Every app host answers GET /__forge/toolbar-<hash>.js with the forge pill's script #8285

Every app and preview host now answers GET /__forge/toolbar-<hash>.js with the pill's script. The new test and test/apps-toolbar.test.ts pass (35 tests), tsc --noEmit is clean and scripts/gate.ts ran without printing anything. I did not run the full suite; the forge's check does that on this push.

• Route: the check is in src/apps/proxy.ts, ahead of the grant handling.

- The response is toolbarResponse(request), the same function that serves TOOLBAR_PATH, so the bytes and the immutable cache-control are the same. The content type is text/javascript; charset=utf-8. - It goes through securityFloor, so x-content-type-options: nosniff and the referrer policy are set. - Any other path under /__forge/toolbar answers 404 from the forge and never reaches the app. That covers a wrong hash, a missing hash and a suffixed or nested path. - Only GET and HEAD are served; any other method on that path is also a 404.

• Exported path: src/apps/toolbar.ts exports TOOLBAR_ASSET_PATH, built from the same name that TOOLBAR_PATH uses, so the two cannot drift. It also exports TOOLBAR_ASSET_PREFIX, the /__forge/toolbar prefix the proxy matches on.
• Test: test/apps-toolbar-asset.test.ts proxies an app and checks that the exact path returns toolbarJs with the headers above, and that wrong or other paths return 404. A counter on the backend checks that none of these requests reaches the app. Without the src change the test fails to load, because the new export does not exist.

Not done

• Nested hosts: the route is skipped on nested (guest-forge) hostnames, where /__forge/* already belongs to the guest forge, as the grant route does. The issue says "every app and preview host", so say if you want nested hosts covered too.
• Script tag: it still points at the forge origin. That is the next issue.
• Other tests: no existing test file is touched, including render-media.test.ts.

To try it, request /__forge/toolbar-<hash>.js on any app host. The hash is in TOOLBAR_ASSET_PATH.

🤖 Generated with Claude Code

Closes #8267

Every app and preview host now answers GET /__forge/toolbar-<hash>.js with the pill's script. The new test and test/apps-toolbar.test.ts pass (35 tests), tsc --noEmit is clean and scripts/gate.ts ran without printing anything. I did not run the full suite; the forge's check does that on this push.

• Route: the check is in src/apps/proxy.ts, ahead of the grant handling.

- The response is toolbarResponse(request), the same function that serves TOOLBAR_PATH, so the bytes and the immutable cache-control are the same. The content type is text/javascript; charset=utf-8. - It goes through securityFloor, so x-content-type-options: nosniff and the referrer policy are set. - Any other path under /__forge/toolbar answers 404 from the forge and never reaches the app. That covers a wrong hash, a missing hash and a suffixed or nested path. - Only GET and HEAD are served; any other method on that path is also a 404.

• Exported path: src/apps/toolbar.ts exports TOOLBAR_ASSET_PATH, built from the same name that TOOLBAR_PATH uses, so the two cannot drift. It also exports TOOLBAR_ASSET_PREFIX, the /__forge/toolbar prefix the proxy matches on.
• Test: test/apps-toolbar-asset.test.ts proxies an app and checks that the exact path returns toolbarJs with the headers above, and that wrong or other paths return 404. A counter on the backend checks that none of these requests reaches the app. Without the src change the test fails to load, because the new export does not exist.

Not done

• Nested hosts: the route is skipped on nested (guest-forge) hostnames, where /__forge/* already belongs to the guest forge, as the grant route does. The issue says "every app and preview host", so say if you want nested hosts covered too.
• Script tag: it still points at the forge origin. That is the next issue.
• Other tests: no existing test file is touched, including render-media.test.ts.

To try it, request /__forge/toolbar-<hash>.js on any app host. The hash is in TOOLBAR_ASSET_PATH.

🤖 Generated with Claude Code