Adds fonts.googleapis.com to CSP by robert-inkeep · Pull Request #2916 · inkeep/agents

robert-inkeep · 2026-03-30T21:19:22Z

No description provided.

changeset-bot · 2026-03-30T21:19:27Z

⚠️ No Changeset found

Latest commit: d385c16

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-03-30T21:19:27Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agents-api	Ready	Preview, Comment	Mar 30, 2026 9:47pm
agents-manage-ui	Ready	Preview, Comment	Mar 30, 2026 9:47pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
agents-docs	Skipped		Mar 30, 2026 9:47pm

pullfrog · 2026-03-30T21:20:23Z

TL;DR — Loosens the Content Security Policy in the manage UI to allow Google Fonts and Monaco Editor's WebAssembly execution, fixing CSP violations for font loading and the code editor.

Key changes

Allow Google Fonts in CSP — Adds https://fonts.googleapis.com to style-src and https://fonts.gstatic.com to font-src so the browser permits loading Google Fonts stylesheets and font files.
Add 'wasm-unsafe-eval' to script-src — Permits Monaco Editor's WebAssembly-based syntax highlighting without opening the full 'unsafe-eval' escape hatch.

_{Summary ｜ 1 file ｜ 4 commits ｜ base: main ← google-font-csp}

Before: style-src 'self' 'unsafe-inline', font-src 'self', and no wasm directive — Google Fonts blocked by CSP and Monaco Editor's WASM execution rejected.
After: style-src 'self' 'unsafe-inline' https://fonts.googleapis.com, font-src 'self' https://fonts.gstatic.com, and 'wasm-unsafe-eval' in script-src — both font loads and WASM execution permitted.

agents-manage-ui/src/proxy.ts

^{｜ View workflow run ｜ Triggered by Pullfrog ｜ Using Claude Opus ｜ 𝕏}

pullfrog

Low urgency — the change is harmless but likely unnecessary, and if Google Fonts are needed at runtime, the CSP is incomplete. One inline comment with details.

^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

pullfrog · 2026-03-30T21:20:41Z

    `default-src 'self'`,
    `script-src ${scriptSrcDomains}`,
-    `style-src 'self' 'unsafe-inline'`,
+    `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,


The app loads fonts via next/font/google (layout.tsx:2), which downloads and self-hosts font files at build time — no runtime requests to fonts.googleapis.com. This CSP addition shouldn't be needed for the current setup.

If there is a use case that requires loading Google Fonts stylesheets at runtime (e.g. a dynamic @import or <link> tag), then font-src on line 70 also needs https://fonts.gstatic.com — otherwise the browser will allow the stylesheet but block the actual .woff2 font file downloads.

Could you share what triggered this change? If there's a CSP violation in the console, the full blocked URI would help determine the right fix.

claude

PR Review Summary

(1) Total Issues | Risk: Medium

🟠⚠️ Major (1) 🟠⚠️

Inline Comments:

🟠 Major: proxy.ts:70 Missing font-src directive — Google Fonts won't load without allowing fonts.gstatic.com

Context

This PR adds https://fonts.googleapis.com to the style-src CSP directive to allow loading Google Fonts stylesheets.

Current architecture note: The app already uses next/font/google (Inter, JetBrains_Mono) in layout.tsx, which self-hosts fonts at build time and doesn't require CSP exceptions. This change suggests either:

A new feature using dynamic Google Fonts loading, or
A third-party dependency that embeds Google Fonts

Without the font-src update, the stylesheet will load but the actual font files will be blocked.

🚫 REQUEST CHANGES

Summary: The CSP change is incomplete — adding fonts.googleapis.com to style-src without also adding fonts.gstatic.com to font-src will cause font loading to fail silently. Please apply the inline suggestion to fix this. Additionally, consider adding a brief PR description explaining which feature requires external Google Fonts loading (since the existing fonts use Next.js's optimized self-hosting approach).

Reviewers (1)

Reviewer	Returned	Main Findings	Consider	While You're Here	Inline Comments	Pending Recs	Discarded
`orchestrator`	1	0	0	0	1	0	0
Total	1	0	0	0	1	0	0

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

claude

PR Review Summary

(1) Total Issues | Risk: Low

🟡 Minor (1) 🟡

Inline Comments:

🟡 Minor: proxy.ts:69-70 Duplicate style-src directive (copy-paste error)

🕐 Pending Recommendations (1)

💭 proxy.ts:69 Consider documenting which feature requires external Google Fonts (since existing fonts use next/font/google self-hosting)

💡 APPROVE WITH SUGGESTIONS

Summary: The prior font-src feedback was addressed — fonts.gstatic.com is now correctly included. However, there's a small copy-paste error that duplicated the style-src line. Apply the 1-click suggestion to clean it up. 🧹

Reviewers (1)

Reviewer	Returned	Main Findings	Consider	While You're Here	Inline Comments	Pending Recs	Discarded
`orchestrator`	1	0	0	0	1	1	0
Total	1	0	0	0	1	1	0

Note: Delta-scoped re-review. Prior font-src issue resolved; new duplicate line detected.

claude · 2026-03-30T21:26:12Z

+    `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,
+    `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,


🟡 Minor: Duplicate style-src directive

Issue: The style-src directive appears twice (lines 69-70). This looks like a copy-paste error when adding the font-src line.

Why: Per the CSP spec, when duplicate directives exist, only the first occurrence is applied — so this won't break anything, but it's unnecessary and adds noise to the CSP header.

Fix: (1-click apply)

Suggested change

`style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,

`style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,

`style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,

Refs:

CSP Level 3 spec — duplicate directives

claude

PR Review Summary

(0) Total Issues | Risk: Low

✅ Prior Issues Resolved

All feedback from previous reviews has been addressed:

✅ Missing font-src https://fonts.gstatic.com — now included (line 71)
✅ Duplicate style-src directive — removed in commit 591c89927

📝 Delta Review (2 commits since last review)

New change: Added 'wasm-unsafe-eval' to script-src (line 60)

This is appropriate for Monaco Editor support:

Monaco uses WebAssembly for syntax highlighting and validation
'wasm-unsafe-eval' is the CSP Level 3 recommended approach — narrowly scoped to WASM compilation only
Safer than 'unsafe-eval' which allows arbitrary string-to-code evaluation
Monaco is extensively used throughout the manage UI (26 files reference it)

✅ APPROVE

Summary: Clean delta — all prior feedback addressed, and the new 'wasm-unsafe-eval' addition is a well-scoped, security-appropriate change for Monaco Editor. Ship it! 🚀

Reviewers (1)

Reviewer	Returned	Main Findings	Consider	While You're Here	Inline Comments	Pending Recs	Discarded
`orchestrator`	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0

Note: Delta-scoped re-review. No sub-reviewers dispatched — small, focused change with clear justification (Monaco Editor CSP support).

font-csp

claude

PR Review Summary

(0) Total Issues | Risk: Low

✅ No New Issues

This is a re-review triggered by a synchronize event. The PR state is unchanged from the previous APPROVE review.

Summary of changes:

style-src → adds https://fonts.googleapis.com (allows Google Fonts CSS)
font-src → adds https://fonts.gstatic.com (allows Google Fonts WOFF2 files)

Both domains are correctly paired per the Google Fonts CSP documentation.

✅ Prior Issues Resolved

All feedback from previous reviews was addressed:

✅ Missing font-src https://fonts.gstatic.com — added
✅ Duplicate style-src directive — removed

✅ APPROVE

Summary: Clean CSP addition for Google Fonts. Both required domains are correctly configured. Ship it! 🚀

Reviewers (1)

Reviewer	Returned	Main Findings	Consider	While You're Here	Inline Comments	Pending Recs	Discarded
`orchestrator`	0	0	0	0	0	0	0
Total	0	0	0	0	0	0	0

Note: Re-review with no new commits since prior APPROVE. No sub-reviewers dispatched.

* Adds fonts.googleapis.com to CSP * Update agents-manage-ui/src/proxy.ts Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> * removes duplicate font-csp --------- Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

Adds fonts.googleapis.com to CSP

157a64b

robert-inkeep enabled auto-merge March 30, 2026 21:19

pullfrog Bot reviewed Mar 30, 2026

View reviewed changes

vercel Bot deployed to Preview – agents-manage-ui March 30, 2026 21:21 View deployment

claude Bot reviewed Mar 30, 2026

View reviewed changes

Comment thread agents-manage-ui/src/proxy.ts Outdated

vercel Bot deployed to Preview – agents-api March 30, 2026 21:22 View deployment

github-actions Bot deleted a comment from claude Bot Mar 30, 2026

robert-inkeep disabled auto-merge March 30, 2026 21:22

Update agents-manage-ui/src/proxy.ts

504489b

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

vercel Bot temporarily deployed to Preview – agents-docs March 30, 2026 21:24 Inactive

vercel Bot deployed to Preview – agents-manage-ui March 30, 2026 21:26 View deployment

claude Bot reviewed Mar 30, 2026

View reviewed changes

github-actions Bot deleted a comment from claude Bot Mar 30, 2026

vercel Bot deployed to Preview – agents-api March 30, 2026 21:27 View deployment

vercel Bot temporarily deployed to Preview – agents-docs March 30, 2026 21:31 Inactive

robert-inkeep enabled auto-merge March 30, 2026 21:33

vercel Bot deployed to Preview – agents-manage-ui March 30, 2026 21:33 View deployment

claude Bot reviewed Mar 30, 2026

View reviewed changes

vercel Bot deployed to Preview – agents-api March 30, 2026 21:34 View deployment

github-actions Bot deleted a comment from claude Bot Mar 30, 2026

robert-inkeep changed the title ~~Adds fonts.googleapis.com to CSP~~ Adds fonts.googleapis.com + Monaco to CSP Mar 30, 2026

robert-inkeep added this pull request to the merge queue Mar 30, 2026

robert-inkeep removed this pull request from the merge queue due to a manual request Mar 30, 2026

removes duplicate

d385c16

font-csp

robert-inkeep force-pushed the google-font-csp branch from 3aba21b to d385c16 Compare March 30, 2026 21:43

vercel Bot temporarily deployed to Preview – agents-docs March 30, 2026 21:43 Inactive

robert-inkeep changed the title ~~Adds fonts.googleapis.com + Monaco to CSP~~ Adds fonts.googleapis.com to CSP Mar 30, 2026

vercel Bot deployed to Preview – agents-manage-ui March 30, 2026 21:45 View deployment

claude Bot reviewed Mar 30, 2026

View reviewed changes

github-actions Bot deleted a comment from claude Bot Mar 30, 2026

vercel Bot deployed to Preview – agents-api March 30, 2026 21:47 View deployment

robert-inkeep added this pull request to the merge queue Mar 30, 2026

Merged via the queue into main with commit c458b0e Mar 30, 2026
19 of 20 checks passed

robert-inkeep deleted the google-font-csp branch March 30, 2026 21:58

claude Bot mentioned this pull request Mar 31, 2026

Add fallback models support and capabilities-gated UI features #2850

Merged

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds fonts.googleapis.com to CSP#2916

Adds fonts.googleapis.com to CSP#2916
robert-inkeep merged 3 commits intomainfrom
google-font-csp

robert-inkeep commented Mar 30, 2026

Uh oh!

changeset-bot Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

pullfrog Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

pullfrog Bot left a comment

Uh oh!

pullfrog Bot Mar 30, 2026

Uh oh!

claude Bot left a comment

Uh oh!

Uh oh!

claude Bot left a comment

Uh oh!

claude Bot Mar 30, 2026

Uh oh!

claude Bot left a comment

Uh oh!

Uh oh!

claude Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		`style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,
		`style-src 'self' 'unsafe-inline' https://fonts.googleapis.com`,

Conversation

robert-inkeep commented Mar 30, 2026

Uh oh!

changeset-bot Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pullfrog Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Key changes

Uh oh!

pullfrog Bot left a comment

Choose a reason for hiding this comment

Uh oh!

pullfrog Bot Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

🟠⚠️ Major (1) 🟠⚠️

Context

🚫 REQUEST CHANGES

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

🟡 Minor (1) 🟡

🕐 Pending Recommendations (1)

💡 APPROVE WITH SUGGESTIONS

Uh oh!

claude Bot Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

✅ Prior Issues Resolved

📝 Delta Review (2 commits since last review)

✅ APPROVE

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

✅ No New Issues

✅ Prior Issues Resolved

✅ APPROVE

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

changeset-bot Bot commented Mar 30, 2026 •

edited

Loading

vercel Bot commented Mar 30, 2026 •

edited

Loading

pullfrog Bot commented Mar 30, 2026 •

edited

Loading