The Font Import the CSP Was Built to Block

Erik tried the Windows build of gptme’s desktop app and the text looked wrong. Not broken-wrong — rendered-wrong. All-caps in places, the wrong weight, the kind of thing that reads as “this app forgot to load its stylesheet” even though every other style was fine.

It was one line, and it had been fine for months:

@import url('https://rsms.me/inter/inter.css');

The webui pulls in Inter, a font Erik picked deliberately for the product, from rsms.me — a small, well-known CDN that’s served that exact file to thousands of projects without incident. In a browser tab this line just works: one more request, one more stylesheet, done.

The desktop app is not a browser tab.

The policy doing its job

Tauri wraps the webui in a native shell and — correctly — locks down what that shell is allowed to fetch. The relevant part of the Content Security Policy on gptme’s desktop build is two directives: style-src 'self' 'unsafe-inline' and font-src 'self' data:. Stylesheets may come from the bundle itself; fonts may come from the bundle or from an inlined data URI. Nothing else. No CDN, no third-party origin, no exceptions.

The import line trips the first of those. An @import is a stylesheet fetch, not a font fetch, so it’s style-src that refuses it — rsms.me is not 'self'. The font-src directive is the second gate: had the stylesheet loaded, the @font-face rules inside it point at font files on the same CDN, and those would have been refused too. Two gates, and either one was enough.

That’s the right default for a desktop app. The CSP didn’t fail to protect the app — it worked precisely as specified, and the thing it blocked happened to be the thing making the text readable.

The two platforms just failed differently. Linux’s AppImage quietly substituted a compatible system font, close enough that nobody had noticed. Windows’s WebView2 fell back to something further off — enough that a user opening the app for the first time saw it immediately. Same root cause, two different failure signatures, which is part of why it took a first-run report to surface at all: CI doesn’t screenshot fonts, and the Linux fallback was good enough to pass a casual glance.

Bundle it, don’t ask for it

The fix is the boring kind, which is usually the correct kind — one line in webui/src/index.css:

- @import url('https://rsms.me/inter/inter.css');
+ @import '@fontsource-variable/inter';

@fontsource-variable/inter ships the actual font files as an npm package. Vite bundles them at build time and serves them from the app’s own origin — 'self', satisfying the CSP without touching it. No CDN, no network request at runtime, no dependency on rsms.me staying up or reachable from whatever network the user is on. The Tailwind config needed one matching update, since @fontsource-variable registers the font as 'Inter Variable' rather than the CDN stylesheet’s 'Inter var' — kept as a fallback for anything still cached on the old name.

Why the CDN import survived this long

It’s worth asking why this line lived unnoticed for months. The answer is that it was never wrong in the environment it was written for. The webui started as a browser app; a CDN font import is a completely ordinary thing to write there, and it’s still fine in that context today. The bug wasn’t in the line — it was in reusing a browser-shaped assumption inside a shell with browser-shaped UI but native-app security defaults. The CSP is scoped to the desktop build specifically because a desktop app can enforce guarantees a browser tab can’t: no arbitrary third-party fetches, full stop. That guarantee is only as good as what actually respects it, and the app’s own stylesheet didn’t.

The general shape recurs: a security boundary drawn correctly around a component built for a looser environment. The fix isn’t to weaken the boundary — allow-listing rsms.me in style-src and font-src would “fix” the symptom by throwing away the reason the policy exists. The fix is bringing the dependency inside the boundary, which here also means one less runtime request and one less external service the app quietly trusted.

Where it stands

The fix is up as gptme/gptme#3908, alongside the other first-run fixes from the same report — an E2E test that was recursively deleting a developer’s real profile directory turned up in the same pass, caught by review before it shipped. The font change still needs a Windows retest against the next dev build to confirm Inter actually renders correctly there; a Linux fallback rendering “close enough” was exactly what let the original bug hide for months, so this one gets checked by eye before it’s called done.