bloby-bot 0.69.5 → 0.69.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bloby-bot",
-  "version": "0.69.5",
+  "version": "0.69.6",
   "releaseNotes": [
     "1. Fix: agent self-update ",
     "1",

package/supervisor/channels/whatsapp.ts

@@ -481,6 +481,7 @@ export class WhatsAppChannel implements ChannelProvider {
       if (connection === 'open') {
         this.connected = true;
         this.reconnectAttempts = 0;
+        this.pairingRetries = 0;
         this.qrData = null;
         this.qrSvg = null;
         this.buildLidMap();
@@ -516,38 +517,40 @@ export class WhatsAppChannel implements ChannelProvider {
           return;
         }
 
-        // Never paired (pair-success sets creds.registered before the post-pairing 515,
-        // so a registered=false close means the pairing window expired unused).
-        if (!state.creds.registered) {
-          if (state.creds.me) {
-            // Phantom identity from an uncompleted pairing-code attempt (Baileys sets
-            // creds.me as a placeholder when the code is requested). Reconnecting would
-            // try to LOG IN with an identity the server never registered → guaranteed
-            // 401 wipe. Reset to a clean unpaired state instead.
-            log.info('[whatsapp] Pairing code expired before confirmation — resetting credentials; connect again to retry');
-            await this.deleteCredentials();
-          } else if (this.pairingRetries < 2) {
-            // Fresh QR windows for a while (the link page is likely still open),
-            // then stop instead of cycling QR codes in the background forever.
+        // restartRequired (515) is the server's reconnect-now handoff. In the QR flow it
+        // arrives right after pair-success, while creds.registered is STILL false (that
+        // flag is only set in the pairing-code flow, messages-recv link_code_pairing_ref)
+        // — so it MUST be handled before any unpaired/phantom logic, or a successful
+        // scan gets thrown away. Backoff guards a pathological repeated-515 loop.
+        if (statusCode === DisconnectReason.restartRequired) {
+          const delay = Math.min(1000 * 2 ** this.reconnectAttempts++, 60_000);
+          log.info(`[whatsapp] Restart required (normal after pairing) — reconnecting in ${delay}ms...`);
+          this.emitStatus();
+          this.scheduleReconnect(delay);
+          return;
+        }
+
+        // Pure QR wait expired without anyone claiming an identity — regenerate a fresh
+        // QR a couple of times (the link page is likely still open), then stop instead
+        // of cycling QR codes in the background forever.
+        if (!state.creds.registered && !state.creds.me) {
+          if (this.pairingRetries < 2) {
             this.pairingRetries++;
             log.info(`[whatsapp] QR expired — generating a fresh one (retry ${this.pairingRetries}/2)`);
             this.emitStatus();
             this.scheduleReconnect(2000);
-            return;
           } else {
             log.info('[whatsapp] Pairing window closed without a scan — connect again to retry');
+            this.emitStatus();
           }
-          this.emitStatus();
           return;
         }
 
-        // restartRequired (515) is the normal post-pairing handoff — reconnect right
-        // away, but only the first time (a repeated-515 loop is a known Baileys failure
-        // mode; let it back off). Everything else backs off 5s → 60s so an offline
-        // network doesn't hot-loop.
-        const fastRestart = statusCode === DisconnectReason.restartRequired && this.reconnectAttempts === 0;
-        const delay = fastRestart ? 1000 : Math.min(5000 * 2 ** this.reconnectAttempts, 60_000);
-        this.reconnectAttempts++;
+        // Anything else reconnects with backoff (5s → 60s). This includes the
+        // me-set-but-unregistered states: a real post-pairing identity completes its
+        // login on reconnect, and a stale pairing-code placeholder gets a 401 from the
+        // server — which lands in the loggedOut branch above and wipes it cleanly.
+        const delay = Math.min(5000 * 2 ** this.reconnectAttempts++, 60_000);
         log.info(`[whatsapp] Reconnecting in ${Math.round(delay / 1000)}s...`);
         this.emitStatus();
         this.scheduleReconnect(delay);

package/supervisor/index.ts

@@ -28,6 +28,7 @@ import { startViteDevServers, stopViteDevServers } from './vite-dev.js';
 import { startScheduler, stopScheduler, readPulseConfig, readCronsConfig, nextRunISO, describeCron } from './scheduler.js';
 import { execSync, spawn as cpSpawn } from 'child_process';
 import crypto from 'crypto';
+import zlib from 'zlib';
 import { ChannelManager } from './channels/manager.js';
 import { SHELL_HTML } from './shell.js';
 
@@ -141,8 +142,10 @@ const SW_JS = `// Service worker — app-shell caching + push notifications
 // cached shell that masks a broken (or just-fixed) frontend and produces the confusing
 // "normal refresh is broken but hard refresh works" split. Cache is a pure offline fallback.
 
-var CACHE = 'bloby-v24';
-var HASHED_RE = new RegExp('/assets/.+-[a-zA-Z0-9]{6,}[.](js|css)$');
+var CACHE = 'bloby-v25';
+// Hash class includes -/_ — Vite's content hashes are base64url (e.g. bloby-Dfx1hOe-.js);
+// without them ~3 MB of hashed chat assets silently fell out of cache-first into network-first.
+var HASHED_RE = new RegExp('/assets/.+-[a-zA-Z0-9_-]{6,}[.](js|css)$');
 
 // Precache the HTML shell on install so the cache is never empty.
 // Without this, the first navigation isn't intercepted (SW wasn't
@@ -197,6 +200,31 @@ self.addEventListener('fetch', function(event) {
     return;
   }
 
+  // Vite's optimized deps (/node_modules/.vite/deps/*?v=<hash>) are content-addressed and
+  // served max-age=31536000,immutable — but fell into network-first below, re-crossing the
+  // tunnel whenever the HTTP cache evicted them (common on mobile). Cache-first, pruning
+  // older ?v= versions of the same module. Source modules (?t=, /@*) stay network-only.
+  if (url.pathname.indexOf('/node_modules/.vite/deps/') === 0 && url.searchParams.has('v')) {
+    event.respondWith(caches.open(CACHE).then(function(c) {
+      return c.match(request).then(function(hit) {
+        if (hit) return hit;
+        return fetch(request).then(function(r) {
+          if (r.ok) {
+            c.put(request, r.clone());
+            c.keys().then(function(keys) {
+              for (var i = 0; i < keys.length; i++) {
+                var u = new URL(keys[i].url);
+                if (u.pathname === url.pathname && u.search !== url.search) c.delete(keys[i]);
+              }
+            });
+          }
+          return r;
+        });
+      });
+    }));
+    return;
+  }
+
   // Navigation: only stale-while-revalidate the dashboard root (/).
   // /bloby/* is a separate app — let it go to network to avoid
   // caching the wrong HTML under the / key.
@@ -431,6 +459,12 @@ export async function startSupervisor() {
   // Create HTTP server first (Vite needs it for HMR WebSocket)
   // The request handler is set up later via server.on('request')
   const server = http.createServer();
+  // cloudflared keeps a pool of ~100 origin connections with a 90s idle timeout; Node's
+  // default keepAliveTimeout is 5s, so after any pause every request burst re-paid TCP setup —
+  // and the 5s-vs-90s mismatch is the classic reused-socket race behind sporadic tunnel 502s
+  // ("error opening a stream to the origin"). Outlive cloudflared's pool instead.
+  server.keepAliveTimeout = 120_000;
+  server.headersTimeout = 125_000; // must exceed keepAliveTimeout (Node guards header floods with it)
 
   // Start Vite dev server — pass supervisor server so Vite attaches HMR WebSocket directly.
   // A Vite boot failure must NOT take down the supervisor (G1): chat is served independently and
@@ -605,19 +639,150 @@ export async function startSupervisor() {
     });
   }
 
+  // ── Cached static serving: in-memory buffers + content ETags + 304s + gzip ──────────────
+  // Everything the supervisor serves on the refresh path used to be fs.readFileSync per request
+  // with no validator — nothing could ever 304, so ~90 KB of identical bytes crossed the tunnel
+  // on every refresh (plus sync SD-card reads on Pi-class hardware). Entries are stat-validated
+  // by mtime, so editing a file (dev) or `bloby update` + restart (prod) is always picked up;
+  // `no-cache` semantics (revalidate every load) are preserved — clients just get 304s now.
+  type CachedAsset = { buf: Buffer; gz: Buffer | null; etag: string; mtimeMs: number };
+  const staticCache = new Map<string, CachedAsset>();
+
+  function buildCachedAsset(buf: Buffer, mtimeMs: number): CachedAsset {
+    const etag = '"' + crypto.createHash('sha1').update(buf).digest('base64url').slice(0, 16) + '"';
+    const gz = buf.length > 1024 ? zlib.gzipSync(buf, { level: 6 }) : null;
+    // Keep gzip only when it actually pays for the Content-Encoding overhead.
+    return { buf, gz: gz && gz.length < buf.length * 0.92 ? gz : null, etag, mtimeMs };
+  }
+
+  function serveCachedText(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    key: string,
+    src: { file?: string; content?: string },
+    contentType: string,
+    cacheControl: string,
+    extra: Record<string, string> = {},
+  ): void {
+    let entry = staticCache.get(key);
+    if (src.file !== undefined) {
+      let mtimeMs = 0;
+      try { mtimeMs = fs.statSync(src.file).mtimeMs; } catch { res.writeHead(404); res.end('Not found'); return; }
+      if (!entry || entry.mtimeMs !== mtimeMs) {
+        if (staticCache.size > 200) staticCache.clear(); // runaway guard; rebuilt on demand
+        try { entry = buildCachedAsset(fs.readFileSync(src.file), mtimeMs); staticCache.set(key, entry); }
+        catch { res.writeHead(404); res.end('Not found'); return; }
+      }
+    } else if (!entry) {
+      entry = buildCachedAsset(Buffer.from(src.content || '', 'utf-8'), -1);
+      staticCache.set(key, entry);
+    }
+    if (req.headers['if-none-match'] === entry.etag) {
+      res.writeHead(304, { ETag: entry.etag, 'Cache-Control': cacheControl, ...extra });
+      res.end();
+      return;
+    }
+    const gzOk = entry.gz !== null && String(req.headers['accept-encoding'] || '').includes('gzip');
+    res.writeHead(200, {
+      'Content-Type': contentType,
+      'Cache-Control': cacheControl,
+      ETag: entry.etag,
+      Vary: 'Accept-Encoding',
+      ...(gzOk ? { 'Content-Encoding': 'gzip' } : {}),
+      ...extra,
+    });
+    res.end(gzOk ? entry.gz : entry.buf);
+  }
+
+  // Read once per process — the version can only change via an update, which restarts us.
+  let pkgVersion = 'unknown';
+  try { pkgVersion = JSON.parse(fs.readFileSync(path.join(PKG_DIR, 'package.json'), 'utf-8')).version || 'unknown'; } catch {}
+
+  // Keep-alive agent for the loopback proxies (Vite dev server + workspace backend). Without it
+  // (on Node 18, the install floor) every proxied module request opens a fresh TCP connection —
+  // dozens of handshakes per refresh that a Pi actually feels.
+  const loopbackAgent = new http.Agent({ keepAlive: true, maxSockets: 64 });
+  const HOP_BY_HOP = ['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade'];
+  function stripHopByHop(h: http.IncomingHttpHeaders): http.IncomingHttpHeaders {
+    const out: http.IncomingHttpHeaders = {};
+    for (const k in h) if (!HOP_BY_HOP.includes(k)) out[k] = h[k];
+    return out; // forwarding 'connection: close' would defeat the keep-alive pool
+  }
+
+  // ── Refresh-performance instrumentation ─────────────────────────────────────────────────
+  // Server side: a ring of recent request timings (duration, bytes out, encoding, whether the
+  // socket was reused). Client side: the shell assembles marks from itself + widget + the
+  // workspace iframe into one beacon per page load and POSTs it here. Read both via
+  // GET /__bloby/perf — LOCALHOST ONLY (request paths/timings stay off the tunnel); remote
+  // debugging uses the console print behind localStorage.bloby_perf='1' in the shell.
+  const perfRequests: object[] = [];
+  const perfBeacons: object[] = [];
+  function isLoopback(req: http.IncomingMessage): boolean {
+    const a = req.socket.remoteAddress || '';
+    return a === '127.0.0.1' || a === '::1' || a === '::ffff:127.0.0.1';
+  }
+
   // HTTP request handler — proxies to Vite dev servers + worker API
   server.on('request', async (req, res) => {
+    // Request timing sample — attached before any routing so every branch is covered.
+    {
+      const t0 = Date.now();
+      const sock = req.socket as any;
+      const reused = !!sock.__blobySeen;
+      sock.__blobySeen = true;
+      const w0 = sock.bytesWritten || 0;
+      let sampled = false;
+      res.on('close', () => {
+        if (sampled) return;
+        sampled = true;
+        perfRequests.push({
+          ts: t0,
+          m: req.method,
+          p: (req.url || '').split('?')[0].slice(0, 120),
+          s: res.statusCode,
+          ms: Date.now() - t0,
+          out: Math.max(0, (req.socket.bytesWritten || 0) - w0),
+          enc: String(res.getHeader('content-encoding') || ''),
+          reused,
+        });
+        if (perfRequests.length > 400) perfRequests.splice(0, perfRequests.length - 400);
+      });
+    }
+
+    // Client perf beacon — one compact JSON per page load, posted by the shell.
+    if (req.url === '/__bloby/perf' && req.method === 'POST') {
+      const chunks: Buffer[] = [];
+      let size = 0;
+      req.on('data', (c: Buffer) => { size += c.length; if (size <= 32_768) chunks.push(c); });
+      req.on('end', () => {
+        try {
+          if (size <= 32_768) {
+            const beacon = JSON.parse(Buffer.concat(chunks).toString('utf-8'));
+            perfBeacons.push({ ts: Date.now(), ...beacon });
+            if (perfBeacons.length > 20) perfBeacons.splice(0, perfBeacons.length - 20);
+          }
+        } catch {}
+        res.writeHead(204);
+        res.end();
+      });
+      return;
+    }
+    if (req.url === '/__bloby/perf' && req.method === 'GET') {
+      if (!isLoopback(req)) { res.writeHead(403); res.end('localhost only'); return; }
+      res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ beacons: perfBeacons, requests: perfRequests }));
+      return;
+    }
+
     // Bloby widget — served directly (not part of Vite build)
     if (req.url === '/bloby/widget.js') {
-      res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' });
-      res.end(fs.readFileSync(paths.widgetJs));
+      serveCachedText(req, res, 'widget', { file: paths.widgetJs }, 'application/javascript', 'no-cache');
       return;
     }
 
     // App WS client — served directly (proxies /app/api calls through WebSocket)
     if (req.url === '/bloby/app-ws.js') {
-      res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' });
-      res.end(fs.readFileSync(path.join(PKG_DIR, 'supervisor', 'app-ws.js')));
+      serveCachedText(req, res, 'app-ws', { file: path.join(PKG_DIR, 'supervisor', 'app-ws.js') }, 'application/javascript', 'no-cache');
       return;
     }
 
@@ -625,15 +790,13 @@ export async function startSupervisor() {
     // below). Auto-reloads into the "backend down" interstitial when the backend gives up, and
     // replaces Vite's raw error overlay with a friendly one. Served here so it's always current.
     if (req.url === '/bloby/workspace-guard.js') {
-      res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' });
-      res.end(fs.readFileSync(path.join(PKG_DIR, 'supervisor', 'workspace-guard.js')));
+      serveCachedText(req, res, 'guard', { file: path.join(PKG_DIR, 'supervisor', 'workspace-guard.js') }, 'application/javascript', 'no-cache');
       return;
     }
 
     // Service worker — served from embedded constant (supervisor/ is always updated)
     if (req.url === '/sw.js' || req.url === '/bloby/sw.js') {
-      res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' });
-      res.end(SW_JS);
+      serveCachedText(req, res, 'sw', { content: SW_JS }, 'application/javascript', 'no-cache');
       return;
     }
 
@@ -650,10 +813,8 @@ export async function startSupervisor() {
     // every reconnect. A mismatch means the immortal shell survived a self-update running
     // pre-update code; the chat then triggers one full shell reload to pick up the new bundle.
     if (req.url === '/__bloby/version') {
-      let v = 'unknown';
-      try { v = JSON.parse(fs.readFileSync(path.join(PKG_DIR, 'package.json'), 'utf-8')).version || 'unknown'; } catch {}
       res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
-      res.end(JSON.stringify({ version: v }));
+      res.end(JSON.stringify({ version: pkgVersion }));
       return;
     }
 
@@ -822,7 +983,7 @@ export async function startSupervisor() {
       }
 
       const proxy = http.request(
-        { host: '127.0.0.1', port: backendPort, path: backendPath, method: req.method, headers: req.headers },
+        { host: '127.0.0.1', port: backendPort, path: backendPath, method: req.method, headers: stripHopByHop(req.headers), agent: loopbackAgent },
         (proxyRes) => {
           const ct = String(proxyRes.headers['content-type'] || '');
           const isSse = ct.includes('text/event-stream');
@@ -2698,6 +2859,13 @@ ${alreadyLinked ? '' : `
           // HTML files: no-cache so rebuilds are picked up immediately
           // Hashed assets (.js, .css): immutable caching
           const cacheControl = ext === '.html' ? 'no-cache' : 'public, max-age=31536000, immutable';
+          // Text assets go through the in-memory cache: gzip (the 750 KB chat entry → ~230 KB
+          // over the tunnel) + ETag/304. The mtime check inside handles rebuilds. Binary types
+          // (images, fonts, webm) stream as before — gzip wouldn't help them.
+          if (['.js', '.css', '.html', '.svg', '.json'].includes(ext) && stat.size < 5_000_000) {
+            serveCachedText(req, res, 'bloby:' + filePath, { file: fullPath }, mime, cacheControl);
+            return;
+          }
           res.writeHead(200, { 'Content-Type': mime, 'Cache-Control': cacheControl });
           // A file removed/replaced mid-stream (common during a workspace rebuild) emits an
           // async 'error' on the stream — without this listener it crashes the supervisor (G1).
@@ -2725,6 +2893,14 @@ ${alreadyLinked ? '' : `
         if (stat.isFile()) {
           const ext = path.extname(assetPath);
           const mime = MIME_TYPES[ext] || 'application/octet-stream';
+          // ETag + 304 via the memory cache (these had no validator, so every >24h-stale
+          // client re-downloaded the sprite sheets in full). Binary types won't gzip below
+          // the keep threshold — the helper drops unhelpful gzip automatically. Very large
+          // files (videos) keep streaming.
+          if (stat.size < 5_000_000) {
+            serveCachedText(req, res, 'pub:' + cleanUrl, { file: assetPath }, mime, 'public, max-age=86400');
+            return;
+          }
           res.writeHead(200, { 'Content-Type': mime, 'Cache-Control': 'public, max-age=86400' });
           const rs = fs.createReadStream(assetPath);
           rs.on('error', () => { if (!res.headersSent) { res.writeHead(404); res.end('Not found'); } else res.destroy(); });
@@ -2770,8 +2946,7 @@ ${alreadyLinked ? '' : `
       (cleanUrl === '/' || fetchDest === 'document' ||
         (!fetchDest && String(req.headers['accept'] || '').includes('text/html')))
     ) {
-      res.writeHead(200, { 'Content-Type': 'text/html', 'Cache-Control': 'no-cache', 'X-Bloby-Origin': 'supervisor' });
-      res.end(SHELL_HTML);
+      serveCachedText(req, res, 'shell', { content: SHELL_HTML }, 'text/html', 'no-cache', { 'X-Bloby-Origin': 'supervisor' });
       return;
     }
 
@@ -2800,8 +2975,14 @@ ${alreadyLinked ? '' : `
 
     // Everything else → proxy to dashboard Vite dev server
     const GUARD_TAG = '<script defer src="/bloby/workspace-guard.js"></script>';
+    // Vite dev serves everything identity-encoded and nothing else on the origin side
+    // compresses, so the residential UPLINK — the slowest hop — carried every module raw.
+    // Gzip text responses on the fly (level 4: ~4x smaller for ~nothing on a Pi, per response).
+    // Streams (SSE), pre-encoded bodies, non-text types, and 304s pass through untouched.
+    const clientAcceptsGzip = String(req.headers['accept-encoding'] || '').includes('gzip');
+    const GZIPPABLE_RE = /^(text\/(?!event-stream)|application\/(javascript|json|manifest\+json)|image\/svg)/;
     const proxy = http.request(
-      { host: '127.0.0.1', port: vitePorts.dashboard, path: req.url, method: req.method, headers: req.headers },
+      { host: '127.0.0.1', port: vitePorts.dashboard, path: req.url, method: req.method, headers: stripHopByHop(req.headers), agent: loopbackAgent },
       (proxyRes) => {
         const ct = String(proxyRes.headers['content-type'] || '');
         const enc = String(proxyRes.headers['content-encoding'] || '');
@@ -2810,8 +2991,21 @@ ${alreadyLinked ? '' : `
         // untouched. The guard auto-reloads into the "backend down" interstitial and replaces
         // Vite's raw error overlay — supervisor-side so it reaches every workspace, no edits needed.
         if (!ct.includes('text/html') || enc) {
-          res.writeHead(proxyRes.statusCode!, proxyRes.headers);
-          proxyRes.pipe(res);
+          const len = Number(proxyRes.headers['content-length'] || NaN);
+          const gzip =
+            clientAcceptsGzip && !enc && req.method === 'GET' && proxyRes.statusCode === 200 &&
+            GZIPPABLE_RE.test(ct) && !proxyRes.headers['content-range'] && !(len < 1024);
+          if (!gzip) {
+            res.writeHead(proxyRes.statusCode!, proxyRes.headers);
+            proxyRes.pipe(res);
+            return;
+          }
+          const headers = { ...proxyRes.headers, 'content-encoding': 'gzip', vary: 'Accept-Encoding' };
+          delete headers['content-length']; // length changes; let Node chunk it
+          res.writeHead(proxyRes.statusCode!, headers);
+          const gz = zlib.createGzip({ level: 4 });
+          gz.on('error', () => { try { res.destroy(); } catch {} });
+          proxyRes.pipe(gz).pipe(res);
           return;
         }
         const chunks: Buffer[] = [];
@@ -2823,9 +3017,19 @@ ${alreadyLinked ? '' : `
           }
           const headers = { ...proxyRes.headers };
           // Body length changed — drop both framing headers and let Node set content-length
-          // from the single res.end() write.
+          // from the single res.end() write. Vite's validators describe the UNMODIFIED body:
+          // forwarding them would let a future conditional request 304 against bytes we changed.
           delete headers['content-length'];
           delete headers['transfer-encoding'];
+          delete headers['etag'];
+          delete headers['last-modified'];
+          if (clientAcceptsGzip && proxyRes.statusCode === 200) {
+            headers['content-encoding'] = 'gzip';
+            headers['vary'] = 'Accept-Encoding';
+            res.writeHead(proxyRes.statusCode!, headers);
+            res.end(zlib.gzipSync(Buffer.from(html, 'utf-8'), { level: 4 }));
+            return;
+          }
           res.writeHead(proxyRes.statusCode!, headers);
           res.end(html);
         });

package/supervisor/public/morphy/headphones.json

@@ -1,9 +1,9 @@
 {
   "name": "headphones",
-  "spritesheet": "headphones.png",
+  "spritesheet": "headphones.webp",
   "frame": {
-    "w": 174,
-    "h": 180
+    "w": 145,
+    "h": 150
   },
   "grid": {
     "cols": 16,
@@ -37,4 +37,4 @@
       "next": "idle"
     }
   }
-}
+}

package/supervisor/public/morphy/teleporting.json

@@ -1,6 +1,6 @@
 {
   "name": "teleporting",
-  "spritesheet": "teleporting.png",
+  "spritesheet": "teleporting.webp",
   "frame": {
     "w": 218,
     "h": 180
@@ -35,4 +35,4 @@
       "next": "idle"
     }
   }
-}
+}

package/supervisor/shell.ts

@@ -21,6 +21,8 @@ export const SHELL_HTML = `<!DOCTYPE html>
     <link rel="icon" type="image/png" href="/morphy-favicon.png" />
     <link rel="apple-touch-icon" href="/morphy-icon-192.png" />
     <link rel="manifest" href="/manifest.json" />
+    <!-- widget.js sits at the end of body; fetch it while the iframe + inline scripts parse -->
+    <link rel="preload" href="/bloby/widget.js" as="script" />
     <title>Bloby</title>
   </head>
   <body style="background-color:#0A0A0A;margin:0;overflow:hidden">
@@ -34,6 +36,53 @@ export const SHELL_HTML = `<!DOCTYPE html>
       allow="camera; microphone; geolocation; clipboard-read; clipboard-write; fullscreen; autoplay; display-capture"
     ></iframe>
 
+    <script>
+    // ── Refresh-performance marks ──────────────────────────────────────────
+    // Collected from this document + widget.js (same window, via window.__blobyPerf.mark) +
+    // the workspace iframe (workspace-guard posts {type:'bloby:perf'}), assembled into ONE
+    // beacon per page load and POSTed to /__bloby/perf (kept server-side, localhost-readable).
+    // Live console print: localStorage.bloby_perf = '1'.
+    (function () {
+      var marks = {};
+      var workspace = null;
+      var sent = false;
+      window.__blobyPerf = {
+        mark: function (name) { if (marks[name] === undefined) marks[name] = Math.round(performance.now()); },
+        workspace: function (data) { workspace = data; },
+      };
+      function assemble() {
+        var nav = null;
+        try { nav = performance.getEntriesByType('navigation')[0] || null; } catch (e) {}
+        var b = {
+          host: location.host,
+          shell: nav ? {
+            ttfb: Math.round(nav.responseStart),
+            htmlDone: Math.round(nav.responseEnd),
+            domLoaded: Math.round(nav.domContentLoadedEventEnd),
+          } : null,
+          marks: marks,
+          workspace: workspace, // its marks arrive on the iframe's clock; offsetMs aligns them
+        };
+        if (workspace && typeof workspace.timeOrigin === 'number') {
+          b.workspace.offsetMs = Math.round(workspace.timeOrigin - performance.timeOrigin);
+        }
+        return b;
+      }
+      function send() {
+        if (sent) return;
+        sent = true;
+        var beacon = assemble();
+        try { if (localStorage.getItem('bloby_perf') === '1') console.log('[bloby-perf]', JSON.stringify(beacon, null, 2)); } catch (e) {}
+        try { fetch('/__bloby/perf', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(beacon), keepalive: true }).catch(function () {}); } catch (e) {}
+      }
+      // Send a few seconds after the workspace reports ready, so stragglers (sprite sheet,
+      // the deferred chat iframe, late modules) land in the same beacon. Backstop for broken
+      // workspaces. 7s covers the chat's idle-deferred load (~app-ready + 4s timeout + load).
+      window.addEventListener('bloby:app-ready', function () { setTimeout(send, 7000); });
+      setTimeout(send, 20000);
+    })();
+    </script>
+
     <script>
     (function () {
       var frame = document.getElementById('bloby-workspace');
@@ -68,8 +117,10 @@ export const SHELL_HTML = `<!DOCTYPE html>
         if (appReadyFired) return;
         appReadyFired = true;
         window.__blobyAppReady = true;
+        if (window.__blobyPerf) window.__blobyPerf.mark('shell:app-ready');
         window.dispatchEvent(new Event('bloby:app-ready'));
       }
+      if (window.__blobyPerf) window.__blobyPerf.mark('shell:frame-src-set');
 
       window.addEventListener('message', function (e) {
         // Same-origin iframe only — drop anything else (extensions, third-party embeds).
@@ -80,6 +131,8 @@ export const SHELL_HTML = `<!DOCTYPE html>
           fireAppReady();
         } else if (d.type === 'bloby:title') {
           document.title = String(d.title || '').slice(0, 200) || 'Bloby';
+        } else if (d.type === 'bloby:perf' && d.data && window.__blobyPerf) {
+          window.__blobyPerf.workspace(d.data);
         }
       });
 

package/supervisor/vite-dev.ts

@@ -1,7 +1,8 @@
 import { createServer as createViteServer, createLogger, type ViteDevServer } from 'vite';
 import type http from 'http';
+import fs from 'fs';
 import path from 'path';
-import { PKG_DIR } from '../shared/paths.js';
+import { PKG_DIR, WORKSPACE_DIR } from '../shared/paths.js';
 import { log } from '../shared/logger.js';
 import { appendFrontendLog } from './frontend-log.js';
 
@@ -37,6 +38,19 @@ export async function startViteDevServers(supervisorPort: number, hmrServer: htt
     dashboard: supervisorPort + 2,
   };
 
+  // vite.config.ts keys the dep-prebundle cache dir by package version (.vite-v<version>) so
+  // each release re-optimizes exactly once. Sweep the previous releases' dirs (best-effort,
+  // async — recharts-sized prebundles are ~10 MB each and would otherwise accumulate forever).
+  try {
+    let current = 'dev';
+    try { current = JSON.parse(fs.readFileSync(path.join(PKG_DIR, 'package.json'), 'utf-8')).version || 'dev'; } catch {}
+    const nmDir = path.join(WORKSPACE_DIR, 'client', 'node_modules');
+    for (const name of fs.readdirSync(nmDir)) {
+      if (name.startsWith('.vite-v') && name !== '.vite-v' + current) {
+        fs.rm(path.join(nmDir, name), { recursive: true, force: true }, () => {});
+      }
+    }
+  } catch { /* no node_modules yet / first boot — nothing to sweep */ }
 
   try {
     dashboardVite = await createViteServer({