mcp-inflight 0.2.0 → 0.2.2

package/README.md

@@ -1,107 +1,50 @@
-# @inflight/mcp-sandbox
+# mcp-inflight
 
-MCP server for sharing local prototypes via public URLs using CodeSandbox.
+MCP server for sharing local prototypes via [InFlight](https://www.inflight.co).
 
 ## What it does
 
-This MCP server provides a `share` tool that:
-
-1. Takes a local project directory
-2. Uploads it to a CodeSandbox VM
-3. Installs dependencies and starts the dev server
-4. Returns a public URL where the app is running
-
-Supports React, Next.js, Vite, Node.js, and static HTML projects.
+Share your local projects as live prototypes that stakeholders can interact with and provide feedback on - directly from Claude Code.
 
 ## Setup
 
-### 1. Get a CodeSandbox API Key
-
-1. Go to https://codesandbox.io and sign in (or create account)
-2. Navigate to https://codesandbox.io/t/api
-3. Click "Create Token"
-4. Copy the token
-
-### 2. Configure Claude Code
-
-Add to your Claude Code MCP config (`~/.claude/claude_code_config.json`):
-
-```json
-{
-  "mcpServers": {
-    "sandbox": {
-      "command": "node",
-      "args": ["/path/to/inflight/packages/mcp-sandbox/dist/index.js"],
-      "env": {
-        "CSB_API_KEY": "your-api-key-here"
-      }
-    }
-  }
-}
-```
-
-Or if published to npm:
+Add to your Claude Code config (`~/.claude.json`):
 
 ```json
 {
   "mcpServers": {
-    "sandbox": {
+    "inflight": {
       "command": "npx",
-      "args": ["@inflight/mcp-sandbox"],
-      "env": {
-        "CSB_API_KEY": "your-api-key-here"
-      }
+      "args": ["-y", "mcp-inflight"]
     }
   }
 }
 ```
 
-## Usage
-
-Once configured, Claude Code can share prototypes:
-
-```text
-User: "Share this React app"
+Then restart Claude Code.
 
-Claude: I'll share your project to get a public URL.
+## Usage
 
-[Calls share tool]
+Use `/share` to share your current project:
 
-Your project is live at: https://abc123-3000.csb.app
 ```
+User: /share
 
-## Tool: share
-
-### Parameters
-
-| Parameter | Type | Required | Description |
-|-----------|------|----------|-------------|
-| `path` | string | Yes | Absolute path to the project directory |
-| `port` | number | No | Port the dev server runs on (auto-detected) |
-| `command` | string | No | Custom start command (overrides auto-detection) |
-
-### Project Type Detection
-
-The tool automatically detects project types:
+Claude: Sharing your project...
+Your prototype is live at: https://www.inflight.co/v/xyz789
+```
 
-- **Next.js**: Has `next` in dependencies → port 3000, `npm run dev`
-- **Vite**: Has `vite` in dependencies → port 5173, `npm run dev`
-- **Create React App**: Has `react-scripts` → port 3000, `npm start`
-- **Node.js**: Has `express`/`fastify`/etc → port 3000, `npm start`
-- **Static**: Has `index.html` without package.json → port 3000, `npx serve .`
+## Commands
 
-## Development
+- `/share` - Share current project as a live prototype
+- `/sandbox-list` - List your deployed prototypes
+- `/sandbox-sync` - Sync changes to an existing prototype
+- `/sandbox-delete` - Delete a prototype
 
-```bash
-# Install dependencies
-pnpm install
+## Supported Projects
 
-# Build
-pnpm build
+Next.js, Vite, Create React App, Node.js, and static HTML.
 
-# Type check
-pnpm typecheck
+## License
 
-# Watch mode
-pnpm dev
-```
+MIT

package/dist/index.js

@@ -11,8 +11,8 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 
 // src/tools/deploy.ts
-import * as path4 from "path";
-import * as fs4 from "fs";
+import * as path5 from "path";
+import * as fs5 from "fs";
 
 // src/utils/detect-project.ts
 import * as fs from "fs";
@@ -46,6 +46,127 @@ function isMonorepo(projectPath, pkg) {
     (config) => fs.existsSync(path.join(projectPath, config))
   );
 }
+function getWorkspacePatterns(projectPath, pkg) {
+  if (pkg.workspaces) {
+    if (Array.isArray(pkg.workspaces)) {
+      return pkg.workspaces;
+    }
+    if (pkg.workspaces.packages) {
+      return pkg.workspaces.packages;
+    }
+  }
+  const pnpmWorkspacePath = path.join(projectPath, "pnpm-workspace.yaml");
+  if (fs.existsSync(pnpmWorkspacePath)) {
+    try {
+      const content = fs.readFileSync(pnpmWorkspacePath, "utf-8");
+      const packagesMatch = content.match(/packages:\s*\n((?:\s+-\s+['"]?[^\n]+['"]?\n?)+)/);
+      if (packagesMatch) {
+        const patterns = packagesMatch[1].split("\n").map((line) => line.trim().replace(/^-\s+['"]?|['"]?$/g, "")).filter(Boolean);
+        return patterns;
+      }
+    } catch {
+    }
+  }
+  return ["apps/*", "packages/*"];
+}
+function expandWorkspacePattern(projectPath, pattern) {
+  const results = [];
+  if (pattern.endsWith("/*")) {
+    const basePath = pattern.slice(0, -2);
+    const fullBasePath = path.join(projectPath, basePath);
+    if (fs.existsSync(fullBasePath)) {
+      try {
+        const entries = fs.readdirSync(fullBasePath, { withFileTypes: true });
+        for (const entry of entries) {
+          if (entry.isDirectory() && !entry.name.startsWith(".")) {
+            const pkgPath = path.join(fullBasePath, entry.name, "package.json");
+            if (fs.existsSync(pkgPath)) {
+              results.push(path.join(basePath, entry.name));
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  } else if (!pattern.includes("*")) {
+    const fullPath = path.join(projectPath, pattern);
+    if (fs.existsSync(path.join(fullPath, "package.json"))) {
+      results.push(pattern);
+    }
+  }
+  return results;
+}
+function detectWorkspaceType(workspacePath) {
+  const pkgPath = path.join(workspacePath, "package.json");
+  if (!fs.existsSync(pkgPath)) {
+    return { type: "node", port: 3e3, startCommand: "npm run dev", hasDevScript: false };
+  }
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    const scripts = pkg.scripts ?? {};
+    const hasDevScript = !!scripts.dev || !!scripts.start;
+    let type = "node";
+    let port = 3e3;
+    if (hasDependency(pkg, "next")) {
+      type = "nextjs";
+      port = 3e3;
+    } else if (hasDependency(pkg, "vite")) {
+      type = "vite";
+      port = 5173;
+    } else if (hasDependency(pkg, "react-scripts")) {
+      type = "cra";
+      port = 3e3;
+    }
+    if (scripts.dev) {
+      const extractedPort = extractPortFromScript(scripts.dev);
+      if (extractedPort) port = extractedPort;
+    }
+    const startCommand = scripts.dev ? "dev" : scripts.start ? "start" : "dev";
+    return { type, port, startCommand, hasDevScript };
+  } catch {
+    return { type: "node", port: 3e3, startCommand: "dev", hasDevScript: false };
+  }
+}
+function discoverMonorepoWorkspaces(projectPath, pkg) {
+  const patterns = getWorkspacePatterns(projectPath, pkg);
+  const workspaces = [];
+  for (const pattern of patterns) {
+    const expandedPaths = expandWorkspacePattern(projectPath, pattern);
+    for (const relativePath of expandedPaths) {
+      const fullPath = path.join(projectPath, relativePath);
+      const info = detectWorkspaceType(fullPath);
+      const pkgPath = path.join(fullPath, "package.json");
+      let name = path.basename(relativePath);
+      try {
+        const pkgContent = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        if (pkgContent.name) {
+          name = pkgContent.name;
+        }
+      } catch {
+      }
+      workspaces.push({
+        name,
+        path: relativePath,
+        type: info.type,
+        port: info.port,
+        startCommand: info.startCommand,
+        hasDevScript: info.hasDevScript
+      });
+    }
+  }
+  workspaces.sort((a, b) => {
+    if (a.hasDevScript !== b.hasDevScript) {
+      return a.hasDevScript ? -1 : 1;
+    }
+    const aIsApp = a.path.startsWith("apps/");
+    const bIsApp = b.path.startsWith("apps/");
+    if (aIsApp !== bIsApp) {
+      return aIsApp ? -1 : 1;
+    }
+    return a.name.localeCompare(b.name);
+  });
+  return workspaces;
+}
 function extractPortFromScript(script) {
   const portPatterns = [
     /--port[=\s]+(\d+)/,
@@ -301,6 +422,7 @@ function detectProjectType(projectPath) {
     isMonorepo: false,
     availableScripts: [],
     suggestedScripts: [],
+    workspaces: [],
     compatibility: defaultCompatibility,
     sizing
   };
@@ -339,6 +461,7 @@ function detectProjectType(projectPath) {
     type = "node";
     defaultPort = 3e3;
   }
+  const workspaces = isRepo ? discoverMonorepoWorkspaces(projectPath, packageJson) : [];
   if (bestScript) {
     return {
       type,
@@ -349,6 +472,7 @@ function detectProjectType(projectPath) {
       isMonorepo: isRepo,
       availableScripts,
       suggestedScripts,
+      workspaces,
       compatibility,
       sizing
     };
@@ -363,6 +487,7 @@ function detectProjectType(projectPath) {
     isMonorepo: isRepo,
     availableScripts,
     suggestedScripts,
+    workspaces,
     compatibility,
     sizing
   };
@@ -419,8 +544,8 @@ function readProjectFiles(projectPath, relativePath = "", includeEnvFiles = fals
   }
   return files;
 }
-var MAX_CHUNK_SIZE = 500 * 1024;
-var CHUNK_THRESHOLD = 800 * 1024;
+var MAX_CHUNK_SIZE = 2 * 1024 * 1024;
+var CHUNK_THRESHOLD = 3 * 1024 * 1024;
 function calculateTotalSize(files) {
   return Object.values(files).reduce((sum, content) => sum + content.length, 0);
 }
@@ -736,39 +861,59 @@ async function consumeSSEStream(response, onStatus, onComplete, onError) {
   }
   const decoder = new TextDecoder();
   let buffer = "";
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    buffer += decoder.decode(value, { stream: true });
-    const lines = buffer.split("\n");
-    buffer = lines.pop() || "";
-    let currentEvent = "";
-    let currentData = "";
-    for (const line of lines) {
-      if (line.startsWith("event: ")) {
-        currentEvent = line.slice(7).trim();
-      } else if (line.startsWith("data: ")) {
-        currentData = line.slice(6);
-      } else if (line === "" && currentEvent && currentData) {
-        try {
-          const data = JSON.parse(currentData);
-          switch (currentEvent) {
-            case "status":
-              onStatus(data.message);
-              break;
-            case "complete":
-              onComplete(data);
-              break;
-            case "error":
-              onError(data.message);
-              break;
+  let receivedAnyData = false;
+  let lastStatusMessage = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      receivedAnyData = true;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split("\n");
+      buffer = lines.pop() || "";
+      let currentEvent = "";
+      let currentData = "";
+      for (const line of lines) {
+        if (line.startsWith("event: ")) {
+          currentEvent = line.slice(7).trim();
+        } else if (line.startsWith("data: ")) {
+          currentData = line.slice(6);
+        } else if (line === "" && currentEvent && currentData) {
+          try {
+            const data = JSON.parse(currentData);
+            switch (currentEvent) {
+              case "status":
+                lastStatusMessage = data.message;
+                onStatus(data.message);
+                break;
+              case "complete":
+                onComplete(data);
+                break;
+              case "error":
+                onError(data.message || "Server returned an error");
+                break;
+            }
+          } catch (parseError) {
+            console.error("Failed to parse SSE data:", currentData, parseError);
+            onError(`Failed to parse server response: ${currentData.slice(0, 100)}`);
           }
-        } catch {
+          currentEvent = "";
+          currentData = "";
         }
-        currentEvent = "";
-        currentData = "";
       }
     }
+    if (!receivedAnyData) {
+      onError("Server closed connection without sending any data");
+    }
+  } catch (streamError) {
+    const errorMsg = streamError instanceof Error ? streamError.message : String(streamError);
+    if (errorMsg.includes("aborted") || errorMsg.includes("timeout")) {
+      onError(`Request timed out. Last status: ${lastStatusMessage || "none"}`);
+    } else if (errorMsg.includes("network") || errorMsg.includes("fetch")) {
+      onError(`Network error: ${errorMsg}`);
+    } else {
+      onError(`Stream error: ${errorMsg}. Last status: ${lastStatusMessage || "none"}`);
+    }
   }
 }
 async function deployProject(files, options, log) {
@@ -953,8 +1098,17 @@ async function createSandbox(options, log) {
     })
   });
   if (!response.ok) {
-    const data2 = await response.json().catch(() => ({ error: "Unknown error" }));
-    throw new APIError(data2.error || "Failed to create sandbox", response.status);
+    const text = await response.text().catch(() => "");
+    let errorMessage = `Failed to create sandbox (HTTP ${response.status})`;
+    try {
+      const data2 = JSON.parse(text);
+      errorMessage = data2.error || data2.message || errorMessage;
+    } catch {
+      if (text) {
+        errorMessage = text.slice(0, 200);
+      }
+    }
+    throw new APIError(errorMessage, response.status);
   }
   const data = await response.json();
   if (!data.success) {
@@ -983,8 +1137,17 @@ async function uploadChunk(sandboxId, files, chunkIndex, totalChunks, log) {
     })
   });
   if (!response.ok) {
-    const data2 = await response.json().catch(() => ({ error: "Unknown error" }));
-    throw new APIError(data2.error || `Failed to upload chunk ${chunkIndex}`, response.status);
+    const text = await response.text().catch(() => "");
+    let errorMessage = `Failed to upload chunk ${chunkIndex} (HTTP ${response.status})`;
+    try {
+      const data2 = JSON.parse(text);
+      errorMessage = data2.error || data2.message || errorMessage;
+    } catch {
+      if (text) {
+        errorMessage = text.slice(0, 200);
+      }
+    }
+    throw new APIError(errorMessage, response.status);
   }
   const data = await response.json();
   if (!data.success) {
@@ -1160,15 +1323,504 @@ function autoCommitForShare(projectPath, inflightVersionId) {
   }
 }
 
+// src/utils/patch-embed.ts
+function alreadyAllowsInflight(content) {
+  return content.includes("inflight.co") && (content.includes("frame-ancestors") || content.includes("X-Frame-Options"));
+}
+function checkNextConfig(content, filePath) {
+  if (alreadyAllowsInflight(content)) {
+    return { canEmbed: true, issues: [], configFile: filePath };
+  }
+  const issues = [];
+  if (content.includes("X-Frame-Options")) {
+    const xfoMatch = content.match(/X-Frame-Options['":\s]+['"]?(DENY|SAMEORIGIN)/i);
+    if (xfoMatch) {
+      issues.push(`X-Frame-Options is set to ${xfoMatch[1]} which blocks embedding`);
+    }
+  }
+  if (content.includes("frame-ancestors")) {
+    const cspMatch = content.match(/frame-ancestors['":\s]+['"]?([^'"}\n]+)/i);
+    if (cspMatch) {
+      const value = cspMatch[1].toLowerCase();
+      if ((value.includes("'none'") || value.includes("'self'")) && !value.includes("inflight")) {
+        issues.push(`CSP frame-ancestors is restrictive: ${cspMatch[1].trim()}`);
+      }
+    }
+  }
+  if (content.includes("async headers()") || content.includes("headers:")) {
+    if (issues.length === 0) {
+      issues.push("Has custom headers configuration - may need to add inflight.co to frame-ancestors");
+    }
+  }
+  return {
+    canEmbed: issues.length === 0,
+    issues,
+    configFile: filePath
+  };
+}
+function checkMiddleware(content, filePath) {
+  if (alreadyAllowsInflight(content)) {
+    return { canEmbed: true, issues: [], configFile: filePath };
+  }
+  const issues = [];
+  if (content.includes("X-Frame-Options")) {
+    const xfoMatch = content.match(/['"](X-Frame-Options)['"]\s*,\s*['"]?(DENY|SAMEORIGIN)['"]?/i);
+    if (xfoMatch) {
+      issues.push(`Middleware sets X-Frame-Options to ${xfoMatch[2]} which blocks embedding`);
+    }
+  }
+  if (content.includes("frame-ancestors")) {
+    const cspMatch = content.match(/frame-ancestors\s+([^'"}\n;]+)/i);
+    if (cspMatch) {
+      const value = cspMatch[1].toLowerCase();
+      if ((value.includes("'none'") || value.includes("'self'")) && !value.includes("inflight")) {
+        issues.push(`CSP frame-ancestors is restrictive: ${cspMatch[1].trim()}`);
+      }
+    }
+  }
+  return {
+    canEmbed: issues.length === 0,
+    issues,
+    configFile: filePath
+  };
+}
+function checkViteConfig(content, filePath) {
+  if (content.includes(".csb.app") || content.includes(".codesandbox.io")) {
+    return { canEmbed: true, issues: [], configFile: filePath };
+  }
+  const issues = [];
+  if (content.includes("allowedHosts")) {
+    const match = content.match(/allowedHosts\s*:\s*(?:'([^']*)'|"([^"]*)"|(\[[^\]]*\]))/);
+    if (match) {
+      const value = match[1] || match[2] || match[3] || "";
+      if (!value.includes(".csb.app") && !value.includes("codesandbox") && value !== "true") {
+        issues.push(`allowedHosts is restrictive - needs .csb.app and .codesandbox.io`);
+      }
+    }
+  }
+  return {
+    canEmbed: issues.length === 0,
+    issues,
+    configFile: filePath
+  };
+}
+function checkHeadersFile(content, filePath) {
+  if (alreadyAllowsInflight(content)) {
+    return { canEmbed: true, issues: [], configFile: filePath };
+  }
+  const issues = [];
+  if (content.includes("X-Frame-Options")) {
+    const xfoMatch = content.match(/X-Frame-Options:\s*(DENY|SAMEORIGIN)/i);
+    if (xfoMatch) {
+      issues.push(`_headers file sets X-Frame-Options: ${xfoMatch[1]} which blocks embedding`);
+    }
+  }
+  if (content.includes("frame-ancestors")) {
+    const cspMatch = content.match(/frame-ancestors\s+([^\n;]+)/i);
+    if (cspMatch) {
+      const value = cspMatch[1].toLowerCase();
+      if ((value.includes("'none'") || value.includes("'self'")) && !value.includes("inflight")) {
+        issues.push(`_headers file has restrictive frame-ancestors: ${cspMatch[1].trim()}`);
+      }
+    }
+  }
+  return {
+    canEmbed: issues.length === 0,
+    issues,
+    configFile: filePath
+  };
+}
+function checkVercelJson(content, filePath) {
+  if (alreadyAllowsInflight(content)) {
+    return { canEmbed: true, issues: [], configFile: filePath };
+  }
+  const issues = [];
+  try {
+    const config = JSON.parse(content);
+    if (config.headers) {
+      for (const headerConfig of config.headers) {
+        for (const header of headerConfig.headers || []) {
+          if (header.key?.toLowerCase() === "x-frame-options") {
+            if (header.value?.toUpperCase() === "DENY" || header.value?.toUpperCase() === "SAMEORIGIN") {
+              issues.push(`vercel.json sets X-Frame-Options: ${header.value} which blocks embedding`);
+            }
+          }
+          if (header.key?.toLowerCase() === "content-security-policy" && header.value?.includes("frame-ancestors")) {
+            const value = header.value.toLowerCase();
+            if ((value.includes("'none'") || value.includes("'self'")) && !value.includes("inflight")) {
+              issues.push(`vercel.json has restrictive CSP frame-ancestors`);
+            }
+          }
+        }
+      }
+    }
+  } catch {
+  }
+  return {
+    canEmbed: issues.length === 0,
+    issues,
+    configFile: filePath
+  };
+}
+function isMiddlewareFile(filePath) {
+  const fileName = filePath.split("/").pop() || "";
+  if (fileName === "middleware.ts" || fileName === "middleware.js") {
+    return true;
+  }
+  if (filePath.includes("/middleware") && (fileName.endsWith(".ts") || fileName.endsWith(".js"))) {
+    return true;
+  }
+  return false;
+}
+var INFLIGHT_FRAME_ANCESTORS = "frame-ancestors 'self' https://*.inflight.co https://inflight.co";
+function patchSupabaseCookies(content) {
+  if (!content.includes("createServerClient") || !content.includes("setAll")) {
+    return null;
+  }
+  if (content.includes("sameSite") && content.includes("none")) {
+    return null;
+  }
+  const setAllPattern = /(cookiesToSet\.forEach\s*\(\s*\(\s*\{\s*name\s*,\s*value\s*,\s*options\s*\}\s*\)\s*=>\s*)([\w.]+\.cookies\.set\s*\(\s*name\s*,\s*value\s*,\s*options\s*\))/g;
+  if (!setAllPattern.test(content)) {
+    return null;
+  }
+  setAllPattern.lastIndex = 0;
+  const patched = content.replace(setAllPattern, (_match, prefix, setCookieCall) => {
+    const patchedSetCall = setCookieCall.replace(
+      /\.cookies\.set\s*\(\s*name\s*,\s*value\s*,\s*options\s*\)/,
+      ".cookies.set(name, value, { ...options, sameSite: 'none', secure: true })"
+    );
+    return prefix + patchedSetCall;
+  });
+  return patched !== content ? patched : null;
+}
+function patchMiddleware(content) {
+  if (alreadyAllowsInflight(content)) {
+    return null;
+  }
+  if (!content.includes("X-Frame-Options")) {
+    return null;
+  }
+  const xfoRegex = /(\s*)([\w.]+\.headers\.set\s*\(\s*['"]X-Frame-Options['"]\s*,\s*['"][^'"]*['"]\s*\)\s*;?)/gi;
+  if (!xfoRegex.test(content)) {
+    return null;
+  }
+  xfoRegex.lastIndex = 0;
+  const patched = content.replace(xfoRegex, (match, indent, xfoLine) => {
+    const varMatch = xfoLine.match(/([\w.]+)\.headers\.set/);
+    const varName = varMatch ? varMatch[1] : "response";
+    const cspLine = `${indent}${varName}.headers.set("Content-Security-Policy", "${INFLIGHT_FRAME_ANCESTORS}");`;
+    return `${match}
+${cspLine}`;
+  });
+  return patched !== content ? patched : null;
+}
+function patchNextConfig(content) {
+  if (alreadyAllowsInflight(content)) {
+    return null;
+  }
+  if (!content.includes("X-Frame-Options") && !content.includes("frame-ancestors")) {
+    return null;
+  }
+  return null;
+}
+function patchHeadersFile(content) {
+  if (alreadyAllowsInflight(content)) {
+    return null;
+  }
+  if (!content.includes("X-Frame-Options") && !content.includes("frame-ancestors")) {
+    return null;
+  }
+  let patched = content;
+  patched = patched.replace(/^\s*X-Frame-Options:\s*(DENY|SAMEORIGIN)\s*$/gim, "");
+  if (patched.includes("/*")) {
+    patched = patched.replace(/(\/\*\s*\n)/, `$1  Content-Security-Policy: ${INFLIGHT_FRAME_ANCESTORS}
+`);
+  }
+  return patched !== content ? patched : null;
+}
+function patchVercelJson(content) {
+  if (alreadyAllowsInflight(content)) {
+    return null;
+  }
+  try {
+    const config = JSON.parse(content);
+    let modified = false;
+    if (config.headers) {
+      for (const headerConfig of config.headers) {
+        if (headerConfig.headers) {
+          headerConfig.headers = headerConfig.headers.filter((h) => {
+            if (h.key?.toLowerCase() === "x-frame-options") {
+              if (h.value?.toUpperCase() === "DENY" || h.value?.toUpperCase() === "SAMEORIGIN") {
+                modified = true;
+                return false;
+              }
+            }
+            return true;
+          });
+          const hasCSP = headerConfig.headers.some(
+            (h) => h.key?.toLowerCase() === "content-security-policy"
+          );
+          if (!hasCSP && modified) {
+            headerConfig.headers.push({
+              key: "Content-Security-Policy",
+              value: INFLIGHT_FRAME_ANCESTORS
+            });
+          }
+        }
+      }
+    }
+    return modified ? JSON.stringify(config, null, 2) : null;
+  } catch {
+    return null;
+  }
+}
+function patchFilesForEmbed(files) {
+  const patchedFiles = [];
+  const remainingIssues = [];
+  const result = { ...files };
+  for (const [filePath, content] of Object.entries(files)) {
+    const fileName = filePath.split("/").pop() || "";
+    let patched = null;
+    if (isMiddlewareFile(filePath)) {
+      let middlewareContent = content;
+      let middlewarePatched = false;
+      const xfoPatch = patchMiddleware(middlewareContent);
+      if (xfoPatch) {
+        middlewareContent = xfoPatch;
+        middlewarePatched = true;
+      } else if (middlewareContent.includes("X-Frame-Options") && !alreadyAllowsInflight(middlewareContent)) {
+        remainingIssues.push(`${filePath}: Could not auto-patch X-Frame-Options`);
+      }
+      const cookiePatch = patchSupabaseCookies(middlewareContent);
+      if (cookiePatch) {
+        middlewareContent = cookiePatch;
+        middlewarePatched = true;
+      }
+      if (middlewarePatched) {
+        result[filePath] = middlewareContent;
+        patchedFiles.push(filePath);
+      }
+    }
+    if (fileName === "next.config.js" || fileName === "next.config.mjs" || fileName === "next.config.ts") {
+      patched = patchNextConfig(content);
+      if (patched) {
+        result[filePath] = patched;
+        patchedFiles.push(filePath);
+      } else if ((content.includes("X-Frame-Options") || content.includes("frame-ancestors")) && !alreadyAllowsInflight(content)) {
+        remainingIssues.push(`${filePath}: Has custom headers - may need manual review`);
+      }
+    }
+    if (fileName === "_headers") {
+      patched = patchHeadersFile(content);
+      if (patched) {
+        result[filePath] = patched;
+        patchedFiles.push(filePath);
+      }
+    }
+    if (fileName === "vercel.json") {
+      patched = patchVercelJson(content);
+      if (patched) {
+        result[filePath] = patched;
+        patchedFiles.push(filePath);
+      }
+    }
+    if (filePath.includes("supabase") && fileName === "server.ts") {
+      patched = patchSupabaseCookies(content);
+      if (patched) {
+        result[filePath] = patched;
+        patchedFiles.push(filePath);
+      }
+    }
+  }
+  return {
+    files: result,
+    patchedFiles,
+    remainingIssues
+  };
+}
+function checkEmbedCompatibility(files) {
+  const allIssues = [];
+  for (const [filePath, content] of Object.entries(files)) {
+    const fileName = filePath.split("/").pop() || "";
+    if (fileName === "next.config.js" || fileName === "next.config.mjs" || fileName === "next.config.ts") {
+      const result = checkNextConfig(content, filePath);
+      if (!result.canEmbed) {
+        allIssues.push({ file: filePath, issues: result.issues });
+      }
+    }
+    if (isMiddlewareFile(filePath)) {
+      const result = checkMiddleware(content, filePath);
+      if (!result.canEmbed) {
+        allIssues.push({ file: filePath, issues: result.issues });
+      }
+    }
+    if (fileName === "vite.config.js" || fileName === "vite.config.ts") {
+      const result = checkViteConfig(content, filePath);
+      if (!result.canEmbed) {
+        allIssues.push({ file: filePath, issues: result.issues });
+      }
+    }
+    if (fileName === "_headers") {
+      const result = checkHeadersFile(content, filePath);
+      if (!result.canEmbed) {
+        allIssues.push({ file: filePath, issues: result.issues });
+      }
+    }
+    if (fileName === "vercel.json") {
+      const result = checkVercelJson(content, filePath);
+      if (!result.canEmbed) {
+        allIssues.push({ file: filePath, issues: result.issues });
+      }
+    }
+  }
+  if (allIssues.length > 0) {
+    return {
+      canEmbed: false,
+      issues: allIssues[0].issues,
+      configFile: allIssues[0].file
+    };
+  }
+  return { canEmbed: true, issues: [], configFile: null };
+}
+
+// src/utils/workspace-bundle.ts
+import * as fs4 from "fs";
+import * as path4 from "path";
+function findMonorepoRoot(startPath) {
+  let current = startPath;
+  const root = path4.parse(current).root;
+  while (current !== root) {
+    if (fs4.existsSync(path4.join(current, "pnpm-workspace.yaml"))) {
+      return current;
+    }
+    const pkgPath = path4.join(current, "package.json");
+    if (fs4.existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
+        if (pkg.workspaces) {
+          return current;
+        }
+      } catch {
+      }
+    }
+    current = path4.dirname(current);
+  }
+  return null;
+}
+function hasWorkspaceDependencies(pkgContent) {
+  try {
+    const pkg = JSON.parse(pkgContent);
+    const allDeps = {
+      ...pkg.dependencies,
+      ...pkg.devDependencies
+    };
+    for (const version of Object.values(allDeps)) {
+      if (version.startsWith("workspace:")) {
+        return true;
+      }
+    }
+  } catch {
+  }
+  return false;
+}
+function detectMonorepoDeployment(projectPath, packageManager, originalStartCommand) {
+  const pkgPath = path4.join(projectPath, "package.json");
+  if (!fs4.existsSync(pkgPath)) {
+    return {
+      rootPath: projectPath,
+      appPath: null,
+      isMonorepo: false,
+      startCommand: null,
+      installCommand: null
+    };
+  }
+  const pkgContent = fs4.readFileSync(pkgPath, "utf-8");
+  if (!hasWorkspaceDependencies(pkgContent)) {
+    return {
+      rootPath: projectPath,
+      appPath: null,
+      isMonorepo: false,
+      startCommand: null,
+      installCommand: null
+    };
+  }
+  const monorepoRoot = findMonorepoRoot(projectPath);
+  if (!monorepoRoot || monorepoRoot === projectPath) {
+    return {
+      rootPath: projectPath,
+      appPath: null,
+      isMonorepo: false,
+      startCommand: null,
+      installCommand: null
+    };
+  }
+  const appPath = path4.relative(monorepoRoot, projectPath);
+  let packageName = null;
+  try {
+    const pkg = JSON.parse(pkgContent);
+    packageName = pkg.name || null;
+  } catch {
+  }
+  let startCommand;
+  let installCommand;
+  if (packageManager === "pnpm") {
+    const scriptMatch = originalStartCommand.match(/(?:pnpm|npm run|yarn)\s+(\S+)/);
+    const scriptName = scriptMatch ? scriptMatch[1] : "dev";
+    if (packageName) {
+      startCommand = `pnpm --filter "${packageName}" ${scriptName}`;
+    } else {
+      startCommand = `pnpm --filter "./${appPath}" ${scriptName}`;
+    }
+    installCommand = "pnpm install";
+  } else if (packageManager === "yarn") {
+    const scriptMatch = originalStartCommand.match(/(?:yarn|npm run)\s+(\S+)/);
+    const scriptName = scriptMatch ? scriptMatch[1] : "dev";
+    if (packageName) {
+      startCommand = `yarn workspace ${packageName} ${scriptName}`;
+    } else {
+      startCommand = `cd ${appPath} && yarn ${scriptName}`;
+    }
+    installCommand = "yarn install";
+  } else {
+    const scriptMatch = originalStartCommand.match(/(?:npm run|npm)\s+(\S+)/);
+    const scriptName = scriptMatch ? scriptMatch[1] : "dev";
+    if (packageName) {
+      startCommand = `npm run ${scriptName} --workspace=${packageName}`;
+    } else {
+      startCommand = `cd ${appPath} && npm run ${scriptName}`;
+    }
+    installCommand = "npm install";
+  }
+  return {
+    rootPath: monorepoRoot,
+    appPath,
+    isMonorepo: true,
+    startCommand,
+    installCommand
+  };
+}
+function readMonorepoFiles(projectPath, packageManager, originalStartCommand, includeEnvFiles = false) {
+  const monorepoResult = detectMonorepoDeployment(projectPath, packageManager, originalStartCommand);
+  const files = readProjectFiles(monorepoResult.rootPath, "", includeEnvFiles);
+  return {
+    files,
+    rootPath: monorepoResult.rootPath,
+    isMonorepo: monorepoResult.isMonorepo,
+    startCommand: monorepoResult.startCommand,
+    installCommand: monorepoResult.installCommand
+  };
+}
+
 // src/tools/deploy.ts
 async function deployPrototype(args, log) {
   const startTime = Date.now();
   await log(`Starting share for: ${args.path}`);
-  const projectPath = path4.resolve(args.path);
-  if (!fs4.existsSync(projectPath)) {
+  const projectPath = path5.resolve(args.path);
+  if (!fs5.existsSync(projectPath)) {
     throw new Error(`Project path does not exist: ${projectPath}`);
   }
-  if (!fs4.statSync(projectPath).isDirectory()) {
+  if (!fs5.statSync(projectPath).isDirectory()) {
     throw new Error(`Path is not a directory: ${projectPath}`);
   }
   if (!isAuthenticated()) {
@@ -1217,17 +1869,55 @@ async function deployPrototype(args, log) {
   if (includeEnv) {
     await log("Including .env files as requested");
   }
-  const files = readProjectFiles(projectPath, "", includeEnv);
+  const monorepoResult = readMonorepoFiles(
+    projectPath,
+    projectInfo.detectedPackageManager,
+    projectInfo.startCommand,
+    includeEnv
+  );
+  let files = monorepoResult.files;
   const fileCount = Object.keys(files).length;
-  const totalSize = Object.values(files).reduce((sum, content) => sum + content.length, 0);
-  await log(`Found ${fileCount} files (${(totalSize / 1024).toFixed(1)} KB)`);
   if (fileCount === 0) {
     throw new Error("No files found in project directory");
   }
+  if (monorepoResult.isMonorepo) {
+    await log(`Monorepo detected - including full workspace from ${path5.basename(monorepoResult.rootPath)}`);
+    if (monorepoResult.startCommand) {
+      projectInfo.startCommand = monorepoResult.startCommand;
+      await log(`Adjusted start command: ${projectInfo.startCommand}`);
+    }
+    if (monorepoResult.installCommand) {
+      projectInfo.installCommand = monorepoResult.installCommand;
+      await log(`Adjusted install command: ${projectInfo.installCommand}`);
+    }
+  }
+  let embedCheck = checkEmbedCompatibility(files);
+  if (!embedCheck.canEmbed) {
+    await log(`Embedding issues detected in ${embedCheck.configFile}:`, "warning");
+    for (const issue of embedCheck.issues) {
+      await log(`  - ${issue}`, "warning");
+    }
+    await log("Patching files to allow InFlight embedding...");
+    const patchResult = patchFilesForEmbed(files);
+    if (patchResult.patchedFiles.length > 0) {
+      files = patchResult.files;
+      for (const patchedFile of patchResult.patchedFiles) {
+        await log(`  \u2713 Patched: ${patchedFile}`);
+      }
+      embedCheck = checkEmbedCompatibility(files);
+    }
+    if (patchResult.remainingIssues.length > 0) {
+      for (const issue of patchResult.remainingIssues) {
+        await log(`  \u26A0\uFE0F ${issue}`, "warning");
+      }
+    }
+  }
+  const totalSize = Object.values(files).reduce((sum, content) => sum + content.length, 0);
+  await log(`Found ${fileCount} files (${(totalSize / 1024 / 1024).toFixed(1)} MB)`);
   let existingSandbox;
   try {
     const sandboxes = await listSandboxes();
-    const projectName = path4.basename(projectPath);
+    const projectName = path5.basename(projectPath);
     existingSandbox = sandboxes.find(
       (s) => s.projectName === projectName && s.status === "running"
     );
@@ -1257,7 +1947,13 @@ async function deployPrototype(args, log) {
         projectType: projectInfo.type,
         synced: true,
         inflightUrl,
-        inflightVersionId
+        inflightVersionId,
+        startCommand: projectInfo.startCommand,
+        port: projectInfo.port,
+        packageManager: projectInfo.detectedPackageManager,
+        isMonorepo: projectInfo.isMonorepo,
+        vmTier: projectInfo.sizing.recommendedTier,
+        embedCheck
       };
       const elapsed = ((Date.now() - startTime) / 1e3).toFixed(1);
       await log(`Sync complete in ${elapsed}s`);
@@ -1282,7 +1978,7 @@ async function deployPrototype(args, log) {
           startCommand: projectInfo.startCommand,
           port: projectInfo.port,
           vmTier: projectInfo.sizing.recommendedTier,
-          projectName: path4.basename(projectPath),
+          projectName: path5.basename(projectPath),
           workspaceId: args.workspaceId,
           gitInfo: gitInfo || void 0
         },
@@ -1294,7 +1990,13 @@ async function deployPrototype(args, log) {
         projectType: projectInfo.type,
         synced: false,
         inflightUrl: deployResult.inflightUrl,
-        inflightVersionId: deployResult.versionId
+        inflightVersionId: deployResult.versionId,
+        startCommand: projectInfo.startCommand,
+        port: projectInfo.port,
+        packageManager: projectInfo.detectedPackageManager,
+        isMonorepo: projectInfo.isMonorepo,
+        vmTier: projectInfo.sizing.recommendedTier,
+        embedCheck
       };
     } else {
       await log("Deploying via InFlight API...");
@@ -1306,7 +2008,7 @@ async function deployPrototype(args, log) {
           startCommand: projectInfo.startCommand,
           port: projectInfo.port,
           vmTier: projectInfo.sizing.recommendedTier,
-          projectName: path4.basename(projectPath),
+          projectName: path5.basename(projectPath),
           workspaceId: args.workspaceId,
           gitInfo: gitInfo || void 0
         },
@@ -1318,7 +2020,13 @@ async function deployPrototype(args, log) {
         projectType: projectInfo.type,
         synced: false,
         inflightUrl: deployResult.inflightUrl,
-        inflightVersionId: deployResult.versionId
+        inflightVersionId: deployResult.versionId,
+        startCommand: projectInfo.startCommand,
+        port: projectInfo.port,
+        packageManager: projectInfo.detectedPackageManager,
+        isMonorepo: projectInfo.isMonorepo,
+        vmTier: projectInfo.sizing.recommendedTier,
+        embedCheck
       };
     }
     const elapsed = ((Date.now() - startTime) / 1e3).toFixed(1);
@@ -1340,13 +2048,13 @@ async function deployPrototype(args, log) {
 }
 
 // src/server.ts
-import * as path5 from "path";
-import * as fs5 from "fs";
+import * as path6 from "path";
+import * as fs6 from "fs";
 function createServer2() {
   const server = new Server(
     {
       name: "mcp-inflight",
-      version: "0.2.0"
+      version: "0.2.2"
     },
     {
       capabilities: {
@@ -1370,21 +2078,21 @@ function createServer2() {
       tools: [
         {
           name: "share",
-          description: "Share a local project by deploying it to a public URL and creating an InFlight version for feedback. Supports React, Next.js, Vite, Node.js, and static HTML projects. Returns the InFlight URL. Requires InFlight authentication (will prompt if not authenticated).",
+          description: "Share a local project by deploying it to a public URL and creating an InFlight version for feedback. IMPORTANT: Before calling this tool, you MUST check for iframe embedding blockers: 1. Search for middleware.ts files and check for X-Frame-Options headers (DENY or SAMEORIGIN block embedding). 2. Check next.config.js/ts for headers() that set X-Frame-Options or restrictive frame-ancestors. 3. If blocking headers are found, ask the user if you should add a CSP frame-ancestors header to allow inflight.co to embed the prototype.    The fix is to add: Content-Security-Policy: frame-ancestors 'self' https://*.inflight.co https://inflight.co 4. For monorepos, determine which app/package to deploy and provide the specific path. 5. Check package.json scripts to find the correct dev command and port. Common patterns: Next.js (port 3000), Vite (port 5173), CRA (port 3000). Returns detected configuration, embed check results, and InFlight URL. Requires InFlight authentication.",
           inputSchema: {
             type: "object",
             properties: {
               path: {
                 type: "string",
-                description: "Absolute path to the project directory to share"
+                description: "Absolute path to the project directory to share. For monorepos, provide the path to the specific app/package (e.g., '/path/to/monorepo/apps/web')."
               },
               port: {
                 type: "number",
-                description: "Port the dev server runs on (optional, auto-detected based on project type)"
+                description: "Port the dev server runs on. Auto-detected from package.json scripts, but provide explicitly if known (e.g., from 'next dev -p 3001')."
               },
               command: {
                 type: "string",
-                description: "Custom start command (optional, overrides auto-detection). Example: 'npm run dev' or 'node server.js'"
+                description: "Start command for the dev server. Auto-detected but provide explicitly for custom setups. Examples: 'npm run dev', 'pnpm dev', 'node server.js'."
               },
               includeEnvFiles: {
                 type: "boolean",
@@ -1479,7 +2187,17 @@ function createServer2() {
               text: JSON.stringify(
                 {
                   success: true,
-                  projectType: result.projectType,
+                  // Detected configuration - communicate this to the user
+                  detectedConfig: {
+                    projectType: result.projectType,
+                    startCommand: result.startCommand,
+                    port: result.port,
+                    packageManager: result.packageManager,
+                    isMonorepo: result.isMonorepo,
+                    vmTier: result.vmTier
+                  },
+                  // Embed check results - shows if there are iframe embedding issues
+                  embedCheck: result.embedCheck,
                   synced: result.synced ?? false,
                   inflightUrl: result.inflightUrl,
                   inflightVersionId: result.inflightVersionId,
@@ -1498,8 +2216,8 @@ function createServer2() {
           await log("Authenticating with InFlight...");
           await authenticate(log);
         }
-        const resolvedPath = path5.resolve(projectPath);
-        if (!fs5.existsSync(resolvedPath)) {
+        const resolvedPath = path6.resolve(projectPath);
+        if (!fs6.existsSync(resolvedPath)) {
           throw new Error(`Project path does not exist: ${resolvedPath}`);
         }
         const files = readProjectFiles(resolvedPath, "", includeEnvFiles ?? false);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-inflight",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "MCP server for sharing prototypes via InFlight",
   "author": "InFlight <hello@inflight.co>",
   "homepage": "https://github.com/inflight/mcp-inflight",