One family. Font stacks name Zen and fall back to the native faces, tokens
name the role rather than a face, and the packages that used to supply a
face now point at @hanzo/font.
Self-hosted @font-face blocks are removed rather than renamed: rewriting the
family in one would leave a src pointing at a file this repo no longer ships.
@hanzo/font carries the binaries and declares the faces, so the local copies
go with the declaration that used them.
Comments naming a face we no longer use are deleted, not reworded.
Co-authored-by: Hanzo Dev <[email protected]>
The `/docs` Web UI vendors the minified `KaTeX` renderer (`katex.min.js`
and `katex.min.css` with the fonts inlined) and embeds it into the binary,
but the copied bundles carried no copyright or permission notice. `KaTeX` is
MIT-licensed (the code: Copyright (c) 2013-2020 Khan Academy and other
contributors; the embedded fonts: Copyright (c) 2018 Khan Academy), so the
notice must travel with substantial copies we distribute.
Prepend the `KaTeX` MIT license banner (copyright + full permission notice +
upstream link) to both files, matching how `marked.min.js`, `uplot.js`, and
`viz-standalone.js` in the same directory preserve their upstream banners. The
banners are leading `/* */` comments, so the served assets are unchanged
functionally; the `url(fonts/` and `data:font/woff2;base64` guards in
04410_docs_web_ui_local_assets still hold.
The built-in `/docs` documentation search page loaded the `marked` (Markdown)
and `katex` (TeX math) renderers from `cdn.jsdelivr.net`. That executes
third-party network code inside the ClickHouse HTTP origin, which also handles
the `user`/`password` credentials entered on the page, so a CDN or package
compromise could read those credentials or issue and exfiltrate queries as the
user. It also broke the page's self-contained/offline contract.
Vendor `marked.min.js`, `katex.min.js`, and `katex.min.css` under
`programs/server/js/` and serve them from the binary via the existing
`JavaScriptWebUIRequestHandler` `/js/` route. The KaTeX fonts are inlined into
the stylesheet as `data:` URIs, so the page pulls no external font files either.
`DocsWebUIRequestHandler` rewrites the CDN links to the same-origin `/js/` paths
when serving the page, mirroring how `DashboardWebUIRequestHandler` handles
`uplot.js`/`lz-string.js`; the CDN URLs are kept in the source so the page still
works when opened as a local file against a remote server.
Add a stateless test `04409_docs_web_ui_local_assets` that checks the served
page references the local `/js/` assets, loads no `cdn.jsdelivr.net` code, and
that the assets are served from the binary with the fonts inlined.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Per review feedback: the page must work in air-gapped or restricted
environments and should not depend on a third-party CDN at runtime.
The `@viz-js/[email protected]` standalone bundle is now embedded into the
binary via `#embed` and served from `/js/viz-standalone.js`, alongside
the other built-in JS assets handled by `JavaScriptWebUIRequestHandler`.
`processors_profile.html` now loads the local copy.
The previous patch only changed the color passed to
_applyMinimumContrast which returns false when no contrast adjustment
is needed, so no color was actually applied. Fix by explicitly pushing
the xterm-fg-15 CSS class (bright white) when the cell is bold and
drawBoldTextInBrightColors is enabled, matching how palette colors
are handled.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
In the DOM renderer's foreground color switch, the default case now
checks if the cell is bold and drawBoldTextInBrightColors is enabled;
if so, it uses ansi[15] (bright white) instead of the theme foreground.
This makes bold text with the default foreground render as pure white
(#ffffff) while non-bold text stays at the softer #d4d4d4.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Embed xterm.js 5.5.0, addon-fit 0.10.0, and addon-web-links 0.11.0
(minified JS and CSS) into the server binary, served at /js/*.
This removes the dependency on CDN and makes the web terminal
page fully self-contained, like the dashboard.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
zeekayandHanzo Dev