fix(favicon): resolve deployment tier at request time, not build time

Addresses review findings on PR #5588:

- Cursor (Medium): next.config.ts's rewrites() runs once during the
  shared, environment-agnostic Docker build (docker/app.Dockerfile
  builds with dummy env values; bootstrap.ts hydrates process.env from
  AWS Secrets Manager only at container boot, after the build already
  ran) - so resolving getDeploymentEnv() inside next.config.ts baked
  in whichever tier happened to be active during that shared build,
  never the tier the container actually runs as. Fixed by rewriting
  /favicon.ico to a stable path (/api/favicon) and resolving the
  destination inside that route handler instead, which runs per-request
  at runtime like generateBrandedMetadata() already correctly does.
  Marked force-dynamic per Next's own docs: generated icon routes are
  statically cached by default unless they use a request-time API or
  dynamic config.

- Greptile (P1): a whitelabeled deployment's favicon slots (16/32/192/512
  PNGs, apple-touch-icon) fell back to the environment-tinted set instead
  of neutral branding when brand.faviconUrl was set. Now falls back to
  the production (neutral) asset set specifically for whitelabeled
  deployments, matching pre-PR behavior for those slots.

- Greptile (P2, ico-serves-svg): verified via `git show origin/staging`
  that /favicon.ico -> /icon.svg is pre-existing, unchanged production
  behavior from before this PR - not addressed here, out of scope.

Also: added app/api/favicon/route.ts to the check:api-validation
INDIRECT_ZOD_ROUTES allowlist (no client-supplied input - only reads
the server's own deployment-tier env var) and bumped the audit baseline.

Author: waleedlatif1

apps/sim/app/api/favicon/route.ts

@@ -0,0 +1,28 @@
+import { type NextRequest, NextResponse } from 'next/server'
+import { getDeploymentEnv } from '@/lib/core/config/env-flags'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const FAVICON_DESTINATIONS: Record<ReturnType<typeof getDeploymentEnv>, string> = {
+  development: '/icon-dev.svg',
+  staging: '/icon-staging.svg',
+  production: '/icon.svg',
+}
+
+/**
+ * Redirect target for the legacy `/favicon.ico` path (rewritten here in
+ * `next.config.ts`), resolved per-request rather than baked into
+ * `next.config.ts`'s `rewrites()` directly. This app's Docker image is built
+ * once with dummy env values and promoted through dev/staging/production —
+ * `bootstrap.ts` hydrates `process.env` from AWS Secrets Manager at container
+ * boot, after the build already ran (`docker/app.Dockerfile`) — so a
+ * same-process-lifetime decision like `getDeploymentEnv()` must be evaluated
+ * here, at request time, not in `next.config.ts`, which only runs once during
+ * that shared build and would freeze whichever tier happened to be active
+ * then (never the tier the container actually ends up running as).
+ */
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  const destination = FAVICON_DESTINATIONS[getDeploymentEnv()]
+  return NextResponse.redirect(new URL(destination, request.url))
+})

apps/sim/ee/whitelabeling/metadata.ts

@@ -52,7 +52,11 @@ const ICON_SETS: Record<ReturnType<typeof getDeploymentEnv>, FaviconSet> = {
  */
 export function generateBrandedMetadata(override: Partial<Metadata> = {}): Metadata {
   const brand = getBrandConfig()
-  const icons = ICON_SETS[getDeploymentEnv()]
+  // A whitelabeled deployment's favicon slots should read as the tenant's own
+  // brand, never an internal Sim dev/staging color — fall back to production's
+  // neutral assets (matching pre-environment-favicon behavior) for the sizes
+  // `brand.faviconUrl` doesn't cover, instead of the environment-tinted set.
+  const icons = ICON_SETS[brand.faviconUrl ? 'production' : getDeploymentEnv()]
 
   const defaultTitle = brand.name
   const summaryFull = `Sim is the open-source AI workspace where teams build, deploy, and manage AI agents. Connect 1,000+ integrations and every major LLM to create agents that automate real work — visually, conversationally, or with code. Trusted by over 100,000 builders — from startups to Fortune 500 companies. SOC2 compliant.`

apps/sim/next.config.ts

@@ -1,7 +1,7 @@
 import path from 'node:path'
 import type { NextConfig } from 'next'
 import { env, isTruthy } from './lib/core/config/env'
-import { getDeploymentEnv, isDev } from './lib/core/config/env-flags'
+import { isDev } from './lib/core/config/env-flags'
 import {
   getChatEmbedCSPPolicy,
   getMainCSPPolicy,
@@ -26,19 +26,6 @@ const minimalRegistryAlias: Record<string, string> = useMinimalRegistry
     }
   : {}
 
-/**
- * Per-environment favicon for `/favicon.ico` requests (the legacy path browsers
- * probe automatically) — same wordmark mark as production, different background
- * color, so a dev/staging tab is never mistaken for prod at a glance. The
- * `<link rel="icon">` tags Next renders from `generateBrandedMetadata()`
- * (`ee/whitelabeling/metadata.ts`) use the same per-environment set.
- */
-const FAVICON_ICO_DESTINATIONS: Record<ReturnType<typeof getDeploymentEnv>, string> = {
-  development: '/icon-dev.svg',
-  staging: '/icon-staging.svg',
-  production: '/icon.svg',
-}
-
 const nextConfig: NextConfig = {
   devIndicators: false,
   poweredByHeader: false,
@@ -450,8 +437,11 @@ const nextConfig: NextConfig = {
   async rewrites() {
     return [
       {
+        // Resolved per-request in app/api/favicon/route.ts, not here — see
+        // that file's TSDoc for why: this config only runs once during the
+        // shared, environment-agnostic Docker build.
         source: '/favicon.ico',
-        destination: FAVICON_ICO_DESTINATIONS[getDeploymentEnv()],
+        destination: '/api/favicon',
       },
       {
         source: '/r/:shortCode',

scripts/check-api-validation-contracts.ts

@@ -9,8 +9,8 @@ const QUERY_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/queries')
 const SELECTOR_HOOKS_DIR = path.join(ROOT, 'apps/sim/hooks/selectors')
 
 const BASELINE = {
-  totalRoutes: 927,
-  zodRoutes: 927,
+  totalRoutes: 928,
+  zodRoutes: 928,
   nonZodRoutes: 0,
 } as const
 
@@ -55,6 +55,9 @@ const INDIRECT_ZOD_ROUTES = new Set([
   // tokens and there are no params, query, or body to validate. Previously had
   // no-op `validateSchema(noInputSchema, {})` guards.
   'apps/sim/app/api/health/route.ts',
+  // Redirect target for the legacy /favicon.ico rewrite in next.config.ts —
+  // reads only the server's own deployment-tier env var, no params/query/body.
+  'apps/sim/app/api/favicon/route.ts',
   'apps/sim/app/api/settings/allowed-providers/route.ts',
   'apps/sim/app/api/settings/allowed-integrations/route.ts',
   'apps/sim/app/api/settings/allowed-mcp-domains/route.ts',