sitedrift 0.3.4 → 0.3.6

package/AGENTS.md

@@ -107,6 +107,6 @@ LIVE render on separate origins. Never expose sitedrift through a public proxy.
 
 The optional Cloudflare Pages addon is intentionally public-preview safe: it is
 installed only on non-production builds, exposes only `/__sitedrift/*`, permits
-only `GET` and `HEAD`, allowlists one configured live origin, and sandboxes both
-frames without same-origin authority. Production output and existing API
-Functions are unchanged.
+only `GET` and `HEAD`, and allowlists one configured live origin. Hosted frames
+execute the compared site's scripts and must be used only with trusted preview
+code. Production output and existing API Functions are unchanged.

package/README.md

@@ -97,8 +97,9 @@ when `CF_PAGES=1` and `CF_PAGES_BRANCH` is not `main`. Production builds are
 left unchanged. Use `--production-branch <name>` when production is another
 branch.
 
-Hosted proxies are read-only (`GET`/`HEAD`), sandboxed without same-origin
-authority, and fixed to the configured live origin. Review notes stay in that
+Hosted proxies are read-only (`GET`/`HEAD`) and fixed to the configured live
+origin. Frames run the compared site's scripts so interactive previews behave
+like the deployment; only enable the addon for preview code you trust. Review notes stay in that
 browser's `localStorage`; they are not sent to an API, shared with agents, or
 written to disk. Existing application Functions keep their original routes.
 

package/assets/viewer.js

@@ -4,10 +4,9 @@
       config.dev = location.origin;
       config.frameOrigins = { dev: location.origin, live: location.origin };
       for (const iframe of document.querySelectorAll('iframe[data-side]')) {
-        // Same-origin is required for Safari to apply `style-src 'self'` inside
-        // the frame. Scripts stay disabled so framed site code cannot reach
-        // the same-origin sitedrift parent.
-        iframe.setAttribute('sandbox', 'allow-downloads allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox allow-same-origin');
+        // Safari requires same-origin for `style-src 'self'`; scripts are
+        // required for the preview to behave like the deployed application.
+        iframe.setAttribute('sandbox', 'allow-downloads allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts');
       }
     }
     const root = document.documentElement;
@@ -506,7 +505,6 @@
         runFrameKey(message.key, side, message);
       }
     });
-
     scrollButton.addEventListener('click', () => {
       syncScroll = !syncScroll;
       scrollButton.classList.toggle('active', syncScroll);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sitedrift",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Catch the drift between dev and live — frame your local site and production side-by-side on the same route, locked scroll, with a difference-blend overlay. Zero runtime dependencies.",
   "type": "module",
   "bin": {