extension: the capture policy decides origins and has no behavioural tests

[L4XB]

Problem

apps/browser-extension/src/capture-policy.js decides what the extension does
with a page: whether a detected PDF is fetched directly, whether it is the same
origin as the active tab, and whether the URL is public HTTPS at all.

const publicHttps = (value) => {
  try { return new URL(value).protocol === "https:"; } catch { return false; }
};

function captureRoute(capture) {
  const activeUrl = String(capture?.url || "");
  const pdfUrl = String(capture?.pdfUrl || "");
  const detectedPdf = Boolean(pdfUrl && publicHttps(pdfUrl));
  ...

Those are origin decisions made on a page the user is logged into. Getting them
wrong means fetching a document from somewhere the user did not intend, or
sending a URL that should not leave the browser.

apps/browser-extension/tests/ contains exactly one file, build.test.mjs,
which validates the built artifact. capture-policy.js appears in it once — as
part of the build, not as behaviour under test.

What to do

Add a test file for captureRoute and the helpers around it. The module is
already written to be importable outside the browser — it assigns to
module.exports when one exists — so this needs no harness.

Cases worth pinning, because each is a decision the function makes:

• http: and file: URLs, and a javascript: URL
• a PDF URL on a different origin from the active tab
• a PDF URL identical to the active tab
• missing, empty, and non-string url / pdfUrl
• a URL that fails to parse at all
• credentials or a port embedded in the URL

Careful

Where a case is currently allowed and you think it should not be, do not
change the behaviour in the same pull request. Pin what it does today, say in
the description which cases surprised you, and open a separate issue. A test
that documents current behaviour is useful even when that behaviour turns out to
be wrong; a test and a behaviour change landing together makes it impossible to
tell which broke something later.

How to verify

cd apps/browser-extension && npm test

Acceptance criteria

• captureRoute has direct tests covering the cases above
• Every assertion states the expected decision, not just that it did not throw
• Any case that looks wrong is raised separately, not silently changed