Half of #8209, split so the route lands by itself and the check stays small. Lab's production sends script-src 'self', so the browser refuses the pill's script from forge.open-platform.sh. Step one is to serve the same bytes from the app's own host. The tag does not change yet: that is the next issue.
Done when:
[ ] The proxy answers GET /__forge/toolbar-<hash>.js on every app and preview host with the bytes TOOLBAR_PATH serves today (src/apps/toolbar.ts), content-type: text/javascript; charset=utf-8, cache-control: public, max-age=31536000, immutable, and the forge's security headers
[ ] A wrong hash, or any other /__forge/toolbar… path, answers 404 and never reaches the app
[ ] toolbar.ts exports the same-origin path, built from the same hash TOOLBAR_PATH uses, so the two cannot drift
[ ] test/apps-toolbar-asset.test.ts proxies an app and proves the route answers those bytes and headers and that a wrong hash is a 404. It fails without the change
Files: src/apps/proxy.ts, src/apps/toolbar.ts, test/apps-toolbar-asset.test.ts
Risk: only the new route and the exported path. Keep the diff away from every other test file. #8209's second try went red on test/render-media.test.ts, which its diff never touched; that test is its own issue in this plan.
Half of #8209, split so the route lands by itself and the check stays small. Lab's production sends
script-src 'self', so the browser refuses the pill's script from forge.open-platform.sh. Step one is to serve the same bytes from the app's own host. The tag does not change yet: that is the next issue.Done when:
GET /__forge/toolbar-<hash>.json every app and preview host with the bytesTOOLBAR_PATHserves today (src/apps/toolbar.ts),content-type: text/javascript; charset=utf-8,cache-control: public, max-age=31536000, immutable, and the forge's security headers/__forge/toolbar…path, answers 404 and never reaches the apptoolbar.tsexports the same-origin path, built from the same hashTOOLBAR_PATHuses, so the two cannot drifttest/apps-toolbar-asset.test.tsproxies an app and proves the route answers those bytes and headers and that a wrong hash is a 404. It fails without the changeFiles: src/apps/proxy.ts, src/apps/toolbar.ts, test/apps-toolbar-asset.test.ts Risk: only the new route and the exported path. Keep the diff away from every other test file. #8209's second try went red on
test/render-media.test.ts, which its diff never touched; that test is its own issue in this plan.