Merge pull request 'perf(web): cache macro images in local PWA (1.1.2)' (#12) from perf/local-image-cache into main

Same fix as the relay: the local PWA re-fetched every macro image and revoked
the blob on each re-render. Cache image URL -> Promise<objectURL> and reuse
across renders (images are immutable per uuid path); add Cache-Control:
immutable on the desktop /api/image response. Verified in a browser: 7
re-renders produced only the initial 3 image fetches, none repeated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-windows.yml

@@ -0,0 +1,160 @@
+name: Build Windows
+
+# Windows-only build for the self-hosted org runner labelled "windows-latest".
+# Produces dist/macropad.exe as a build artifact, and on a version tag (v*)
+# creates/updates a Gitea release and attaches the exe.
+#
+# Notes for self-hosted Windows runners:
+#  - Uses `shell: powershell` (Windows PowerShell 5.1); `pwsh`/PowerShell 7 is
+#    not assumed to be installed.
+#  - actions/setup-python is avoided (its Windows tool-cache install hangs on
+#    self-hosted runners); Python 3.11 is used if present, else silently
+#    installed per-user.
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  # Fast smoke test so a broken runner fails in seconds, not minutes.
+  preflight:
+    runs-on: windows-latest
+    timeout-minutes: 5
+    steps:
+      - name: Runner check
+        shell: powershell
+        run: |
+          Write-Host "Runner OK on $env:COMPUTERNAME"
+          Write-Host "OS: $([System.Environment]::OSVersion.VersionString)"
+          Write-Host "PowerShell: $($PSVersionTable.PSVersion)"
+          $py = Get-Command py -ErrorAction SilentlyContinue
+          if ($py) { & py -3.11 --version } else { Write-Host "No py launcher; build will self-install Python 3.11." }
+
+  build-windows:
+    needs: [preflight]
+    runs-on: windows-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Ensure Python 3.11
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+          # Persistent, side-effect-free Python for this builder. We use a
+          # standalone CPython from nuget (no registry/PATH changes, idempotent)
+          # cached under LOCALAPPDATA so subsequent runs reuse it. A pre-existing
+          # Python 3.11 on PATH is honoured if present.
+          $pyVersion = "3.11.9"
+          $root      = Join-Path $env:LOCALAPPDATA "MacroPadBuild"
+          $python    = Join-Path $root "python.$pyVersion\tools\python.exe"
+
+          if (-not (Test-Path $python)) {
+            # Honour an existing 3.11 on PATH (e.g. if the VM is pre-provisioned).
+            try {
+              $v = & python --version 2>&1
+              if ($LASTEXITCODE -eq 0 -and "$v" -match '3\.11') {
+                $python = (& python -c "import sys; print(sys.executable)").Trim()
+              }
+            } catch {}
+          }
+
+          if (-not (Test-Path $python)) {
+            Write-Host "Provisioning standalone Python $pyVersion via nuget..."
+            New-Item -ItemType Directory -Force -Path $root | Out-Null
+            $nuget = Join-Path $root "nuget.exe"
+            if (-not (Test-Path $nuget)) {
+              Invoke-WebRequest -UseBasicParsing -Uri "https://dist.nuget.org/win-x86-commandline/latest/nuget.exe" -OutFile $nuget
+            }
+            & $nuget install python -Version $pyVersion -OutputDirectory $root -Source "https://api.nuget.org/v3/index.json" -NonInteractive
+            if ($LASTEXITCODE -ne 0) { throw "nuget install python exited with $LASTEXITCODE" }
+            $python = Join-Path $root "python.$pyVersion\tools\python.exe"
+          }
+
+          if (-not (Test-Path $python)) { throw "Python not found at '$python'" }
+          & $python -m ensurepip --upgrade 2>$null | Out-Null
+          & $python --version
+          # Write to GITHUB_ENV without a BOM (ascii) so the value parses cleanly.
+          Add-Content -Path $env:GITHUB_ENV -Value "PYTHON=$python" -Encoding ascii
+
+      - name: Install dependencies
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+          # Native command failures do NOT trip $ErrorActionPreference, so check
+          # $LASTEXITCODE explicitly — otherwise a broken install ships silently.
+          & $env:PYTHON -m pip install --upgrade pip
+          if ($LASTEXITCODE -ne 0) { throw "pip upgrade failed ($LASTEXITCODE)" }
+          & $env:PYTHON -m pip install -e .
+          if ($LASTEXITCODE -ne 0) { throw "pip install -e . failed ($LASTEXITCODE)" }
+          & $env:PYTHON -m pip install pyinstaller
+          if ($LASTEXITCODE -ne 0) { throw "pip install pyinstaller failed ($LASTEXITCODE)" }
+
+      - name: Verify runtime imports
+        shell: powershell
+        run: |
+          # Fail fast if any runtime dependency is missing before we bundle.
+          & $env:PYTHON -c "import PySide6.QtWidgets, fastapi, uvicorn, aiohttp, PIL, pystray, qrcode, pyautogui, pyperclip, websockets, multipart; print('deps OK')"
+          if ($LASTEXITCODE -ne 0) { throw "dependency import smoke test failed ($LASTEXITCODE)" }
+
+      - name: Build Windows executable
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          & $env:PYTHON -m PyInstaller --noconfirm macropad.spec
+
+      - name: Verify build output
+        shell: powershell
+        run: |
+          if (-not (Test-Path dist/macropad.exe)) {
+            throw "Build failed: dist/macropad.exe not found"
+          }
+          Get-Item dist/macropad.exe | Format-List Name, Length, LastWriteTime
+
+      - name: Upload build artifact
+        # v3 uses the artifact protocol Gitea supports; v4+ requires a backend
+        # Gitea (reported as GHES) does not provide.
+        uses: actions/upload-artifact@v3
+        with:
+          name: macropad-windows
+          path: dist/macropad.exe
+          if-no-files-found: error
+
+      - name: Publish release asset (tags only)
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: powershell
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+          $api  = $env:GITHUB_API_URL
+          $repo = $env:GITHUB_REPOSITORY
+          $tag  = $env:GITHUB_REF_NAME
+          $headers = @{ Authorization = "token $env:GITEA_TOKEN" }
+
+          # Create the release for this tag, or fetch it if it already exists.
+          $body = @{ tag_name = $tag; name = $tag; draft = $false; prerelease = $false } | ConvertTo-Json
+          try {
+            $rel = Invoke-RestMethod -Method Post -Uri "$api/repos/$repo/releases" `
+              -Headers $headers -ContentType 'application/json' -Body $body
+          } catch {
+            $rel = Invoke-RestMethod -Method Get -Uri "$api/repos/$repo/releases/tags/$tag" -Headers $headers
+          }
+
+          # Attach the executable (replace a prior asset of the same name).
+          $existing = $rel.assets | Where-Object { $_.name -eq 'macropad.exe' }
+          if ($existing) {
+            Invoke-RestMethod -Method Delete -Headers $headers `
+              -Uri "$api/repos/$repo/releases/$($rel.id)/assets/$($existing.id)"
+          }
+          Invoke-RestMethod -Method Post -Headers $headers `
+            -Uri "$api/repos/$repo/releases/$($rel.id)/assets?name=macropad.exe" `
+            -InFile dist/macropad.exe -ContentType 'application/octet-stream'
+          Write-Host "Attached macropad.exe to release $tag"

.gitea/workflows/release.yml

@@ -1,159 +0,0 @@
-# =============================================================================
-# WORKFLOW DISABLED - Pending testing of v0.9.0 modernization
-# =============================================================================
-# This workflow is temporarily disabled while testing the new:
-# - PySide6 GUI (replacing Tkinter)
-# - FastAPI web server (replacing Flask)
-# - pyproject.toml build system (replacing requirements.txt)
-# - PWA web interface
-#
-# Uncomment the workflow below once builds are verified locally.
-# =============================================================================
-
-# name: Build and Release
-#
-# on:
-#   push:
-#     branches:
-#       - main
-#
-# jobs:
-#   create-release:
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Checkout code
-#         uses: actions/checkout@v3
-#
-#       - name: Get version
-#         id: get_version
-#         run: |
-#           VERSION=$(cat version.txt)
-#           echo "VERSION=$VERSION" >> $GITHUB_ENV
-#
-#       - name: Create Release
-#         id: create_release
-#         uses: softprops/action-gh-release@v1
-#         with:
-#           tag_name: v${{ env.VERSION }}
-#           name: Release v${{ env.VERSION }}
-#           draft: false
-#           prerelease: false
-#
-#   build-windows:
-#     needs: [create-release]
-#     runs-on: windows-latest
-#     steps:
-#       - name: Checkout code
-#         uses: actions/checkout@v3
-#
-#       - name: Set up Python
-#         uses: actions/setup-python@v4
-#         with:
-#           python-version: '3.11'
-#
-#       - name: Install dependencies
-#         run: |
-#           python -m pip install --upgrade pip
-#           pip install pyinstaller
-#           pip install -e .
-#
-#       - name: Build executable
-#         run: |
-#           pyinstaller macropad.spec
-#
-#       - name: Upload Windows artifact
-#         uses: actions/upload-artifact@v3
-#         with:
-#           name: macropad-windows
-#           path: dist/macropad.exe
-#
-#   build-linux:
-#     needs: [create-release]
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Checkout code
-#         uses: actions/checkout@v3
-#
-#       - name: Set up Python
-#         uses: actions/setup-python@v4
-#         with:
-#           python-version: '3.11'
-#
-#       - name: Install system dependencies
-#         run: |
-#           sudo apt-get update
-#           # PySide6 requirements
-#           sudo apt-get install -y libxcb-xinerama0 libxkbcommon-x11-0 libegl1
-#           # System tray requirements
-#           sudo apt-get install -y libgtk-3-dev python3-gi python3-gi-cairo gir1.2-gtk-3.0
-#           sudo apt-get install -y gir1.2-appindicator3-0.1
-#           sudo apt-get install -y libcairo2-dev libgirepository1.0-dev
-#
-#       - name: Install dependencies
-#         run: |
-#           python -m pip install --upgrade pip
-#           pip install pyinstaller
-#           pip install -e .
-#
-#       - name: Build executable
-#         run: |
-#           pyinstaller macropad_linux.spec
-#
-#       - name: Upload Linux artifact
-#         uses: actions/upload-artifact@v3
-#         with:
-#           name: macropad-linux
-#           path: dist/macropad
-#
-# # MacOS build - requires macos runner
-# #  build-macos:
-# #    needs: [create-release]
-# #    runs-on: macos-latest
-# #    steps:
-# #      - name: Checkout code
-# #        uses: actions/checkout@v3
-# #
-# #      - name: Set up Python
-# #        uses: actions/setup-python@v4
-# #        with:
-# #          python-version: '3.11'
-# #
-# #      - name: Install dependencies
-# #        run: |
-# #          python -m pip install --upgrade pip
-# #          pip install pyinstaller
-# #          pip install -e .
-# #
-# #      - name: Build executable
-# #        run: |
-# #          pyinstaller macropad_macos.spec
-# #
-# #      - name: Upload macOS artifact
-# #        uses: actions/upload-artifact@v3
-# #        with:
-# #          name: macropad-macos
-# #          path: dist/macropad.app
-#
-#   attach-to-release:
-#     needs: [create-release, build-windows, build-linux]
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Checkout code
-#         uses: actions/checkout@v3
-#
-#       - name: Get version
-#         id: get_version
-#         run: |
-#           VERSION=$(cat version.txt)
-#           echo "VERSION=$VERSION" >> $GITHUB_ENV
-#
-#       - name: Download all artifacts
-#         uses: actions/download-artifact@v3
-#
-#       - name: Attach executables to release
-#         uses: softprops/action-gh-release@v1
-#         with:
-#           tag_name: v${{ env.VERSION }}
-#           files: |
-#             macropad-windows/macropad.exe
-#             macropad-linux/macropad

README.md

@@ -39,7 +39,6 @@ A cross-platform macro management application with desktop and web interfaces. C
 - PyAutoGUI (Keyboard automation)
 - Pillow (Image processing)
 - pystray (System tray)
-- netifaces (Network detection)
 - qrcode (QR code generation)
 - aiohttp (Relay server client)
 

config.py

@@ -1,6 +1,6 @@
 # Configuration and constants for MacroPad Server
 
-VERSION = "1.0.0"
+VERSION = "1.1.2"
 DEFAULT_PORT = 40000
 SETTINGS_FILE = "settings.json"
 

gui/main_window.py

@@ -469,19 +469,39 @@ class MainWindow(QMainWindow):
         # QR/copied URL lets a LAN device authenticate against the API.
         token = self.settings_manager.get_web_auth_token()
         token_qs = f"?token={token}" if token else ""
+        ip = self._detect_lan_ip()
+        if ip:
+            self.ip_label.setText(f"http://{ip}:{DEFAULT_PORT}{token_qs}")
+            return
+        self.ip_label.setText(f"http://localhost:{DEFAULT_PORT}{token_qs}")
+
+    @staticmethod
+    def _detect_lan_ip():
+        """Best-effort primary LAN IPv4, with no third-party dependency.
+
+        Uses a UDP socket to discover which local interface would be used to
+        reach the internet (no packets are actually sent), then falls back to
+        resolving the hostname. Returns None if only loopback is available.
+        """
+        import socket
         try:
-            import netifaces
+            s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-            for iface in netifaces.interfaces():
+            try:
-                addrs = netifaces.ifaddresses(iface)
+                s.connect(("8.8.8.8", 80))
-                if netifaces.AF_INET in addrs:
+                ip = s.getsockname()[0]
-                    for addr in addrs[netifaces.AF_INET]:
+            finally:
-                        ip = addr.get('addr', '')
+                s.close()
-                        if ip and not ip.startswith('127.'):
+            if ip and not ip.startswith("127."):
-                            self.ip_label.setText(f"http://{ip}:{DEFAULT_PORT}{token_qs}")
+                return ip
-                            return
         except Exception:
             pass
-        self.ip_label.setText(f"http://localhost:{DEFAULT_PORT}{token_qs}")
+        try:
+            for ip in socket.gethostbyname_ex(socket.gethostname())[2]:
+                if not ip.startswith("127."):
+                    return ip
+        except Exception:
+            pass
+        return None
 
     def copy_url_to_clipboard(self):
         """Copy the web interface URL to clipboard."""

macro_manager.py

@@ -416,15 +416,23 @@ class MacroManager:
 
         elif cmd_type == "app":
             # Launch application.
-            # SECURITY: shell=True was removed to kill shell-metacharacter
+            # SECURITY: never use shell=True — that would allow shell-metacharacter
-            # injection (no ; && | $() chaining). We tokenize the command
+            # injection (; && | $() chaining, redirection). Both branches below run
-            # and exec the program directly without a shell.
+            # without a shell, so the command can only launch a program with args.
             command = cmd.get("command", "")
             if command:
                 try:
-                    args = shlex.split(command, posix=(os.name != "nt"))
+                    if os.name == "nt":
-                    if args:
+                        # Windows: pass the string so CreateProcess parses it
-                        subprocess.Popen(args)
+                        # (correctly handling quoted paths like "C:\Program
+                        # Files\app.exe"). shell=False means no cmd.exe, so no
+                        # metacharacter chaining.
+                        subprocess.Popen(command)
+                    else:
+                        # POSIX: split into an argv list; no shell involved.
+                        args = shlex.split(command)
+                        if args:
+                            subprocess.Popen(args)
                 except Exception as e:
                     print(f"Error launching app command: {e}")
 

macropad-relay/public/app.js

@@ -7,6 +7,11 @@ class MacroPadApp {
         this.tabs = [];
         this.currentTab = 'All';
         this.ws = null;
+        // Cache of image_path -> Promise<objectURL>. Macro images are
+        // content-addressed by uuid filename, so they are immutable: once
+        // fetched, an image never changes for a given path. Caching here avoids
+        // re-fetching every image through the relay on each re-render.
+        this._imageCache = new Map();
         this.desktopConnected = false;
         this.wsAuthenticated = false;
 
@@ -249,35 +254,55 @@ class MacroPadApp {
         this.loadMacroImages();
     }
 
-    // Fetch each macro image with the password header and display it
+    // Fetch each macro image with the password header and display it as a blob
-    // as a blob object URL so the credential never appears in a URL.
+    // object URL so the credential never appears in a URL. Images are fetched
-    async loadMacroImages() {
+    // in parallel and cached (see _imageCache) so re-renders reuse them instead
+    // of re-fetching through the relay each time.
+    loadMacroImages() {
         for (const [id, macro] of Object.entries(this.macros)) {
             if (!macro.image_path) continue;
             const card = document.querySelector(`[data-macro-id="${id}"]`);
             if (!card) continue;
             const img = card.querySelector('.macro-image');
             if (!img) continue;
-
+            this._applyMacroImage(img, macro.image_path);
-            try {
-                const response = await fetch(
-                    `/${this.sessionId}/api/image/${macro.image_path}`,
-                    { headers: this.getApiHeaders() }
-                );
-                if (!response.ok) continue; // keep placeholder
-                const blob = await response.blob();
-                const objectUrl = URL.createObjectURL(blob);
-                img.onload = () => URL.revokeObjectURL(objectUrl);
-                img.src = objectUrl;
-                img.style.display = '';
-                const placeholder = img.nextElementSibling;
-                if (placeholder) placeholder.style.display = 'none';
-            } catch (error) {
-                // Leave the placeholder visible on failure.
-            }
         }
     }
 
+    async _applyMacroImage(img, imagePath) {
+        try {
+            const objectUrl = await this._getImageUrl(imagePath);
+            img.src = objectUrl;
+            img.style.display = '';
+            const placeholder = img.nextElementSibling;
+            if (placeholder) placeholder.style.display = 'none';
+        } catch (error) {
+            // Leave the placeholder visible on failure.
+        }
+    }
+
+    // Returns a cached Promise<objectURL> for an image path, fetching once.
+    // The object URL is retained for the page's lifetime (images are immutable
+    // per path, so there is nothing to invalidate); this de-duplicates
+    // concurrent requests and eliminates re-fetching on re-render.
+    _getImageUrl(imagePath) {
+        let entry = this._imageCache.get(imagePath);
+        if (entry) return entry;
+        entry = (async () => {
+            const response = await fetch(
+                `/${this.sessionId}/api/image/${imagePath}`,
+                { headers: this.getApiHeaders() }
+            );
+            if (!response.ok) throw new Error(`image ${response.status}`);
+            const blob = await response.blob();
+            return URL.createObjectURL(blob);
+        })();
+        // Drop failed fetches from the cache so a later render can retry.
+        entry.catch(() => this._imageCache.delete(imagePath));
+        this._imageCache.set(imagePath, entry);
+        return entry;
+    }
+
     setupEventListeners() {
         document.getElementById('tabs-container').addEventListener('click', (e) => {
             if (e.target.classList.contains('tab')) {

macropad-relay/src/handlers/apiProxy.ts

@@ -49,6 +49,10 @@ export function createApiProxy(
       if (response.body?.base64 && response.body?.contentType) {
         const buffer = Buffer.from(response.body.base64, 'base64');
         res.set('Content-Type', response.body.contentType);
+        // Macro images are content-addressed (uuid filenames) and therefore
+        // immutable, so let the browser cache them aggressively. 'private'
+        // keeps them out of shared proxy caches since they sit behind auth.
+        res.set('Cache-Control', 'private, max-age=31536000, immutable');
         res.send(buffer);
       } else {
         res.status(response.status).json(response.body);

macropad.spec

@@ -45,9 +45,11 @@ a = Analysis(
         'pyautogui',
         'pyperclip',
         'pystray',
-        'netifaces',
         'websockets',
         'multipart',
+        # Relay client (imported lazily in the GUI, so declare explicitly)
+        'relay_client',
+        'aiohttp',
     ],
     hookspath=[],
     hooksconfig={},
@@ -78,5 +80,5 @@ exe = EXE(
     target_arch=None,
     codesign_identity=None,
     entitlements_file=None,
-    icon='Macro Pad.png',
+    icon='Macro Pad.ico',
 )

macropad_linux.spec

@@ -49,7 +49,6 @@ a = Analysis(
         'pyperclip',
         'pystray',
         'pystray._base',
-        'netifaces',
         'websockets',
         'multipart',
         # Linux system tray

macropad_macos.spec

@@ -45,7 +45,6 @@ a = Analysis(
         'pyautogui',
         'pyperclip',
         'pystray',
-        'netifaces',
         'websockets',
         'multipart',
     ],

pyproject.toml

@@ -23,8 +23,6 @@ dependencies = [
     "uvicorn>=0.24.0",
     "websockets>=12.0",
     "python-multipart>=0.0.6",  # For file uploads
-    # Network utilities
-    "netifaces>=0.11.0",
     # QR code generation
     "qrcode>=7.4.2",
     # Desktop GUI

version.txt

@@ -1 +1 @@
-1.0.0
+1.1.2

web/js/app.js

@@ -34,8 +34,10 @@ class MacroPadApp {
         // Guards against out-of-order macro fetches
         this._macroReqId = 0;
 
-        // Blob object URLs created for macro images (revoked on re-render)
+        // Cache of image URL -> Promise<objectURL>. Macro images are
-        this._objectUrls = [];
+        // content-addressed by uuid filename, so they are immutable; caching
+        // avoids re-fetching every image on each re-render.
+        this._imageCache = new Map();
 
         // Set once a local-mode auth failure has been surfaced, to avoid
         // reconnect loops and repeated toasts.
@@ -451,16 +453,12 @@ class MacroPadApp {
         return headers;
     }
 
-    // Fetch a macro image with the auth header and display it as a blob
+    // Fetch a macro image with the auth header and display it as a blob object
-    // object URL, so no credential is ever placed on an <img> src.
+    // URL, so no credential is ever placed on an <img> src. The fetched blob is
+    // cached (images are immutable per URL) and reused across re-renders.
     async loadMacroImage(url, img, placeholder) {
         try {
-            const res = await fetch(url, { headers: this.getAuthHeaders() });
+            const objectUrl = await this._getImageUrl(url);
-            if (!res.ok) throw new Error('image request failed');
-            const blob = await res.blob();
-            const objectUrl = URL.createObjectURL(blob);
-            // Track for best-effort revocation on the next render.
-            this._objectUrls.push(objectUrl);
             img.src = objectUrl;
         } catch (e) {
             // Fall back to the placeholder if the image can't be loaded.
@@ -469,6 +467,23 @@ class MacroPadApp {
         }
     }
 
+    // Returns a cached Promise<objectURL> for an image URL, fetching once and
+    // retaining it for the page's lifetime (immutable content, nothing to
+    // invalidate); de-duplicates concurrent requests too.
+    _getImageUrl(url) {
+        let entry = this._imageCache.get(url);
+        if (entry) return entry;
+        entry = (async () => {
+            const res = await fetch(url, { headers: this.getAuthHeaders() });
+            if (!res.ok) throw new Error('image request failed');
+            const blob = await res.blob();
+            return URL.createObjectURL(blob);
+        })();
+        entry.catch(() => this._imageCache.delete(url));
+        this._imageCache.set(url, entry);
+        return entry;
+    }
+
     // Rendering (safe DOM construction only - no user value reaches innerHTML)
     renderTabs() {
         const container = document.getElementById('tabs-container');
@@ -492,12 +507,6 @@ class MacroPadApp {
         const container = document.getElementById('macro-grid');
         if (!container) return;
 
-        // Best-effort: revoke object URLs from the previous render to avoid leaks.
-        if (this._objectUrls && this._objectUrls.length) {
-            this._objectUrls.forEach((u) => URL.revokeObjectURL(u));
-        }
-        this._objectUrls = [];
-
         container.textContent = '';
 
         const macroEntries = Object.entries(this.macros);

web_server.py

@@ -338,7 +338,11 @@ class WebServer:
             # Only serve files that resolve to inside the macro_images directory
             if (os.path.commonpath([requested, images_real]) == images_real
                     and os.path.isfile(requested)):
-                return FileResponse(requested)
+                # Macro images are content-addressed (uuid filenames) and thus
+                # immutable, so let the browser cache them aggressively.
+                return FileResponse(requested, headers={
+                    "Cache-Control": "private, max-age=31536000, immutable"
+                })
             raise HTTPException(status_code=404, detail="Image not found")
 
         @app.websocket("/ws")