blume 2.0.1 → 2.0.3

package/src/deploy/platforms/netlify.ts

@@ -1,14 +1,81 @@
+import { existsSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
+
+import { join } from "pathe";
+
+import { buildHomeLinkHeader } from "../../ai/link-headers.ts";
+import { markdownRoutePaths } from "../../ai/markdown.ts";
+import type { BlumeProject } from "../../core/project-graph.ts";
 import { NETLIFY_ADAPTER_PACKAGE } from "../adapters/netlify.ts";
+import { buildNetlifyConfigHeaders } from "../headers.ts";
+import type { NetlifyConfigHeaders } from "../headers.ts";
 import { buildNetlifyRedirects } from "../redirects.ts";
 import { distDir, toSiteUrl } from "./paths.ts";
-import type { DeployPlatform, RedirectFile } from "./types.ts";
+import type { BuildLog, DeployPlatform, RedirectFile } from "./types.ts";
 
-/** `_redirects`, the format Netlify and Cloudflare Pages/Workers read. */
+/**
+ * `_redirects`, the format Netlify and Cloudflare Pages/Workers read, in the
+ * form both accept: a static build for Cloudflare, or for no named host.
+ */
 export const REDIRECTS_FILE: RedirectFile = {
   build: buildNetlifyRedirects,
   name: "_redirects",
 };
 
+/**
+ * `_redirects` for a `netlify()` static build, every rule forced (`301!`).
+ * Astro writes a redirect page at each `from` (`dist/old/index.html`), and
+ * Netlify serves a file that exists ahead of an unforced rule, so without the
+ * flag that page would answer with a 200 instead of the redirect.
+ */
+export const NETLIFY_REDIRECTS_FILE: RedirectFile = {
+  build: (redirects) => buildNetlifyRedirects(redirects, true),
+  name: "_redirects",
+};
+
+/** The Frameworks API config, once the build surfaced it to the project root. */
+export const NETLIFY_CONFIG_FILE = join(".netlify", "v1", "config.json");
+
+/**
+ * Carry the static header rules into a server build. A static `netlify()`
+ * build gets them from `_headers` (see `deploy/artifacts.ts`), but a server
+ * build's header rules go in the Frameworks API config the adapter writes
+ * (`.netlify/v1/config.json`, beside its own `Cache-Control` rule for
+ * `/_astro/*`), which follows the same rules as `netlify.toml`'s
+ * `[[headers]]`: the charset on the raw Markdown and text files, the homepage
+ * `Link` header, the discovery files' media types and CORS header, and the
+ * sandbox on downloaded SVGs, which Netlify serves from the publish directory
+ * as static files, so the prerendered endpoint's own headers never ship.
+ */
+export const emitNetlifyHeaders = async (
+  project: BlumeProject,
+  log: BuildLog
+): Promise<void> => {
+  const { config, context } = project;
+  const configPath = join(context.root, NETLIFY_CONFIG_FILE);
+  if (!existsSync(configPath)) {
+    log.warn(
+      `Could not find Netlify's deploy config at ${configPath}, so the site is served without its header rules (the homepage Link header, the discovery files' media types and CORS header, and the sandbox on downloaded SVGs).`
+    );
+    return;
+  }
+  // Only `headers` is read; every other key rides through as parsed.
+  const frameworks: { headers?: NetlifyConfigHeaders[] } = JSON.parse(
+    await readFile(configPath, "utf-8")
+  );
+  const ours = buildNetlifyConfigHeaders(
+    config,
+    buildHomeLinkHeader(config, markdownRoutePaths(project))
+  );
+  // A second pass over the same build replaces its own entries.
+  const paths = new Set(ours.map((entry) => entry.for));
+  frameworks.headers = [
+    ...(frameworks.headers ?? []).filter((entry) => !paths.has(entry.for)),
+    ...ours,
+  ];
+  await writeFile(configPath, JSON.stringify(frameworks), "utf-8");
+};
+
 /**
  * Netlify. A server build runs on Netlify Functions from the Frameworks API
  * tree the adapter writes to `.netlify/v1`, relative to the Astro root —
@@ -34,7 +101,14 @@ export const netlifyPlatform: DeployPlatform = {
       toSiteUrl(env.DEPLOY_PRIME_URL) ??
       toSiteUrl(env.DEPLOY_URL),
   },
-  finalizeBuild: null,
+  finalizeBuild: async ({ isolated, log, project }) => {
+    // The Frameworks API config is a deploy artifact; an isolated verify
+    // never surfaces it.
+    if (!isolated) {
+      await emitNetlifyHeaders(project, log);
+    }
+    return true;
+  },
   hiddenRuntime: {
     ignoreDir: ".netlify/",
     showProjectRoot: false,
@@ -42,11 +116,15 @@ export const netlifyPlatform: DeployPlatform = {
   },
   kind: "netlify",
   negotiatesMarkdown: false,
+  // @astrojs/netlify declares no preview entrypoint.
+  previewDeploy: "netlify deploy",
   // Netlify reads `_headers` from the publish directory of a static deploy.
   // A server build's static assets ride the Frameworks API tree instead,
-  // where the file has never been applied.
+  // where the file has never been applied, so `finalizeBuild` writes the
+  // same rules into that tree's config.
   readsHeaderFiles: { server: false, static: true },
-  redirectFiles: [REDIRECTS_FILE],
+  redirectFiles: [NETLIFY_REDIRECTS_FILE],
+  serverClientUnderBase: false,
   serverOutputDir: distDir,
   serverStaticDir: distDir,
 };

package/src/deploy/platforms/node.ts

@@ -6,11 +6,12 @@ import type { DeployPlatform } from "./types.ts";
 /**
  * A self-hosted Node server. The standalone server in `dist/server` serves
  * `dist/client` through its own static handler, which has no `_headers` or
- * `_redirects` support — redirects are answered at request time from the
- * Astro config, and a header file written there would be inert. The headers
- * the discovery files need come from a wrapper around the server entry
- * instead (`deploy/node-headers.ts`). No platform env to detect: the site URL
- * has to be configured.
+ * `_redirects` support, so a file written there would be inert. A wrapper
+ * around the server entry (`deploy/node-headers.ts`) sets the headers the
+ * discovery files and downloaded SVGs need instead, and answers the
+ * configured redirects with their exact status, which Astro's own handler
+ * would default to 301 or 308. No platform env to detect: the site URL has to
+ * be configured.
  */
 export const nodePlatform: DeployPlatform = {
   astro: {
@@ -33,8 +34,10 @@ export const nodePlatform: DeployPlatform = {
   },
   kind: "node",
   negotiatesMarkdown: false,
+  previewDeploy: null,
   readsHeaderFiles: { server: false, static: false },
   redirectFiles: [],
+  serverClientUnderBase: false,
   serverOutputDir: distDir,
   serverStaticDir: clientDir,
 };

package/src/deploy/platforms/static.ts

@@ -22,8 +22,10 @@ export const staticPlatform: DeployPlatform = {
   },
   kind: "static",
   negotiatesMarkdown: false,
+  previewDeploy: null,
   readsHeaderFiles: { server: false, static: true },
   redirectFiles: [REDIRECTS_FILE, VERCEL_JSON_FILE],
+  serverClientUnderBase: false,
   serverOutputDir: distDir,
   serverStaticDir: distDir,
 };

package/src/deploy/platforms/types.ts

@@ -98,6 +98,13 @@ export interface DeployPlatform {
   kind: DeployAdapterKind;
   /** Whether a server build honors `Accept: text/markdown` at the content URLs. */
   negotiatesMarkdown: boolean;
+  /**
+   * The host CLI command that deploys a preview, for a platform whose
+   * `@astrojs/*` adapter has no local preview server: Astro's `preview`
+   * throws for its server build, so `blume preview` points here instead. Null
+   * when the adapter can preview a server build locally, or there is none.
+   */
+  previewDeploy: string | null;
   /**
    * Whether the platform applies a `_headers` file to the static assets it
    * serves, per output mode.
@@ -105,6 +112,14 @@ export interface DeployPlatform {
   readsHeaderFiles: Record<DeployOutput, boolean>;
   /** The redirect files a static build writes, beside the manifest. */
   redirectFiles: RedirectFile[];
+  /**
+   * Whether the adapter moves a server build's client output under
+   * `deployment.base` (`dist/client/<base>/`, the directory Astro then hands
+   * `astro:build:done`) while the platform keeps serving `serverStaticDir`
+   * as the assets root. The files the platform reads there, like `_headers`,
+   * belong above the directory Astro reports.
+   */
+  serverClientUnderBase: boolean;
   /** Where a server build's deploy bundle lands. */
   serverOutputDir: (context: ProjectContext) => string;
   /** The directory a server build serves as static files. */

package/src/deploy/platforms/vercel.ts

@@ -124,7 +124,10 @@ export const emitVercelNegotiation = async (
       json: existsSync(join(staticDir, "404.json")),
       markdown: existsSync(join(staticDir, "404.md")),
     },
-    crossOriginDiscoveryPaths(config)
+    crossOriginDiscoveryPaths(config),
+    // Downloaded content assets are prerendered static files; only a build
+    // that has them needs the SVG sandbox route.
+    existsSync(join(staticDir, "blume-assets"))
   );
   if (injected === null) {
     log.warn(
@@ -144,8 +147,9 @@ export const emitVercelNegotiation = async (
  * `@vercel/nft` dependency trace is rooted there too, and tracing from the
  * hidden runtime silently drops the function's chunks and `node_modules`.
  * Static assets are served from the tree's `static/` half, so the deploy
- * artifacts are written there; headers arrive through the routing config
- * rather than a `_headers` file, which Vercel never reads.
+ * artifacts are written there; headers (the discovery files', the sandbox on
+ * downloaded SVGs) arrive through the routing config rather than a
+ * `_headers` file, which Vercel never reads.
  */
 export const vercelPlatform: DeployPlatform = {
   astro: {
@@ -186,8 +190,11 @@ export const vercelPlatform: DeployPlatform = {
   },
   kind: "vercel",
   negotiatesMarkdown: true,
+  // @astrojs/vercel declares no preview entrypoint.
+  previewDeploy: "vercel deploy",
   readsHeaderFiles: { server: false, static: false },
   redirectFiles: [VERCEL_JSON_FILE],
+  serverClientUnderBase: false,
   serverOutputDir: buildOutputDir,
   serverStaticDir: (context) => join(buildOutputDir(context), "static"),
 };

package/src/deploy/redirects.ts

@@ -1,9 +1,14 @@
 import {
   normalizeBasePath,
+  withAuthoredBasePath,
   withBasePath,
   withComposedBasePath,
 } from "../core/base-path.ts";
+import { routeSetFor, servesRoute } from "../core/locale-links.ts";
+import type { RouteSet } from "../core/locale-links.ts";
+import type { BlumeProject } from "../core/project-graph.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
+import { escapeVercelSource } from "./headers.ts";
 import type { VercelHeader } from "./headers.ts";
 
 /**
@@ -16,6 +21,23 @@ import type { VercelHeader } from "./headers.ts";
 
 type Redirect = ResolvedConfig["redirects"][number];
 
+/**
+ * Base a redirect destination authored as if mounted at root by what it
+ * names (see `withAuthoredBasePath`): a page gains the full
+ * `{deployment.base}{basePath}` stack, a public file (`/files/spec.pdf`, with
+ * no page in `routes`) only the deployment base — `public/` is served there
+ * whatever `basePath` is. External URLs pass through.
+ */
+const baseRedirectTarget = (
+  to: string,
+  basePath: string,
+  base: string,
+  routes: RouteSet
+): string =>
+  withAuthoredBasePath(base, basePath, to, (route) =>
+    servesRoute(routes, route)
+  );
+
 /**
  * Base a redirect for Astro's `redirects` config, where the two sides are not
  * symmetric:
@@ -23,19 +45,23 @@ type Redirect = ResolvedConfig["redirects"][number];
  * - `from` gains only `basePath`. Astro builds the match pattern with
  *   `deployment.base` already applied (`getPattern(segments, config.base)`), so
  *   adding it here would serve the redirect at `{base}{base}/from`.
- * - `to` gains the full `{deployment.base}{basePath}` stack. Astro resolves a
- *   destination that matches a known route by regenerating it from that route's
- *   segments, which carry no base — and passes an unmatched destination through
- *   verbatim. Neither path prepends `base`, so a root-relative `to` escapes the
- *   base entirely (withastro/astro#7774, still the behavior in Astro 7).
+ * - `to` gains the full `{deployment.base}{basePath}` stack, or the deployment
+ *   base alone for a public file (see {@link baseRedirectTarget}). Astro
+ *   resolves a destination that matches a known route by regenerating it from
+ *   that route's segments, which carry no base — and passes an unmatched
+ *   destination through verbatim. Neither path prepends `base`, so a
+ *   root-relative `to` escapes the base entirely (withastro/astro#7774, still
+ *   the behavior in Astro 7).
  *
- * Both sides are authored as if mounted at root; external `to` URLs pass
- * through. Idempotent, so a hand-written base isn't doubled.
+ * Both sides are authored as if mounted at root; `routes` (the served page
+ * routes, carrying `basePath`) tell a dotted page route like `/releases/v1.2`
+ * from a file. Idempotent, so a hand-written base isn't doubled.
  */
 export const applyBaseToAstroRedirects = (
   redirects: Redirect[],
   basePath: string,
-  deployBase: string
+  deployBase: string,
+  routes: RouteSet
 ): Redirect[] => {
   // `deployment.base` arrives as the user wrote it (Astro accepts `/base/`,
   // even `base`); normalizing here keeps the composed paths well-formed.
@@ -44,27 +70,29 @@ export const applyBaseToAstroRedirects = (
     ? redirects.map((redirect) => ({
         ...redirect,
         from: withBasePath(basePath, redirect.from),
-        to: withComposedBasePath(base, basePath, redirect.to),
+        to: baseRedirectTarget(redirect.to, basePath, base, routes),
       }))
     : redirects;
 };
 
 /**
  * Base a redirect for the host platform files below. Unlike Astro's config,
- * these are matched against the real served URL, so both sides carry the full
- * `{deployment.base}{basePath}` stack.
+ * these are matched against the real served URL, so `from` carries the full
+ * `{deployment.base}{basePath}` stack, and so does `to` unless it names a
+ * public file (see {@link baseRedirectTarget}).
  */
 export const applyBaseToPlatformRedirects = (
   redirects: Redirect[],
   basePath: string,
-  deployBase: string
+  deployBase: string,
+  routes: RouteSet
 ): Redirect[] => {
   const base = normalizeBasePath(deployBase);
   return basePath || base
     ? redirects.map((redirect) => ({
         ...redirect,
         from: withComposedBasePath(base, basePath, redirect.from),
-        to: withComposedBasePath(base, basePath, redirect.to),
+        to: baseRedirectTarget(redirect.to, basePath, base, routes),
       }))
     : redirects;
 };
@@ -75,17 +103,34 @@ export const applyBaseToPlatformRedirects = (
  * share: the emitted redirect files and the Cloudflare worker-first redirect
  * exemptions both compare these paths against real served URLs.
  */
-export const platformRedirects = (config: ResolvedConfig): Redirect[] =>
-  applyBaseToPlatformRedirects(
+export const platformRedirects = (project: {
+  config: ResolvedConfig;
+  manifest: Pick<BlumeProject["manifest"], "routes">;
+}): Redirect[] => {
+  const { config } = project;
+  return applyBaseToPlatformRedirects(
     config.redirects,
     config.basePath,
-    config.deployment.options.base ?? ""
+    config.deployment.options.base ?? "",
+    routeSetFor(project.manifest.routes)
   );
+};
 
-/** `_redirects` text (Netlify + Cloudflare Pages): `from to status` per line. */
-export const buildNetlifyRedirects = (redirects: Redirect[]): string =>
+/**
+ * `_redirects` text (Netlify + Cloudflare Pages): `from to status` per line.
+ * `force` appends Netlify's `!` to each status (`301!`), so the rule wins over
+ * the redirect page Astro writes at `from`; Cloudflare, which always applies
+ * its rules first, rejects a line carrying it.
+ */
+export const buildNetlifyRedirects = (
+  redirects: Redirect[],
+  force = false
+): string =>
   `${redirects
-    .map((redirect) => `${redirect.from} ${redirect.to} ${redirect.status}`)
+    .map(
+      (redirect) =>
+        `${redirect.from} ${redirect.to} ${redirect.status}${force ? "!" : ""}`
+    )
     .join("\n")}\n`;
 
 /** The `vercel.json` Blume writes for a static deploy of `dist/`. */
@@ -99,7 +144,9 @@ interface VercelConfig {
  * header rules are given (see `buildVercelHeaders`). Uses `statusCode` (Vercel's
  * alternative to the boolean `permanent`) so the configured code ships exactly:
  * `permanent` would silently coerce a 301 to 308 and a 302 to 307, diverging
- * from the `_redirects` file, which preserves exact codes.
+ * from the `_redirects` file, which preserves exact codes. A `source` is a
+ * `path-to-regexp` pattern, so each exact `from` path is escaped: unescaped,
+ * `/c++-guide` fails the whole config and `/faq(old)` never matches.
  */
 export const buildVercelConfig = (
   redirects: Redirect[],
@@ -108,7 +155,7 @@ export const buildVercelConfig = (
   const config: VercelConfig = {
     redirects: redirects.map((redirect) => ({
       destination: redirect.to,
-      source: redirect.from,
+      source: escapeVercelSource(redirect.from),
       statusCode: redirect.status,
     })),
   };

package/src/deploy/robots.ts

@@ -1,4 +1,4 @@
-import { normalizeBasePath, withBasePath } from "../core/base-path.ts";
+import { mountBasePath, normalizeBasePath } from "../core/base-path.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
 import type { ContentSignalPolicy, ContentSignals } from "../core/schema.ts";
 import { absoluteUrl } from "../core/site-url.ts";
@@ -49,7 +49,7 @@ export const buildRobots = (project: BlumeProject): string | null => {
 
   const { site } = config.deployment.options;
   if (site && config.seo.sitemap) {
-    const sitemapPath = withBasePath(
+    const sitemapPath = mountBasePath(
       normalizeBasePath(config.deployment.options.base),
       "/sitemap.xml"
     );

package/src/deploy/rss.ts

@@ -2,7 +2,7 @@
 // `'` reference rather than `'`, which XML accepts equally.
 import { escape as escapeXml } from "html-escaper";
 
-import { normalizeBasePath, withBasePath } from "../core/base-path.ts";
+import { mountBasePath, normalizeBasePath } from "../core/base-path.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
 import { siteRoot } from "../core/site-url.ts";
 import type { PageRecord } from "../core/types.ts";
@@ -57,7 +57,8 @@ export const buildRssFeeds = (project: BlumeProject): RssFeed[] => {
     return [];
   }
   const base = siteRoot(site);
-  // Routes carry `basePath`; a `deployment.base` subdirectory is layered on top.
+  // Routes carry `basePath`; a `deployment.base` subdirectory is mounted on top
+  // of every one, even a route whose first segment matches it (see sitemap.ts).
   // The feed's own `link`/self URL points at the docs root under that base, while
   // `path` stays base-less (it's also the on-disk output location).
   const deployBase = normalizeBasePath(config.deployment.options.base);
@@ -80,7 +81,7 @@ export const buildRssFeeds = (project: BlumeProject): RssFeed[] => {
         description: page.description,
         // Encode like the sitemap does: a route with spaces or non-ASCII
         // must still yield a valid <link>/<guid> URL after XML decoding.
-        link: encodeURI(`${base}${withBasePath(deployBase, page.route)}`),
+        link: encodeURI(`${base}${mountBasePath(deployBase, page.route)}`),
         title: page.title,
       }))
       .toSorted((a, b) => (b.date?.getTime() ?? 0) - (a.date?.getTime() ?? 0))

package/src/deploy/sitemap.ts

@@ -6,7 +6,7 @@ import {
   discoverPagesSync,
   hasGeneratedChangelog,
 } from "../astro/pages.ts";
-import { normalizeBasePath, withBasePath } from "../core/base-path.ts";
+import { mountBasePath, normalizeBasePath } from "../core/base-path.ts";
 import type { BlumeProject } from "../core/project-graph.ts";
 import { siteRoot } from "../core/site-url.ts";
 
@@ -78,7 +78,9 @@ export const buildSitemapFiles = (
   }
 
   const base = siteRoot(site);
-  // Routes carry `basePath`; a `deployment.base` subdirectory is layered on top.
+  // Routes carry `basePath`; a `deployment.base` subdirectory is mounted on
+  // top of every one, even a route whose first segment matches it: under base
+  // `/guides`, `guides/setup.md` is served at `/guides/guides/setup`.
   const deployBase = normalizeBasePath(project.config.deployment.options.base);
 
   // Archived-version pages leave the sitemap when the version is noindexed,
@@ -135,7 +137,7 @@ export const buildSitemapFiles = (
     ) {
       continue;
     }
-    pushUrl(withBasePath(deployBase, page.route), page.lastModified);
+    pushUrl(mountBasePath(deployBase, page.route), page.lastModified);
   }
   // Custom `.astro` pages and the generated changelog index mount outside
   // `basePath` (they're injected at their pattern — see `blumeIntegration`), so
@@ -150,7 +152,7 @@ export const buildSitemapFiles = (
     extraRoutes.push("/changelog");
   }
   for (const route of extraRoutes) {
-    pushUrl(withBasePath(deployBase, route));
+    pushUrl(mountBasePath(deployBase, route));
   }
   urls.sort();
 
@@ -169,7 +171,7 @@ export const buildSitemapFiles = (
     // Chunks sit next to sitemap.xml, so their URLs layer the same deployment
     // base robots.txt uses for the index.
     const loc = escapeXml(
-      encodeURI(`${base}${withBasePath(deployBase, `/${name}`)}`)
+      encodeURI(`${base}${mountBasePath(deployBase, `/${name}`)}`)
     );
     references.push(`  <sitemap><loc>${loc}</loc></sitemap>`);
   }

package/src/deploy/vercel-negotiation.ts

@@ -16,6 +16,8 @@
  * prerendered problem-details 404.
  */
 
+import { SVG_ASSET_HEADERS } from "./headers.ts";
+
 /**
  * Regex for the `accept` header condition. Written to hold under both matching
  * semantics a router may apply — full-string and substring — by anchoring the
@@ -248,6 +250,30 @@ const corsRoute = (path: string): VercelRoute => ({
   src: `^${routePattern(path)}$`,
 });
 
+/**
+ * The `src` of the route stamping the content-source SVG headers: every `.svg`
+ * under `/blume-assets/`. The adapter copies the static files into the Build
+ * Output tree without the deployment base, like every path matched here.
+ */
+const SVG_ASSET_SRC = String.raw`^/blume-assets/.+\.svg$`;
+
+/**
+ * A main-phase `continue` route stamping the sandbox headers
+ * (`deploy/headers.ts`) on a downloaded SVG, which Vercel serves from the
+ * static layer — where the prerendered asset endpoint's own headers never
+ * reach.
+ */
+const svgAssetRoute = (): VercelRoute => ({
+  continue: true,
+  headers: Object.fromEntries(
+    Object.entries(SVG_ASSET_HEADERS).map(([name, value]) => [
+      name.toLowerCase(),
+      value,
+    ])
+  ),
+  src: SVG_ASSET_SRC,
+});
+
 /** Whether a route is a `corsRoute` — the same three-field shape test as the others. */
 const isCorsRoute = (route: VercelRoute): boolean =>
   route.continue === true &&
@@ -279,7 +305,8 @@ const isNegotiationRoute = (route: VercelRoute): boolean =>
     isString(route.headers?.link) &&
     route.src === HOME_SRC &&
     Object.keys(route).length === 3) ||
-  isCorsRoute(route);
+  isCorsRoute(route) ||
+  (route.continue === true && route.src === SVG_ASSET_SRC);
 
 /**
  * Splice the negotiation routes into a Build Output `config.json`, plus — when
@@ -297,7 +324,8 @@ const isNegotiationRoute = (route: VercelRoute): boolean =>
  * `404.md`, `notFound.json` for `404.json`), its routes go into the miss
  * phase right before the adapter's `/404.html` fallback — and nowhere when
  * that fallback is absent, since a `dest` with no file behind it would serve
- * nothing. Returns the updated JSON
+ * nothing. With `svgAssets`, a main-phase route also sandboxes the SVGs a
+ * content source downloaded (see {@link svgAssetRoute}). Returns the updated JSON
  * text (tab-indented, like the adapter's own output), or `null` when there is
  * nowhere safe to splice: an unparsable config, no `routes` array, or no
  * `handle: "filesystem"` marker to anchor the splice.
@@ -309,7 +337,8 @@ export const injectNegotiationRoutes = (
   contentTypeOverrides?: Record<string, string>,
   homeTokens?: number,
   notFound: NotFoundVariants = {},
-  corsPaths: readonly string[] = []
+  corsPaths: readonly string[] = [],
+  svgAssets = false
 ): string | null => {
   const overrideEntries = Object.entries(contentTypeOverrides ?? {});
   let config: {
@@ -348,6 +377,9 @@ export const injectNegotiationRoutes = (
     });
   }
   headerRoutes.push(...corsPaths.map(corsRoute));
+  if (svgAssets) {
+    headerRoutes.push(svgAssetRoute());
+  }
   // Headers first: `continue` routes accumulate, so a request the rewrite
   // route then terminates (Markdown negotiation on the homepage) still carries
   // the Link header.

package/src/eval/agents.ts

@@ -124,6 +124,14 @@ export const runAgentHeadless = (
       }
     });
 
+    // An agent that exits before reading the whole prompt (it rejected a flag,
+    // say) closes the pipe mid-write, and the resulting EPIPE would otherwise
+    // be an uncaught exception that aborts the run. The exit itself is the
+    // outcome: `close` resolves with the agent's code and stderr, which
+    // `readAgentOutput` reports.
+    child.stdin?.on("error", () => {
+      // Deliberately ignored — see above.
+    });
     child.stdin?.end(options.prompt);
   });
 
@@ -208,7 +216,7 @@ const claudeArgs = (context: InvocationContext): string[] => {
 
 /**
  * Codex config overrides that leave an eval run nothing but its prompt and the
- * docs MCP tools. `--sandbox read-only` blocks writes and the network but still
+ * docs MCP tools (and a `blume translate` run nothing but its prompt). `--sandbox read-only` blocks writes and the network but still
  * lets the shell tool read any file the user can, and the docs a reader
  * searches — or the answer a judge grades — can come from a remote source, so
  * an instruction planted there could otherwise pull a local secret into the
@@ -216,7 +224,7 @@ const claudeArgs = (context: InvocationContext): string[] => {
  * local-image tool off, and any subprocess started with no inherited
  * environment, there is nothing on the machine for a run to read.
  */
-const CODEX_LOCKDOWN = [
+export const CODEX_LOCKDOWN = [
   "-c",
   "features.shell_tool=false",
   "-c",

package/src/eval/run.ts

@@ -181,6 +181,31 @@ const runQuestion = async (
   };
 };
 
+/** The findings a missed question produces: failed, or its agent run errored. */
+const MISS_CODES: ReadonlySet<string> = new Set([
+  "BLUME_EVAL_QUESTION_ERROR",
+  "BLUME_EVAL_QUESTION_FAILED",
+]);
+
+/**
+ * The fraction of run (non-skipped) questions that pass the CI gate. A miss on
+ * a `severity: warning` question is reported as a warning and never counts
+ * against the gate — each miss's finding carries its question's severity, so
+ * the gate reads the same findings the JSON summary counts, and the exit code
+ * can't disagree with the summary's error total.
+ */
+export const passFraction = (result: EvalResult): number => {
+  const ran = result.results.length - result.counts.skip;
+  if (ran === 0) {
+    return 1;
+  }
+  const misses = result.diagnostics.filter(
+    (diagnostic) =>
+      MISS_CODES.has(diagnostic.code) && diagnostic.severity === "error"
+  ).length;
+  return (ran - misses) / ran;
+};
+
 /**
  * Run every question through the reader/judge pair, sequentially: each
  * question is already two agent sessions, and a serial run keeps progress