refactor(landing): fix invalid const assertion, trim comments

- Fixed HUBSPOT_SCRIPT_SRC/HUBSPOT_CONNECT_SRC: 'as const' cannot wrap a
  ternary expression directly (TS1355) — caught by a full project typecheck
  I ran specifically to verify this PR, not by lint/tests alone. Rewrote
  using the same conditional-spread-inside-array-literal pattern already
  used by every other array in this file (e.g. STATIC_FRAME_SRC)
- Trimmed comments across all four touched files down to only the
  non-obvious 'why' (module-scope tracking flag, HubSpot CSP scoping
  rationale), matching this codebase's terse comment style elsewhere

Author: waleedlatif1

apps/sim/app/(landing)/hubspot-page-view-tracker.tsx

@@ -9,20 +9,14 @@ declare global {
   }
 }
 
-// next/script dedupes by id, so the HubSpot loader auto-tracks exactly one
-// pageview per browser session and never reloads on remount. Track that at
-// module scope so it survives LandingLayout unmounting and remounting (e.g.
-// leaving the landing site and navigating back).
+// next/script dedupes by id and never reloads on remount, so this must be
+// module-scope (not a ref) to survive LandingLayout unmounting/remounting.
 let hasTrackedInitialPageView = false
 
 /**
- * The HubSpot loader auto-tracks only the very first page load. LandingLayout
- * persists across client-side navigations between landing routes (see its
- * TSDoc), so HubSpot never sees those route changes on its own — including
- * query-only navigations (blog/library pagination, careers filters), which
- * is why this depends on the full path + search string, not just the path.
- * Push a manual pageview through HubSpot's `_hsq` queue on every navigation
- * after the first.
+ * The HubSpot loader only auto-tracks the first page load; LandingLayout
+ * persists across client-side navigations, so HubSpot never sees the rest.
+ * Pushes a manual pageview through `_hsq` on every navigation after the first.
  */
 export function HubspotPageViewTracker() {
   const pathname = usePathname()

apps/sim/app/(landing)/layout.tsx

@@ -33,7 +33,7 @@ export default function LandingLayout({ children }: { children: ReactNode }) {
   return (
     <LandingShell>
       {children}
-      {/* HubSpot tracking code — hosted marketing site only, not self-hosted deployments */}
+      {/* HubSpot tracking — hosted only */}
       {isHosted && (
         <>
           <Script id='hs-script-loader' src={HUBSPOT_SCRIPT_SRC} strategy='afterInteractive' />

apps/sim/lib/core/security/csp.ts

@@ -101,30 +101,24 @@ const STATIC_CONNECT_SRC = [
 ] as const
 
 /**
- * HubSpot tracking code sources. The loader is rendered only inside the
- * (landing) route group — never /workspace, /login, or /signup — so these
- * are kept out of STATIC_SCRIPT_SRC/STATIC_CONNECT_SRC (shared by every
- * route) and merged in only by the landing-scoped CSP builders below.
+ * HubSpot tracking sources. The loader only renders inside the (landing)
+ * route group, so these are kept out of STATIC_SCRIPT_SRC/STATIC_CONNECT_SRC
+ * and merged in only by the landing-scoped CSP builders below.
  */
-const HUBSPOT_SCRIPT_SRC = isHosted
-  ? [
-      // The loader plus the analytics/form-tracking/banner scripts it
-      // injects as <script> tags
-      'https://*.hs-scripts.com',
-      'https://*.hs-analytics.net',
-      'https://*.hscollectedforms.net',
-      'https://*.hs-banner.com',
-    ]
-  : []
+const HUBSPOT_SCRIPT_SRC = [
+  ...(isHosted
+    ? [
+        'https://*.hs-scripts.com',
+        'https://*.hs-analytics.net',
+        'https://*.hscollectedforms.net',
+        'https://*.hs-banner.com',
+      ]
+    : []),
+] as const
 
-const HUBSPOT_CONNECT_SRC = isHosted
-  ? [
-      // Form-tracking API calls (hscollectedforms.js) and the visitor
-      // beacon (track.hubspot.com)
-      'https://*.hscollectedforms.net',
-      'https://*.hubspot.com',
-    ]
-  : []
+const HUBSPOT_CONNECT_SRC = [
+  ...(isHosted ? ['https://*.hscollectedforms.net', 'https://*.hubspot.com'] : []),
+] as const
 
 const STATIC_FRAME_SRC = [
   "'self'",
@@ -244,19 +238,15 @@ function buildRuntimeCSPDirectives(): CSPDirectives {
 }
 
 /**
- * Generate runtime CSP header for authenticated app routes (/workspace,
- * /login, /signup) and other non-landing routes handled by proxy.ts.
+ * Generate runtime CSP header for non-landing routes (proxy.ts).
  */
 export function generateRuntimeCSP(): string {
   return buildCSPString(buildRuntimeCSPDirectives())
 }
 
 /**
  * Generate runtime CSP header for the public marketing/landing site.
- * Extends the shared runtime policy with HubSpot tracking hosts — the
- * HubSpot loader is rendered only inside the (landing) route group, so
- * these hosts have no reason to be allowed on /workspace, /login, or
- * /signup.
+ * Extends the shared runtime policy with HubSpot tracking hosts.
  */
 export function generateLandingRuntimeCSP(): string {
   const directives = buildRuntimeCSPDirectives()

apps/sim/proxy.ts

@@ -117,13 +117,7 @@ function buildPreflightResponse(policy: CorsPolicy): NextResponse {
   return response
 }
 
-/**
- * Top-level pages outside the (landing) route group that still reach the
- * catch-all branch below (auth sub-pages, invite links, file shares, the
- * playground). These get the tight app CSP rather than the landing-only
- * HubSpot allowance. Keep in sync with apps/sim/app/(auth)/**,
- * apps/sim/app/(interfaces)/**, and the other non-landing top-level routes.
- */
+/** Top-level pages outside (landing) that still reach the catch-all branch below. */
 const NON_LANDING_PATH_PREFIXES = [
   '/verify',
   '/sso',
@@ -308,11 +302,8 @@ export async function proxy(request: NextRequest) {
   const securityBlock = handleSecurityFiltering(request)
   if (securityBlock) return track(request, securityBlock)
 
-  // Everything else falling through here is the public marketing/landing
-  // site — except a handful of non-landing pages (auth sub-pages, invite
-  // links, file shares, the playground) that reach this branch too. Only
-  // the landing site renders the HubSpot loader, so only it gets the
-  // landing-scoped CSP.
+  // Mostly the public marketing/landing site, plus a few non-landing pages
+  // (see isNonLandingPath) that also fall through to this branch.
   const response = NextResponse.next()
   response.headers.set('Vary', 'User-Agent')