Serve htmx and Pico locally instead of from a CDN

[aaronsmulktis]

Why serve local dependencies?

fast_app()/FastHTML() load htmx, Pico and three helper scripts from cdn.jsdelivr.net by default. Many eval nodes have no outbound network, so in these cases none of those dependencies arrives there, and nothing anywhere reports that:

htmx missing makes every hx- attribute inert. /todo alone carries 15 hx-put attributes. A checkbox still toggles on click -- that is native browser behaviour, not htmx -- so the screenshot shows the interaction landing while no PUT is sent, /todo_all never changes, and the task scores zero. The trajectory reads as a model that clicked the right element.
Pico missing renders every page unstyled, which changes the observation a screenshot-only agent is graded on.

This PR vendors htmx 2.0.4 (0BSD) and Pico 2.1.1 (MIT) under apps/assets/vendor, served by the static route that already serves jquery and fontawesome the same way. Versions are pinned in the filename: the default pulled pico@latest`, so a run's styling depended on the day it ran.

Every FastHTML construction site now passes default_hdrs=False and takes headers from open_apps.frontend.local_hdrs(). That also removes a duplicate htmx 1.9.10 from unpkg in messenger, which was racing the 2.0.4 FastHTML injected, and two picolink references in codeeditor whose hdrs are rebuilt in set_environment.

Tests:

tests/test_no_egress.py ratchets this. The load-bearing case is test_interactive_routes_load_htmx_locally: a page with hx-* attributes must load htmx from local assets. Verified it has teeth by reverting todo_app to fast_app() -- three tests fail with the fix in the message. Full suite: 704 passed.

[Copilot]

Pull request overview

This PR removes the runtime dependency on external CDNs for core frontend assets by vendoring htmx and Pico under local static assets and standardizing FastHTML header construction to serve those assets offline on eval nodes.

Changes:

• Add open_apps.frontend.local_hdrs() + pinned local asset URLs for htmx and Pico.
• Update apps / start-page host app construction to disable FastHTML default CDN headers and use locally served headers instead.
• Add no-egress regression tests to ensure interactive routes load local htmx and that static serving of vendored assets works.

Reviewed changes

Copilot reviewed 7 out of 10 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/test_no_egress.py	Adds offline/egress regression tests for CDN usage and local asset loading.
src/open_apps/frontend.py	Introduces local_hdrs() and pinned vendor URLs/constants for htmx + Pico.
src/open_apps/apps/todo_app/main.py	Switches fast_app() construction to use default_hdrs=False and local headers.
src/open_apps/apps/start_page/helper.py	Ensures the main mounted app uses local headers and disables default CDN headers.
src/open_apps/apps/messenger_app/main.py	Replaces CDN htmx/Pico usage with vendored headers and disables default CDN headers.
src/open_apps/apps/codeeditor_app/main.py	Replaces CDN Pico usage with vendored headers and disables default CDN headers.
src/open_apps/apps/calendar_app/main.py	Switches calendar app headers to include vendored Pico/htmx and disables default CDN headers.
src/open_apps/apps/assets/vendor/README.md	Documents rationale, versions, and update process for vendored assets.
src/open_apps/apps/assets/vendor/pico-2.1.1.min.css	Adds vendored Pico CSS asset.
src/open_apps/apps/assets/vendor/htmx-2.0.4.min.js	Adds vendored htmx JS asset.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[marksibrahim]

This is a great life improvement for us, especially when launching in internet restricted clusters. Thanks Aaron!