no-ui-flash

Prevents incorrect placeholder UI flashes during client-side data resolution in SPA and SSR apps.

Updated Aug 15, 2025
One-click install
npx skills add https://github.com/yehezkieldio/topaz --skill no-ui-flash-yehezkieldio
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: no-ui-flash
Source: https://github.com/yehezkieldio/topaz/tree/main/.agents/skills/no-ui-flash
Command: npx skills add https://github.com/yehezkieldio/topaz --skill no-ui-flash-yehezkieldio

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Client-rendered apps have a window between first paint and the moment client-side data resolves, and filling that window with a placeholder that bets on the wrong outcome produces jarring UI flashes: an app-shell skeleton shown to visitors about to be bounced to login, a results skeleton before "no results found", or a light-theme flash before dark mode loads. ## Core Features & Use Cases - Edge-first state resolution: Gate document navigations at the server/edge using locally verifiable session cookies or JWTs, redirecting signed-out users before any app HTML is served, and serving correct theme or empty-state variants in the initial document. - Optimistic hint cookies: Snapshot server-confirmed state into a non-HttpOnly cookie so the next load paints correctly while the probe is in flight, with strict rules that the hint is never an authority and must be cleared when the underlying state dies. - Redirect-back (returnTo) flows: Carry deep links through OAuth-style login round trips by riding the state parameter, validating returnTo as a same-origin relative path. - Loading-window testing: Hold the timing window open with intercepted and delayed probes (e.g. Playwright page.route), assert what paints during the delay, and verify cookie hygiene via Set-Cookie headers. - Use Case: A user bookmarks a gated dashboard page, logs out in another tab, then revisits the bookmark — apply this Skill to ensure they see a login redirect with a valid returnTo instead of a flash of the authenticated app shell. ## Quick Start Apply the no-ui-flash skill to fix the skeleton flash users see before being redirected to login on my app's dashboard route.

Frequently Asked Questions about no-ui-flash

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I stop the app shell skeleton from flashing before redirecting to login?

Gate document navigations at the edge or server before any app HTML is served. Verify the session cookie or JWT locally, and redirect signed-out users to /login with a returnTo parameter so the wrong shell is never sent to the browser.

How do I prevent a light-theme flash before dark mode loads?

Read the theme preference cookie at the edge and serve the correct variant in the initial HTML, such as a class on the html element. A server-rendered class beats a client-side flip that happens after first paint.

What is an optimistic hint cookie and when should I use one?

A hint cookie is a non-HttpOnly cookie the client writes after the server confirms state, used to seed an optimistic UI on the next load while the probe is in flight. It is a hint, never an authority, and must be cleared whenever the underlying state dies.

How do I test the loading window between first paint and data resolution?

Intercept the probe with a tool like Playwright page.route and delay the response, then assert what is painted during the delay. Also drive the full redirect round trip and assert cookie hygiene through Set-Cookie headers.

How should I validate a returnTo parameter after login redirect?

Validate returnTo as a same-origin relative path: it must start with a single slash, must not start with // (a protocol-relative URL in disguise), and must not point at an API path. Anything else falls back to /, and malformed values decode to no returnTo rather than throwing.

Why does my app still flash the wrong UI after adding edge auth checks?

Common causes are gating non-document requests, leaving invalid cookies in place instead of expiring them, or dropping rotated refresh tokens on the response. Failures inside the edge check should also collapse to the safe state, never a 500.