Fixing Theme Cookie Handling & Portal Call Loading Issues — September 2, 2026

Today, I tackled two critical bugs that had been causing headaches in my spatial AI platform. The first fix was related to how the gp_theme cookie was being handled for anonymous requests, and the second fix addressed the loading method for the daily-js call machine. Each of these issues was a reminder of the intricate dance between functionality and security, especially as I strive to build a one-man-show company with a billion-dollar valuation.

The first issue I encountered was with the gp_theme cookie. I realized that the server-side rendering (SSR) was improperly honoring this cookie for anonymous requests. This oversight meant that a visitor who selected a dark theme could unintentionally bake a dark-variant page that was then served to everyone else. The implications of this were significant, as it could confuse users who expected a consistent experience based on their own settings. It took me about 30 minutes to diagnose this issue. I had to dive deep into the caching mechanisms of our shared Nginx server, which caches pages for varying lengths of time based on the URL. Ultimately, I implemented a fix that ensures the gp_theme cookie is never SSR'd for anonymous requests, effectively guarding against cache poisoning.

The second fix was a bit more technical but equally important. I had to address how the daily-js call machine was being loaded. The enforced Content Security Policy (CSP) was set to carry `wasm-unsafe-eval` but not `unsafe-eval`, which meant that the default loader for daily-js was attempting to use `eval()` to execute the fetched call-machine bundle. This was particularly problematic since every Tavus portal call was failing at the join stage due to the CSP blocking the URI. After spending another 30 minutes on this, I adjusted the loading mechanism to avoid using `eval()`. This required some careful refactoring to ensure that we maintained the functionality while staying within the security boundaries imposed by the CSP.

Overall, the fixes took about an hour of focused work, but the learning and insights gained were invaluable. Working solo on this project means that I have to wear many hats—developer, security analyst, and user experience designer—often all in the same day. Each bug fix is not just a step toward a more stable platform but also a crucial learning opportunity that informs how I approach future development.

As I look at these challenges, I can't help but reflect on the broader vision of building an agentic web platform that seamlessly integrates spatial AI capabilities. My goal is to create a system that not only meets the immediate needs of users but also anticipates their future demands. Fixing these bugs is part of that journey, ensuring that the foundation is solid as we continue to build out features like the GIGI AI concierge and Tavus video personas.

It's also worth noting that I tackled these issues using Claude Code in VS Code, which allowed me to stay focused without the distractions of other tools or needing to pay for additional seats. This solo approach is part of my strategy to maintain agility and control over the project as I work toward that billion-dollar valuation. While it can be tempting to scale up and bring in more resources, I believe that keeping it lean for now will pay off in the long run.

In summary, today was a reminder that the road to building a robust platform is paved with challenges. Each bug fix not only improves the product but also strengthens my resolve and provides clarity on the direction I need to take. I’m excited to continue this journey and see how these fixes will enhance the user experience on the agentic web. The challenges of today are the stepping stones to the successes of tomorrow, and I’m ready for whatever comes next.