Toolbar CSS is hardcoded to eu-assets.i.posthog.com — breaks reverse-proxy + CSP setups

[cosmoz]

Bug description

The toolbar loads unstyled on our site. Huge black SVG icons stacked at the bottom of the page (screenshot below).

Cause: the toolbar bundle (1.418.6) hardcodes its stylesheet URL:

r.href = "https://eu-assets.i.posthog.com/static/1.418.6/toolbar/toolbar-app.css"

We follow the reverse-proxy docs. api_host is https://app.watchmy.cloud/ingest. Our CSP is style-src 'self' 'unsafe-inline', so the browser blocks that URL (style-src-elem violation). The toolbar logs "Failed to load toolbar.css" and mounts anyway, unstyled.

The loader (toolbar.js) gets this right — it resolves the JS bundle relative to document.currentScript.src, so it loads through the proxy. Only the CSS href is absolute.

Suggested fix

Resolve the CSS the same way as the JS. Through our proxy, /ingest/static/toolbar/toolbar-app.css already returns 200. Font URLs inside it are relative (./assets/…), so they follow. No CSP change needed. It would also fix the toolbar for anyone whose ad-blocker drops eu-assets.i.posthog.com — the reason the proxy exists.

Environment

• posthog-js 1.374.2, PostHog Cloud EU
• Toolbar 1.418.6
• First-party reverse proxy per the docs: /ingest/static/ + /ingest/array/ → eu-assets.i.posthog.com, rest → eu.i.posthog.com

Workaround

Append <link rel="stylesheet" href="/ingest/static/toolbar/toolbar-app.css"> into #posthog-toolbar-styles in the toolbar's shadow root.

Happy to test a patch.

Screenshot