[Bug] Explicit scriptSrc drops Weaverse Studio and YouTube origins (breaks if CSP is enforced)

[hta218]

Found while reviewing Weaverse/naturelle#156, which hit the live version of this.

Problem

app/weaverse/csp.ts sets:

scriptSrc: ["https://cdn.shopify.com"],

createContentSecurityPolicy appends the nonce to scriptSrc, but it does not add 'self' and it never merges defaultSrc into it — scriptSrc is not in Hydrogen's defaultDirectives, so the value is taken verbatim. Once scriptSrc exists, everything in defaultSrc stops applying to scripts, including ...weaverseHosts.

Weaverse loads the Studio bridge through loadScript(), which appends a plain <script src> with no nonce:

getStudioScriptSrc() -> `${weaverseHost}/static/studio/hydrogen/index.js`

That origin is not in scriptSrc, so the Studio bridge violates the policy. react-player's https://www.youtube.com/iframe_api is in the same position.

Why this is not currently breaking Pilot

app/entry.server.tsx ships the policy as report-only:

// TODO: change to Content-Security-Policy when you ready with your CSP configs.
responseHeaders.set("Content-Security-Policy-Report-Only", header);

So nothing is blocked today — the violations only reach the console.

Why it is still worth fixing

1. The TODO invites merchants to switch to the enforcing header. Anyone who follows it loses Weaverse Studio and YouTube playback, with no hint that csp.ts is the cause.
2. Naturelle already enforces the header, copied this scriptSrc while aligning with Pilot, and broke design mode — see fix: modernize dependencies naturelle#156. Themes derived from Pilot will keep hitting this.
3. Report-only still logs a violation on every Studio load, which buries genuine violations.

Suggested fix

Make scriptSrc self-sufficient so enabling enforcement is safe:

scriptSrc: [
  "'self'",
  "https://cdn.shopify.com",
  "https://www.youtube.com",
  ...weaverseHosts,
],

Worth checking the other origins in defaultSrc for anything else that is script-loaded rather than framed — cdn.jsdelivr.net and cdn.alireviews.io are the likely candidates.

Acceptance criteria

• Switching entry.server.tsx to the enforcing header leaves Studio, preview mode, and YouTube playback working
• No CSP violations reported on a normal page load or in design mode