{# Inline badge shown on the IPI launcher card after a managed tunneled listener is started. Renders the public URL and a Stop control. The public_url is only rendered as a clickable when the scheme is http(s). A poisoned ~/.qai/active-callback file could otherwise publish a javascript: or data: URL and turn the operator's click into code execution. Rendering as

 for non-http(s) values
   keeps the string visible for debugging but not clickable. #}


    Tunnel active
    {% if handle.public_url.startswith(('http://', 'https://')) %}
    
        {{ handle.public_url }}
    
    {% else %}
    {{ handle.public_url }}
    {% endif %}