diff --git a/src/servers/api/dev-proxy/html-rewrite.test.ts b/src/servers/api/dev-proxy/html-rewrite.test.ts
new file mode 100644
index 00000000..c053d027
--- /dev/null
+++ b/src/servers/api/dev-proxy/html-rewrite.test.ts
@@ -0,0 +1,77 @@
+import { describe, expect, test } from 'bun:test';
+import { rewriteAssetPaths, rewriteHtml } from './html-rewrite';
+
+const BASE = '/api/dev-proxy/3001';
+const attrs = (html: string) => [...html.matchAll(/(?:src|href)="([^"]+)"/g)].map((m) => m[1]!);
+
+// What a browser would resolve the rewritten path to. The bug this file exists for is invisible without
+// this step: the rewrite looked right and the browser threw the prefix away.
+const resolved = (path: string) => new URL(path, 'https://platform.officer.dev/').pathname;
+
+describe('rewriteHtml', () => {
+  test('a plain root-absolute asset gets the prefix', () => {
+    expect(attrs(rewriteHtml('<link href="/style.css">', BASE))).toEqual(['/api/dev-proxy/3001/style.css']);
+  });
+
+  // The blank preview. Bun's dev server emits `href="/../../../chunk-qmw09gd9.css"` — root-absolute AND
+  // climbing. Prefixed naively the browser normalises it straight back to the platform root and 404s.
+  test('`..` segments are collapsed BEFORE the prefix, not handed to the browser', () => {
+    const out = attrs(rewriteHtml('<link href="/../../../chunk-qmw09gd9.css">', BASE));
+    expect(out).toEqual(['/api/dev-proxy/3001/chunk-qmw09gd9.css']);
+  });
+
+  test('and the result survives the browser resolving it — the part that actually failed', () => {
+    const [href] = attrs(rewriteHtml('<script src="/../../../chunk-bmp7wy3m.js">', BASE));
+    expect(resolved(href!)).toBe('/api/dev-proxy/3001/chunk-bmp7wy3m.js');
+  });
+
+  test('the naive version would have escaped, which is why this is asserted at all', () => {
+    // Not testing our code — testing the claim that made the fix necessary.
+    expect(resolved(`${BASE}/../../../chunk-x.css`)).toBe('/chunk-x.css');
+  });
+
+  test('single quotes are handled too', () => {
+    expect(rewriteHtml("<img src='/a/../b.png'>", BASE)).toContain("src='/api/dev-proxy/3001/b.png'");
+  });
+
+  test('a protocol-relative URL is left alone — it names another host', () => {
+    expect(attrs(rewriteHtml('<script src="//cdn.example.com/x.js">', BASE))).toEqual(['//cdn.example.com/x.js']);
+  });
+
+  test('an absolute URL is left alone', () => {
+    expect(attrs(rewriteHtml('<img src="https://example.com/x.png">', BASE))).toEqual(['https://example.com/x.png']);
+  });
+
+  test('a relative path is left alone — it already resolves under the prefix', () => {
+    expect(attrs(rewriteHtml('<img src="./logo.png">', BASE))).toEqual(['./logo.png']);
+  });
+
+  test('css url() gets the same treatment', () => {
+    expect(rewriteHtml('<style>a{background:url(/../img/x.png)}</style>', BASE)).toContain(
+      'url(/api/dev-proxy/3001/img/x.png)',
+    );
+  });
+
+  test('the interception script is injected into head', () => {
+    const out = rewriteHtml('<html><head><title>x</title></head></html>', BASE);
+    expect(out).toContain('window.fetch=function');
+    expect(out.indexOf('<script>')).toBeLessThan(out.indexOf('<title>'));
+  });
+
+  test('a query string and hash survive normalisation', () => {
+    expect(attrs(rewriteHtml('<script src="/../x.js?v=2#frag">', BASE))).toEqual(['/api/dev-proxy/3001/x.js?v=2#frag']);
+  });
+});
+
+describe('rewriteAssetPaths', () => {
+  test("Bun's chunk imports are prefixed", () => {
+    expect(rewriteAssetPaths('import "/_bun/client/index.js"', BASE)).toBe(
+      'import "/api/dev-proxy/3001/_bun/client/index.js"',
+    );
+  });
+
+  test('nothing else in the file is touched', () => {
+    const js = 'const re = /^\\/api\\/users$/; fetch("/api/users");';
+    expect(rewriteAssetPaths(js, BASE)).toBe(js);
+  });
+});
diff --git a/src/servers/api/dev-proxy/html-rewrite.ts b/src/servers/api/dev-proxy/html-rewrite.ts
index 8c45cf7b..3925ce05 100644
--- a/src/servers/api/dev-proxy/html-rewrite.ts
+++ b/src/servers/api/dev-proxy/html-rewrite.ts
@@ -17,9 +17,13 @@
 export const proxyOverrideScript = (base: string) =>
   `<script>(function(){` +
   `var b=${JSON.stringify(base)},o=location.origin;` +
+  // `n()` collapses `..` the way the browser would, for the same reason the HTML rewrite does: Bun emits
+  // `/../../../chunk-x.js`, and prefixing without normalising hands the browser a path that climbs back
+  // out of the proxy and 404s at the platform root.
+  `function n(u){try{var p=new URL(u,"http://x/");return p.pathname+p.search+p.hash}catch(e){return u}}` +
   `function rw(u){` +
   `if(typeof u==="string"){` +
-  `if(u.startsWith("/")&&!u.startsWith("//")&&!u.startsWith(b))return b+u;` +
+  `if(u.startsWith("/")&&!u.startsWith("//")&&!u.startsWith(b))return b+n(u);` +
   `if(u.startsWith(o+"/")&&!u.startsWith(o+b))return o+b+u.slice(o.length);` +
   `return u}` +
   `if(u instanceof URL&&u.origin===o&&!u.pathname.startsWith(b))` +
@@ -42,13 +46,38 @@ export const proxyOverrideScript = (base: string) =>
   `window.WebSocket.OPEN=NWS.OPEN;window.WebSocket.CLOSING=NWS.CLOSING;window.WebSocket.CLOSED=NWS.CLOSED;` +
   `})()</script>`;
 
+/**
+ * Collapse `..` before prefixing, or the prefix is thrown away.
+ *
+ * Bun's dev server emits `href="/../../../chunk-qmw09gd9.css"` — root-absolute AND climbing. Prefixed
+ * naively that becomes `/api/dev-proxy/3001/../../../chunk-…`, which the BROWSER normalises straight back
+ * to `/chunk-…` at the platform root, where it 404s. The page then renders blank with two failed asset
+ * requests and no clue that a proxy was ever involved.
+ *
+ * `..` in a URL is resolved by whoever consumes it, so it has to be resolved HERE, before the prefix goes
+ * on. `new URL` does exactly the normalisation the browser would.
+ */
+const normalisePath = (path: string): string => {
+  try {
+    const url = new URL(path, 'http://placeholder/');
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return path;
+  }
+};
+
+/** `/x` → `<base>/x`, with `..` already collapsed. Never touches `//host` or a full URL. */
+const prefix = (base: string, path: string): string => `${base}${normalisePath(path)}`;
+
 // HTML: rewrite src/href/action attributes with absolute paths + inject fetch/XHR override
 export const rewriteHtml = (html: string, base: string) =>
   html
     .replace(/<head([^>]*)>/i, `<head$1>${proxyOverrideScript(base)}`)
-    .replace(/(href|src|action)="\/(?!\/)/g, `$1="${base}/`)
-    .replace(/(href|src|action)='\/(?!\/)/g, `$1='${base}/`)
-    .replace(/url\(\//g, `url(${base}/`);
+    .replace(
+      /(href|src|action)=("|')(\/(?!\/)[^"']*)\2/gi,
+      (_match, attr: string, quote: string, path: string) => `${attr}=${quote}${prefix(base, path)}${quote}`,
+    )
+    .replace(/url\((\/(?!\/)[^)"']*)\)/g, (_match, path: string) => `url(${prefix(base, path)})`);
 
 // JS/CSS: only `/_bun/` paths.
 //