chore: add favicon (closes audit #20)

landing/index.html

@@ -15,6 +15,9 @@
 <meta name="twitter:description" content="The first x402 payment facilitator for Cardano mainnet. Pay for any API with ADA.">
 <meta name="twitter:image" content="https://cardano402.com/og-image.svg">
 
+<link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+<link rel="alternate icon" href="/favicon.ico" />
+
 <link rel="preconnect" href="https://fonts.googleapis.com" />
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
 <link href="https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:opsz,wght@12..96,400;12..96,500;12..96,600;12..96,700;12..96,800&family=Instrument+Serif:ital@0;1&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet" />

src/routes/agent-discovery.ts

@@ -85,6 +85,15 @@ async function readSkillMd(): Promise<string> {
   return cachedSkillMd;
 }
 
+let cachedFaviconSvg: string | null = null;
+
+async function readFaviconSvg(): Promise<string> {
+  if (cachedFaviconSvg === null) {
+    cachedFaviconSvg = await readFile(resolve(process.cwd(), 'landing/favicon.svg'), 'utf-8');
+  }
+  return cachedFaviconSvg;
+}
+
 const agentDiscoveryRoutes: FastifyPluginCallback = (fastify, _options, done) => {
   fastify.get('/robots.txt', async (_req, reply) => {
     return reply.type('text/plain; charset=utf-8').status(200).send(ROBOTS_TXT);
@@ -103,6 +112,17 @@ const agentDiscoveryRoutes: FastifyPluginCallback = (fastify, _options, done) =>
     return reply.type('text/markdown; charset=utf-8').status(200).send(body);
   });
 
+  // /favicon.ico — legacy fallback path that crawlers and old browsers probe
+  // unconditionally. Serving the same SVG (with the correct image/svg+xml
+  // content type) means the 200 satisfies the probe and stops the request,
+  // which kills the steady stream of /favicon.ico 404s in production logs.
+  // Modern browsers prefer the <link rel="icon" type="image/svg+xml"> in
+  // landing/index.html and never hit this route.
+  fastify.get('/favicon.ico', async (_req, reply) => {
+    const body = await readFaviconSvg();
+    return reply.type('image/svg+xml').status(200).send(body);
+  });
+
   done();
 };
 

tests/unit/routes/agent-discovery.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -26,6 +26,12 @@ describe('Agent-discovery routes', () => {
     originalCwd = process.cwd();
     tmpDir = mkdtempSync(join(tmpdir(), 'cardano402-skill-'));
     writeFileSync(join(tmpDir, 'SKILL.md'), '# Test SKILL\n\nFixture body.\n');
+    // The /favicon.ico route reads `${cwd}/landing/favicon.svg` -- fixture it.
+    mkdirSync(join(tmpDir, 'landing'));
+    writeFileSync(
+      join(tmpDir, 'landing', 'favicon.svg'),
+      '<svg xmlns="http://www.w3.org/2000/svg"><rect/></svg>\n'
+    );
     process.chdir(tmpDir);
   });
 
@@ -110,6 +116,22 @@ describe('Agent-discovery routes', () => {
     });
   });
 
+  describe('GET /favicon.ico', () => {
+    it('returns 200 with image/svg+xml content type (kills bot 404 noise)', async () => {
+      server = await createServer();
+      const res = await server.inject({ method: 'GET', url: '/favicon.ico' });
+      expect(res.statusCode).toBe(200);
+      expect(res.headers['content-type']).toContain('image/svg+xml');
+    });
+
+    it('serves the SVG body so even bots that ignore <link> get a valid image', async () => {
+      server = await createServer();
+      const res = await server.inject({ method: 'GET', url: '/favicon.ico' });
+      expect(res.body).toContain('<svg');
+      expect(res.body).toContain('</svg>');
+    });
+  });
+
   describe('GET /SKILL.md', () => {
     it('returns 200 with text/markdown content', async () => {
       server = await createServer();