Serve /blog and /llms.txt publicly instead of redirecting to login#1201
Merged
Conversation
On executor.sh the cloud worker only proxies an allow-list of paths to the marketing worker; everything else falls through to the auth gate. /blog and /llms.txt were not on the list, so unauthenticated visits got redirected to /login?returnTo=..., and session replays show those visitors bouncing immediately (blog ~79%, llms.txt ~90%). Add both to the marketing allow-list. /blog already has marketing routes; add a real llms.txt under marketing/public describing the product and key links. Export isMarketingPath and cover the allow-list with a unit test.
Greptile SummaryAdds
Confidence Score: 5/5Safe to merge; the change is additive and isolated to the marketing proxy allow-list with no impact on authenticated routes or the auth gate. Two paths are added to a static allow-list, the proxy logic that handles them is unchanged, and the only new function export is the predicate that the new tests cover. The /blogger prefix-collision guard confirms the startsWith logic was correctly considered. No auth paths are touched and the marketing worker binding guards against accidental exposure in non-production environments. No files require special attention. A manual smoke-test of /blog and /llms.txt on the production domain after deploy is still worth doing, as noted in the PR description, since the middleware only activates with the prod MARKETING binding. Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant C as Unauthenticated Visitor
participant W as executor.sh Worker
participant M as executor-marketing Worker
Note over W: marketingMiddleware runs first
C->>W: GET /blog/some-post
W->>W: isMarketingPath("/blog/some-post") true
W->>M: proxy request unchanged
M-->>C: 200 Blog page
C->>W: GET /llms.txt
W->>W: isMarketingPath("/llms.txt") true
W->>M: proxy request unchanged
M-->>C: 200 llms.txt (static file)
C->>W: GET /dashboard (not on allow-list)
W->>W: isMarketingPath("/dashboard") false
W->>W: next() falls through to auth gate
W-->>C: "302 /login?returnTo=/dashboard"
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant C as Unauthenticated Visitor
participant W as executor.sh Worker
participant M as executor-marketing Worker
Note over W: marketingMiddleware runs first
C->>W: GET /blog/some-post
W->>W: isMarketingPath("/blog/some-post") true
W->>M: proxy request unchanged
M-->>C: 200 Blog page
C->>W: GET /llms.txt
W->>W: isMarketingPath("/llms.txt") true
W->>M: proxy request unchanged
M-->>C: 200 llms.txt (static file)
C->>W: GET /dashboard (not on allow-list)
W->>W: isMarketingPath("/dashboard") false
W->>W: next() falls through to auth gate
W-->>C: "302 /login?returnTo=/dashboard"
Reviews (1): Last reviewed commit: "Serve /blog and /llms.txt publicly inste..." | Re-trigger Greptile |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-cloud | 3b66c3e | Jun 29 2026, 02:10 AM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-marketing | 3b66c3e | Commit Preview URL Branch Preview URL |
Jun 29 2026, 02:10 AM |
Contributor
Cloudflare previewTorn down — the PR is closed. |
@executor-js/cli
@executor-js/config
@executor-js/execution
@executor-js/sdk
@executor-js/codemode-core
@executor-js/runtime-quickjs
@executor-js/plugin-file-secrets
@executor-js/plugin-graphql
@executor-js/plugin-keychain
@executor-js/plugin-mcp
@executor-js/plugin-onepassword
@executor-js/plugin-openapi
executor
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On
executor.shthe cloud worker only proxies an allow-list of paths to the marketing worker; everything else falls through to the auth gate./blogand/llms.txtwere not on the list, so unauthenticated visits got redirected to/login?returnTo=....Session replays back this up: visitors landing on those login redirects bounced almost immediately (blog ~79%, llms.txt ~90% bounce, 0s median).
Changes
/blogand/llms.txtto the marketing allow-list (apps/cloud/src/edge/marketing.ts)./blogalready has marketing routes.llms.txtdid not exist anywhere, so add a real one underapps/marketing/public/(product summary + docs/source/community links, per the llms.txt convention) rather than allow-listing a 404.isMarketingPath(mirroring the siblingdocs.ts) and cover the allow-list with a unit test, including a/bloggerguard against a bare prefix match.Verification
apps/cloud/src/edge/marketing.test.ts: 15/15 pass.@executor-js/cloudtypecheck: clean.host === "executor.sh"with the prodMARKETINGbinding); the unit test covers the routing. Worth a manual hit of/blogand/llms.txtafter deploy.