fix(web): dev-server console noise — public/ assets 404 and blocked blob worker

[Zach Dunn (zachdunn)]

Summary

Two dev-only fixes for console noise on every astro dev page load.

public/ assets 404 in dev

The Cloudflare Vite plugin routes dev requests through workerd and serves static assets from wrangler's assets.directory (./dist — the production build output), not public/. With run_worker_first: ["/*"], every public asset — /favicon.svg, the homepage's /preview/hero-*.webp, /robots.txt, all of it — hit the Astro worker in dev, matched no route, and rendered 404.astro. Prod is unaffected (the build copies public/ into dist/).

Fix: a small dev-only Vite middleware (servePublicInDev in astro.config.mjs) that answers GET/HEAD from public/ (with path-traversal guard and a minimal MIME map) before the worker sees the request. configureServer is ignored in builds, so prod behavior is untouched.

CSP-blocked blob worker on signed-in pages

Dev sessions intermittently log Creating a worker from 'blob:…' violates … script-src on /account/*. No app or dependency code creates workers (verified by grepping the entire loaded module graph); the spawner is dev tooling instrumentation running in page context. signedInCsp now emits worker-src 'self' blob: under import.meta.env.DEV only — same pattern as the existing dev img-src loopback allowance. Prod CSP is unchanged.

Verification

On the local stack (PORTLESS=0 node scripts/dev-stack.mjs):

• /favicon.svg, /preview/hero-before.webp, /robots.txt now 200 with correct Content-Type (all previously 404)
• /account/workspaces response header carries worker-src 'self' blob: in dev
• Signed-in people page reloads with a clean console (no 404s, no CSP error)
• Web vitest suite 57 files / 868 tests pass; tsc --noEmit clean

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4c2a2ca

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ebffd117-9b8c-46d0-a5ee-d63f5a2b2fb7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	uploads-web	4c2a2ca	Commit Preview URL Branch Preview URL	Aug 23 2026, 05:37 PM