Add browser-tab MCP demo

[mmkal]

Summary

Adds a tabbed in-browser demo to www.captun.sh so visitors can switch the editable fetch handler between:

• hello world, a tiny default response
• chat room, the existing browser-backed chat demo
• mcp server, a browser-tab MCP server sample using the MCP SDK from esm.sh

The MCP sample exposes an ask_question tool backed by window.prompt(...), keeps MCP streamable HTTP transports by session id, and handles browser CORS explicitly in the visible snippet with withCors(...).

The hosted landing page now keeps the page script and demo snippets as readable dedented JavaScript source blocks before inserting them into the HTML, so the source no longer has to maintain deeply escaped inline JS strings.

Also makes the hosted landing page available on loopback dev origins and pins the hosted Wrangler config to the Iterate production account with the live captun.sh/* and *.captun.sh/* routes.

Verification

• pnpm exec vitest run test/hosted-worker.test.ts
• pnpm exec oxfmt --check src/hosted/site.ts test/hosted-worker.test.ts wrangler.hosted.jsonc
• pnpm exec oxlint src/hosted/site.ts test/hosted-worker.test.ts --threads 1 --deny-warnings
• pnpm run typecheck
• pnpm exec wrangler deploy -c wrangler.hosted.jsonc --dry-run --outdir /tmp/captun-hosted-dry-run-ignoreme
• wrangler dev src/hosted/worker.ts --name captun-public-local --compatibility-date 2026-05-15 --ip 127.0.0.1 --port 8789 --local --var CUSTOM_HOSTNAME:captun.sh, then curl/browser smoke checks for /, /captun.browser.js, and the MCP tab source
• CAPTUN_PUBLIC_E2E=1 pnpm exec vitest run test/public-hosted.test.ts

Live deploy

Deployed the browser-tab MCP demo to captun-public as Worker version 76c8c2dd-1b34-4bcb-b006-6295a9df5751, and verified https://www.captun.sh/ serves the tabbed demo and explicit withCors MCP snippet. The latest source-readability refactor is verified locally and by Wrangler dry-run, but has not been redeployed.

---

Note

Medium Risk
Pins live Cloudflare routes/account and expands the public demo surface (user-run code, MCP/CORS); core tunnel auth logic is largely unchanged but deploy misconfiguration would hit production.

Overview
Adds a tabbed in-browser demo on the hosted landing page (hello world, chat room, MCP server) with editable snippets built from dedented TypeScript source instead of heavily escaped inline HTML/JS.

The MCP tab runs streamable HTTP in the tab (SDK via esm.sh), an ask_question tool backed by window.prompt, per-session transports, and explicit CORS in the visible snippet. Tunnel teardown uses Symbol.dispose; creating a tunnel re-evaluates the editor (live edit-on-type refresh is removed).

/captun.browser.js is now produced at build time: esbuild bundles src/index.ts for the browser (external capnweb on esm.sh) into browser-module.generated.ts, wired into build / deploy.

Loopback dev serves the landing and captun.browser.js on localhost and uses folder-style tunnel paths (e.g. /demo/...). wrangler.hosted.jsonc pins the production account and captun.sh / *.captun.sh routes and sets keep_names: false.

^{Reviewed by Cursor Bugbot for commit d6e54b8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/captun@24

commit: d6e54b8

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 040a4dc. Configure here.}