SizeItUp

あなたのゲームですか？

Gamesdleの中でそのまま遊べるようにしましょう。このプロンプトをAIコーディングエージェント（Claude Code、Cursor、Copilotなど）に貼り付けるか、サイトの管理者に送ってください。

My web game at https://sizeitup.us/ needs to be playable inside an iframe on https://gamesdle.bid (a directory of daily games that embeds games in its page).

Right now the browser refuses to show it in a frame because the page is served with:
  Content-Security-Policy: ... frame-ancestors 'self' https://alldle.net https://www.alldle.net ...

Please make these changes, keeping everything else about the site the same:

1. Send this on every HTML response (merge it into the existing Content-Security-Policy if there is one; keep any other origins that are already allowed):
   Content-Security-Policy: frame-ancestors 'self' https://alldle.net https://www.alldle.net https://gamesdle.bid
2. Remove the X-Frame-Options header. It cannot allow one specific outside site, and frame-ancestors replaces it in all current browsers.
3. Find where headers are set. Common places: public/_headers (Cloudflare Pages, Netlify), vercel.json "headers", next.config.js headers(), nuxt/vite server config, nginx add_header, Apache Header set, Express/helmet (frameguard and contentSecurityPolicy.frameAncestors), a Cloudflare Worker or other edge function, or a CDN response-header rule.
4. Search the client code for frame-busting such as `if (top !== self) top.location = ...`, `window.top.location`, or code that hides the page when `window.self !== window.top`, and remove it or allow it to run when the parent is https://gamesdle.bid.
5. Inside a cross-site iframe, browsers may block or partition third-party cookies and storage. If saving progress or signing in depends on cookies, make sure the game still starts and plays without them (localStorage is fine; it is kept separately per embedding site).

When it is deployed, verify with:
  curl -sI https://sizeitup.us/ | grep -iE 'x-frame-options|content-security-policy'
The output should include frame-ancestors with https://gamesdle.bid and no X-Frame-Options DENY or SAMEORIGIN.