[lmjabreu]

The local "You're connected" and "Authentication failed" pages had their own inline SVG copy of the old icon, so they still showed it after the refresh in #79. They now load LOGO_URI, the PNG the consent screen already shows, so the icon lives in one file.

Doistbot spotted this on the icon docs PR (#83).

It also points LOGO_URI and the README back at icons/comms-cli.png and deletes icons/comms-cli_512px.png, an identical copy left by #79. Clients first registered by 3.6.1 to 3.6.3 sent the _512px URL, so their consent screen will show Todoist's fallback icon.

Test plan

1. On main, run tdc auth login and approve.
   • The browser page shows the old, washed-out icon.
2. On this branch, run tdc auth login and approve.
   • The page shows the new icon, with the green check badge.
3. Repeat with an invalid client or by denying access.
   • The failure page shows the new icon with the red badge.

Demo

Before	After

🤖 Generated with Claude Code

[lmjabreu]

@doistbot /review

[doistbot]

This update consolidates the auth icon on the shared LOGO_URI across the local callback pages, replacing the outdated inline SVGs. No inline issues were flagged.

I also included a few optional follow-up notes in the details below.

Optional follow-up notes (3)

• src/lib/auth-constants.ts:7: This comment references docs/icon.md, but no such file exists in the repo (docs/ only has comms-search.md and SPEC.md). Either commit that doc on this branch or drop the parenthetical so the comment doesn't point readers to a dead file.
• src/lib/auth-pages.ts:4: These pages are the OAuth callback HTML, so their URL can carry the authorization code and state (e.g. http://localhost:8766/callback?code=...&state=...). The new <img> loads https://raw.githubusercontent.com/... without a referrerpolicy, so browsers that still default to no-referrer-when-downgrade will send the full callback URL — including the code — to GitHub in the Referer header. Add referrerpolicy="no-referrer" to this <img> (or a <meta name="referrer" content="no-referrer"> in both page <head>s) so the code never leaves the callback request.
• src/lib/auth-pages.test.ts:12: The negative assertion checks an incidental Figma group id (Size=72, Style=Color) from the old SVG rather than the observable contract (no inline 72px logo SVG). If a different inline copy ever comes back, this test still passes. Prefer expect(html).not.toMatch(/<svg[^>]*viewBox="0 0 72 72"/) to target the actual 72px logo SVG, or drop the assertion entirely — the toContain('<img src="...') check already fails if the page reverts to the old SVG.

_{Share Feedback • Review Logs}

[lmjabreu]

This comment references docs/icon.md, but no such file exists in the repo

Done. Dropped it, the doc lands in #83.

Add referrerpolicy="no-referrer" to this <img>

Done, with a test. Applied the same to Doist/todoist-cli#601 and Doist/automations#4827.

The negative assertion checks an incidental Figma group id

Done. It now fails on any inline 72px SVG.

[engfragui]

💭 The logo now depends on a network fetch from raw.githubusercontent.com. The error page is rendered precisely when auth failed — often due to no/blocked network — so this <img> (with alt="") will show nothing exactly when it's most likely needed. Networks that reach todoist.com but block GitHub raw would also get a broken logo on the success page.

The previous inline SVG rendered unconditionally. Consider keeping an inline SVG / data-URI fallback so the pages always show the icon offline.

[lmjabreu]

Keeping as-is to avoid one more place the icon needs updating. This page is only reached through the redirect from todoist.com, so the browser is online by then, and inlining the image would only help with performance. If we do inline it, it'd be great to generate it from the PNG automatically, e.g. with a GitHub Action.

[doist-release-bot]

🎉 This PR is included in version 3.6.5 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀