chore: release v0.6.9

docker build sets next_public_app_url to localhost; preferring it over
runtime auth_url made prod share links point at localhost:3000.

.env.example

@@ -57,3 +57,5 @@ LLM_API_KEY=
 LLM_MODEL=llama3.2
 # IANA timezone for assistant relative dates ("Thursday at 2"). Falls back to TZ, then America/Chicago.
 HOUSEHOLD_TIMEZONE=America/Chicago
+# Optional override for agent tool → /api/v1 self-calls (defaults to http://127.0.0.1:$PORT).
+# INTERNAL_API_BASE_URL=http://127.0.0.1:3000

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [0.6.9](https://github.com/ginnoir/famapp/compare/v0.6.8...v0.6.9) (2026-07-18)
+
+### Bug Fixes
+
+- build share urls from auth_url instead of localhost ([832e726](https://github.com/ginnoir/famapp/commit/832e7265c9354edf86f28f72f129ee34da8c3d04))
+
+## [0.6.8](https://github.com/ginnoir/famapp/compare/v0.6.7...v0.6.8) (2026-07-18)
+
+### Bug Fixes
+
+- restore share and note scrolling on ios pwa ([969521a](https://github.com/ginnoir/famapp/commit/969521ac3f527a939988053b453881ed3560eb61))
+
+## [0.6.7](https://github.com/ginnoir/famapp/compare/v0.6.6...v0.6.7) (2026-07-13)
+
+### Bug Fixes
+
+- **garden:** add ikea cabinet and acrylic case container types ([043d285](https://github.com/ginnoir/famapp/commit/043d28539ec08dd46a097970b4e876bfb1ba7aa1))
+
+## [0.6.6](https://github.com/ginnoir/famapp/compare/v0.6.5...v0.6.6) (2026-07-13)
+
+### Bug Fixes
+
+- **garden:** add carnivore plant category ([b8229eb](https://github.com/ginnoir/famapp/commit/b8229eb9b5550cde98e5446615873e727ead05a8))
+
+## [0.6.5](https://github.com/ginnoir/famapp/compare/v0.6.4...v0.6.5) (2026-07-09)
+
+### Bug Fixes
+
+- **agent:** call api v1 via loopback instead of public url ([3e8fe2d](https://github.com/ginnoir/famapp/commit/3e8fe2d06dc31d3a1058b4b8942c46b1220a6b4c))
+
 ## [0.6.4](https://github.com/ginnoir/famapp/compare/v0.6.3...v0.6.4) (2026-07-09)
 
 ### Bug Fixes

Dockerfile

@@ -16,7 +16,9 @@ ENV CI=true
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV DATABASE_URL=postgres://build:build@localhost:5432/build
 ENV AUTH_SECRET=build-time-placeholder
+# Build-only placeholder. Runtime public URL is AUTH_URL from stack.env — never prefer this.
 ENV NEXT_PUBLIC_APP_URL=http://localhost:3000
+ENV AUTH_URL=http://localhost:3000
 COPY . .
 RUN pnpm install --offline --frozen-lockfile
 RUN --mount=type=cache,id=famapp-nextjs,target=/app/.next/cache \

package.json

@@ -1,6 +1,6 @@
 {
   "name": "famapp",
-  "version": "0.6.4",
+  "version": "0.6.9",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@10.33.3",

src/app/globals.css

@@ -725,9 +725,19 @@
 
 .scroll-area {
   flex: 1;
-  overflow: auto;
+  overflow-x: hidden;
+  overflow-y: auto;
   padding: 20px 24px 60px;
 }
+
+/* Bare routes (/s/*, /login, signed-out) — same scrollport as .scroll-area
+   without app chrome padding. Needed because html/body are overflow:hidden. */
+.bare-scroll {
+  height: 100%;
+  height: 100dvh;
+  overflow-x: hidden;
+  overflow-y: auto;
+}
 :where(html[data-nav="bottom"]) .scroll-area,
 :where(html[data-nav="fab"]) .scroll-area {
   padding: 12px 14px 74px;
@@ -1617,7 +1627,8 @@ select {
   }
 
   /* Momentum scrolling + prevent page bounce fighting in-app scroll */
-  .scroll-area {
+  .scroll-area,
+  .bare-scroll {
     -webkit-overflow-scrolling: touch;
     overscroll-behavior-y: contain;
   }

src/app/layout.tsx

@@ -1,4 +1,5 @@
 import type { Metadata, Viewport } from "next";
+import { headers } from "next/headers";
 import "./globals.css";
 import { Inter, Source_Serif_4, Newsreader, Fraunces, JetBrains_Mono } from "next/font/google";
 import { cn } from "@/lib/utils";
@@ -71,9 +72,13 @@ export const metadata: Metadata = {
 
 // Pre-paint: read user's theme prefs from localStorage and apply data-* + .dark.
 // Falls back to clay/serif-sans/regular/sidebar/system if nothing is stored.
+// Public share pages always use ink so guests get a neutral, consistent look.
 const prePaintScript = `(function(){
   try {
-    var palette = localStorage.getItem('themePalette') || localStorage.getItem('theme') || 'clay';
+    var isShare = location.pathname.indexOf('/s/') === 0;
+    var palette = isShare
+      ? 'ink'
+      : (localStorage.getItem('themePalette') || localStorage.getItem('theme') || 'clay');
     var mode = localStorage.getItem('themeMode') || 'system';
     var fontPair = localStorage.getItem('themeFontPair') || 'serif-sans';
     var density = localStorage.getItem('themeDensity') || 'regular';
@@ -106,6 +111,10 @@ export default async function RootLayout({ children }: { children: React.ReactNo
   let assistantName = DEFAULT_ASSISTANT_NAME;
   let assistantModel: string | null = null;
 
+  const headersList = await headers();
+  const pathname = headersList.get("x-pathname") ?? "";
+  const isSharePage = pathname === "/s" || pathname.startsWith("/s/");
+
   const session = await auth();
   if (session?.user?.id) {
     signedIn = true;
@@ -146,6 +155,10 @@ export default async function RootLayout({ children }: { children: React.ReactNo
       .orderBy(asc(dashboards.position), asc(dashboards.createdAt));
   }
 
+  if (isSharePage) {
+    palette = "ink";
+  }
+
   // Server-side initial dark guess: only for `dark` mode (system mode is corrected
   // before paint by the inline script). Avoids a flash on signed-in users.
   const isDark = mode === "dark";

src/components/app-shell.tsx

@@ -24,7 +24,8 @@ export async function AppShell({ signedIn, navStyle, children }: Props) {
 
   if (bare || !signedIn) {
     // No shell — share viewer and signed-out pages render bare.
-    return <>{children}</>;
+    // html/body are overflow:hidden for the app grid; bare pages need their own scroller.
+    return <div className="bare-scroll">{children}</div>;
   }
 
   const useTopVariant = navStyle === "top-nav";

src/components/rich-text/rich-text.css

@@ -64,6 +64,9 @@
   margin: 0.8em 0;
   max-width: 100%;
   overflow-x: auto;
+  overflow-y: hidden;
+  -webkit-overflow-scrolling: touch;
+  overscroll-behavior-x: contain;
   padding: 0.75rem 0.9rem;
 }
 
@@ -91,7 +94,12 @@
   display: block;
   margin: 0.8em 0;
   max-width: 100%;
+  /* overflow-x alone computes overflow-y to auto, which traps vertical
+     touch scrolling on iOS when a wide table fills the viewport. */
   overflow-x: auto;
+  overflow-y: hidden;
+  -webkit-overflow-scrolling: touch;
+  overscroll-behavior-x: contain;
   width: max-content;
 }
 

src/lib/app-url.ts

@@ -0,0 +1,8 @@
+/** Public origin for absolute links. AUTH_URL wins — Docker build sets NEXT_PUBLIC to localhost. */
+export function getAppPublicUrl(): string {
+  const raw =
+    process.env.AUTH_URL?.trim() ||
+    process.env.NEXT_PUBLIC_APP_URL?.trim() ||
+    "http://localhost:3000";
+  return raw.replace(/\/$/, "");
+}

src/modules/_core/share-api.ts

@@ -1,6 +1,7 @@
 import { createHash, randomBytes } from "crypto";
 import { and, eq, isNull } from "drizzle-orm";
 import type { ApiAuthContext } from "@/lib/api-auth";
+import { getAppPublicUrl } from "@/lib/app-url";
 import { db } from "@/lib/db";
 import { getEntityType, getRegistry } from "./registry";
 import { shareLinks } from "./schema";
@@ -27,9 +28,7 @@ function hashToken(raw: string): string {
 }
 
 function buildUrl(token: string): string {
-  const base =
-    process.env["NEXT_PUBLIC_APP_URL"] ?? process.env["AUTH_URL"] ?? "http://localhost:3000";
-  return `${base}/s/${token}`;
+  return `${getAppPublicUrl()}/s/${token}`;
 }
 
 export function listShareableEntityTypes() {

src/modules/_core/share.ts

@@ -2,6 +2,7 @@
 
 import { createHash, randomBytes } from "crypto";
 import { and, eq, isNull } from "drizzle-orm";
+import { getAppPublicUrl } from "@/lib/app-url";
 import { db } from "@/lib/db";
 import { getCurrentSession } from "@/lib/session";
 import { getEntityType } from "./registry";
@@ -21,9 +22,7 @@ function hashToken(raw: string): string {
 }
 
 function buildUrl(token: string): string {
-  const base =
-    process.env["NEXT_PUBLIC_APP_URL"] ?? process.env["AUTH_URL"] ?? "http://localhost:3000";
-  return `${base}/s/${token}`;
+  return `${getAppPublicUrl()}/s/${token}`;
 }
 
 export async function createShareLink(

src/modules/agent/server/run.ts

@@ -160,8 +160,20 @@ export async function runAgentChat(options: {
 
       try {
         result = await executeTool(toolCall.function.name, toolCall.function.arguments);
-        const parsed = JSON.parse(result) as { status?: number };
+        const parsed = JSON.parse(result) as { status?: number; body?: unknown };
         status = typeof parsed.status === "number" ? parsed.status : 200;
+        if (status >= 400) {
+          logger.warn(
+            {
+              msg: "agent.chat.tool_error",
+              round,
+              name: toolCall.function.name,
+              status,
+              body: parsed.body,
+            },
+            "agent tool returned error",
+          );
+        }
       } catch (err) {
         status = 500;
         result = JSON.stringify({

src/modules/agent/tool-executor.ts

@@ -1,3 +1,5 @@
+import logger from "@/lib/logger";
+
 type ApiCallResult = {
   status: number;
   body: unknown;
@@ -5,8 +7,22 @@ type ApiCallResult = {
 
 export type ToolExecutor = (name: string, argsJson: string) => Promise<string>;
 
+/** Loopback base for in-process tool → /api/v1 calls. Avoids hairpinning to the public URL. */
+export function resolveInternalApiBase(request: Request): string {
+  const configured = process.env.INTERNAL_API_BASE_URL?.trim();
+  if (configured) return configured.replace(/\/$/, "");
+
+  const port = process.env.PORT?.trim() || "3000";
+  const requestUrl = new URL(request.url);
+  if (requestUrl.hostname === "localhost" || requestUrl.hostname === "127.0.0.1") {
+    return requestUrl.origin;
+  }
+
+  return `http://127.0.0.1:${port}`;
+}
+
 export function createApiToolExecutor(request: Request): ToolExecutor {
-  const origin = new URL(request.url).origin;
+  const origin = resolveInternalApiBase(request);
 
   return async (name: string, argsJson: string) => {
     const args = parseArgs(argsJson);
@@ -522,14 +538,30 @@ async function callApi(
   path: string,
   body?: Record<string, unknown>,
 ): Promise<ApiCallResult> {
-  const response = await fetch(`${origin}${path}`, {
-    method,
-    headers: {
-      "Content-Type": "application/json",
-      cookie: request.headers.get("cookie") ?? "",
-    },
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-  });
+  const url = `${origin}${path}`;
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+  const cookie = request.headers.get("cookie");
+  if (cookie) headers.cookie = cookie;
+  const authorization = request.headers.get("authorization");
+  if (authorization) headers.authorization = authorization;
+
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      method,
+      headers,
+      body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "fetch failed";
+    logger.error(
+      { msg: "agent.tool.fetch_failed", method, url, error: message },
+      "agent tool internal fetch failed",
+    );
+    return { status: 502, body: { error: `Internal API unreachable: ${message}`, url } };
+  }
 
   const text = await response.text();
   let parsed: unknown = null;
@@ -541,5 +573,12 @@ async function callApi(
     }
   }
 
+  if (response.status >= 400) {
+    logger.warn(
+      { msg: "agent.tool.api_error", method, url, status: response.status, body: parsed },
+      "agent tool API error",
+    );
+  }
+
   return { status: response.status, body: parsed };
 }

src/modules/garden/components/container-form.tsx

@@ -10,6 +10,8 @@ const CONTAINER_TYPES = [
   { value: "raised-bed", label: "Raised bed" },
   { value: "window-box", label: "Window box" },
   { value: "single-pot", label: "Single pot" },
+  { value: "ikea-cabinet", label: "Ikea Cabinet" },
+  { value: "acrylic-case", label: "Acrylic Case" },
   { value: "outdoor", label: "Outdoor" },
   { value: "other", label: "Other" },
 ];

src/modules/garden/components/plant-form.tsx

@@ -14,6 +14,7 @@ const CATEGORIES = [
   { value: "flower", label: "Flower" },
   { value: "succulent", label: "Succulent" },
   { value: "cactus", label: "Cactus" },
+  { value: "carnivore", label: "Carnivore" },
   { value: "tropical", label: "Tropical" },
   { value: "tree", label: "Tree" },
   { value: "shrub", label: "Shrub" },

tests/unit/agent-tools-runtime.test.ts

@@ -1,7 +1,10 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import { appendAgentRuntimeContext, resolveHouseholdTimezone } from "../../src/modules/agent/tools";
-import { createApiToolExecutor } from "../../src/modules/agent/tool-executor";
+import {
+  createApiToolExecutor,
+  resolveInternalApiBase,
+} from "../../src/modules/agent/tool-executor";
 
 describe("appendAgentRuntimeContext", () => {
   it("appends current time and timezone to the prompt", () => {
@@ -38,6 +41,34 @@ describe("resolveHouseholdTimezone", () => {
   });
 });
 
+describe("resolveInternalApiBase", () => {
+  it("uses loopback instead of the public request origin", () => {
+    const original = process.env.INTERNAL_API_BASE_URL;
+    const originalPort = process.env.PORT;
+    delete process.env.INTERNAL_API_BASE_URL;
+    process.env.PORT = "3000";
+
+    const base = resolveInternalApiBase(new Request("https://fam.ginnoir.com/api/agent/chat"));
+    assert.equal(base, "http://127.0.0.1:3000");
+
+    if (original === undefined) delete process.env.INTERNAL_API_BASE_URL;
+    else process.env.INTERNAL_API_BASE_URL = original;
+    if (originalPort === undefined) delete process.env.PORT;
+    else process.env.PORT = originalPort;
+  });
+
+  it("honors INTERNAL_API_BASE_URL when set", () => {
+    const original = process.env.INTERNAL_API_BASE_URL;
+    process.env.INTERNAL_API_BASE_URL = "http://127.0.0.1:3010/";
+
+    const base = resolveInternalApiBase(new Request("https://fam.ginnoir.com/api/agent/chat"));
+    assert.equal(base, "http://127.0.0.1:3010");
+
+    if (original === undefined) delete process.env.INTERNAL_API_BASE_URL;
+    else process.env.INTERNAL_API_BASE_URL = original;
+  });
+});
+
 describe("create_event calendar resolution", () => {
   it("uses the first calendar when calendarId and calendarName are omitted", async () => {
     const originalFetch = globalThis.fetch;
@@ -45,13 +76,13 @@ describe("create_event calendar resolution", () => {
 
     globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
       const url = String(input);
-      if (url.endsWith("/api/v1/calendars") && (!init?.method || init.method === "GET")) {
+      if (url.includes("/api/v1/calendars") && (!init?.method || init.method === "GET")) {
         return Response.json([
           { id: "cal-1", name: "Family" },
           { id: "cal-2", name: "Work" },
         ]);
       }
-      if (url.endsWith("/api/v1/events") && init?.method === "POST") {
+      if (url.includes("/api/v1/events") && init?.method === "POST") {
         const body = JSON.parse(String(init.body));
         posts.push({ path: url, body });
         return Response.json({ id: "evt-1", ...body }, { status: 201 });
@@ -59,7 +90,11 @@ describe("create_event calendar resolution", () => {
       return new Response("not found", { status: 404 });
     }) as typeof fetch;
 
-    const execute = createApiToolExecutor(new Request("http://localhost:3000/api/agent/chat"));
+    const execute = createApiToolExecutor(
+      new Request("https://fam.ginnoir.com/api/agent/chat", {
+        headers: { cookie: "authjs.session-token=test" },
+      }),
+    );
     const result = JSON.parse(
       await execute(
         "create_event",
@@ -74,6 +109,7 @@ describe("create_event calendar resolution", () => {
     assert.equal(result.status, 201);
     assert.equal(result.body.calendarId, "cal-1");
     assert.equal(posts.length, 1);
+    assert.match(posts[0]!.path, /^http:\/\/127\.0\.0\.1:3000\/api\/v1\/events/);
 
     globalThis.fetch = originalFetch;
   });
@@ -83,13 +119,13 @@ describe("create_event calendar resolution", () => {
 
     globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
       const url = String(input);
-      if (url.endsWith("/api/v1/calendars") && (!init?.method || init.method === "GET")) {
+      if (url.includes("/api/v1/calendars") && (!init?.method || init.method === "GET")) {
         return Response.json([
           { id: "cal-1", name: "Family" },
           { id: "cal-2", name: "Work" },
         ]);
       }
-      if (url.endsWith("/api/v1/events") && init?.method === "POST") {
+      if (url.includes("/api/v1/events") && init?.method === "POST") {
         const body = JSON.parse(String(init.body));
         return Response.json({ id: "evt-1", ...body }, { status: 201 });
       }
@@ -114,4 +150,22 @@ describe("create_event calendar resolution", () => {
 
     globalThis.fetch = originalFetch;
   });
+
+  it("returns a clear error when the internal API is unreachable", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () => {
+      throw new TypeError("fetch failed");
+    }) as typeof fetch;
+
+    const execute = createApiToolExecutor(new Request("https://fam.ginnoir.com/api/agent/chat"));
+    const result = JSON.parse(await execute("list_calendars", "{}")) as {
+      status: number;
+      body: { error?: string };
+    };
+
+    assert.equal(result.status, 502);
+    assert.match(String(result.body.error), /unreachable/i);
+
+    globalThis.fetch = originalFetch;
+  });
 });