Part two of #6076, the script half. It can start now: it reads side from the /__forge/crew answer, and with no side it draws nothing.
Done when:
[ ] The pill script in src/apps/toolbar.ts, given c.side, draws one link labelled side.label whose href is new URL(side.url).origin + location.pathname + location.search. It never uses new URL(path, base). With no side, it draws no link.
[ ] The link is drawn only when side.url is https, or on the same scheme as the page.
[ ] A test runs toolbarJs against a stubbed document, location and fetch (as closed pull #6261's test/apps-pill-side.test.ts did) and expects /a/b?x=1 to give https://<other>/a/b?x=1. With pathname: "//evil.test/x" it expects an href whose origin is the other side's own.
[ ] The toolbar script stays under the 16 KiB budget in test/apps-crew-pill.test.ts, and that test is unchanged.
Files: src/apps/toolbar.ts, a new test file.
Risk: the script has no build step, so keep it ES5-plain like the rest of toolbar.ts.
Part two of #6076, the script half. It can start now: it reads
sidefrom the/__forge/crewanswer, and with nosideit draws nothing.Done when:
c.side, draws one link labelledside.labelwhose href isnew URL(side.url).origin + location.pathname + location.search. It never usesnew URL(path, base). With noside, it draws no link.side.urlis https, or on the same scheme as the page.toolbarJsagainst a stubbed document, location and fetch (as closed pull #6261's test/apps-pill-side.test.ts did) and expects/a/b?x=1to givehttps://<other>/a/b?x=1. Withpathname: "//evil.test/x"it expects an href whose origin is the other side's own.Files: src/apps/toolbar.ts, a new test file. Risk: the script has no build step, so keep it ES5-plain like the rest of toolbar.ts.