fix(demo): exempt landing routes from COEP so the Cal.com booker loads on soft nav

[TheodoreSpeaks]

Summary

• /demo's Cal.com booker hung on an infinite spinner when reached by clicking "Request a demo" from any landing page — it only worked on a direct load or refresh
• COEP is a document header and is inherited across client-side <Link> navigations, so /demo's existing unsafe-none exemption (fix(demo): unblock Cal.com booking embed and align work-email validation #5335) never applied on a soft nav; the booker iframe loaded credentialless and stalled on its storage-access handshake
• COEP stays on by default — a new route is still cross-origin isolated unless named in the new LANDING_ROUTES list, which exempts the marketing surface (app/(landing)/**) wholesale since every landing page can soft-nav into /demo
• Split COEP off the old combined rule so COOP is untouched: landing keeps same-origin, /demo keeps same-origin-allow-popups

Type of Change

• Bug fix

Testing

Tested manually. Reproduced on prod: from /?home, clicking "Request a demo" leaves crossOriginIsolated: true on /demo (navigation entry still /?home), and <cal-inline> never reaches loading="done" — iframe stuck at height: 100%.

Verified on the patched build: / and /pricing serve no COEP (browser default unsafe-none), /demo unsafe-none, /login still credentialless; COOP unchanged on all four. Same soft-nav path now gives crossOriginIsolated: false and the embed reaches loading="done" with the iframe resolving to 592px — calendar renders and slots are selectable.

Route patterns validated against Next's bundled path-to-regexp: all 23 landing paths exempt, all 15 isolated routes still strict, no path receiving two conflicting values for either header. LANDING_ROUTES verified at exact parity with the app/(landing) directory listing.

bun run lint clean; all 11 audit checks pass (check:boundaries, check:api-validation:strict, check:utils, check:zustand-v5, check:react-query, check:client-boundary, check:bare-icons, check:icon-paths, check:realtime-prune, skills:check, agent-stream-docs:check). No migrations touched.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 31, 2026 12:35am

[cursor]

PR Summary

Medium Risk
Changes default COEP coverage for many public routes and relies on keeping LANDING_ROUTES in sync with app/(landing); misconfiguration could weaken isolation on app routes or re-break third-party embeds.

Overview
Fixes the Cal.com booker on /demo hanging when users click through from marketing pages: COEP is inherited on client-side <Link> navigations, so /demo’s existing unsafe-none rule only applied on a direct load while soft navs stayed credentialless and the iframe stalled.

Adds a LANDING_ROUTES list (aligned with app/(landing)/** plus root) and splits COEP from COOP in next.config.ts: COOP behavior is unchanged on the broad matcher; a new header rule applies credentialless COEP only to routes not in that marketing exemption set (and existing app carve-outs). Landing paths and / therefore get no strict COEP on document responses, so soft navigation into /demo is not cross-origin isolated and the embed can finish loading.

^{Reviewed by Cursor Bugbot for commit d98230c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

Updates Next.js response-header routing so all current marketing routes omit COEP during client-side navigation while preserving strict COEP on application routes and leaving existing COOP behavior unchanged.

Confidence Score: 5/5

The PR appears safe to merge with the current route inventory.

Every existing landing route is covered by the COEP exemption, current non-landing routes remain isolated, and the overlapping permissive header rule does not conflict with the new matcher.

Important Files Changed

Filename	Overview
apps/sim/next.config.ts	Adds a complete landing-route inventory and separates COEP from COOP matching; all current landing and non-landing routes receive the intended policies without conflicting header rules.

_{Reviews (1): Last reviewed commit: "fix(demo): exempt landing routes from CO..." | Re-trigger Greptile}