The forge pill shows on an app whose CSP allows only its own scripts: the proxy serves it from the app's host #8209

The Lost test fails on the forge's own app today. withToolbar (src/apps/toolbar.ts) writes <script src="https://forge.open-platform.sh/assets/toolbar-….js"> into the page, but lab's production answers script-src 'self', so the browser refuses the pill and nobody on lab sees where they are. The pill's calls already go to same-origin /__forge/notes, /__forge/note, /__forge/crew; only the script itself is foreign.

Done when:

• [ ] The proxy answers GET /__forge/toolbar-<hash>.js on every app host with the pill's bytes, content-type: text/javascript, cache-control: public, max-age=31536000, immutable, and the forge's security headers
• [ ] toolbarTag writes that same-origin path, so a page whose CSP says script-src 'self' loads it; the data attributes are unchanged and still escaped
• [ ] Anything that reads the pill's origin from me.src (home link, pull link, "what is this" link) still points at the forge, not at the app host — passed as a data attribute when the script is same-origin
• [ ] A test proxies an app that answers script-src 'self' and proves the tag's src is same-origin and that /__forge/toolbar-<hash>.js answers the bytes; it fails without the change
• [ ] Look: lab production shows the pill (dot bottom-right)

Files: src/apps/toolbar.ts, src/apps/proxy.ts, test/apps-toolbar-same-origin.test.ts Risk: an app that itself serves /__forge/… already loses that prefix to the proxy; nothing new there.

Parked by the crew: the check stayed red through 2 automatic tries (pull #8215 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries: audio and video on the blob page > the can't-play note and its Download are in the markup, hidden (pull #8228 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #8215 closed)
2. the check stayed red through 2 automatic tries: audio and video on the blob page > the can't-play note and its Download are in the markup, hidden (pull #8228 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split by the planner into #8267 (every app host serves the pill's script at /__forge/toolbar-<hash>.js) and #8268 (the tag is same-origin and carries data-forge; waits for #8267). Each one is small enough to keep the check green. The second red try failed on test/render-media.test.ts, which the diff never touched. That flake now has its own issue, #8269, so it stops blocking unrelated pulls. #8210 now waits for #8268.