Replace codetabs with first-party proxy

.gitignore

@@ -6,3 +6,4 @@ node_modules
 .env
 .env.*
 !.env.example
+/.vercel

AGENTS.md

@@ -20,6 +20,6 @@
 - The `prepare` script (`svelte-kit sync`) runs automatically during `npm install`. If you see import errors for `$app/*` modules, re-run `npm install`.
 - The dev server uses Vite's default port **5173**. Pass `--host 0.0.0.0` to expose it outside localhost: `npm run dev -- --host 0.0.0.0`.
 - Requires **Node.js >= 24** (`engines` field in `package.json`). Use `nvm use 24` if multiple versions are installed.
-- Preview functionality depends on the external CORS proxy `api.codetabs.com`. If previews fail to load, this third-party service may be down.
+- Preview functionality uses the internal `/api/proxy` endpoint. Configure `PROXY_ALLOWED_ORIGINS` with deployment origins (comma separated) to restrict CORS.
 - `svelte-preprocess` deprecation warnings about "defaults" are expected and harmless.
 - The `package-lock.json` uses npm; do not mix with other package managers.

README.md

@@ -28,6 +28,24 @@ npm i
 npm run dev -- --open
 ```
 
+## Proxy Configuration
+
+Preview fetching now uses the first-party SvelteKit endpoint at `/api/proxy` (instead of `api.codetabs.com`), which requires a server adapter such as Vercel.
+
+To lock down CORS for your deployment domain(s), configure:
+
+```sh
+PROXY_ALLOWED_ORIGINS=https://static-preview.vercel.app,http://localhost:5173
+```
+
+Security constraints in `/api/proxy`:
+
+- only proxies `https://raw.githubusercontent.com/...` URLs
+- only proxies GitLab `https://gitlab.com/.../-/raw/...` URLs
+- rejects non-HTTPS targets, query strings, and path traversal
+- allows requests only from configured origins (checks `Origin` then `Referer`)
+- enforces a max upstream payload size of 5 MiB
+
 ## Testing
 
 We use [Jest](https://jestjs.io/) for unit testing. Only URL parsing is tested to prevent regressions.

eslint.config.js

@@ -15,6 +15,7 @@ export default [
       '.DS_Store',
       'node_modules/**',
       'build/**',
+      '.vercel/**',
       '.svelte-kit/**',
       'package/**',
       '.env',