[comp] Production Deploy

apps/api/Dockerfile

@@ -1,8 +1,13 @@
 # Use Node.js runtime for production
 FROM node:20-slim
 
-# Install required packages (wget for healthcheck, curl/bash for bun install, libc compat for prisma)
-RUN apt-get update && apt-get install -y --no-install-recommends wget curl openssl && rm -rf /var/lib/apt/lists/*
+# Install required packages:
+# - wget for healthcheck, curl/bash for bun install, openssl for prisma
+# - fontconfig + fonts-dejavu-core so sharp/librsvg can render text in the
+#   browser-automation screenshot overlay (node:*-slim ships with zero fonts)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    wget curl openssl fontconfig fonts-dejavu-core \
+  && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 

apps/api/Dockerfile.multistage

@@ -84,8 +84,11 @@ RUN groupadd --system nestjs && useradd --system --gid nestjs --create-home nest
 WORKDIR /app
 RUN chown nestjs:nestjs /app
 
-# Install runtime dependencies + AWS RDS CA certificate bundle
-RUN apt-get update && apt-get install -y --no-install-recommends wget ca-certificates \
+# Install runtime dependencies + AWS RDS CA certificate bundle.
+# fontconfig + fonts-dejavu-core are needed so sharp/librsvg can render text
+# in the browser-automation screenshot overlay (node:*-slim has no fonts).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    wget ca-certificates fontconfig fonts-dejavu-core \
   && wget -q -O /usr/local/share/aws-rds-ca-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem \
   && apt-get clean && rm -rf /var/lib/apt/lists/*
 

apps/api/src/auth/hybrid-auth.guard.ts

@@ -218,6 +218,9 @@ export class HybridAuthGuard implements CanActivate {
       request.authType = 'session';
       request.isApiKey = false;
       request.isServiceToken = false;
+      request.sessionId = sessionData.id;
+      request.sessionDeviceAgent =
+        (sessionData as Record<string, unknown>).deviceAgent === true;
       // Resolve isPlatformAdmin from the User.role column (via better-auth session),
       // not from the member relation. This ensures the flag is set regardless of
       // org membership or skipOrgCheck.

apps/api/src/auth/types.ts

@@ -16,6 +16,8 @@ export interface AuthenticatedRequest extends Request {
   memberDepartment?: Departments; // Member department for visibility filtering (only available for session auth)
   apiKeyScopes?: string[]; // Scopes for API key auth (empty = legacy full access)
   impersonatedBy?: string; // User ID of the admin who initiated impersonation (only set during impersonation sessions)
+  sessionId?: string; // Session ID (only set for session auth)
+  sessionDeviceAgent?: boolean; // Whether the session is a device-agent session (only set for session auth)
 }
 
 export interface AuthContext {

apps/api/src/browserbase/screenshot-overlay.ts

@@ -115,8 +115,10 @@ function buildBannerSvg(args: BannerArgs): string {
   const { width, height, instruction, sourceUrl, timestamp } = args;
   const rowFontSize = 12;
   const labelFontSize = 9;
-  const fontFamily =
-    '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif';
+  // Explicit Linux-safe font stack. The production container only ships
+  // DejaVu Sans (via fonts-dejavu-core); Apple/Segoe/Roboto aren't available
+  // so librsvg would render .notdef glyphs ("□ □ □") on servers.
+  const fontFamily = '"DejaVu Sans", sans-serif';
 
   const w = Math.floor(width);
   const h = Math.floor(height);