Repository navigation
refactor: simplify hero scene and improve live visitor tracking - #17
Merged
Merged
Conversation
Fresh cloud containers start with an empty local D1, so pnpm dev served 500s (no such table: post) until migrations were applied by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5
The escape had degraded into replacing "<" with "<", a no-op, so a title containing </script> could inject markup. Adds a regression test and lets the web unit tests resolve the @/ alias and SITE. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5
R2 rejected the tee'd transform stream (unknown length), so variants were never stored and every cache miss re-ran a billable transform. Variants are now buffered, stored and served; their ETag is known up front, so revalidations are answered with a 304 before any R2 read or transform, and the global etag() middleware no longer buffers and hashes image bodies. The original is only read when the variant is missing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5
One INSERT for every path exceeded D1's 100 bound parameters as soon as a day had more than 25 distinct paths, failing the whole rollup. Rows are now written in chunks of 25 in one atomic batch, and only the 1000 most viewed paths per day are kept, since the beacon accepts any path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5
…ures The renderer throws on nodes and marks the editor cannot produce; that surfaced as a 500 and an unhandled-error log instead of a 422. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5
…dcasting Any page or script could open presence sockets and inflate the visitor count. The room now refuses handshakes whose Origin is not the site's own (CSRF checks skip GET, so WebSockets had no origin check) and caps open sockets per visitor at 10, keyed by a hashed IP. Nobody reads the room's messages: public pages only need to be counted and the dashboard polls count() over SSE. Dropping the broadcast removes the O(n) fan-out on every join and leave (O(n^2) traffic overall). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5
…name A token from another site embedding the same widget no longer passes. Cloudflare's dummy test secrets report example.com, so they skip the check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5
The home page hydrated React only to run an idle timer that lazy-loaded the Three.js scene. A plain Astro script now applies the same gates (flag, reduced motion, Save-Data, WebGL 2) and mounts the scene, so the home page ships no framework runtime: 6 instead of 10 scripts and 127 instead of 194 KiB of JavaScript. Lab scores stay within noise (median 98); ADR-024 records the measurements and why the poster stays lazily loaded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
orkide-web | 5e26936 | Commit Preview URL Branch Preview URL |
Oct 02 2026, 09:21 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
This PR makes two major improvements:
Hero scene: Removes React island overhead by converting the hero scene from a React component (
HeroScene,HeroCanvas) to a plain script that progressively loads the Three.js pollen visualization. The home page now ships zero framework runtime, with the scene fetched and mounted only after the page is idle and when WebGL 2 is available.Live visitor tracking: Refactors the presence system to count visitors without broadcasting messages. The room now only tracks open sockets per visitor IP (with a limit of 10 per IP to prevent abuse), and the admin dashboard reads the count via RPC on its own schedule. This reduces memory usage and makes joins/leaves O(1) regardless of audience size.
Additional improvements:
<to prevent script injectionCloses #[issue-number]
Checklist
pnpm check,pnpm typecheckandpnpm testpass@orkide/validators), none hand-writtenApiErrorproblems; public pages stay a pure function of their URLdocs/decisions.mdhttps://claude.ai/code/session_016v6LHswjLWAHsncyuRpCE5