food/deploy, branch mcp-api

nginx: match the MCP location with or without a trailing slash

2026-06-23T20:50:31+00:00

claude.ai strips the trailing slash from the connector URL, so a location of /mcp// missed and fell to the 301 catch-all. Use a regex (^/mcp//?(.*)$) that matches both and normalises onto the FastMCP root. Co-Authored-By: Claude Opus 4.8

nginx: 404 the .well-known/ OAuth probes for the MCP connector

2026-06-23T20:41:41+00:00

claude.ai's custom-connector flow probes /.well-known/oauth-* during setup. The catch-all 301 -> /app/ made those return the Kitchen login page (200), so claude.ai mistook it for an OAuth sign-in service, tried Dynamic Client Registration, and failed. Returning 404 makes it treat the server as authless and connect. Co-Authored-By: Claude Opus 4.8

fix service group

2026-06-23T20:29:12+00:00

Phase 3b: FastMCP "ai service" for claude.ai cooking mode

2026-06-23T20:16:30+00:00

A standalone MCP server (no Django import) exposing 7 tools over Streamable HTTP, backed by the Django REST API via the caine token. - mcp_server/: client.py (httpx wrapper over /api/), server.py (the tools + FastMCP app + main), __main__.py, tests.py. - Tools: get_pantry, set_item_state, add_to_pantry, what_can_i_cook, get_recipes, log_cook (suggests, never mutates), create_meta_recipe (brainstorm -> commit). Each description says when to call it. - deploy/food-mcp.service: systemd unit (own process, runs .venv python -m mcp_server, loads /var/lib/food/.env). - deploy/food.tomflux.xyz.nginx: current config + an authless /mcp// location proxying to 127.0.0.1:8765 (the URL secret is the credential; SSE-friendly buffering/timeout). - pyproject: [dependency-groups] mcp = [fastmcp, httpx]; deploy with `uv sync --group mcp`. Verified: 7 tools register on fastmcp 3.x, run() accepts transport/ host/port/path, 6 FoodClient unit tests pass (httpx MockTransport). Co-Authored-By: Claude Opus 4.8

Phase 2: session auth for the web UI

2026-06-23T19:37:48+00:00

Require login for /app/, with a long sliding session so you log in once per device and effectively stay in. - AppLoginRequiredMiddleware gates only /app/; /api/ keeps DRF token auth and /admin/ keeps its own login (a blanket LoginRequired would break token requests, whose user isn't resolved until the view runs). - Login page (styled to the dark palette) via django.contrib.auth.urls; logout control in the nav. - Session: ~1 year cookie, sliding (saved every request), survives browser close. - Dropped every @csrf_exempt now that a real session + CSRF token are in place (HTMX already sends X-CSRFToken). - SECRET_KEY and DEBUG now read from the environment (prod-safe defaults); systemd loads an optional /var/lib/food/.env. - Tests authenticate, plus new coverage: /app/ redirects when logged out, login grants access, /api/ is not caught by the app gate. Co-Authored-By: Claude Opus 4.8

Migrate dependency management to uv

2026-06-23T18:55:42+00:00

Replace requirements.txt with pyproject.toml (direct deps only; uv resolves the rest into uv.lock). Point the systemd unit at the uv-managed .venv, and gitignore it. Run `uv lock` to generate the lockfile and commit it. Co-Authored-By: Claude Opus 4.8

Phase 4: HTMX frontend with dark palette

2026-04-02T22:08:43+00:00

- 4 pages: Pantry, Recipes, Shopping List, Cook Log - HTMX-powered: add/delete pantry items, toggle shopping, generate smart list - Custom 13-colour palette from Lospec (dark bg, yellow accent) - Mobile-responsive - Whitenoise for static files in production - All routes under /app/ - API (/api/) stays internal, frontend (/app/) for browser use