feat(landing): add HubSpot tracking script for hosted marketing site by waleedlatif1 · Pull Request #5565 · simstudioai/sim

waleedlatif1 · 2026-07-10T18:03:42Z

Summary

Add the HubSpot tracking script (loader js-na2.hs-scripts.com/246720681.js) to the landing route group only, gated by isHosted — never loads for self-hosted/OSS deployments
Loaded via next/script with strategy='afterInteractive' (matches the existing GTM/GA pattern in the root layout), so it doesn't block hydration or affect LCP/CLS/SEO — landing content is server-rendered regardless
Update CSP (script-src/connect-src) to allow the loader plus the companion scripts it injects (analytics, form-tracking, banner) and their beacon hosts, verified against the actual scripts' real network calls, not guessed

Type of Change

New feature

Testing

Tested manually — verified the built CSP string programmatically against every real HubSpot host observed from the live scripts. bun run lint and CSP unit tests pass.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

- Loads the HubSpot loader in the landing route group only, gated by isHosted - Not loaded for self-hosted/OSS deployments - Adds the loader's companion scripts (analytics, form-tracking, banner) and their beacon hosts to CSP, verified against the actual scripts' network calls

vercel · 2026-07-10T18:03:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 10, 2026 7:18pm

cursor · 2026-07-10T18:03:54Z

PR Summary

Low Risk
Marketing-only third-party script gated by isHosted, with CSP allowlists; large deletions are unused dev preview tooling, not production app paths.

Overview
Adds HubSpot analytics on the hosted marketing site only (isHosted): the landing layout loads the HubSpot script via next/script (afterInteractive) and mounts a client HubspotPageViewTracker that pushes setPath + trackPageView through _hsq on client-side route changes (skipping the first load so it doesn’t double-count the loader’s initial pageview).

CSP is extended for hosted builds so script-src and connect-src allow the loader and the analytics, form-tracking, and banner scripts/hosts HubSpot injects.

Cleanup: removes temporary app/landing-preview/* dev routes (landing preview, marks lab, README tour capture) and drops SandboxWorkspacePermissionsProvider, which only supported the capture harness.

^{Reviewed by Cursor Bugbot for commit 8a9a3c9. Configure here.}

greptile-apps · 2026-07-10T18:05:39Z

Greptile Summary

This PR adds HubSpot tracking for the hosted marketing site. The main changes are:

Adds the HubSpot loader to the landing layout behind the hosted deployment flag.
Tracks client-side landing page navigations with a small client component.
Updates the hosted CSP to allow the HubSpot script and form-tracking hosts.
Removes the temporary landing-preview routes and their sandbox permissions helper.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/app/(landing)/layout.tsx	Adds the hosted-only HubSpot script and wraps the page-view tracker in Suspense.
apps/sim/app/(landing)/hubspot-page-view-tracker.tsx	Adds client-side HubSpot page-view tracking for landing route navigation.
apps/sim/lib/core/security/csp.ts	Adds hosted HubSpot script and form-tracking hosts to the shared CSP.
apps/sim/app/workspace/[workspaceId]/providers/workspace-permissions-provider.tsx	Removes the sandbox permissions provider used by deleted preview scaffolding.

_{Reviews (11): Last reviewed commit: "fix(csp): drop overbroad *.hubspot.com c..." | Re-trigger Greptile}

Greptile flagged that the HubSpot script/connect hosts were added to the shared CSP arrays used by every route, including /workspace, /login, and /signup — even though the HubSpot loader only ever renders inside the (landing) route group. - Move the HubSpot hosts out of STATIC_SCRIPT_SRC/STATIC_CONNECT_SRC - Add generateLandingRuntimeCSP(), which extends the shared runtime policy with the HubSpot hosts, mirroring the existing getChatEmbedCSPPolicy() pattern for route-scoped CSP variants - Wire it into proxy.ts's catch-all branch, which is what actually serves the marketing/landing site; /workspace, /login, /signup keep the unmodified shared policy

Cursor Bugbot flagged that the HubSpot loader only auto-fires a pageview on the initial load. Since LandingLayout persists across client-side navigations between landing routes, subsequent Link navigations never told HubSpot about the route change, undercounting pageviews. Add HubspotPageViewTracker, a small client component using the standard Next.js App Router pattern (usePathname/useSearchParams in a Suspense boundary) to push a manual pageview through HubSpot's _hsq queue on every navigation after the first.

waleedlatif1 · 2026-07-10T18:15:43Z

@greptile

waleedlatif1 · 2026-07-10T18:15:44Z

@cursor review

…acker usePathname() alone doesn't require a Suspense boundary to preserve static rendering — only useSearchParams() does. The tracker only needs the path, not the query string, so drop useSearchParams and the Suspense wrapper entirely. Simpler, and no risk to the landing site's static rendering/LCP.

Greptile's second pass caught that proxy.ts's catch-all branch (which serves generateLandingRuntimeCSP()) also handles several non-landing pages that fall through the earlier explicit branches: /verify, /sso, /reset-password (auth sub-pages), /resume/[workflowId] (interfaces), /f/[token] (file shares), /playground, and the authenticated/callbackUrl invite fallthrough. None of these render the HubSpot loader, so they shouldn't get its CSP allowance either. Add an explicit non-landing path prefix list and only fall back to generateRuntimeCSP() (the tight policy) for those, keeping generateLandingRuntimeCSP() for everything else in the catch-all.

…unt bug - Greptile correctly flagged /unsubscribe as another top-level page outside (landing) that reaches the CSP fallback branch; add it to the exclusion list - Cursor caught that the per-mount useRef in HubspotPageViewTracker resets whenever LandingLayout remounts (e.g. leaving the landing site and coming back), but next/script dedupes the loader by id and won't re-fire the auto-tracked pageview on remount — so that return visit was silently dropped. Move the flag to module scope so it reflects the actual once-per-browser-session lifetime of the loader script, not per-mount

waleedlatif1 · 2026-07-10T18:24:38Z

@greptile

waleedlatif1 · 2026-07-10T18:24:40Z

@cursor review

Cursor caught that the tracker only depended on usePathname(), so client-side navigations that change only the query string (blog/library pagination, careers filters) never fired a pageview at all, and setPath dropped the search string even when the path did change. Add useSearchParams() back (the officially documented Next.js pattern for tracking all route changes) and depend on the full path+query string. Wrap the tracker in a local Suspense boundary, as required to keep the route statically rendered — the fallback is null and the component renders nothing, so this has no LCP/visual cost.

waleedlatif1 · 2026-07-10T18:30:19Z

@greptile

waleedlatif1 · 2026-07-10T18:30:20Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 79d108a. Configure here.}

Exports isNonLandingPath and covers the exact prefix-boundary cases (e.g. /f vs /ffoo, /resume vs /resumes) that the CSP routing fix depends on, so this logic is verified by CI rather than my own ad-hoc checks.

It was a temporary route for visual iteration (404s in production) — not needed anymore, and Greptile had just flagged it as another route that falsely inherited the landing CSP allowance. Removing it outright is simpler than maintaining an exclusion for it. Also removes SandboxWorkspacePermissionsProvider, which existed solely to support the deleted readme-tour-capture page and has no other callers.

waleedlatif1 · 2026-07-10T18:46:08Z

@greptile

waleedlatif1 · 2026-07-10T18:46:10Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ae92f4e. Configure here.}

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6807b4e. Configure here.}

- Fixed HUBSPOT_SCRIPT_SRC/HUBSPOT_CONNECT_SRC: 'as const' cannot wrap a ternary expression directly (TS1355) — caught by a full project typecheck I ran specifically to verify this PR, not by lint/tests alone. Rewrote using the same conditional-spread-inside-array-literal pattern already used by every other array in this file (e.g. STATIC_FRAME_SRC) - Trimmed comments across all four touched files down to only the non-obvious 'why' (module-scope tracking flag, HubSpot CSP scoping rationale), matching this codebase's terse comment style elsewhere

waleedlatif1 · 2026-07-10T18:54:57Z

@greptile

waleedlatif1 · 2026-07-10T18:54:58Z

@cursor review

…olicy Cursor caught a fundamental problem with the landing-scoped CSP: the Content-Security-Policy header is fixed to the document's initial HTTP response and is NOT re-applied on Next.js client-side (soft) navigation. Both the landing navbar's ChipLink to /login and AuthShell's Link back to / are soft navigations (confirmed directly in the source, not assumed). That means: - /login -> / (soft nav): the browser keeps /login's CSP, which never allowed HubSpot hosts, so the loader gets silently blocked on landing. - / -> /login (soft nav): the browser keeps the landing CSP, which is MORE permissive than /login's, undoing the tightening entirely. A per-route CSP is fundamentally incompatible with this app's client-side-routed navigation. Greptile's original 'CSP too broad on /workspace' concern was valid in isolation, but the fix built across the last several rounds doesn't actually work — it's neither reliably tighter nor reliably functional, and each round's patch (exclusion list entries, /landing-preview handling) was really just papering over that core issue. Revert to a single shared CSP for the whole app, matching exactly how GTM/GA/ahrefs are already handled in this same file: HubSpot hosts land in STATIC_SCRIPT_SRC/STATIC_CONNECT_SRC under the existing isHosted gate. /workspace's CSP header technically allows origins it never requests (same accepted tradeoff as GTM/GA), but the tracking script only ever renders in the (landing) layout — matching the CSP scope Greptile originally objected to. This is now provably correct because it can't desync: proxy.ts, csp.ts, and proxy.test.ts are byte-for-byte identical to origin/staging except for the HubSpot host list itself.

waleedlatif1 · 2026-07-10T19:05:08Z

@greptile

waleedlatif1 · 2026-07-10T19:05:09Z

@cursor review

waleedlatif1 · 2026-07-10T19:12:51Z

@greptile

waleedlatif1 · 2026-07-10T19:12:52Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 24e9f45. Configure here.}

Greptile correctly flagged that *.hubspot.com is far broader than anything the tracker actually needs — it covers HubSpot's entire product surface (app, api, marketing), not just the tracking endpoints. Re-checked my own network trace from earlier: the pageview beacon itself is an image pixel (new Image() to track.hubspot.com/__pto.gif), which is governed by img-src (already wide open to any https: origin), not connect-src. The *.hubspot.com entry was an unverified guess for the forms-API/banner fetch calls I couldn't pin down through minification — removing it since I can't confirm what it was actually protecting, keeping only the verified *.hscollectedforms.net entry.

waleedlatif1 · 2026-07-10T19:18:29Z

@greptile

waleedlatif1 · 2026-07-10T19:18:30Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8a9a3c9. Configure here.}

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/lib/core/security/csp.ts Outdated

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/app/(landing)/layout.tsx

vercel Bot temporarily deployed to Preview July 10, 2026 18:13 Inactive

vercel Bot temporarily deployed to Preview July 10, 2026 18:15 Inactive

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/proxy.ts Outdated

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/lib/core/security/csp.ts Outdated

Comment thread apps/sim/app/(landing)/hubspot-page-view-tracker.tsx

vercel Bot temporarily deployed to Preview July 10, 2026 18:18 Inactive

vercel Bot temporarily deployed to Preview July 10, 2026 18:22 Inactive

vercel Bot temporarily deployed to Preview July 10, 2026 18:24 Inactive

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/app/(landing)/hubspot-page-view-tracker.tsx Outdated

vercel Bot temporarily deployed to Preview July 10, 2026 18:30 Inactive

cursor Bot reviewed Jul 10, 2026

View reviewed changes

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/proxy.ts Outdated

test(proxy): add regression coverage for the non-landing path classifier

c9fa654

Exports isNonLandingPath and covers the exact prefix-boundary cases (e.g. /f vs /ffoo, /resume vs /resumes) that the CSP routing fix depends on, so this logic is verified by CI rather than my own ad-hoc checks.

vercel Bot temporarily deployed to Preview July 10, 2026 18:46 Inactive

cursor Bot reviewed Jul 10, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview July 10, 2026 18:54 Inactive

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/proxy.ts Outdated

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/proxy.ts Outdated

vercel Bot temporarily deployed to Preview July 10, 2026 19:04 Inactive

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/lib/core/security/csp.ts

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/app/(landing)/layout.tsx

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/lib/core/security/csp.ts Outdated

cursor Bot reviewed Jul 10, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview July 10, 2026 19:18 Inactive

cursor Bot reviewed Jul 10, 2026

View reviewed changes

waleedlatif1 merged commit 4952ddb into staging Jul 10, 2026
18 checks passed

waleedlatif1 deleted the hubspot-embed branch July 10, 2026 19:25

waleedlatif1 mentioned this pull request Jul 10, 2026

v0.7.29: GLM, ui and ux improvements #5567

Merged

Uh oh!

Conversation

waleedlatif1 commented Jul 10, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

waleedlatif1 commented Jul 10, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

vercel Bot commented Jul 10, 2026 •

edited

Loading

cursor Bot commented Jul 10, 2026 •

edited

Loading

greptile-apps Bot commented Jul 10, 2026 •

edited

Loading