Repository navigation
index.css imports Google Fonts: remote request conflicts with local-first rule #94
Description
Problem
desktop/src/index.css begins with @import url("https://fonts.googleapis.com/css2?family=Inter...&family=JetBrains+Mono..."). In a browser or the Vite dev server this makes a request to Google's font host when Studio loads. Studio's rules say it is local-first and nothing leaves the user's machine.
In the packaged Tauri app the request is probably blocked by the Content Security Policy (style-src 'self' 'unsafe-inline', font-src 'self' data:), so the fonts fall back silently; that has not been checked in an installed build.
Found by
The fail-closed network guard in the new tool-tabs keyboard check caught the request in the dev server on its first run. The check now blocks and records those two hosts explicitly so it can still run.
Proposed fix
Remove the remote @import. If Inter and JetBrains Mono are wanted, bundle the font files locally (check their licences) and reference them with @font-face; otherwise use the system font stack. Verify in an installed build that no request leaves the machine.
Activity
test(desktop): make the font guard fail instead of going vacuous; cla…
test(desktop): font guard matches @import across line breaks and comm…
DVOpenLabs commentedon Oct 21, 2026
Closing: the original defect, a remote Google Fonts import in
desktop/src/index.css, is fixed in released code.Evidence:
@importof fonts.googleapis.com fromdesktop/src/index.css. It is an ancestor of RC2 build source ab507e5 and is contained in tag v1.6.0 (commit dd14a3c).desktop/tailwind.config.json that commit now sets system font stacks only, with a comment citing this issue.desktop/src/noRemoteFonts.test.tsis in v1.6.0. It fails if any CSS, HTML, TS or TSX underdesktop/src, ordesktop/index.html, names a known font host or contains a remote@import. I re-ran it against current main plus the pending prepared-link branch today: 5 passed, 0 failed.Scope of this claim: no font is requested from a remote host by the stylesheet or the HTML, and the guard covers named font hosts and remote
@importonly. This is not a claim of zero network traffic from the application. The packaged Tauri window and WebKitGTK were not re-checked for this issue.The separate Edge offline harness from PR #100 is not on main; it is accounted for in the #100 closure note.