Part one of #6076, the server half. The pill's link to the other side needs the forge to say where that side is, and only to someone who may read the repository.
Done when:
[ ] /__forge/crew (src/apps/proxy.ts) answers side: { label, url } from sideOf (src/apps/side.ts) when the viewer can read the app's repository: production names the newest open preview the viewer may see, a preview names production.
[ ] A guest (no cookie) or a signed-in stranger of a private app gets no side key, and the side is not computed for them at all.
[ ] An HTTP-level test fetches /__forge/crew on production and on a preview host as a reader and checks side, and as a guest of a private app checks there is none. A test that only calls a helper directly does not count.
[ ] If the side read is timed, its phase is side, and test/apps-door.test.ts lists it on the signed-in reads only. The guest's crew line still names exactly render and session. Both tries of #6076 failed the check on exactly this: the new phase broke apps-door's exact phase lists (bun test test/apps-door.test.ts shows it). Run that file before pushing.
Files: src/apps/proxy.ts, test/apps-door.test.ts, a new test file.
Risk: leaking a private preview's pull title to a stranger. Gate on read access first.
Part one of #6076, the server half. The pill's link to the other side needs the forge to say where that side is, and only to someone who may read the repository.
Done when:
/__forge/crew(src/apps/proxy.ts) answersside: { label, url }fromsideOf(src/apps/side.ts) when the viewer can read the app's repository: production names the newest open preview the viewer may see, a preview names production.sidekey, and the side is not computed for them at all./__forge/crewon production and on a preview host as a reader and checksside, and as a guest of a private app checks there is none. A test that only calls a helper directly does not count.side, andtest/apps-door.test.tslists it on the signed-in reads only. The guest's crew line still names exactlyrenderandsession. Both tries of #6076 failed the check on exactly this: the new phase broke apps-door's exact phase lists (bun test test/apps-door.test.tsshows it). Run that file before pushing.Files: src/apps/proxy.ts, test/apps-door.test.ts, a new test file. Risk: leaking a private preview's pull title to a stranger. Gate on read access first.