Fixing Cache Poisoning & Portal Call Issues in the Theme — September 2, 2026

Today was a focused hour of fixing two critical issues that were hindering the performance and stability of my spatial AI platform. I tackled cache poisoning caused by the gp_theme cookie and resolved a major problem with the daily-js call machine that affected Tavus portal calls. Both fixes were essential to ensure a seamless experience for users interacting with the agentic web.

The first issue I addressed was related to the gp_theme cookie. I discovered that the shared nginx page caches were not correctly handling this cookie for anonymous requests. This oversight allowed one dark/space visitor to bake a dark-variant page that was subsequently served to everyone. In simple terms, users who didn’t set a specific theme were inadvertently receiving a version of the site that was not intended for them. This could lead to confusion and a poor user experience. The fix involved ensuring that the gp_theme cookie is never server-side rendered for anonymous requests, effectively acting as a cache-poison guard.

This fix took a bit of time to implement, as I had to dive deep into the caching logic and understand how nginx was managing these requests. I had to run various tests to ensure that the changes would not inadvertently affect other areas of the site. After several iterations, I finally got it working, and it felt incredibly satisfying to know that I had prevented potential chaos in the user experience.

Next, I turned my attention to the daily-js call machine. The enforced Content Security Policy (CSP) was causing issues because it allowed wasm-unsafe-eval but not unsafe-eval. This meant that the default loader for daily-js was attempting to use eval() to execute the fetched call-machine bundle, which led to every Tavus portal call failing at the join stage. Identifying this problem took some time, as I initially thought it might be an issue with the way calls were being structured.

Once I pinpointed the CSP restrictions as the culprit, I quickly implemented a fix by loading the daily-js call machine without using eval. This change not only resolved the immediate issue but also aligned better with the security protocols I’m implementing throughout the platform. It’s essential to maintain high security standards, especially when dealing with user data and interactions.

Reflecting on today’s work, I’m reminded of the challenges of building this project solo, especially when it comes to debugging. Having Claude Code by my side in VS Code has been invaluable; it allows me to work efficiently without incurring additional costs for collaborative tools. For a one-man show like mine, every minute and every dollar counts.

As I continue to build toward my billion-dollar valuation goal, each fix like these contributes to the overall stability and reliability of the platform. The agentic web is not just about flashy features; it’s about creating a solid foundation that users can trust and rely on. I’m proud of the progress I made today, and I’m looking forward to tackling the next set of challenges that come my way.

In summary, today’s efforts were crucial in maintaining the integrity of the user experience on my platform. Fixing the gp_theme cookie issue and resolving the daily-js call machine problem are steps in the right direction as I strive to build a world-class spatial AI portal. Each fix not only improves the current state of the project but also sets the stage for future enhancements and features that will inevitably follow. I’m excited to continue this journey and see where it leads.