feat(geo): track multiple domains per project for AI traffic

[janburzinski]

Description

Give a short summary of what this PR does and why it's needed.

Screenshot/Recording (if applicable)

Attach a screenshot or recording of the change. This is optional, but can help reviewers understand the change. You can use Cap to record a video.

Checklist

• I ran a self-review before opening this PR
• I ran formatting/linting/type checks locally
• I updated docs when behavior or setup changed
• I only added comments where the logic is not obvious
• I have used conventional commits for the PR title and commit messages
• I did not use AI to write the code in this PR or have disclosed that I did

  

---

Summary by cubic

Projects can track up to 20 extra hostnames under one project and ingest token. AI traffic pages and citations are grouped and filtered by host, while ingest drops events from hosts outside the brand website or tracked domains so leaked tokens cannot register other hosts.

Behavior

• Stores normalized domains; the brand website remains read-only, every tracked host uses the same token, and settings or project changes invalidate cached allowlists.
• Seeds sample traffic across www, docs, and app, includes subdomains for tracked hosts, and canonicalizes Unicode domains to punycode.
• Rejects hostless URLs such as data: and file://; allowlist lookup failures fail open.
• Applies host filters before limits, preserves selections missing from the top-500 results, keeps the host selector when that selection is empty, groups pages by host and path, binds the selector to canonical host values so www URLs match collapsed options, resets log pagination on host changes, and clears selections when switching projects.
• Splits assistant-browse crawlers into a Cited band, gives Instagram its own source icon, and attributes meta.ai referrals to Meta.
• Fixes narrow-pane metric wrapping and tag remove-button hover shapes.
• Local development authentication requires NODE_ENV=development, DEV_AUTH_ENABLED, and DEV_AUTH_EMAIL; it only works on loopback requests, rejects tunneled or forwarded hosts, and sends banned DEV_AUTH_EMAIL users to /auth/banned.

Rollout

• The pages endpoint remains on raw events until the host-aware rollup backfill runs.

^{Written for commit 5473341. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
notra	Ready	Preview	Sep 13, 2026 6:57am UTC

4 Skipped Deployments

Project	Deployment	Actions	Updated
notra-agent	Skipped		Sep 13, 2026 6:57am UTC
notra-onboarding-agent	Skipped		Sep 13, 2026 6:57am UTC
notra-ui	Skipped		Sep 13, 2026 6:57am UTC
notra-web	Skipped		Sep 13, 2026 6:57am UTC

[CLAassistant]

All committers have signed the CLA.

[github-actions]

React Doctor found 1 new issue in 1 file · 1 warning · score 91 / 100 (Great) · 0 fixed · vs main

1 warning

src/utils/local-dev-auth.test.ts

• ⚠️ L12 Secret in client code no-secrets-in-client-code

_{Reviewed by React Doctor for commit 5473341. See inline comments for fixes.}

[cubic-dev-ai]

All reported issues were addressed across 7 files (changes from recent commits).

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[janburzinski]

@cubic

[cubic-dev-ai]

@cubic

@janburzinski I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

4 issues found across 79 files

Confidence score: 2/5

• apps/dashboard/src/utils/local-dev-auth.ts accepts a spoofed Host: localhost:3000 when the development server is exposed beyond localhost, allowing the proxy and getAuthIdentity path to bypass intended local-development restrictions; require trusted forwarding or bind/restrict the server to loopback.
• apps/dashboard/src/lib/auth/server.ts turns a banned DEV_AUTH_EMAIL identity failure into an unauthenticated result, while isSessionBanned treats that result as allowed, potentially bypassing the ban; preserve and enforce the banned state explicitly.
• packages/geo-core/src/types/geo.ts can resolve an Instagram source to an unregistered dashboard icon key, causing the UI to show the Microsoft Copilot fallback; add the Instagram icon mapping or registry entry.
• packages/geo-core/src/utils/geo-project-domains.ts does not normalize a selected www. host, so valid traffic-host selections can be rejected; normalize the selected hostname before comparison.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/geo-core/src/types/geo.ts">

<violation number="1" location="packages/geo-core/src/types/geo.ts:1144">
P2: When an Instagram source reaches the dashboard `EngineIcon`, `resolveEngineIconKey` returns `"instagram"` but the dashboard icon registry lacks it, so the component renders the Microsoft Copilot fallback. Add Instagram to the dashboard icon registry.</violation>
</file>

<file name="apps/dashboard/src/lib/auth/server.ts">

<violation number="1" location="apps/dashboard/src/lib/auth/server.ts:156">
P2: When `DEV_AUTH_EMAIL` belongs to a banned user, `loadLocalDevIdentity` fails and this branch converts that failure to `null`. Auth guards then call `isSessionBanned`, which returns `false` for an allowed local request. Banned developers are therefore sent to `/login` instead of `/auth/banned`; preserve the banned result or query the pinned user in that helper.</violation>
</file>

<file name="packages/geo-core/src/utils/geo-project-domains.ts">

<violation number="1" location="packages/geo-core/src/utils/geo-project-domains.ts:169">
P2: When the selected host is `www.example.com` and only `docs.example.com` is present, `isKnownTrafficHost` fails to recognize the selection because it does not normalize `www.`. Normalize `selected` before the host comparisons.</violation>
</file>

<file name="apps/dashboard/src/utils/local-dev-auth.ts">

<violation number="1" location="apps/dashboard/src/utils/local-dev-auth.ts:135">
P1: When the development server is reachable on a LAN or public interface, a client can send `Host: localhost:3000` without forwarding headers, and this condition returns `allowed`. The proxy and `getAuthIdentity` then bypass AuthKit and load `DEV_AUTH_EMAIL`; validate the actual peer address at the network boundary instead of trusting `Host` or spoofable forwarding headers.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: When the development server is reachable on a LAN or public interface, a client can send Host: localhost:3000 without forwarding headers, and this condition returns allowed. The proxy and getAuthIdentity then bypass AuthKit and load DEV_AUTH_EMAIL; validate the actual peer address at the network boundary instead of trusting Host or spoofable forwarding headers.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/dashboard/src/utils/local-dev-auth.ts, line 135:

<comment>When the development server is reachable on a LAN or public interface, a client can send `Host: localhost:3000` without forwarding headers, and this condition returns `allowed`. The proxy and `getAuthIdentity` then bypass AuthKit and load `DEV_AUTH_EMAIL`; validate the actual peer address at the network boundary instead of trusting `Host` or spoofable forwarding headers.</comment>

<file context>
@@ -0,0 +1,148 @@
+    return { kind: "blocked", reason: "missing_email" };
+  }
+  const host = headers?.get("host") ?? null;
+  if (!requestHostIsLoopback(host) || requestLooksPubliclyExposed(headers)) {
+    return { kind: "blocked", reason: "non_loopback" };
+  }
</file context>

[cubic-dev-ai]

P2: When an Instagram source reaches the dashboard EngineIcon, resolveEngineIconKey returns "instagram" but the dashboard icon registry lacks it, so the component renders the Microsoft Copilot fallback. Add Instagram to the dashboard icon registry.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/geo-core/src/types/geo.ts, line 1144:

<comment>When an Instagram source reaches the dashboard `EngineIcon`, `resolveEngineIconKey` returns `"instagram"` but the dashboard icon registry lacks it, so the component renders the Microsoft Copilot fallback. Add Instagram to the dashboard icon registry.</comment>

<file context>
@@ -1137,6 +1141,7 @@ export type EngineIconKey =
   | "mistral"
   | "deepseek"
   | "meta"
+  | "instagram"
   | "grok"
   | "qwen"
</file context>

[cubic-dev-ai]

P2: When DEV_AUTH_EMAIL belongs to a banned user, loadLocalDevIdentity fails and this branch converts that failure to null. Auth guards then call isSessionBanned, which returns false for an allowed local request. Banned developers are therefore sent to /login instead of /auth/banned; preserve the banned result or query the pinned user in that helper.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/dashboard/src/lib/auth/server.ts, line 156:

<comment>When `DEV_AUTH_EMAIL` belongs to a banned user, `loadLocalDevIdentity` fails and this branch converts that failure to `null`. Auth guards then call `isSessionBanned`, which returns `false` for an allowed local request. Banned developers are therefore sent to `/login` instead of `/auth/banned`; preserve the banned result or query the pinned user in that helper.</comment>

<file context>
@@ -99,10 +103,71 @@ const buildAuthIdentity = Effect.fn("auth.identity.build")(function* (
+        headerList = null;
+      }
+      const gate = evaluateLocalDevAuth(headerList);
+      if (gate.kind === "allowed") {
+        return Effect.runPromise(
+          loadLocalDevIdentity().pipe(
</file context>

[cubic-dev-ai]

P2: When the selected host is www.example.com and only docs.example.com is present, isKnownTrafficHost fails to recognize the selection because it does not normalize www.. Normalize selected before the host comparisons.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/geo-core/src/utils/geo-project-domains.ts, line 169:

<comment>When the selected host is `www.example.com` and only `docs.example.com` is present, `isKnownTrafficHost` fails to recognize the selection because it does not normalize `www.`. Normalize `selected` before the host comparisons.</comment>

<file context>
@@ -0,0 +1,187 @@
+  selected: string,
+  hosts: readonly string[]
+): boolean {
+  const needle = selected.trim();
+  if (needle.length === 0 || needle === "all") {
+    return true;
</file context>

[cubic-dev-ai]

All reported issues were addressed across 15 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[github-actions]

React Doctor · react-doctor/no-secrets-in-client-code (warning)

This hardcoded secret is a security vulnerability: it ships to the browser where anyone can read it.

Fix → Move secrets to server-only code. In Next.js, only NEXT_PUBLIC_* env vars are exposed to the browser, and they must not contain secrets

Docs