DEV Community: Junyi Zhang

How to Return 410 Gone on Cloudflare Pages (The \_redirects Gotcha

Junyi Zhang — Mon, 27 Jul 2026 23:45:22 +0000

Background

I registered a domain for a new project. Shortly after launch, Google Search Console started flooding with mysterious 404 errors — URLs like /post/xxx and /category-xxx, the classic WordPress path patterns. Turns out the domain had a previous owner who ran a WordPress site, and Google still had those old pages indexed.

When search engines see 404s on old URLs, they keep retrying. Better to tell them unequivocally: "This content is gone for good" — that's what 410 Gone is for.

The Pitfall: _redirects Only Supports 3xx

My first instinct was to add rules to _redirects:

/post/*    410
/category-*    410

Deployed it. Nothing happened — those URLs still returned 404.

After digging into the Cloudflare Pages docs, the answer emerged: _redirects only supports five status codes — 301, 302, 303, 307, and 308. Writing 410 gets silently ignored. No warning, no error, nothing.

As a bonus facepalm: my test 301 redirect wasn't working either, because I had the format backwards:

/test-redirect  301  /     ← Wrong: destination and status code are swapped
/test-redirect  /  301     ← Correct: source → destination → status code

The Fix: Cloudflare Pages Functions

Use a Cloudflare Pages Function as middleware. Create functions/[[path]].js at the project root:

// Intercept old WordPress URLs, return 410 Gone
// Pass everything else through to static assets

const GONE_PATTERNS = [
  /^\/post\//,
  /^\/category-/,
  /^\/author-/,
  /^\/page_/,
  /^\/date-/,
];

const GONE_EXACT = [
  '/.IGV0hOcNusVJOgqoD1HuWTk0PssdueKB',
];

export async function onRequest(context) {
  const { pathname } = new URL(context.request.url);

  if (GONE_PATTERNS.some((p) => p.test(pathname))
      || GONE_EXACT.includes(pathname)) {
    return new Response('410 Gone — This content has been permanently removed.', {
      status: 410,
      headers: { 'Content-Type': 'text/plain; charset=utf-8' },
    });
  }

  return context.next();
}

Matches old WordPress URL patterns → returns 410
Everything else → context.next() passes through to static assets with zero overhead

Deployment

Place the functions/ directory at the project root (not inside src/ or public/). Cloudflare Pages auto-detects it and enables the Functions runtime — no extra configuration needed.

✨ Uploading _redirects
✨ Uploading Functions bundle

Verification

$ curl -s -o /dev/null -w "HTTP %{http_code}" https://example.com/post/hello-world
HTTP 410

$ curl -s -o /dev/null -w "HTTP %{http_code}" https://example.com/category-tech
HTTP 410

$ curl -s -o /dev/null -w "HTTP %{http_code}" https://example.com/
HTTP 200

TL;DR

Need	Solution
3xx redirects	`_redirects` file
4xx / 5xx status codes	Cloudflare Pages Functions
Complex routing (rate limiting, auth, etc.)	Functions or Workers

This was a real-world pitfall encountered while building BGM Box, a free online BRSTM converter and player for Nintendo game audio. Convert 100+ formats (MP3, WAV, OGG, FLAC, ADX, HCA, FSB, WEM...) to BRSTM, BCSTM, and BFSTM — all in your browser with no sign-up and no file uploads. Give it a try!

How I Built a BRSTM Converter with WebAssembly — Technical Deep Dive

Junyi Zhang — Fri, 24 Jul 2026 07:50:10 +0000

The Problem: No Browser-Based BRSTM Tool Existed

Every existing BRSTM converter was a desktop app — BrawlBox for Windows, Looping Audio Converter (a .NET Framework app written in C#), or command-line tools that needed compiling from source. If you were on a Mac, on Linux, or wanted to quickly convert a file without installing anything, you were out of luck.

The core challenge: BRSTM encoding requires C libraries (DspTool) that were never designed to run in a browser. And decoding game audio formats like ADX, HCA, and FSB requires vgmstream, a massive C codebase with decades of reverse-engineered format support.

Architecture: Three WebAssembly Modules in One Browser Tab

The workflow splits processing away from the main UI thread into background Web Workers, maintaining a butter-smooth 60 FPS user interface during complex encoding tasks:

+-------------------------------------------------------------------+
|                        MAIN THREAD (UI)                           |
|  - Drag & Drop Handling      - Audio Preview (Web Audio API)      |
|  - Progress Bar Rendering    - SEO & Route State                  |
+-------------------------------------------------------------------+
                                 |
                          postMessage()
                                 v
+-------------------------------------------------------------------+
|                     WEB WORKERS (Background)                      |
|                                                                   |
|  1. VgmstreamWorker      2. EncoderWorker     3. Export Worker    |
|   [vgmstream.wasm]        [sound.wasm]        [lame / vorbis]     |
|   Decode to PCM          Encode to BRSTM       Export MP3/OGG     |
+-------------------------------------------------------------------+

1. `vgmstream.wasm` — The Universal Decoder (4.1 MB)

vgmstream is the industry-standard game audio decoding library. It supports 100+ formats — from Nintendo's BRSTM/BCSTM/BFSTM to CRI's ADX/HCA, Microsoft's XMA, FMOD's FSB, and Sony's ATRAC3. The vgmstream project provides a pre-built WASM binary, which I wrapped in a Web Worker so decoding never blocks the UI thread.

The hardest part was integrating with the Emscripten virtual filesystem that vgmstream's WASM build uses internally. Files are written to the virtual FS via FS.writeFile(), decoded via vgmstream's CLI interface (callMain(['-o', '/out.wav', '/in.bcstm'])), then read back from FS.readFile() — all inside a Web Worker.

2. `sound.wasm` — The BRSTM Encoder (176 KB)

The encoding process relies on DspTool (developed by Alex Barney), an MIT-licensed C library designed for generating BRSTM, BCSTM, and BFSTM files.

Takes raw PCM audio data and outputs a fully compliant Nintendo audio file complete with loop point metadata.
Memory Management: PCM data is pushed into the WASM heap using Emscripten’s _malloc and converted to match Nintendo DSP ADPCM standards.

3. `lame.min.js` + `vorbis-encoder-bundle` — The Export Encoders

For reverse conversions (BRSTM → MP3, BCSTM → OGG, FSB → MP3), browser-native encoders are required:

MP3: Handled efficiently via lamejs.
OGG Vorbis: libvorbis.js compiled with Emscripten, bundled with Browserify to ensure compatibility with importScripts() inside Web Workers.

Technical Deep-Dive: The Interleaved vs. Planar PCM Bug

During development, multi-channel audio output resulted in harsh, garbled noise. Tracking this down required comparing hex dumps of PCM buffers against expected byte layouts.

Interleaved PCM (vgmstream output / Web Audio API):
[ L0, R0, L1, R1, L2, R2, ... ]

Planar PCM (DspTool expectation):
[ L0, L1, L2, ... ] [ R0, R1, R2, ... ]

The bug stemmed from an indexing calculation error during the deinterleaving pass:

// ❌ Incorrect Deinterleaving Formula
const sample = pcm[channelIndex * sampleLength + i];

// ✅ Correct Deinterleaving Formula
const sample = pcm[i * totalChannels + channelIndex];

By ensuring proper data transformation before allocation to the WASM heap, multi-channel audio was rendered cleanly without UI thread stutter.

Web Worker Memory Optimization

Loading a 4.1 MB WASM module multiple times can quickly lead to heavy memory consumption. To keep performance optimal:

Persistent Worker Allocation: Web Workers are instantiated once and kept alive throughout the session.
Transferable Objects: Large ArrayBuffer payloads exchanged via postMessage() use transferables (postMessage(data, [data.buffer])), transferring ownership zero-copy rather than cloning large audio arrays.
WASM Module Caching: Compiled WebAssembly modules are cached in IndexedDB to bypass recompilation overhead on subsequent page visits.

Try It Out

BGM Box is 100% free and open about its technical implementation. Every conversion process executes entirely inside your client browser — no server-side uploading or processing required.

👉 bgmbox.com — Convert, Play, Loop. All in one box.

Full Analysis of AI Agent Security Tools: Onecli, Sigcli, Agent Vault, Ren AI Proxy, and FakeKey

Junyi Zhang — Tue, 28 Apr 2026 09:29:39 +0000

Full Analysis of AI Agent Security Tools: Onecli, Sigcli, Agent Vault, Ren AI Proxy, and FakeKey

Background: An Emerging Security Need

The rise of AI agents and coding assistants (such as Claude Code, Cursor) is bringing brand‑new security challenges to developers. Your project directory may quietly contain a .env file storing various API keys for OpenAI, Anthropic, Alibaba Cloud, Feishu – many of which are linked to credit cards.

The recent LiteLLM Axios supply‑chain attack has made the issue acute: when your development environment can be scanned by malicious dependencies at any time, storing API keys in plaintext is like walking around naked.

Hence, a new category of tools has emerged – credential security tools for AI agents. These tools share a highly consistent goal: enabling AI agents to securely access external services without needing (and being unable) to see the real API keys.

Below is a comprehensive overview of five representative products.

Product Definitions at a Glance

Product	Core Definition	One‑Sentence Positioning
Onecli	Open‑source credential vault that gives AI agents secure access to services	No key exposure
Sigcli	Authentication CLI & proxy for AI agents	Grant access, not credentials
Agent Vault	HTTP credential proxy and vault	Dual role: proxy + vault
Ren AI Proxy	LLM API sharing proxy	Share quota securely without exposing keys
FakeKey	Rust‑based API key security proxy	Replace real keys with fake ones – make leaks meaningless

Detailed Product Descriptions

1. Onecli

Website: https://www.onecli.sh/
Positioning: Open‑source credential vault

Onecli is a general‑purpose credential management tool, specifically optimised for AI agent scenarios. It acts as a secure “middleman” – the AI agent requests credentials from Onecli, and Onecli handles the interaction with the real service. Throughout the process, the original API key remains completely invisible to the agent.

2. Sigcli

Website: https://sigcli.ai/
Positioning: Authentication CLI & proxy for AI agents

The name Sigcli hints at its core capability – authentication. It is more than a credential proxy; it is a complete identity verification solution. Its design philosophy is “grant the agent access, not your credentials” – meaning you can finely control what the agent can and cannot do without handing over your keys.

3. Agent Vault

Documentation: https://docs.agent-vault.dev/
Positioning: HTTP credential proxy and vault

Agent Vault’s product name directly reflects its functionality: it is a proxy plus a vault. The AI agent sends HTTP requests to it, and Agent Vault dynamically replaces fake credentials with real keys before the request reaches the target API.

4. Ren AI Proxy

Website: https://ren.im
Positioning: LLM API sharing proxy

Ren AI Proxy has the most unique positioning in this category. Its goal is not “protect my own keys from leakage” but rather “share my API quota with others without exposing my keys”. For example, if you have unused quota from a Coding Plan, you can share it with your team or friends via Ren AI Proxy. It supports:

LAN sharing
Internet sharing (using intranet penetration tools such as Tunelo)

5. FakeKey

GitHub: https://github.com/happyvibing/fakekey
Positioning: Rust‑based API key security proxy – replace real keys with fake ones

FakeKey has the most radical and direct idea: “make leaks meaningless”.

How it works

Client Agent (uses fake key sk-xxx_fk) 
    → FakeKey Proxy (TLS decryption, identify replacement rules) 
        → External API (uses real key sk-xxx)

The AI agent and all dependencies only ever see fake keys (e.g., sk-xxx_fk).
Real keys are encrypted and stored in the system’s built‑in key manager (e.g., macOS Keychain).
Only when an HTTP/HTTPS request is made does the FakeKey proxy replace the fake key with the real one in real time.
If any dependency is compromised, the attacker can at most steal meaningless fake strings.

Quick Start

# One‑line installation
curl -fsSL https://raw.githubusercontent.com/happyvibing/fakekey/main/install.sh | bash

# Initialisation and onboarding
fakekey onboard

# Run your favourite tool (leak‑free)
fakekey run claude
fakekey run pi

FakeKey is written entirely in Rust, requires no Docker, and emphasises being lightweight, fast, and deeply integrated with the system’s native key management.

Technical Route Comparison

The products above can be divided into two technical schools:

School 1: Proxy + Dynamic Replacement (Onecli, Sigcli, Agent Vault, FakeKey)

Core idea: Place a local proxy between the AI agent and the target API. The agent uses fake credentials; the proxy swaps them for real ones just before sending the request.
Problems solved: Credential leakage from dependency poisoning, log leaks, environment variable scanning, etc.
Differences among representatives:
- FakeKey: Most radical – “fake‑key replacement” is in its name and core.
- Agent Vault: Emphasises being an HTTP credential proxy.
- Onecli / Sigcli: Naming highlights “credential vault” and “authentication” concepts.

School 2: Permission Sharing (Ren AI Proxy)

Core idea: Still a proxy model, but the goal shifts from “protecting yourself” to “securely sharing quota”.
Problems solved: How to authorise access without handing over keys in multi‑user / multi‑machine environments.
Unique value: It addresses “trust transfer” rather than just “leak prevention”.

Selection Recommendations

If your need is…	Recommended products
Protect your local AI coding environment	Onecli, Sigcli, Agent Vault, FakeKey
Deep integration with system keychain (macOS Keychain)	FakeKey
Preference for lightweight CLI, Rust implementation	FakeKey
Preference for a generic HTTP proxy approach	Agent Vault
Share API quota with others (without exposing keys)	Ren AI Proxy

Conclusion: A New Security Category Taking Shape

These five products together reflect a trend: as AI agents become part of developers’ daily toolchains, credential security in agent environments is emerging as an independent and important sub‑domain of security.

Their core insight is: in a runtime environment where absolute trust is impossible, instead of trying to “prevent poisoning”, it may be better to design a mechanism that makes leakage itself worthless.

Onecli, Sigcli, Agent Vault, Ren AI Proxy, and FakeKey each approach this problem from different angles. The tooling landscape in this area is still evolving rapidly, but the direction and value are becoming increasingly clear.

DEV Community: Junyi Zhang

How to Return 410 Gone on Cloudflare Pages (The \_redirects Gotcha

Background

The Pitfall: _redirects Only Supports 3xx

The Fix: Cloudflare Pages Functions

Deployment

Verification

TL;DR

How I Built a BRSTM Converter with WebAssembly — Technical Deep Dive

The Problem: No Browser-Based BRSTM Tool Existed

Architecture: Three WebAssembly Modules in One Browser Tab

1. vgmstream.wasm — The Universal Decoder (4.1 MB)

2. sound.wasm — The BRSTM Encoder (176 KB)

3. lame.min.js + vorbis-encoder-bundle — The Export Encoders

Technical Deep-Dive: The Interleaved vs. Planar PCM Bug

Web Worker Memory Optimization

Try It Out

Full Analysis of AI Agent Security Tools: Onecli, Sigcli, Agent Vault, Ren AI Proxy, and FakeKey

Full Analysis of AI Agent Security Tools: Onecli, Sigcli, Agent Vault, Ren AI Proxy, and FakeKey

Background: An Emerging Security Need

Product Definitions at a Glance

Detailed Product Descriptions

1. Onecli

2. Sigcli

3. Agent Vault

4. Ren AI Proxy

5. FakeKey

How it works

Quick Start

Technical Route Comparison

School 1: Proxy + Dynamic Replacement (Onecli, Sigcli, Agent Vault, FakeKey)

School 2: Permission Sharing (Ren AI Proxy)

Selection Recommendations

Conclusion: A New Security Category Taking Shape

1. `vgmstream.wasm` — The Universal Decoder (4.1 MB)

2. `sound.wasm` — The BRSTM Encoder (176 KB)

3. `lame.min.js` + `vorbis-encoder-bundle` — The Export Encoders