load skopec.dev live in its window via an allowlisted header-stripping proxy (/api/frame)

src/app/components/WindowsDesktop.tsx

@@ -62,15 +62,18 @@ const SERVICE_SHORTCUTS: Shortcut[] = [
 
 // Friends' sites, opened in a live window when they allow framing. bukovinafilip
 // and vlcak.me send no framing headers, so `url` (== `realUrl`) is framed
-// directly. skopec.dev sends `X-Frame-Options: SAMEORIGIN` on every path, so we
-// frame the same-origin mirror at `/skopec.html` instead; the www button still
-// opens the live site. To embed a site that blocks framing live, it would need a
-// header-stripping proxy.
+// directly. skopec.dev sends `X-Frame-Options: SAMEORIGIN` on every path, so
+// `proxy: true` routes it through /api/frame, which strips the framing headers
+// and serves the live page from our origin. The www button always opens the live
+// site (`realUrl`).
 const FRIEND_SHORTCUTS: Shortcut[] = friends.map((f, i) => ({
   id: `friend-${i}`,
   label: f.name,
   url: f.realUrl || f.url,
-  embedUrl: f.url,
+  embedUrl:
+    f.proxy && f.realUrl
+      ? `/api/frame?url=${encodeURIComponent(f.realUrl)}`
+      : f.url,
   embed: f.iframe,
   color: "#c0392b",
   icon: "🫂",