From 0df8eb127ce79825dde0b849b4a4bdf8803366c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kasper=20H=C3=A4gele?= <kasper@picqer.com>
Date: Mon, 7 Sep 2026 19:37:31 +0200
Subject: [PATCH] fix(web-standalone): revalidate on every visit, start in the
 first field, honour hidden

Three things on a fresh visit (#124).

What's new showed old entries: server.py sent no Cache-Control, so
browsers applied heuristic caching to index.html and changelog.json and
served yesterday's file for hours; only an incognito window showed the
current one. end_headers() now sends Cache-Control: no-cache on every
response that has none (the proxy routes keep their no-store), and the
page fetches the changelog with cache: "no-cache". Cloudflare honours
the origin header.

Nothing had focus: a fresh visit now puts the cursor in the first-hop
field, also right after the intro is dismissed, with preventScroll so a
phone does not jump. A deep link, an incident link or a filled field
leaves focus alone.

"Add repeater prefixes within this cluster" showed before any cluster
was locked: the label carried hidden, but a display rule on labels beat
the attribute, the same trap the manual banner had a local fix for.
One global rule: [hidden] { display: none !important }.

Verified: curl shows Cache-Control: no-cache on / and /changelog.json
and no-store on the proxy; in the pane a fresh visit focuses
prefix-input, with the intro the focus is on its button and moves to
prefix-input when it closes without scrolling; the label and the manual
banner compute display: none while hidden; pytest 6 passed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 web-standalone/changelog.json |  6 ++++++
 web-standalone/index.html     | 21 ++++++++++++++++++++-
 web-standalone/server.py      | 12 ++++++++++++
 3 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/web-standalone/changelog.json b/web-standalone/changelog.json
index e883e12..732746b 100644
--- a/web-standalone/changelog.json
+++ b/web-standalone/changelog.json
@@ -1,4 +1,10 @@
 [
+  {
+    "id": "2026-09-07-fresh-visit",
+    "date": "2026-09-07",
+    "title": "Fresh visits start in the right place",
+    "body": "What's new showed old entries because the browser kept yesterday's file; the page now revalidates on every visit. A fresh visit puts the cursor in the first-hop field, also right after the intro. And a Step 2 label no longer shows before a cluster is locked."
+  },
   {
     "id": "2026-09-07-the-link-carries-the-scene",
     "date": "2026-09-07",
diff --git a/web-standalone/index.html b/web-standalone/index.html
index d1dec2a..f7ac6fb 100644
--- a/web-standalone/index.html
+++ b/web-standalone/index.html
@@ -10,6 +10,12 @@
     crossorigin=""
   >
   <style>
+    /* The hidden attribute wins over any display rule. Without this a
+       label or banner with its own display: block stayed on screen while
+       carrying hidden (#124); several places worked around it locally. */
+    [hidden] {
+      display: none !important;
+    }
     :root {
       --bg: #08141b;
       --panel: rgba(7, 25, 35, 0.88);
@@ -5686,6 +5692,15 @@ <h3>Unknown Node Estimate</h3>
       if (!introOverlay || introOverlay.hidden) return;
       introOverlay.hidden = true;
       markIntroSeen();
+      focusFirstInput();
+    }
+
+    // A fresh visit starts in the first-hop field (#124). preventScroll keeps
+    // a phone from jumping the page to the field on load; the flow's own
+    // scrolls (#118) take over from there.
+    function focusFirstInput() {
+      if (!prefixInput || prefixInput.value) return;
+      try { prefixInput.focus({ preventScroll: true }); } catch (error) { prefixInput.focus(); }
     }
     function introLoadingDone() {
       if (!introOverlay || introOverlay.hidden || !introLoading || introLoading.hidden) return;
@@ -5717,6 +5732,8 @@ <h3>Unknown Node Estimate</h3>
       discoverButton.click();
     } else if (showIntro) {
       openIntro(false);
+    } else if (!new URLSearchParams(window.location.search).get("incident")) {
+      focusFirstInput();
     }
 
     // "What's new" changelog (#22): loads web-standalone/changelog.json,
@@ -5728,7 +5745,9 @@ <h3>Unknown Node Estimate</h3>
       const SEEN_KEY = "changelog:lastSeenId";
       let entries = [];
       try {
-        entries = await fetch("changelog.json").then((r) => r.json());
+        // Revalidate every time: with the default the browser kept yesterday's
+        // file for hours and What's new showed old entries (#124).
+        entries = await fetch("changelog.json", { cache: "no-cache" }).then((r) => r.json());
       } catch (error) {
         whatsNewButton.hidden = true;
         return;
diff --git a/web-standalone/server.py b/web-standalone/server.py
index 350c715..af9e797 100644
--- a/web-standalone/server.py
+++ b/web-standalone/server.py
@@ -70,11 +70,23 @@ def __init__(self, *args, **kwargs):
         super().__init__(*args, directory=BASE_DIR, **kwargs)
 
     def end_headers(self):
+        # Every response revalidates. Without a Cache-Control header browsers
+        # apply heuristic caching to index.html and changelog.json and served
+        # yesterday's page for hours; Cloudflare in front honours this too
+        # (#124). The proxy routes set their own no-store before this runs.
+        if not any(name.lower() == "cache-control" for name, _ in self._headers_buffer_names()):
+            self.send_header("Cache-Control", "no-cache")
         self.send_header("Access-Control-Allow-Origin", "*")
         self.send_header("Access-Control-Allow-Headers", "Content-Type")
         self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
         super().end_headers()
 
+    def _headers_buffer_names(self):
+        for line in getattr(self, "_headers_buffer", []):
+            if isinstance(line, bytes) and b":" in line:
+                name = line.split(b":", 1)[0].decode("latin-1", "replace").strip()
+                yield name, None
+
     def do_OPTIONS(self):
         self.send_response(204)
         self.end_headers()