From 182b0c49c28e245680dc063742f290af7b53114c Mon Sep 17 00:00:00 2001 From: Tomas Dvorak Date: Thu, 24 Sep 2026 22:01:47 +0200 Subject: [PATCH] fix: vendor dashboard fonts + vault_exec docs cleanup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Geist/Geist Mono via @fontsource inside the Vite bundle — the Google Fonts was blocked by the nginx CSP (style-src 'self'), so the dashboard silently fell back and phoned home on self-hosted instances. Fonts now serve from /assets under 'self' — CSP-clean, airgapped, no console violation. - mcp README: vault_exec described the old deny-list; rewritten for the allow-list contract. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- CHANGELOG.md | 1 + apps/frontend/index.html | 7 ------- apps/frontend/package.json | 2 ++ apps/frontend/src/index.css | 9 +++++++++ apps/mcp/README.md | 8 ++++++-- package-lock.json | 22 +++++++++++++++++++++- 6 files changed, 39 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8f9e29b..0b489e2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,7 @@ All notable changes to Primora. Format follows [Keep a Changelog](https://keepac - **Structured error hygiene** — `pgconn.PgError` codes map to clean statuses (23505 → 409 "resource already exists", 23503 → 409, 22001/54000 → 400 "value too large", 22021 → 400) instead of leaking SQLSTATE/constraint names; validator failures report `field is required`/`field failed validation`; a new `services.InputError` type maps service-layer input failures to 400 (webhook URL/event-type errors were 500s). Presign on the local driver returns `presign_unsupported` 400. - **`fetch failed` polish** — connection failures report the cause code and suggest `primora context` instead of bare undici errors. - **`login --json`** — the flag now emits JSON on both the session and API-key paths. +- **Dashboard fonts vendored** — Geist/Geist Mono now ship via `@fontsource` inside the bundle instead of a Google Fonts `` the nginx CSP blocked (`style-src 'self'`). Removes the runtime Google dependency, works airgapped, and eliminates the console CSP violation. ## [0.7.1] - 2026-09-23 diff --git a/apps/frontend/index.html b/apps/frontend/index.html index a2d492f..4eabac1 100644 --- a/apps/frontend/index.html +++ b/apps/frontend/index.html @@ -16,13 +16,6 @@ - - - -