sparkecoder 0.1.93 → 0.1.95

package/web/.next/standalone/web/next.config.ts

@@ -1,12 +1,62 @@
 import type { NextConfig } from "next";
 import createMDX from "@next/mdx";
 
+// Origins allowed to iframe `/embed/:id` pages. Comma-separated list.
+//
+// The personal-agents dashboard's TaskDrawer iframes `${webUrl}/embed/${sparkTaskId}`
+// to show the live SparkECoder session inside the dashboard. By default both
+// Next.js and Cloudflare Tunnel emit `X-Frame-Options: SAMEORIGIN`, which
+// blocks that. We explicitly allow the dashboard origins (and localhost
+// during dev) on `/embed/:path*` only — every other route stays
+// frame-locked.
+//
+// Override at runtime with EMBED_FRAME_ANCESTORS, e.g.:
+//   EMBED_FRAME_ANCESTORS="https://personal-agents.studyfetchcms.com,http://localhost:3000"
+const DEFAULT_EMBED_FRAME_ANCESTORS = [
+  "https://personal-agents.studyfetchcms.com",
+  "http://localhost:3000",
+  "http://localhost:3001",
+  "https://sparkecoder.com",
+  "https://sparkecode.com",
+];
+const embedFrameAncestors = (
+  process.env.EMBED_FRAME_ANCESTORS?.split(",")
+    .map((s) => s.trim())
+    .filter(Boolean) ?? DEFAULT_EMBED_FRAME_ANCESTORS
+).join(" ");
+
 const nextConfig: NextConfig = {
   // Output standalone build for npm package distribution
   // This creates a self-contained build that doesn't need source files
   output: "standalone",
   // Configure `pageExtensions` to include markdown and MDX files
   pageExtensions: ["js", "jsx", "md", "mdx", "ts", "tsx"],
+  async headers() {
+    return [
+      {
+        // Only the embed route opts out of the default frame-deny posture.
+        source: "/embed/:path*",
+        headers: [
+          {
+            // CSP frame-ancestors is the modern way to allow specific
+            // embedders. `'self'` keeps same-origin embedding working
+            // (the live preview opens the same URL in a new tab).
+            key: "Content-Security-Policy",
+            value: `frame-ancestors 'self' ${embedFrameAncestors}`,
+          },
+          {
+            // Modern browsers honour CSP over XFO when both are present,
+            // but we override XFO too for older clients. There's no
+            // standard "allow these origins" XFO value, so we just remove
+            // it by setting a no-op string browsers ignore. (DENY would
+            // re-block; SAMEORIGIN is what we're getting today.)
+            key: "X-Frame-Options",
+            value: "ALLOWALL",
+          },
+        ],
+      },
+    ];
+  },
 };
 
 const withMDX = createMDX({