Update OneDollarStats script handling

[leoisadev1]

Summary

• expose the OneDollarStats script URL and integrity hash as constants to ensure the live vendor asset stays in sync
• update the analytics script tag to reuse the new constants and keep the integrity hash up to date
• simplify the web dev script by removing the redundant PORTLESS_NAME interpolation

Testing

• Not run (not requested)

---

Summary by cubic

Fixes OneDollarStats tracking by updating the SRI hash and extracting ONEDOLLARSTATS_SCRIPT_SRC and ONEDOLLARSTATS_SCRIPT_INTEGRITY constants in __root.tsx so browsers don’t block analytics. Also restores the configurable dev script in apps/web/package.json (keeps PORTLESS_NAME support).

^{Written for commit 13efa21. Summary will update on new commits.}

Note

Remove Subresource Integrity check from OneDollarStats analytics script

Extracts the analytics script URL into a ONEDOLLARSTATS_SCRIPT_SRC constant in __root.tsx and removes the integrity attribute from the script tag. Risk: browsers will no longer enforce SRI for this script, meaning any changes to the remote script will load without hash verification.

^{Macroscope summarized d9764d7.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
osschat-web	Ignored	Preview	Mar 10, 2026 2:35pm

[github-actions]

🚀 Preview Deployment Ready

Vercel is rebuilding the frontend with the new Convex backend URL.

Vercel will post the preview URL automatically.

Convex Preview Backend

• Cloud URL: https://fastidious-giraffe-908.convex.cloud
• Site URL: https://fastidious-giraffe-908.convex.site

ℹ️ Preview deployments support email/password auth only (GitHub/Vercel OAuth disabled).

---

_{🤖 Deployed automatically by GitHub Actions}

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

[tembo]

✅ No security issues found — scanned commits: 13d683b

[greptile-apps]

Greptile Summary

This PR extracts the OneDollarStats analytics script URL into a named constant (ONEDOLLARSTATS_SCRIPT_SRC) in __root.tsx and removes the previously stale SRI integrity attribute from the script tag. The stated goal of unblocking analytics in production (the old hash no longer matched the live asset) is achieved.

Key observations:

• The URL extraction is a clean, sensible refactor that makes future URL changes a single-line edit.
• The integrity attribute has been removed entirely rather than updated or extracted to a constant — this contradicts the PR description, which claims both a URL and an integrity-hash constant were added. If the intent was to drop SRI (a valid choice for mutable CDN assets), the description should be updated to reflect that.
• crossOrigin: "anonymous" is left on the script tag but is now redundant without a paired integrity attribute — it can be safely removed.
• The apps/web/package.json change (hardcoding openchat instead of the ${PORTLESS_NAME:-openchat} shell substitution) is mentioned in the PR description but does not appear in the diff, so it was either already merged or is being described from a different commit.

Confidence Score: 4/5

• Safe to merge — the change is small, restores analytics functionality, and introduces no new runtime errors.
• The only changed file has a very narrow diff (one constant added, the integrity + src literals replaced). Both issues found are cosmetic/documentation-level: a now-redundant crossOrigin attribute and a PR description that doesn't match the actual code. Neither affects correctness or security in a blocking way.
• No files require special attention beyond the two style notes in apps/web/src/routes/__root.tsx.

Important Files Changed

Filename	Overview
apps/web/src/routes/__root.tsx	Extracts the OneDollarStats CDN URL into ONEDOLLARSTATS_SCRIPT_SRC and removes the integrity (SRI) attribute from the analytics script tag. The change is functionally straightforward; minor issues are a leftover crossOrigin: "anonymous" that is now meaningless without SRI, and a PR description that inaccurately claims an ONEDOLLARSTATS_SCRIPT_INTEGRITY constant was also added.

Sequence Diagram

sequenceDiagram
    participant Browser
    participant CDN as assets.onedollarstats.com
    participant OneDollarStats as OneDollarStats Collector

    Browser->>Browser: Parse __root.tsx head scripts
    Note over Browser: ONEDOLLARSTATS_SCRIPT_SRC constant<br/>resolves to stonks.js URL
    Browser->>CDN: GET /stonks.js (defer, no SRI check)
    CDN-->>Browser: stonks.js payload
    Note over Browser: No integrity verification (SRI removed)
    Browser->>Browser: Execute stonks.js
    Browser->>OneDollarStats: Send page-view analytics event

Loading

_{Last reviewed commit: d9764d7}

[leoisadev1]

@macroscope-app review

[macroscopeapp]

Review complete! No issues found. View the results here:

• Macroscope - Correctness Check

[macroscopeapp]

Approvability

Verdict: Would Approve

This is a minimal configuration change that extracts analytics script constants and updates an SRI integrity hash. The unresolved comment raises a valid operational concern about the SRI approach but doesn't identify a bug or security issue in the code itself.

^{Macroscope would have approved this PR. Enable approvability here.}

[leoisadev1]

@macroscope-app review

[tembo]

✅ No security issues found — scanned commits: 13d683b, 13efa21

[tembo]

✅ No security issues found — scanned commits: 13d683b, 13efa21, d9764d7

[greptile-apps]

crossOrigin: "anonymous" serves no purpose without integrity

The crossOrigin: "anonymous" attribute is primarily meaningful in combination with SRI (integrity). Its role is to tell the browser to make a CORS request so the response can be verified against the hash. Now that the integrity attribute has been removed, this attribute does nothing useful for a plain <script src> tag from a CDN — browsers already fetch cross-origin scripts without needing crossOrigin: "anonymous" set explicitly.

Confidence this is worth changing: 2/5 — it's harmless in practice, but keeping it is misleading and suggests SRI is still in play.

Suggested change

	src: ONEDOLLARSTATS_SCRIPT_SRC,
	defer: true,
	crossOrigin: "anonymous",
	integrity: "sha384-JKNAwAZy8iZWcJrexWvQf3rNcosuH0th/rwqZoiM84ea7fMGTt2eq8ddZb//nd9H",
	},
	src: ONEDOLLARSTATS_SCRIPT_SRC,
	defer: true,

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

[greptile-apps]

PR description claims ONEDOLLARSTATS_SCRIPT_INTEGRITY was also extracted — it wasn't

The PR summary states:

expose the OneDollarStats script URL and integrity hash as constants

And the auto-generated cubic summary echoes:

extracting ONEDOLLARSTATS_SCRIPT_SRC and ONEDOLLARSTATS_SCRIPT_INTEGRITY constants

However, the diff only adds ONEDOLLARSTATS_SCRIPT_SRC. The integrity attribute was removed entirely rather than being extracted to a named constant. If the intent was truly to make the hash easy to update in one place, the constant should have been created and wired back in — otherwise the description misrepresents the change.

If the intent was to drop SRI entirely (a valid decision, discussed in the previous thread), the PR description should be updated to reflect that.

Confidence: 3/5 — the description / code mismatch is real, but the behaviour itself (removing SRI) may be intentional even if the words say otherwise.