From e284ef882b6cfd156103be9ccc7a3c9a3e69c2ff Mon Sep 17 00:00:00 2001
From: Paul Bakaus <paul.bakaus@gmail.com>
Date: Thu, 9 Apr 2026 08:08:04 -0700
Subject: [PATCH] Fix visual-mode iframe blocked by X-Frame-Options: DENY

The global _headers rule set DENY for all paths, preventing the
/visual-mode/ page from embedding /antipattern-examples/ in an iframe.
Add a path-specific SAMEORIGIN override for /antipattern-examples/*.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 scripts/build.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/build.js b/scripts/build.js
index d55d1147b..e2a3759ba 100644
--- a/scripts/build.js
+++ b/scripts/build.js
@@ -503,6 +503,10 @@ function generateCFConfig(buildDir) {
 /antipattern-images/*
   Cache-Control: public, max-age=604800, stale-while-revalidate=86400
 
+# Antipattern examples: allow same-origin framing (visual-mode page embeds these)
+/antipattern-examples/*
+  X-Frame-Options: SAMEORIGIN
+
 # Root static assets (favicon, og-image, etc.)
 /favicon.svg
   Cache-Control: public, max-age=604800, stale-while-revalidate=86400