From 16e324102e0191b16278009c4595ef0ea3f69d3e Mon Sep 17 00:00:00 2001
From: root <root@claude.hynesy.com>
Date: Tue, 9 Jun 2026 11:25:54 +1000
Subject: [PATCH] fix(icons): serve icons no-cache so updates propagate (2.5.2)

Icon route used Cache-Control: public, max-age=86400, so changed icons stayed
stuck in CF + browser caches for a day. Switch to no-cache (revalidate; Express
ETag => 304 when unchanged) so icon edits show up immediately.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 lib/api/routes/icon_sets.js | 5 ++++-
 package-lock.json           | 4 ++--
 package.json                | 2 +-
 server.js                   | 2 +-
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/api/routes/icon_sets.js b/lib/api/routes/icon_sets.js
index 6a97b26..b73354d 100644
--- a/lib/api/routes/icon_sets.js
+++ b/lib/api/routes/icon_sets.js
@@ -20,7 +20,10 @@ router.get('/:set/:file', asyncWrap(async (req, res) => {
   try { buf = await sets.readIcon(req.params.set, req.params.file); }
   catch (e) { return res.status(e.message === 'bad_slug' ? 400 : 404).end(); }
   const ct = req.params.file.endsWith('.svg') ? 'image/svg+xml' : 'image/png';
-  res.set('Content-Type', ct).set('Cache-Control', 'public, max-age=86400').send(buf);
+  // no-cache => browsers/CF revalidate (304 via Express's ETag when unchanged), so
+  // icon updates propagate immediately instead of being stuck for a day. Icons are
+  // tiny, so the revalidation cost is negligible.
+  res.set('Content-Type', ct).set('Cache-Control', 'no-cache').send(buf);
 }));
 
 // POST /api/icon-sets/:set — owner upload: multipart files (incl .zip) and/or { url }.
diff --git a/package-lock.json b/package-lock.json
index c75717c..a113193 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "void-server",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "void-server",
-      "version": "2.5.1",
+      "version": "2.5.2",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
         "@mozilla/readability": "^0.6.0",
diff --git a/package.json b/package.json
index 07da4b3..8a33f8c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "void-server",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "type": "module",
   "private": true,
   "scripts": {
diff --git a/server.js b/server.js
index e17cbc7..c1527b6 100644
--- a/server.js
+++ b/server.js
@@ -15,7 +15,7 @@ import { mcpAuth } from './lib/api/middleware/mcp_auth.js';
 import { handleMcp } from './lib/mcp/http.js';
 import httpProxy from 'http-proxy';
 
-const VERSION = '2.5.1';
+const VERSION = '2.5.2';
 
 // Proxy /terminal (+ its WebSocket) to ttyd on CT 300, so the embedded terminal
 // works whether the Void is reached via Traefik (void2-app.hynesy.com) OR the