fix: ingress double-slash 404, Supervisor API startup race, MQTT graceful fallback

- Redirect // → / in ingress middleware (Supervisor proxy sends GET //)
- Retry loop waits for Supervisor API before reading config
- MQTT service read with fallback when not configured

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jrx-code

ha-sandbox/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.12.2] - 2026-03-10
+
+### Fixed
+- **Ingress double-slash** — `GET //` from Supervisor proxy now redirects to `/` (was returning 404)
+- **Startup race condition** — retry loop waits for Supervisor API before reading config (fixes "Unable to access the API, forbidden" on fresh install)
+- **MQTT graceful fallback** — no more error when MQTT service not configured in Supervisor
+
 ## [0.12.1] - 2026-03-10
 
 ### Fixed

ha-sandbox/app/main.py

@@ -61,6 +61,9 @@ async def ingress_middleware(request: Request, call_next):
     """Support HA ingress by reading X-Ingress-Path header."""
     ingress_path = request.headers.get("X-Ingress-Path", "")
     request.state.ingress_path = ingress_path
+    # Normalize double-slash from ingress proxy (GET // → redirect to /)
+    if request.url.path != "/" and request.url.path.startswith("//"):
+        return RedirectResponse(request.url.path.replace("//", "/", 1), status_code=301)
     response = await call_next(request)
     return response
 

ha-sandbox/config.yaml

@@ -1,5 +1,5 @@
 name: "HA Security Sandbox"
-version: "0.12.1"
+version: "0.12.2"
 slug: ha_security_sandbox
 description: "Security scanner for Home Assistant custom components — static analysis + AI review"
 url: "https://github.com/jrx-code/ha-security-sandbox"

ha-sandbox/run.sh

@@ -4,6 +4,12 @@
 if bashio::supervisor.ping 2>/dev/null; then
     STANDALONE=false
     bashio::log.info "Running as HA Add-on (Supervisor detected)"
+    # Wait for Supervisor API to be fully ready (avoids "forbidden" on fresh install)
+    for i in 1 2 3; do
+        if bashio::config 'log_level' &>/dev/null; then break; fi
+        bashio::log.info "Waiting for Supervisor API... ($i/3)"
+        sleep 2
+    done
 else
     STANDALONE=true
     bashio::log.info "Running standalone (no Supervisor)"
@@ -25,20 +31,29 @@ if [ "$STANDALONE" = "false" ]; then
     export SANDBOX_AI_PROVIDER="$AI_PROVIDER"
 
     # MQTT — use HA Supervisor MQTT service if available
-    if bashio::services.available "mqtt"; then
-        export SANDBOX_MQTT_HOST="$(bashio::services mqtt 'host')"
-        export SANDBOX_MQTT_PORT="$(bashio::services mqtt 'port')"
-        export SANDBOX_MQTT_USER="$(bashio::services mqtt 'username')"
-        export SANDBOX_MQTT_PASS="$(bashio::services mqtt 'password')"
+    if bashio::services.available "mqtt" 2>/dev/null; then
+        export SANDBOX_MQTT_HOST="$(bashio::services mqtt 'host' 2>/dev/null || echo '')"
+        export SANDBOX_MQTT_PORT="$(bashio::services mqtt 'port' 2>/dev/null || echo '1883')"
+        export SANDBOX_MQTT_USER="$(bashio::services mqtt 'username' 2>/dev/null || echo '')"
+        export SANDBOX_MQTT_PASS="$(bashio::services mqtt 'password' 2>/dev/null || echo '')"
         export SANDBOX_MQTT_USE_TLS="false"
-        bashio::log.info "Using Supervisor MQTT service at ${SANDBOX_MQTT_HOST}:${SANDBOX_MQTT_PORT}"
+        if [ -n "${SANDBOX_MQTT_HOST}" ]; then
+            bashio::log.info "Using Supervisor MQTT service at ${SANDBOX_MQTT_HOST}:${SANDBOX_MQTT_PORT}"
+        else
+            bashio::log.warning "MQTT service available but could not read config"
+        fi
+    else
+        bashio::log.info "No MQTT service found in Supervisor"
     fi
     export SANDBOX_MQTT_ENABLED="$(bashio::config 'mqtt_enabled')"
     export SANDBOX_MQTT_TLS="$(bashio::config 'mqtt_tls')"
 
     # HA API via Supervisor
     export SANDBOX_HA_URL="http://supervisor/core"
-    export SANDBOX_HA_TOKEN="${SUPERVISOR_TOKEN}"
+    export SANDBOX_HA_TOKEN="${SUPERVISOR_TOKEN:-}"
+    if [ -z "${SANDBOX_HA_TOKEN}" ]; then
+        bashio::log.warning "SUPERVISOR_TOKEN not set — HA API access disabled"
+    fi
 
     LOG_LEVEL="$(bashio::config 'log_level')"
 else