feature: Performance improvements

server/package.json

@@ -16,11 +16,12 @@
     "lint": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
+    "@fastify/compress": "^9.2.0",
     "@fastify/cookie": "^11.1.2",
-    "@fastify/static": "^10.1.2",
     "@fastify/csrf-protection": "^8.0.1",
     "@fastify/redis": "^8.0.0",
     "@fastify/reply-from": "^12.6.4",
+    "@fastify/static": "^10.1.2",
     "fastify": "^5.11.2",
     "fastify-plugin": "^6.0.0",
     "ioredis": "^5.11.1",

server/src/index.ts

@@ -10,6 +10,7 @@
 import Fastify from "fastify";
 
 import { config } from "./config.js";
+import compressPlugin from "./plugins/compress.js";
 import cookiePlugin from "./plugins/cookie.js";
 import csrfPlugin from "./plugins/csrf.js";
 import redisPlugin from "./plugins/redis.js";
@@ -30,6 +31,7 @@ await fastify.register(cookiePlugin);
 await fastify.register(redisPlugin);
 await fastify.register(sessionPlugin);
 await fastify.register(csrfPlugin);
+await fastify.register(compressPlugin);
 await fastify.register(staticPlugin);
 
 fastify.get("/healthz", async () => ({ ok: true }));

server/src/plugins/compress.ts

@@ -0,0 +1,23 @@
+// Location: ./client/server/src/plugins/compress.ts
+// Copyright contributors to the MCP-CONTEXT-FORGE project
+// SPDX-License-Identifier: Apache-2.0
+//
+// Global response compression (brotli > gzip > deflate, by Accept-Encoding).
+// Must be registered before staticPlugin — @fastify/compress's global hook
+// only wraps replies from routes registered after it. SSE routes are exempt
+// automatically: proxy-sse.ts calls reply.hijack(), which skips the onSend
+// chain this plugin hooks into.
+//
+// globalDecompression: false — { global: true } alone also auto-decompresses
+// request bodies fleet-wide (undocumented decompression-bomb surface).
+
+import fastifyCompress from "@fastify/compress";
+import type { FastifyInstance } from "fastify";
+import fp from "fastify-plugin";
+
+export default fp(
+  async function compressPlugin(fastify: FastifyInstance) {
+    await fastify.register(fastifyCompress, { global: true, globalDecompression: false });
+  },
+  { name: "compressPlugin" },
+);

server/src/plugins/static.ts

@@ -26,12 +26,31 @@ import { config } from "../config.js";
 const DEFAULT_PUBLIC_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../../public");
 const PUBLIC_DIR = config.publicDir ?? DEFAULT_PUBLIC_DIR;
 
+// The one place both the cache-header check below and the 404 handler's
+// asset allowlist agree on what "an asset" is — keep them pointed at the
+// same name so they can't drift, and keep it in sync with vite.config.ts's
+// outDir contents and the root public/ dir it copies verbatim.
+const ASSETS_DIR_NAME = "assets";
+const ASSETS_URL_PREFIX = `/${ASSETS_DIR_NAME}/`;
+// Prefix, not substring: PUBLIC_DIR is deploy-configurable (PUBLIC_DIR env
+// var), so a bare `pathName.includes("/assets/")` would false-positive on
+// index.html for any deploy path with an "assets" *ancestor* directory
+// (e.g. PUBLIC_DIR=/srv/assets/server/public) — long-caching the SPA shell
+// itself instead of only PUBLIC_DIR/assets/*.
+const ASSETS_FS_PREFIX = path.join(PUBLIC_DIR, ASSETS_DIR_NAME) + path.sep;
+
 export default fp(
   async function staticPlugin(fastify: FastifyInstance) {
     await fastify.register(fastifyStatic, {
       root: PUBLIC_DIR,
       prefix: "/",
       index: false, // '/' is handled explicitly by routes/app.ts, for the auth check
+      // Only /assets/* is content-hashed by Vite, so only it gets long-cached.
+      setHeaders(reply, pathName) {
+        if (pathName.startsWith(ASSETS_FS_PREFIX)) {
+          reply.header("Cache-Control", "public, max-age=31536000, immutable");
+        }
+      },
     });
 
     fastify.setNotFoundHandler((request: FastifyRequest, reply: FastifyReply) => {
@@ -42,9 +61,8 @@ export default fp(
       // /app/reset-password/:token when the token itself contains a dot.
       // Anything under these prefixes that reaches here is a genuinely
       // missing build artifact; everything else is a client-router path and
-      // gets the SPA shell. Keep in sync with vite.config.ts's outDir
-      // contents and the root public/ dir it copies verbatim.
-      const isKnownAssetPath = pathname.startsWith("/assets/") || pathname === "/favicon.ico";
+      // gets the SPA shell.
+      const isKnownAssetPath = pathname.startsWith(ASSETS_URL_PREFIX) || pathname === "/favicon.ico";
 
       if (
         request.method !== "GET" ||