blume 2.0.0 → 2.0.2

package/src/deploy/node-headers.ts

@@ -13,12 +13,13 @@ import {
   SIGNATURES_DIRECTORY_PATH,
   SIGNATURES_DIRECTORY_TYPE,
 } from "../ai/web-bot-auth.ts";
-import { normalizeBasePath } from "../core/base-path.ts";
+import { normalizeBasePath, normalizePath } from "../core/base-path.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
-import { SVG_ASSET_POLICY } from "./headers.ts";
+import { SVG_ASSET_HEADERS, svgAssetPath } from "./headers.ts";
 import { distDir } from "./platforms/paths.ts";
 import type { BuildLog } from "./platforms/types.ts";
+import { platformRedirects } from "./redirects.ts";
 
 /**
  * The response headers the Node standalone server can't set itself. Its static
@@ -29,6 +30,12 @@ import type { BuildLog } from "./platforms/types.ts";
  * (`deploy/headers.ts`) that a Node server has no file to read from. The Markdown
  * and text charsets need no rule here: `send` already adds `charset=UTF-8` to
  * `text/*` types.
+ *
+ * The same wrapper answers the configured redirects. Astro's own handler
+ * honors a redirect's configured status only when its destination resolves
+ * to a discrete route, and Blume serves every page from `[...slug]`, so a
+ * `302` or `307` would go out as a `301` or `308` — permanent redirects that
+ * browsers cache.
  */
 
 /** The headers one exact served path (deployment base included) gets. */
@@ -93,35 +100,130 @@ const patternRules = (
     });
 
 /**
- * The entry that replaces Astro's: it stamps the rules' headers on the
- * response, then hands the request to Astro's handler. `send` leaves a
- * Content-Type that is already set alone, so the registered media type wins.
+ * The configured redirects the wrapper answers, keyed by served path (the
+ * trailing slash trimmed), each to its `Location` and exact status.
+ */
+export type NodeRedirects = Record<string, [string, number]>;
+
+/**
+ * The configured redirects, based the way the host matches them (see
+ * `platformRedirects`) and keyed for the wrapper's lookup, the `Location`
+ * percent-encoded as Astro sends it. A redirect at a content route's own path
+ * is left out: the prerendered page owns that URL, and the static handler
+ * serves it before Astro's redirect ever could.
+ */
+export const nodeRedirects = (project: BlumeProject): NodeRedirects => {
+  const { config } = project;
+  if (config.redirects.length === 0) {
+    return {};
+  }
+  const base = normalizeBasePath(config.deployment.options.base);
+  const pages = new Set(
+    project.manifest.routes.map((route) =>
+      normalizePath(`${base}${route.path}`)
+    )
+  );
+  return Object.fromEntries(
+    platformRedirects(config)
+      .filter((redirect) => !pages.has(normalizePath(redirect.from)))
+      .map((redirect) => [
+        normalizePath(redirect.from),
+        [encodeURI(redirect.to), redirect.status],
+      ])
+  );
+};
+
+/** What the wrapper needs beyond the header rules. */
+export interface NodeEntryOptions {
+  /** `deployment.base`, normalized (`""` at the root). */
+  base?: string;
+  /** The configured redirects, from {@link nodeRedirects}. */
+  redirects?: NodeRedirects;
+}
+
+/**
+ * The entry that replaces Astro's: it answers a configured redirect with its
+ * exact status, and otherwise stamps the rules' headers on the response and
+ * hands the request to Astro's handler. `send` leaves a Content-Type that is
+ * already set alone, so the registered media type wins.
+ *
+ * A rule matches the file the static handler will serve, not the raw URL:
+ * Astro strips the base when it leads the path and serves the rest from the
+ * client directory either way, and `send` decodes and normalizes the path —
+ * so `/docs/blume-assets/a.sv%67`, `/blume-assets/a.svg`, and
+ * `/docs//x/../blume-assets/a.svg` are all the same SVG. The comparison
+ * ignores case, as a case-insensitive disk and `send`'s MIME lookup do.
  *
  * It keeps Astro's contract — the `handler`, `options`, and `startServer`
  * exports `astro preview` and a middleware-mode host import — and its
  * autostart: Astro's entry is imported with autostart off (the env var is read
  * when that module evaluates, so the import has to be dynamic), and the
- * wrapper starts the server itself with its listener in front of Astro's.
+ * wrapper starts the server itself, taking over its request listener so a
+ * redirect is answered before Astro sees the request.
  */
-export const nodeEntryWrapper = (rules: readonly NodeHeaderRule[]): string =>
+export const nodeEntryWrapper = (
+  rules: readonly NodeHeaderRule[],
+  options: NodeEntryOptions = {}
+): string =>
   `${WRAPPER_MARKER}
 // Written by \`blume build\`: Astro's server entry is ./${NODE_ASTRO_ENTRY_FILE}.
-// This wrapper sets the media types and CORS headers of the .well-known
-// discovery files, which the standalone server's static handler can't, then
-// hands every request to Astro.
+// This wrapper answers the configured redirects with their exact status and
+// sets the headers the standalone server's static handler can't (the media
+// types and CORS headers of the .well-known discovery files, the sandbox on
+// downloaded SVGs), then hands every other request to Astro.
+import { posix } from "node:path";
+
+const BASE = ${JSON.stringify(options.base ?? "")};
 const RULES = new Map(${JSON.stringify(exactRules(rules))});
 const PATTERNS = ${JSON.stringify(patternRules(rules))};
+const REDIRECTS = ${JSON.stringify(options.redirects ?? {})};
+const safeDecode = (path) => {
+  try {
+    return decodeURIComponent(path);
+  } catch {
+    return path;
+  }
+};
+const urlPath = (req) => (req.url ?? "").split("#")[0].split("?")[0];
+// The file the static handler serves for a request, spelled with the base.
+const servedPath = (req) => {
+  const path = posix.normalize("/" + safeDecode(urlPath(req)));
+  const rest =
+    BASE && (path === BASE || path.startsWith(BASE + "/"))
+      ? path.slice(BASE.length)
+      : path;
+  return BASE + (rest || "/");
+};
 const applyHeaders = (req, res) => {
-  const path = (req.url ?? "").split("?")[0];
+  const path = servedPath(req);
+  const lower = path.toLowerCase();
   const headers =
     RULES.get(path) ??
-    PATTERNS.find(([prefix, suffix]) => path.startsWith(prefix) && path.endsWith(suffix))?.[2];
+    PATTERNS.find(
+      ([prefix, suffix]) =>
+        lower.startsWith(prefix.toLowerCase()) &&
+        lower.endsWith(suffix.toLowerCase())
+    )?.[2];
   if (headers) {
     for (const [name, value] of Object.entries(headers)) {
       res.setHeader(name, value);
     }
   }
 };
+// Answer a configured redirect with its exact status; Astro's handler would
+// send a 301 (a 308 for other methods) whatever the configured one.
+const answerRedirect = (req, res) => {
+  const path = urlPath(req);
+  const trimmed = path !== "/" && path.endsWith("/") ? path.slice(0, -1) : path;
+  const key = safeDecode(trimmed);
+  if (!Object.hasOwn(REDIRECTS, key)) {
+    return false;
+  }
+  const [location, status] = REDIRECTS[key];
+  res.writeHead(status, { location });
+  res.end();
+  return true;
+};
 const previous = process.env.ASTRO_NODE_AUTOSTART;
 process.env.ASTRO_NODE_AUTOSTART = "disabled";
 const astro = await import("./${NODE_ASTRO_ENTRY_FILE}");
@@ -132,17 +234,30 @@ if (previous === undefined) {
 }
 export const { options } = astro;
 export const handler = (req, res, ...rest) => {
+  if (answerRedirect(req, res)) {
+    return;
+  }
   applyHeaders(req, res);
   return astro.handler(req, res, ...rest);
 };
 export const startServer = () => {
   const started = astro.startServer();
-  // Stamp the headers only where the adapter exposes its HTTP server as
-  // expected; a different shape serves the files without them rather than
-  // failing to start.
+  // Take over the adapter's request listener only where it exposes its HTTP
+  // server as expected; a different shape serves without the headers and
+  // redirect statuses rather than failing to start.
   const httpServer = started?.server?.server;
-  if (typeof httpServer?.prependListener === "function") {
-    httpServer.prependListener("request", applyHeaders);
+  if (typeof httpServer?.listeners === "function") {
+    const astroListeners = httpServer.listeners("request");
+    httpServer.removeAllListeners("request");
+    httpServer.on("request", (req, res) => {
+      if (answerRedirect(req, res)) {
+        return;
+      }
+      applyHeaders(req, res);
+      for (const listener of astroListeners) {
+        listener.call(httpServer, req, res);
+      }
+    });
   }
   return started;
 };
@@ -152,9 +267,9 @@ if (options.mode === "standalone" && previous !== "disabled") {
 `;
 
 /**
- * Put the header wrapper in front of a Node server build's entry. A build
- * with no rule (no API catalog, AI catalog, MCP server, signatures directory,
- * or downloaded content assets) leaves Astro's entry alone.
+ * Put the wrapper in front of a Node server build's entry. A build with no
+ * rule (no API catalog, AI catalog, MCP server, signatures directory, or
+ * downloaded content assets) and no redirect leaves Astro's entry alone.
  */
 export const wrapNodeEntry = async (
   project: BlumeProject,
@@ -169,20 +284,21 @@ export const wrapNodeEntry = async (
     ...(existsSync(assetsDir)
       ? [
           {
-            headers: { "Content-Security-Policy": SVG_ASSET_POLICY },
-            path: `${normalizeBasePath(project.config.deployment.options.base)}/blume-assets/*.svg`,
+            headers: { ...SVG_ASSET_HEADERS },
+            path: svgAssetPath(project.config),
           },
         ]
       : []),
   ];
-  if (rules.length === 0) {
+  const redirects = nodeRedirects(project);
+  if (rules.length === 0 && Object.keys(redirects).length === 0) {
     return;
   }
   const serverDir = join(distDir(project.context), "server");
   const entry = join(serverDir, NODE_ENTRY_FILE);
   if (!existsSync(entry)) {
     log.warn(
-      `Could not find the Node server entry at ${entry}, so the .well-known discovery files are served without their media types and CORS headers.`
+      `Could not find the Node server entry at ${entry}, so the server runs without the headers and redirect statuses Blume sets there.`
     );
     return;
   }
@@ -191,8 +307,13 @@ export const wrapNodeEntry = async (
     return;
   }
   await rename(entry, join(serverDir, NODE_ASTRO_ENTRY_FILE));
-  await writeFile(entry, nodeEntryWrapper(rules), "utf-8");
-  log.success(
-    "Wired the .well-known discovery headers into the Node server entry"
+  await writeFile(
+    entry,
+    nodeEntryWrapper(rules, {
+      base: normalizeBasePath(project.config.deployment.options.base),
+      redirects,
+    }),
+    "utf-8"
   );
+  log.success("Wired headers and redirects into the Node server entry");
 };

package/src/deploy/platforms/cloudflare.ts

@@ -305,6 +305,7 @@ export const cloudflarePlatform: DeployPlatform = {
   },
   kind: "cloudflare",
   negotiatesMarkdown: true,
+  previewDeploy: null,
   readsHeaderFiles: { server: true, static: true },
   redirectFiles: [REDIRECTS_FILE],
   serverOutputDir: distDir,

package/src/deploy/platforms/netlify.ts

@@ -1,14 +1,81 @@
+import { existsSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
+
+import { join } from "pathe";
+
+import { buildHomeLinkHeader } from "../../ai/link-headers.ts";
+import { markdownRoutePaths } from "../../ai/markdown.ts";
+import type { BlumeProject } from "../../core/project-graph.ts";
 import { NETLIFY_ADAPTER_PACKAGE } from "../adapters/netlify.ts";
+import { buildNetlifyConfigHeaders } from "../headers.ts";
+import type { NetlifyConfigHeaders } from "../headers.ts";
 import { buildNetlifyRedirects } from "../redirects.ts";
 import { distDir, toSiteUrl } from "./paths.ts";
-import type { DeployPlatform, RedirectFile } from "./types.ts";
+import type { BuildLog, DeployPlatform, RedirectFile } from "./types.ts";
 
-/** `_redirects`, the format Netlify and Cloudflare Pages/Workers read. */
+/**
+ * `_redirects`, the format Netlify and Cloudflare Pages/Workers read, in the
+ * form both accept: a static build for Cloudflare, or for no named host.
+ */
 export const REDIRECTS_FILE: RedirectFile = {
   build: buildNetlifyRedirects,
   name: "_redirects",
 };
 
+/**
+ * `_redirects` for a `netlify()` static build, every rule forced (`301!`).
+ * Astro writes a redirect page at each `from` (`dist/old/index.html`), and
+ * Netlify serves a file that exists ahead of an unforced rule, so without the
+ * flag that page would answer with a 200 instead of the redirect.
+ */
+export const NETLIFY_REDIRECTS_FILE: RedirectFile = {
+  build: (redirects) => buildNetlifyRedirects(redirects, true),
+  name: "_redirects",
+};
+
+/** The Frameworks API config, once the build surfaced it to the project root. */
+export const NETLIFY_CONFIG_FILE = join(".netlify", "v1", "config.json");
+
+/**
+ * Carry the static header rules into a server build. A static `netlify()`
+ * build gets them from `_headers` (see `deploy/artifacts.ts`), but a server
+ * build's header rules go in the Frameworks API config the adapter writes
+ * (`.netlify/v1/config.json`, beside its own `Cache-Control` rule for
+ * `/_astro/*`), which follows the same rules as `netlify.toml`'s
+ * `[[headers]]`: the charset on the raw Markdown and text files, the homepage
+ * `Link` header, the discovery files' media types and CORS header, and the
+ * sandbox on downloaded SVGs, which Netlify serves from the publish directory
+ * as static files, so the prerendered endpoint's own headers never ship.
+ */
+export const emitNetlifyHeaders = async (
+  project: BlumeProject,
+  log: BuildLog
+): Promise<void> => {
+  const { config, context } = project;
+  const configPath = join(context.root, NETLIFY_CONFIG_FILE);
+  if (!existsSync(configPath)) {
+    log.warn(
+      `Could not find Netlify's deploy config at ${configPath}, so the site is served without its header rules (the homepage Link header, the discovery files' media types and CORS header, and the sandbox on downloaded SVGs).`
+    );
+    return;
+  }
+  // Only `headers` is read; every other key rides through as parsed.
+  const frameworks: { headers?: NetlifyConfigHeaders[] } = JSON.parse(
+    await readFile(configPath, "utf-8")
+  );
+  const ours = buildNetlifyConfigHeaders(
+    config,
+    buildHomeLinkHeader(config, markdownRoutePaths(project))
+  );
+  // A second pass over the same build replaces its own entries.
+  const paths = new Set(ours.map((entry) => entry.for));
+  frameworks.headers = [
+    ...(frameworks.headers ?? []).filter((entry) => !paths.has(entry.for)),
+    ...ours,
+  ];
+  await writeFile(configPath, JSON.stringify(frameworks), "utf-8");
+};
+
 /**
  * Netlify. A server build runs on Netlify Functions from the Frameworks API
  * tree the adapter writes to `.netlify/v1`, relative to the Astro root —
@@ -34,7 +101,14 @@ export const netlifyPlatform: DeployPlatform = {
       toSiteUrl(env.DEPLOY_PRIME_URL) ??
       toSiteUrl(env.DEPLOY_URL),
   },
-  finalizeBuild: null,
+  finalizeBuild: async ({ isolated, log, project }) => {
+    // The Frameworks API config is a deploy artifact; an isolated verify
+    // never surfaces it.
+    if (!isolated) {
+      await emitNetlifyHeaders(project, log);
+    }
+    return true;
+  },
   hiddenRuntime: {
     ignoreDir: ".netlify/",
     showProjectRoot: false,
@@ -42,11 +116,14 @@ export const netlifyPlatform: DeployPlatform = {
   },
   kind: "netlify",
   negotiatesMarkdown: false,
+  // @astrojs/netlify declares no preview entrypoint.
+  previewDeploy: "netlify deploy",
   // Netlify reads `_headers` from the publish directory of a static deploy.
   // A server build's static assets ride the Frameworks API tree instead,
-  // where the file has never been applied.
+  // where the file has never been applied, so `finalizeBuild` writes the
+  // same rules into that tree's config.
   readsHeaderFiles: { server: false, static: true },
-  redirectFiles: [REDIRECTS_FILE],
+  redirectFiles: [NETLIFY_REDIRECTS_FILE],
   serverOutputDir: distDir,
   serverStaticDir: distDir,
 };

package/src/deploy/platforms/node.ts

@@ -6,11 +6,12 @@ import type { DeployPlatform } from "./types.ts";
 /**
  * A self-hosted Node server. The standalone server in `dist/server` serves
  * `dist/client` through its own static handler, which has no `_headers` or
- * `_redirects` support — redirects are answered at request time from the
- * Astro config, and a header file written there would be inert. The headers
- * the discovery files need come from a wrapper around the server entry
- * instead (`deploy/node-headers.ts`). No platform env to detect: the site URL
- * has to be configured.
+ * `_redirects` support, so a file written there would be inert. A wrapper
+ * around the server entry (`deploy/node-headers.ts`) sets the headers the
+ * discovery files and downloaded SVGs need instead, and answers the
+ * configured redirects with their exact status, which Astro's own handler
+ * would default to 301 or 308. No platform env to detect: the site URL has to
+ * be configured.
  */
 export const nodePlatform: DeployPlatform = {
   astro: {
@@ -33,6 +34,7 @@ export const nodePlatform: DeployPlatform = {
   },
   kind: "node",
   negotiatesMarkdown: false,
+  previewDeploy: null,
   readsHeaderFiles: { server: false, static: false },
   redirectFiles: [],
   serverOutputDir: distDir,

package/src/deploy/platforms/static.ts

@@ -22,6 +22,7 @@ export const staticPlatform: DeployPlatform = {
   },
   kind: "static",
   negotiatesMarkdown: false,
+  previewDeploy: null,
   readsHeaderFiles: { server: false, static: true },
   redirectFiles: [REDIRECTS_FILE, VERCEL_JSON_FILE],
   serverOutputDir: distDir,

package/src/deploy/platforms/types.ts

@@ -98,6 +98,13 @@ export interface DeployPlatform {
   kind: DeployAdapterKind;
   /** Whether a server build honors `Accept: text/markdown` at the content URLs. */
   negotiatesMarkdown: boolean;
+  /**
+   * The host CLI command that deploys a preview, for a platform whose
+   * `@astrojs/*` adapter has no local preview server: Astro's `preview`
+   * throws for its server build, so `blume preview` points here instead. Null
+   * when the adapter can preview a server build locally, or there is none.
+   */
+  previewDeploy: string | null;
   /**
    * Whether the platform applies a `_headers` file to the static assets it
    * serves, per output mode.

package/src/deploy/platforms/vercel.ts

@@ -124,7 +124,10 @@ export const emitVercelNegotiation = async (
       json: existsSync(join(staticDir, "404.json")),
       markdown: existsSync(join(staticDir, "404.md")),
     },
-    crossOriginDiscoveryPaths(config)
+    crossOriginDiscoveryPaths(config),
+    // Downloaded content assets are prerendered static files; only a build
+    // that has them needs the SVG sandbox route.
+    existsSync(join(staticDir, "blume-assets"))
   );
   if (injected === null) {
     log.warn(
@@ -144,8 +147,9 @@ export const emitVercelNegotiation = async (
  * `@vercel/nft` dependency trace is rooted there too, and tracing from the
  * hidden runtime silently drops the function's chunks and `node_modules`.
  * Static assets are served from the tree's `static/` half, so the deploy
- * artifacts are written there; headers arrive through the routing config
- * rather than a `_headers` file, which Vercel never reads.
+ * artifacts are written there; headers (the discovery files', the sandbox on
+ * downloaded SVGs) arrive through the routing config rather than a
+ * `_headers` file, which Vercel never reads.
  */
 export const vercelPlatform: DeployPlatform = {
   astro: {
@@ -186,6 +190,8 @@ export const vercelPlatform: DeployPlatform = {
   },
   kind: "vercel",
   negotiatesMarkdown: true,
+  // @astrojs/vercel declares no preview entrypoint.
+  previewDeploy: "vercel deploy",
   readsHeaderFiles: { server: false, static: false },
   redirectFiles: [VERCEL_JSON_FILE],
   serverOutputDir: buildOutputDir,

package/src/deploy/redirects.ts

@@ -82,10 +82,21 @@ export const platformRedirects = (config: ResolvedConfig): Redirect[] =>
     config.deployment.options.base ?? ""
   );
 
-/** `_redirects` text (Netlify + Cloudflare Pages): `from to status` per line. */
-export const buildNetlifyRedirects = (redirects: Redirect[]): string =>
+/**
+ * `_redirects` text (Netlify + Cloudflare Pages): `from to status` per line.
+ * `force` appends Netlify's `!` to each status (`301!`), so the rule wins over
+ * the redirect page Astro writes at `from`; Cloudflare, which always applies
+ * its rules first, rejects a line carrying it.
+ */
+export const buildNetlifyRedirects = (
+  redirects: Redirect[],
+  force = false
+): string =>
   `${redirects
-    .map((redirect) => `${redirect.from} ${redirect.to} ${redirect.status}`)
+    .map(
+      (redirect) =>
+        `${redirect.from} ${redirect.to} ${redirect.status}${force ? "!" : ""}`
+    )
     .join("\n")}\n`;
 
 /** The `vercel.json` Blume writes for a static deploy of `dist/`. */

package/src/deploy/vercel-negotiation.ts

@@ -16,6 +16,8 @@
  * prerendered problem-details 404.
  */
 
+import { SVG_ASSET_HEADERS } from "./headers.ts";
+
 /**
  * Regex for the `accept` header condition. Written to hold under both matching
  * semantics a router may apply — full-string and substring — by anchoring the
@@ -248,6 +250,30 @@ const corsRoute = (path: string): VercelRoute => ({
   src: `^${routePattern(path)}$`,
 });
 
+/**
+ * The `src` of the route stamping the content-source SVG headers: every `.svg`
+ * under `/blume-assets/`. The adapter copies the static files into the Build
+ * Output tree without the deployment base, like every path matched here.
+ */
+const SVG_ASSET_SRC = String.raw`^/blume-assets/.+\.svg$`;
+
+/**
+ * A main-phase `continue` route stamping the sandbox headers
+ * (`deploy/headers.ts`) on a downloaded SVG, which Vercel serves from the
+ * static layer — where the prerendered asset endpoint's own headers never
+ * reach.
+ */
+const svgAssetRoute = (): VercelRoute => ({
+  continue: true,
+  headers: Object.fromEntries(
+    Object.entries(SVG_ASSET_HEADERS).map(([name, value]) => [
+      name.toLowerCase(),
+      value,
+    ])
+  ),
+  src: SVG_ASSET_SRC,
+});
+
 /** Whether a route is a `corsRoute` — the same three-field shape test as the others. */
 const isCorsRoute = (route: VercelRoute): boolean =>
   route.continue === true &&
@@ -279,7 +305,8 @@ const isNegotiationRoute = (route: VercelRoute): boolean =>
     isString(route.headers?.link) &&
     route.src === HOME_SRC &&
     Object.keys(route).length === 3) ||
-  isCorsRoute(route);
+  isCorsRoute(route) ||
+  (route.continue === true && route.src === SVG_ASSET_SRC);
 
 /**
  * Splice the negotiation routes into a Build Output `config.json`, plus — when
@@ -297,7 +324,8 @@ const isNegotiationRoute = (route: VercelRoute): boolean =>
  * `404.md`, `notFound.json` for `404.json`), its routes go into the miss
  * phase right before the adapter's `/404.html` fallback — and nowhere when
  * that fallback is absent, since a `dest` with no file behind it would serve
- * nothing. Returns the updated JSON
+ * nothing. With `svgAssets`, a main-phase route also sandboxes the SVGs a
+ * content source downloaded (see {@link svgAssetRoute}). Returns the updated JSON
  * text (tab-indented, like the adapter's own output), or `null` when there is
  * nowhere safe to splice: an unparsable config, no `routes` array, or no
  * `handle: "filesystem"` marker to anchor the splice.
@@ -309,7 +337,8 @@ export const injectNegotiationRoutes = (
   contentTypeOverrides?: Record<string, string>,
   homeTokens?: number,
   notFound: NotFoundVariants = {},
-  corsPaths: readonly string[] = []
+  corsPaths: readonly string[] = [],
+  svgAssets = false
 ): string | null => {
   const overrideEntries = Object.entries(contentTypeOverrides ?? {});
   let config: {
@@ -348,6 +377,9 @@ export const injectNegotiationRoutes = (
     });
   }
   headerRoutes.push(...corsPaths.map(corsRoute));
+  if (svgAssets) {
+    headerRoutes.push(svgAssetRoute());
+  }
   // Headers first: `continue` routes accumulate, so a request the rewrite
   // route then terminates (Markdown negotiation on the homepage) still carries
   // the Link header.

package/src/eval/agents.ts

@@ -124,6 +124,14 @@ export const runAgentHeadless = (
       }
     });
 
+    // An agent that exits before reading the whole prompt (it rejected a flag,
+    // say) closes the pipe mid-write, and the resulting EPIPE would otherwise
+    // be an uncaught exception that aborts the run. The exit itself is the
+    // outcome: `close` resolves with the agent's code and stderr, which
+    // `readAgentOutput` reports.
+    child.stdin?.on("error", () => {
+      // Deliberately ignored — see above.
+    });
     child.stdin?.end(options.prompt);
   });
 
@@ -208,7 +216,7 @@ const claudeArgs = (context: InvocationContext): string[] => {
 
 /**
  * Codex config overrides that leave an eval run nothing but its prompt and the
- * docs MCP tools. `--sandbox read-only` blocks writes and the network but still
+ * docs MCP tools (and a `blume translate` run nothing but its prompt). `--sandbox read-only` blocks writes and the network but still
  * lets the shell tool read any file the user can, and the docs a reader
  * searches — or the answer a judge grades — can come from a remote source, so
  * an instruction planted there could otherwise pull a local secret into the
@@ -216,7 +224,7 @@ const claudeArgs = (context: InvocationContext): string[] => {
  * local-image tool off, and any subprocess started with no inherited
  * environment, there is nothing on the machine for a run to read.
  */
-const CODEX_LOCKDOWN = [
+export const CODEX_LOCKDOWN = [
   "-c",
   "features.shell_tool=false",
   "-c",

package/src/eval/run.ts

@@ -181,6 +181,31 @@ const runQuestion = async (
   };
 };
 
+/** The findings a missed question produces: failed, or its agent run errored. */
+const MISS_CODES: ReadonlySet<string> = new Set([
+  "BLUME_EVAL_QUESTION_ERROR",
+  "BLUME_EVAL_QUESTION_FAILED",
+]);
+
+/**
+ * The fraction of run (non-skipped) questions that pass the CI gate. A miss on
+ * a `severity: warning` question is reported as a warning and never counts
+ * against the gate — each miss's finding carries its question's severity, so
+ * the gate reads the same findings the JSON summary counts, and the exit code
+ * can't disagree with the summary's error total.
+ */
+export const passFraction = (result: EvalResult): number => {
+  const ran = result.results.length - result.counts.skip;
+  if (ran === 0) {
+    return 1;
+  }
+  const misses = result.diagnostics.filter(
+    (diagnostic) =>
+      MISS_CODES.has(diagnostic.code) && diagnostic.severity === "error"
+  ).length;
+  return (ran - misses) / ran;
+};
+
 /**
  * Run every question through the reader/judge pair, sequentially: each
  * question is already two agent sessions, and a serial run keeps progress