Web UI: vendor htmx locally instead of loading from unpkg.com (jobs page stuck on "Loading jobs...")

jerry commented

2026-10-23 13:15:33 +00:00

Contributor

Problem
The manager's templates load htmx from a CDN: <script src="https://unpkg.com/htmx.org@1.9.12"></script>. If the browser blocks third-party scripts (Brave Shields, uBlock, an offline/LAN-only box), htmx never loads, so hx-get="/ui/fragments/jobs" never fires and the Jobs page sits on "Loading jobs..." forever. Seen live on 0.0.10 (Justin, Brave). The API is fine: /api/jobs and /ui/fragments/jobs both return 200 with the job.

Fix

Vendor htmx 1.9.12 into the embedded assets (e.g. /assets/htmx.min.js) and point every template at the local copy. No external script/CSS hosts at all.
Add a test or check that rendered templates contain no https:// script or style sources.
Cut a patch release (0.0.11) so the lab manager can be updated.

Done when: the Jobs page lists jobs with all third-party requests blocked, and a release is tagged.

Reported by Jerry for Justin; urgent (Justin asked for a quick fix).

**Problem** The manager's templates load htmx from a CDN: `<script src="https://unpkg.com/htmx.org@1.9.12"></script>`. If the browser blocks third-party scripts (Brave Shields, uBlock, an offline/LAN-only box), htmx never loads, so `hx-get="/ui/fragments/jobs"` never fires and the Jobs page sits on "Loading jobs..." forever. Seen live on 0.0.10 (Justin, Brave). The API is fine: `/api/jobs` and `/ui/fragments/jobs` both return 200 with the job. **Fix** - Vendor htmx 1.9.12 into the embedded assets (e.g. `/assets/htmx.min.js`) and point every template at the local copy. No external script/CSS hosts at all. - Add a test or check that rendered templates contain no `https://` script or style sources. - Cut a patch release (0.0.11) so the lab manager can be updated. **Done when**: the Jobs page lists jobs with all third-party requests blocked, and a release is tagged. Reported by Jerry for Justin; urgent (Justin asked for a quick fix).

ash was assigned by eva

2026-10-23 13:16:00 +00:00

eva commented

2026-10-23 13:16:00 +00:00

Owner

Urgent, Justin wants a quick fix. Scope: vendor htmx 1.9.12 into the embedded assets, point every template at the local copy, and add a test that rendered templates have no external (https://) script or style sources. Keep the toolchain preflight as is (forge-toolchain standard). Out of scope: any other UI changes. Revert is a plain git revert. Open the PR against develop (master if the repo has no develop) and don't merge it yourself; the 0.0.11 cut happens after it lands. Done when the Jobs page lists jobs with all third-party requests blocked.

ash referenced this issue from a commit

2026-10-23 13:17:55 +00:00

web: vendor htmx 1.9.12 and serve it from /assets (closes #23)

ash referenced this issue from a pull request that will close it,

2026-10-23 13:18:03 +00:00

web: vendor htmx 1.9.12 locally instead of unpkg.com (closes #23) #24