setup.sh downloaded and built txiki under /tmp/tjs-$$.gz,
/tmp/txiki-src-$$ and /tmp/txiki-$$.zip. PID-based names are
predictable, so another local user could pre-plant a symlink or a
source tree there. Everything now goes in one mktemp -d dir removed by
an EXIT trap; the macOS launcher build's BUILD_TMP lives inside it
(a second trap would replace the first).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

runtime/txiki.sha256 holds the sha256 of the tjs binary inside each
saghul/txiki.js release zip we fetch (v26.6.0 macOS arm64/x86_64,
Windows x86_64). cli.js checks it after download AND on every reuse of
~/Library/Caches/tinyjs (user-writable, and its exe gets bundled and
codesigned into cross-arch/universal builds); setup.sh, setup.ps1 and
release.yml check their downloads against it too. Verify notes in
TODO-verify.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…EW2_* env (#29)

A built app copied its whole environment into the launcher and honored
TINYJS_HTML/TINYJS_LAUNCHER/TINYJS_SOCKET itself, so whatever started it
could swap its page or launcher, inject script, widen media/read access,
or (WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS, which we appended to) open a
remote-debugging port. When bundlePath() says we're built, those are
ignored and every inherited TINYJS_*/WEBVIEW2_* var is dropped before the
bridge sets its own from the manifest; TINYJS_LAUNCHER_DEBUG stays.
Dev and macOS are unchanged. Verify steps in TODO-verify.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Every page numbers its streams f1, f2… from scratch, so two windows
streaming at once collided on f1: the later stream replaced the earlier
one in the bridge's map (the first window's body was cut off after one
chunk), and any window could pull or cancel another's by id. Streams
are now keyed by the calling window plus the id, and a reloaded page's
leftover stream under a reused id is cancelled first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Both setTitle paths only replaced \n; use one(), which every other
single-line wire field already goes through.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

On a plain {}, set('__proto__', v) swapped the store's prototype
instead of storing anything (get('x') then answered v.x, nothing was
saved) and get('constructor') returned Object's own function. A
store.json holding non-object JSON now loads as empty instead of
throwing on every call. Verify notes for #30.7 in TODO-verify.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Stock webview keys the WebView2 user-data folder on the exe name, and
every tinyjs app's window belongs to launcher.exe, so all tinyjs apps on
a machine shared cookies, IndexedDB, permissions and localStorage (file://
is one origin under --allow-file-access-from-files). The bridge now sets
TINYJS_WEBVIEW2_DATA=%APPDATA%\<app-id>\WebView2 and the win32_edge.hh
patch uses it. No migration: apps start with a fresh profile. tinyjs dev
also rebuilds launcher-win.exe when win32_edge.hh changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…profile

All run on Windows 11 2026-10-02: setup.ps1 pin check (clean + tampered),
built-app env stripping against a dev control, dev regression incl. F12,
two-window streams + store, and the per-app profile (build, folder,
isolation, persistence, survives self-update). Windows CI #26 and Linux
#30.7 still open.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

setup.sh prebuilt + source build leave no temp dir; built app ignores
inherited TINYJS_* knobs (dev control bites, built doesn't); two-window
fetch streams and null-prototype store reproduced on the old bridge and
fixed on this one, dev and built.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…s, bridge fixes (#26, #29, #30)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>