@kolbo/mcp 1.87.10 → 1.87.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/package.json +1 -1
  2. package/src/apps/index.js +6 -5
  3. package/src/apps/theme.js +444 -446
  4. package/src/apps/widgets/plans.js +164 -113
  5. package/src/tools/blender.js +62 -57
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@kolbo/mcp",
3
- "version": "1.87.10",
3
+ "version": "1.87.12",
4
4
  "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
5
5
  "main": "src/index.js",
6
6
  "bin": {
package/src/apps/index.js CHANGED
@@ -146,11 +146,12 @@ const WIDGET_CSP = {
146
146
  // the in-chat XHR is CSP-blocked and every claude.ai upload fails silently.
147
147
  'https://upload-api.kolbo.ai',
148
148
  ],
149
- // Nested iframes. Empty/omitted → frame-src 'none' and the live pricing
150
- // embed inside the upgrade card is a blank box.
151
- frameDomains: [
152
- 'https://app.kolbo.ai',
153
- ],
149
+ // Nested iframes: NONE. The plans card used to iframe app.kolbo.ai/pricing;
150
+ // OpenAI rejected the ChatGPT app for it (2026-09-06: "frameDomains is
151
+ // reserved for limited cases where embedding a third-party experience is
152
+ // essential"). Every card renders from structuredContent and opens Kolbo in a
153
+ // new tab instead. Adding a host here re-triggers that rejection.
154
+ frameDomains: [],
154
155
  };
155
156
 
156
157
  /** Register all Kolbo widget resources on an McpServer. */