refactor: pass verify_ssl to remaining direct-Supervisor httpx callers

[Patch76]

What does this PR do?

Closes #1127. Mirrors the verify=self.verify_ssl propagation pattern established in #1126 (rest_client.py:_get_addon_logs_via_supervisor) at the two other direct-Supervisor httpx.AsyncClient call sites in the codebase, so all three sites use a verify=...verify_ssl access path appropriate to their scope.

• src/ha_mcp/tools/tools_bug_report.py:_fetch_addon_logs → verify=get_global_settings().verify_ssl (module-level helper, no self/closure context — pulls from the Settings singleton).
• src/ha_mcp/settings_ui.py:_restart_addon → verify=server.settings.verify_ssl (closure has access to server: HomeAssistantSmartMCPServer; reads directly from the eager-initialized settings instance to avoid lazy HomeAssistantClient instantiation — adopted from Gemini G1 review on this PR, see commit 732a98a).

The http://supervisor URL is plain HTTP and TLS verification is semantically a no-op there — but the constructor shape is the kind of detail bot reviewers will keep flagging until all three sites match. After this PR, they do.

Boy-Scout — _restart_addon test coverage (Round-2 extended after KP13's CR)

test_settings_ui.py::TestRestartAddon pins five previously-uncovered branches of _restart_addon:

Branch (symbol)	Test	Outcome
if not token: guard (no SUPERVISOR_TOKEN)	test_returns_400_without_supervisor_token	400 + CONFIG_VALIDATION_FAILED
catch on (ReadError, RemoteProtocolError) (Supervisor kills mid-request)	test_treats_connection_drop_as_success (parametrized)	200 + "Restart initiated"
httpx.ConnectError falls through to httpx.HTTPError (Supervisor unreachable)	test_connect_error_returns_502	502 + CONNECTION_FAILED
httpx.HTTPError fall-through (e.g. PoolTimeout)	test_generic_http_error_returns_502	502 + CONNECTION_FAILED
Supervisor returns 4xx (status_code >= 400)	test_supervisor_4xx_returns_502	502

The first two were flagged in #960's approve-body but never followed up at the time. The other three came from KP13's round-1 CR ((ReadError, RemoteProtocolError) narrowing means the prior bare-Exception-equivalent intent had to be split across multiple test cases for accurate coverage).

Test docstrings reference branches by symbol rather than line number — kwarg-splits and adjacent refactors keep shifting _restart_addon's start line.

Out of scope

A shared module-level helper that constructs the Supervisor httpx client once with the right defaults plus the Authorization: Bearer ${SUPERVISOR_TOKEN} header (currently duplicated across all three call sites) — covered as the alternative in #1127's body. That's a refactor with new abstractions and design decisions and would benefit from its own dedicated discussion. Filed as #1130 for when there's appetite.

Type of change

• 🐛 Bug fix
• ✨ New feature
• 📚 Documentation
• 🔧 Maintenance/refactor
• 🧪 Tests only
• 💥 Breaking change

Testing

• I have tested these changes with a LLM agent
• All automated tests pass (uv run pytest)
• Code follows style guidelines (uv run ruff check)

Local: 1762 unit tests pass at 4b1e336, ruff lint + format clean.

The verify= kwarg itself is test-transparent — existing tests mock httpx.AsyncClient.get/.post (the methods, not the constructor). The Boy-Scout TestRestartAddon block (5 branches above) is the additional coverage delta over master.

Checklist

• I have updated documentation if needed (no docs touched; refactor in client/UI layer)

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request standardizes the SSL verification configuration for Supervisor-related HTTP requests. By ensuring that all httpx.AsyncClient instances explicitly handle the verify_ssl setting, the codebase achieves better consistency and alignment with established patterns, resolving potential configuration discrepancies.

Highlights

• SSL Verification Consistency: Propagated the verify_ssl setting to all direct Supervisor httpx.AsyncClient call sites to ensure consistent configuration across the codebase.
• Refactored Call Sites: Updated src/ha_mcp/tools/tools_bug_report.py and src/ha_mcp/settings_ui.py to correctly utilize the appropriate verify_ssl context.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[Patch76]

Implementation Summary

Choices Made:

• Propagation pattern, not verify=False — Issue [FEATURE] Standardize verify_ssl on direct-Supervisor httpx callers #1127's body originally listed verify=False as the minimal option, but that would create a NEW inconsistency with fix: route addon and HA core log fetches directly to Supervisor on addon installs #1126's verify=self.verify_ssl. Updated [FEATURE] Standardize verify_ssl on direct-Supervisor httpx callers #1127's body before implementation; this PR uses the propagation pattern uniformly across all three sites.
• Context-appropriate access path per site:
  • tools_bug_report.py:_fetch_addon_logs (module-level helper) → get_global_settings().verify_ssl. No self, no closure with a server reference, so the Settings singleton is the right access path.
  • settings_ui.py:_restart_addon (closure inside register_settings_routes(mcp, server: HomeAssistantSmartMCPServer, ...)) → server.settings.verify_ssl. Original choice was server.client.verify_ssl; Gemini's G1 review on this PR pointed out that server.client is a lazy @property (instantiating HomeAssistantClient on first access just to read a config bool), while server.settings is eager-initialized in the constructor. Adopted the change in commit 732a98a. Additional benefit: in OAuth deployment mode server.client resolves to an OAuthProxyClient whose __getattr__ requires an OAuth-authenticated request context that _restart_addon doesn't have — server.settings.verify_ssl sidesteps that latent failure mode.
• Boy-Scout test pin (147ad5f) — while touching _restart_addon for the verify_ssl-propagation, two previously-untested branches were pinned in test_settings_ui.py: missing-SUPERVISOR_TOKEN (settings_ui.py:780-789, structured-400) and connection-drop-as-success (:798-801, ReadError/RemoteProtocolError/ConnectError → 200). Both were flagged in feat: web-based settings UI for per-tool enable/disable/pin #960's approve-body but never followed up at the time. The verify= kwarg itself is test-transparent — existing httpx.AsyncClient.get/.post mocks don't assert on constructor kwargs; verifying the constructor kwarg directly would cement an internal-detail and isn't worth a follow-up. The Boy-Scout extension targets the actual untested branches in the function whose access path this PR changes.

Problems Encountered:

• None during implementation. Issue [FEATURE] Standardize verify_ssl on direct-Supervisor httpx callers #1127 was filed by me as a follow-up to fix: route addon and HA core log fetches directly to Supervisor on addon installs #1126; the corrected approach was clear once the body was updated to reflect the actual verify=...verify_ssl propagation pattern from fix: route addon and HA core log fetches directly to Supervisor on addon installs #1126.

Suggested Improvements (Optional Follow-ups):

• Shared Supervisor httpx helper — covered as the alternative in [FEATURE] Standardize verify_ssl on direct-Supervisor httpx callers #1127's body. Would consolidate all three sites' httpx.AsyncClient construction + SUPERVISOR_TOKEN lookup + Authorization: Bearer ... header in one place. Out of scope here (would also need a maintainer discussion on whether a fourth Supervisor call site is on the horizon to justify the helper module). Filed as [FEATURE] Add shared Supervisor httpx helper module #1130 for tracking — three open architecture questions there (per-call vs singleton, module placement, settings-access shape).

[gemini-code-assist]

Code Review

This pull request introduces SSL verification for internal HTTP requests by updating httpx.AsyncClient calls in settings_ui.py and tools_bug_report.py. In tools_bug_report.py, the global configuration is now used to determine the SSL verification status. The review feedback suggests a more efficient way to access the SSL setting in settings_ui.py by using server.settings.verify_ssl directly, which avoids the unnecessary lazy instantiation of the HomeAssistantClient and its associated side effects.

[Patch76]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the httpx.AsyncClient instances in settings_ui.py and tools_bug_report.py to respect the SSL verification configuration. A suggestion was made to use server.client.verify_ssl instead of server.settings.verify_ssl in settings_ui.py to ensure consistency with other call sites and align with the PR's stated objectives.

[Patch76]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the internal HTTP clients used for supervisor interactions to respect the global SSL verification settings. Specifically, the verify parameter in httpx.AsyncClient is now explicitly set using server.settings.verify_ssl in the settings UI and get_global_settings().verify_ssl in the bug report tool. These changes ensure consistent SSL behavior across the application when restarting the add-on or fetching logs. I have no feedback to provide.

[Patch76]

Heads-up: pushed 147ad5f after RfR — Boy-Scout test extension, no behavior change.

While touching _restart_addon for the verify=server.settings.verify_ssl propagation, two previously-untested branches in the same function got pinned:

• settings_ui.py:780-789 (missing SUPERVISOR_TOKEN → structured 400)
• settings_ui.py:798-801 (connection drop → 200 success — Supervisor kills our process during restart, so a ReadError/RemoteProtocolError/ConnectError from the POST is the documented success signal)

Both were flagged in #960's approve-body ("two short cases would close the loop; happy to follow up post-merge instead") but never followed up at the time. The fix-while-already-touching shape avoids a separate tracker issue — the Boy Scout Rule's "When to open an issue instead" carve-out (AGENTS.md:328) doesn't apply (single-function scope, two parametrize-style tests, no design decisions).

PR body + IS comment updated to reflect the test additions.

[kingpanther13]

I haven't done formal review yet so I apologize if I'm overlooking something else here, but I see that this is based on some stuff you figured out with #1126 , and #1126 in its current state doesn't work, it needs some minor changes to work. See the comment and changes requested I placed on it. Once we get everything with #1126 addressed and have confirmed it is working, you should reevaluate to see if this PR and its related issue #1127 are still relevant.

[kingpanther13]

Asks:

1. Narrow the connection-drop catch to (ReadError, RemoteProtocolError). settings_ui.py:822. ConnectError fires before a connection is established — DNS failure, TCP refused, supervisor socket misconfigured. None of those mean a restart was initiated; they mean Supervisor was unreachable. Currently the user clicks restart, sees "Restart initiated," and nothing happens. Let ConnectError fall through to the existing httpx.HTTPError handler (:826) which already returns 502 with CONNECTION_FAILED. Pre-existing, but the new test docstring codifies the broad catch as intentional — cleaner to close the loop here than a separate PR.

2. Parametrize the connection-drop test over (ReadError, RemoteProtocolError), and add a separate case asserting ConnectError returns 502. Locks the contract on both sides.

3. Pin the remaining two _restart_addon branches while you're already in TestRestartAddon. httpx.HTTPError → 502 (:826-834) and status_code >= 400 → 502 (:836+) are still uncovered. Same Boy-Scout pass.

4. Fix the line-number references in the new test docstrings. Class docstring + both method docstrings cite settings_ui.py:780-789 and :798-801, but in master _restart_addon starts at 803 — those ranges land inside _save_tools. Symbol-based references ("the if not token: guard", "the catch on (ReadError, RemoteProtocolError)") survive line shifts; the kwarg-split in this PR shifts them again.

5. Replace __import__("httpx").ReadError("kill") (line 380) with a top-level import httpx.

6. Trim "post-G1 state" from the verify_ssl = True comment. The rest (httpx rejects MagicMock for verify=) is the part that pays off in 6 months.

7. Move the #960 approve-body cross-reference out of the source docstring and into the PR body. Source-level pointers to closed-PR review history rot fast.

Otherwise: server.settings.verify_ssl over server.client.verify_ssl is the right call; pattern matches merged #1126.

[Patch76]

Round-2 — addressed in 4b1e336 (merge commit, also brings master in to clear the conflict against #1136's settings_ui.py stub-injection refactor).

#	KP13 ask	Disposition
1	Narrow connection-drop catch to (ReadError, RemoteProtocolError); let ConnectError fall through	✅ _restart_addon in settings_ui.py. Inline comment documents the deliberate exclusion (DNS / TCP-refused / supervisor-socket-misconfigured all mean Supervisor was unreachable, not that a restart was initiated).
2	Parametrize connection-drop test + separate ConnectError → 502 case	✅ test_treats_connection_drop_as_success parametrizes over (httpx.ReadError, httpx.RemoteProtocolError); new test_connect_error_returns_502 locks the 502 + CONNECTION_FAILED contract for the unreachable case.
3	Pin remaining _restart_addon branches (httpx.HTTPError fall-through, status_code >= 400)	✅ test_generic_http_error_returns_502 (uses httpx.PoolTimeout to exercise the fall-through) + test_supervisor_4xx_returns_502 (Supervisor returns 401 → 502). All five _restart_addon branches now pinned — full table in the updated PR body.
4	Symbol-based test docstrings instead of line numbers	✅ Class-docstring + method-docstrings reference "the if not token: guard", "the catch on (ReadError, RemoteProtocolError)", "the httpx.HTTPError handler", "the status_code >= 400 branch".
5	Top-level import httpx instead of __import__("httpx")	✅ Module-level import in tests/src/unit/test_settings_ui.py.
6	Trim "post-G1 state" from the verify_ssl = True comment	✅ Kept the substantive part ("must resolve to a real bool, not a MagicMock, because httpx accepts only bool/SSLContext for verify=").
7	Move #960 cross-reference out of source docstring into PR body	✅ Dropped from the TestRestartAddon class docstring; the #960 history note moved into the new "Boy-Scout — _restart_addon test coverage" section in the PR body.

Local: 1762 unit tests pass at 4b1e336, ruff lint + format clean.

[kingpanther13]

All seven round-1 asks addressed cleanly. ConnectError narrowing is the substantive win — silent-success on Supervisor-unreachable would have been a real footgun. Boy-Scout pin now covers all five reachable error branches. LGTM.

[github-actions]

🧪 Your changes are now in the dev channel!

Your PR has been merged to master and is available for testing in the dev channel.

Test your changes before the next stable release (biweekly Wednesday):
📖 Dev Channel Documentation

Quick start

# Run dev version
uvx ha-mcp-dev

# Check version
uvx ha-mcp-dev --version

Docker:

docker pull ghcr.io/homeassistant-ai/ha-mcp:dev
docker run --rm -i \
  -e HOMEASSISTANT_URL=http://your-ha:8123 \
  -e HOMEASSISTANT_TOKEN=your_token \
  ghcr.io/homeassistant-ai/ha-mcp:dev

---

Found an issue? Please open a new bug report and mention this PR for context.