From 7816cce14fb31d0a856bf68f4d2d31a95cb269b3 Mon Sep 17 00:00:00 2001 From: Grok Date: Mon, 26 Oct 2026 21:38:05 -0400 Subject: [PATCH] feat(site): emit Cloudflare Web Analytics beacon and allow it in the CSP The zone's auto-install never reached the pages: site-worker.js CSP is script-src 'self' + jsdelivr and connect-src 'self', so the injected beacon was blocked and the Web Analytics dashboard stayed empty. Emit the tag from build-site.mjs (shared layout + docs head; not the unlisted /reviews pages) and allow static.cloudflareinsights.com / cloudflareinsights.com. Co-Authored-By: Claude Sonnet 5.5 --- CLAUDE.md | 9 +++++++++ scripts/build-site.mjs | 10 ++++++++-- site-worker.js | 2 +- 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 3e0b715..caccd6f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1616,6 +1616,15 @@ instead; both paths create a normal release for the tag. **Never publish the (auto on docs/site paths, `workflow_dispatch` otherwise) rebuilds `public/` from `scripts/build-site.mjs` — never hand-edit `public/`. +## Site analytics (2026-10-26) + +Cloudflare Web Analytics (cookieless) is emitted by `scripts/build-site.mjs` (`ANALYTICS_BEACON`) into the +shared layout and the docs head, never into the unlisted `/reviews/` pages. It needs the two Cloudflare hosts in +`site-worker.js`'s CSP (`script-src` static.cloudflareinsights.com, `connect-src` cloudflareinsights.com): the +zone's auto-install had been silently blocked by the old CSP, so the dashboard was empty. Workers Logs is on for +`corevideo-docs` (`observability` in `wrangler.jsonc`); it serves corevideo.io and corevideo.iamfatness.us, +including the OAuth broker, so sign-ins are visible in the Cloudflare Workers logs. + ## Style Comments state the constraint the code can't show — most files here carry the diff --git a/scripts/build-site.mjs b/scripts/build-site.mjs index 7d89faa..3b9d0cc 100644 --- a/scripts/build-site.mjs +++ b/scripts/build-site.mjs @@ -12,6 +12,12 @@ const outDir = path.join(root, "public"); // primary host so the two domains are not treated as duplicate content. const PRIMARY_ORIGIN = "https://corevideo.io"; const SITE_NAME = "CoreVideo"; +// Cloudflare Web Analytics (cookieless). The zone's auto-install never reached +// the pages: the worker's CSP blocked the injected beacon, so the dashboard +// stayed empty. Emitted explicitly here, with site-worker.js allowing the two +// Cloudflare hosts. The token is public by design (it ships in every page). +const ANALYTICS_BEACON = + ` \n`; const OG_IMAGE = `${PRIMARY_ORIGIN}/assets/corevideo-share.jpg`; const OG_IMAGE_ALT = "CoreVideo - Zoom participant video and audio as native OBS Studio sources"; @@ -926,7 +932,7 @@ function layout(page, content, options = {}) { ${options.canonical ? ` \n` : ""}${socialTags({ title: fullTitle, description: page.description, url: options.canonical, image: ogImage })} -${options.jsonLd ? jsonLdBlock(options.jsonLd) : ""} +${ANALYTICS_BEACON}${options.jsonLd ? jsonLdBlock(options.jsonLd) : ""}
${MULTIVIEW_MARK}CoreVideo @@ -1324,7 +1330,7 @@ const docsHtml = fs.readFileSync(path.join(docsDir, "index.html"), "utf8") url: DOCS_CANONICAL, image: OG_IMAGE, }) + - "\n", + "\n" + ANALYTICS_BEACON + "", ); if (!docsHtml.includes('rel="canonical"')) { throw new Error( diff --git a/site-worker.js b/site-worker.js index e182824..9d662a2 100644 --- a/site-worker.js +++ b/site-worker.js @@ -2,7 +2,7 @@ import { handleReviewFeedback } from './review-feedback.js'; const SECURITY_HEADERS = { "content-security-policy": - "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; script-src 'self' https://cdn.jsdelivr.net; connect-src 'self'; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'", + "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; script-src 'self' https://cdn.jsdelivr.net https://static.cloudflareinsights.com; connect-src 'self' https://cloudflareinsights.com; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'", "referrer-policy": "strict-origin-when-cross-origin", "x-content-type-options": "nosniff", };