diff --git a/DECISIONS.md b/DECISIONS.md index fc56bf41..59646a5f 100644 --- a/DECISIONS.md +++ b/DECISIONS.md @@ -599,3 +599,4 @@ One line per decision: `[YYYY-MM-DD] : `. Appended by agents and [2026-07-27] Analytics is hosted-only and explicitly so: isAnalyticsEnabled() short-circuits on NEXT_PUBLIC_SELF_HOSTED and no __NEXT_PUBLIC_POSTHOG_*__ sentinel was added to Dockerfile/docker-entrypoint.sh. Recapt reached the same outcome only by accident (its env var was simply missing from the sentinel list), which meant a self-hosted operator could never have configured it and nobody had decided that on purpose. An AGPL operator's users should not be reported to our project. [2026-07-27] Removing Recapt made lib/support/submit-feedback.ts single-channel: a failing /api/support/contact now surfaces as a real error instead of being masked by Recapt reporting success on its own channel. That is the correct behaviour (silently "succeeding" while the message reached nobody was worse) and the Resend path is solid. A non-blocking posthog.capture('support_feedback_submitted') replaces the useful half of the Recapt channel by putting the submission on the user's timeline next to the session replay; it deliberately carries no message body, since free text is user content and would be PII in an event property. [2026-07-27] vitest.config.ts now aliases 'server-only' to tests/stubs/server-only.ts. Its real entry point throws unconditionally (Next.js swaps it out at bundle time; Vitest cannot), so the moment a server-only module entered the test graph it broke 48 test files at import. app/(dashboard)/request-context.ts was already carrying the same latent trap and had simply never been imported by a test. +[2026-07-27] Self-hosted the dicebear Notionists avatars under public/agent-avatars instead of loading api.dicebear.com per render: the licence turned out to be CC0 1.0 (verified on dicebear.com/licenses AND in each file's own RDF metadata), so there was no licence decision to escalate, and the CDN was sending every authenticated page view's IP and referer to a third party while breaking firewalled/self-hosted installs entirely. diff --git a/components/agent/AgentAvatar.tsx b/components/agent/AgentAvatar.tsx index 9e6d31d2..89ef40c2 100644 --- a/components/agent/AgentAvatar.tsx +++ b/components/agent/AgentAvatar.tsx @@ -11,14 +11,13 @@ interface Props { alt?: string } -// Renders the agent's avatar: either the chosen dicebear SVG from the -// AVATAR_OPTIONS registry, or a fallback MessageCircle glyph on a dark circle -// when no avatar is set yet (free tier / older profiles). +// Renders the agent's avatar: either the chosen SVG from the AVATAR_OPTIONS +// registry, or a fallback MessageCircle glyph on a dark circle when no avatar +// is set yet (free tier / older profiles). // -// `next/image` is intentionally NOT used: avatars are tiny remote SVGs from -// the dicebear CDN, and adding the domain to next.config just to render a -// 28px image is overkill. Browser caches the SVG forever via the seed-keyed -// URL. +// `next/image` is intentionally NOT used: these are tiny static SVGs served +// from our own /public, and the optimizer does not process SVG anyway, so it +// would add a round trip through /_next/image for nothing. export default function AgentAvatar({ avatarId, size = 'sm', className, alt }: Props) { const url = getAvatarUrl(avatarId) const dim = SIZES[size] diff --git a/components/agent/__tests__/avatars.test.ts b/components/agent/__tests__/avatars.test.ts new file mode 100644 index 00000000..cd727120 --- /dev/null +++ b/components/agent/__tests__/avatars.test.ts @@ -0,0 +1,85 @@ +import { describe, it, expect } from 'vitest' +import { existsSync, readFileSync } from 'node:fs' +import { join } from 'node:path' +import { AVATAR_OPTIONS, getAvatarUrl } from '../avatars' + +/** + * These avatars used to be fetched from api.dicebear.com on every render, so + * every authenticated page view of an accounting product told a third party + * who was looking at it, and a firewalled or self-hosted install showed no + * faces at all. The point of these tests is that the registry cannot quietly + * drift back to a remote URL, and that every entry actually has a file. + */ + +const PUBLIC_DIR = join(process.cwd(), 'public') + +describe('AVATAR_OPTIONS', () => { + it('serves every avatar from our own origin', () => { + for (const option of AVATAR_OPTIONS) { + expect(option.url.startsWith('/'), `${option.id} must be a local path`).toBe(true) + expect(option.url).not.toMatch(/^https?:/) + expect(option.url).not.toContain('dicebear.com') + } + }) + + it('has a real file behind every entry', () => { + // A registry entry with no file renders a broken image, which looks like a + // bug in the agent rather than a missing asset. + for (const option of AVATAR_OPTIONS) { + expect(existsSync(join(PUBLIC_DIR, option.url)), `missing file for ${option.id}`).toBe(true) + } + }) + + it('ships avatars that make no network requests of their own', () => { + // Self-hosting the file is pointless if the file then phones home. This + // asserts the PROPERTY (nothing points off-origin) rather than a list of + // elements: an allowlist of and xlink:href would still let a + // future asset through via , , or a + // scheme-relative //host, which is how this sort of guard rots. + for (const option of AVATAR_OPTIONS) { + const svg = readFileSync(join(PUBLIC_DIR, option.url), 'utf8') + + // Namespace declarations and the licence metadata legitimately contain + // URLs and are never fetched, so they are removed before the check + // rather than special-cased inside it. + const referencing = svg + .replace(//gi, '') + .replace(/xmlns(:[a-z0-9-]+)?\s*=\s*"[^"]*"/gi, '') + .replace(/xsi:type\s*=\s*"[^"]*"/gi, '') + + expect(referencing, `${option.id} references an absolute URL`).not.toMatch(/https?:\/\//i) + // Scheme-relative: "//host/x" inherits the page's scheme and still + // leaves the origin. + expect(referencing, `${option.id} references a scheme-relative URL`).not.toMatch( + /(href|src)\s*=\s*"\/\//i, + ) + expect(referencing).not.toMatch(/url\(\s*['"]?\/\//i) + expect(referencing, `${option.id} contains a script`).not.toMatch(/