+Like the stable add-on, the dev add-on requests `hassio_role: manager` to
+fetch add-on, system-service, and HA-core logs via the Supervisor REST API
+(`/addons/<slug>/logs`, `/<service>/logs`, `/core/logs`) — `default` returns
+403 on these endpoints (see #1116). The role also grants
+start/stop/install/update on other add-ons; ha-mcp only uses the read-side
+capabilities.
+
 ## Tool Settings Web UI
 
 The add-on exposes a web-based settings page for managing which tools are available to AI assistants. Click **"Open Web UI"** on the add-on info page to access it.

homeassistant-addon-dev/config.yaml

@@ -14,7 +14,10 @@ ingress: true
 ingress_port: 9583
 ingress_stream: true
 hassio_api: true
-hassio_role: default
+# `manager` (not `default`) is required so the Supervisor token grants access
+# to /addons/<slug>/logs and /<service>/logs (system service logs). Verified
+# via live test — `default` returns 403 for both. See #1116.
+hassio_role: manager
 homeassistant_api: true
 host_network: true
 image: "ghcr.io/homeassistant-ai/ha-mcp-addon-dev-{arch}"

homeassistant-addon/DOCS.md

@@ -287,6 +287,15 @@ The add-on uses Home Assistant Supervisor's built-in authentication. No tokens o
 - **Remote access** - Use the [Webhook Proxy add-on](../homeassistant-addon-webhook-proxy/DOCS.md) (easiest with Nabu Casa) or the Cloudflared add-on for secure HTTPS tunnels
 - **Never expose** port 9583 directly to the internet without proper security measures
 
+### Supervisor Permissions
+
+The add-on requests `hassio_role: manager` (declared in `config.yaml`).
+`manager` is required for the Supervisor REST endpoints used to fetch
+add-on and system-service logs (`/addons/<slug>/logs`, `/<service>/logs`,
+`/core/logs`) — `default` returns 403 (see #1116). The role also grants
+start/stop/install/update on other add-ons, but ha-mcp only uses the
+read-side capabilities.
+
 ---
 
 ## Troubleshooting

homeassistant-addon/config.yaml

@@ -13,7 +13,10 @@ startup: application
 boot: manual
 # Enable access to Supervisor API for auto-discovery
 hassio_api: true
-hassio_role: default
+# `manager` (not `default`) is required so the Supervisor token grants access
+# to /addons/<slug>/logs and /<service>/logs (system service logs). Verified
+# via live test — `default` returns 403 for both. See #1116.
+hassio_role: manager
 # Enable access to Home Assistant API
 homeassistant_api: true
 # Enable host network mode for local network access