dvorakmortonxd/dvorakmortonxd.dev
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

embed friends' sites live in desktop windows; frame the skopec mirror since skopec.dev blocks framing

Browse source
This commit is contained in:
Martin Dvořák 2026-09-30 06:30:30 +00:00
commit d5dfea060f
4 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
agents.md
View file

@ -295,6 +295,14 @@ list reordering, not free placement. Don't confuse the two.
`Content-Security-Policy: frame-ancestors`. Discord keeps a link card because
it sends `DENY` and can't be configured. Always verify headers before enabling
`embed` on a new service.
- Friend shortcuts reuse the same embed path, driven by `data.ts`. `friend.iframe`
is the `embed` flag; `friend.url` is what the frame loads and `friend.realUrl`
is what the www button opens — `createWebsiteApp`'s `embedUrl` option lets the
two differ. `bukovinafilip.com` and `vlcak.me` send no framing headers, so they
frame the live site; `skopec.dev` sends `X-Frame-Options: SAMEORIGIN` on every
path, so `friends[0].url` points at the bundled `/public/skopec.html` mirror
and only the button is live. Making a blocking site load *live* would need a
header-stripping proxy (allowlisted) — not implemented.
- **Embedded iframes swallow the pointer.** While dragging/resizing a window,
the moment the cursor passes over a service `<iframe>` the site's own document
receives the `pointermove`/`pointerup`, so a gesture that listens on `window`