Hardening batch: unauthenticated tiny-media:// CORS-bypass proxy, navigation-scheme bypass, tinyjs update = curl | sh, setup.sh /tmp races, api-gate edges — plus the areas this pass verified clean #30

Last batch from the pass that produced #22/#24/#26 and the curl/sampler issues.
Mixed severities, mostly low individually — filing together so the tracker stays
readable; each item has a suggested direction. Verification status is marked
per item.

1. tiny-media://proxy/?u= — CORS-bypass proxy without auth or origin check (mac+linux)

The custom scheme handler proxies any URL passed as ?u= with no authentication,
no origin allowlist and no content-type restriction — a page (including a wrapped
third-party one) can read same-origin-policy-protected content of any origin
through it, bypassing CORS entirely. Code-read, current main. Fix: restrict to
the app's own origins, or require a per-request token minted by the bridge.

2. Navigation policy is http(s)-only — custom schemes bypass onNavigate (×3 OS)

The navigation policy answers http(s); a page can navigate/iframe to custom
schemes (intent:, registered app schemes…) without onNavigate ever seeing it,
defeating app-level navigation audits. Code-read; Windows launch behavior needs
a box. Fix: default-deny non-http(s) navigations unless the manifest allows the
scheme, and surface them to onNavigate anyway.

3. tinyjs update = curl https://tinyjs.app/install | sh

Same supply-chain posture as #26 but for the updater itself: the install/update
command pipes a shell script straight from the website. The site is the trust
anchor for the whole machine here (TLS only). Code-read; matches the tool's
documented design ("defy design"), filing for the record. Fix: checksum-pinned
installer + a --dry-run that prints instead of piping to sh.

4. setup.sh: predictable /tmp paths ($$-based) → symlink race

setup.sh builds temp paths from the PID, predictable in advance; a local user
can pre-place symlinks and swap files mid-install. Code-read. Fix: mktemp -d.

5. api-gate edges

• * compiles to an unbounded .* — a pattern like user* matches userfoo.bar.baz; fine if intended, worth documenting.
• When the launcher doesn't attest an origin (Windows/Linux leave origin
  undefined today), the gate treats it as "no origin scoping": origins-keyed
  grants apply to every frame of those platforms. With Linux: origin attribution is frame-blind — a hostile subframe inherits the top frame's api gate #18 fixed on Linux,
  that becomes the remaining per-origin gap on win/linux. Code-read.

6. Launcher-side seq/event hardening (defense in depth after #23)

#23 fixed the bridge sinks; the launcher still executes wire lines whose seq/
identifier fields arrive raw, and the reply matcher keys on them — a forged
MENU <id>/HOTKEY <id>/AITOOL event line from a compromised bridge would be
accepted. Belt-and-braces: scrub line structure launcher-side (all three
launchers), the same way #23 scrubbed bridge-side. Code-read; needs native
rebuild to test.

7. Minor batch (each small, listed for completeness)

• Linux: allow_universal_access_from_file_urls is TRUE for all webviews (not just app pages) — interacts with Security: getUserMedia is auto-granted without an origin check (macOS unconditional hook; Linux manifest-only) — a wrapped third-party site gets mic/camera with no per-site consent #24's wrapped-origin concern.
• Docs drift: "the page NEVER has system access" vs the media hook (Security: getUserMedia is auto-granted without an origin check (macOS unconditional hook; Linux manifest-only) — a wrapped third-party site gets mic/camera with no per-site consent #24), meta.origin advertised "engine-attested" but false on Linux.
• TINYJS_DEBUG=1 traces clipboard/secrets to stderr.
• Window title: \r not stripped (launcher parse quirk).
• store keys pass through a __proto__-unsafe object spread.
• fetchStreams map has no owner check (any window can pull another's stream).
• Windows UncHandler registered without unregister (handle retention).
• Update swap is non-atomic (see fix(runtime): retry locked renames + roll back a failed Windows swap #16 for the Windows fix); zip sha256 checked only against the same origin it came from.

8. Areas this pass verified CLEAN (for the record — saves you a re-audit)

Menu/tray/clipboard/hotkey/keystroke/drop all escape correctly (one()/esc():
HKREG, CLIPWRITE, DRAGOUT, TRAYBEGIN, MENUBEGIN, DLG…) · no system()/popen()/
NSTask with page data in any launcher · osascript fallback argv-only · Windows
toasts fully xml_escape()d · keystrokes = keycode whitelist · dev socket
mkdtemp 0700, no race · store tmp+rename atomic, keys never in paths · curl body
temp 0700 with cleanup on all exits · Windows launcher is pipe-client-only, CALL
origin forging closed (position-from-end read) · audioTap gate really enforced in
the bridge · release workflows quoted, cache keys not influencable · template
scaffold innerHTML escaped.

Scope note: static pass over bridge.js, cli.js, the three launchers and the
update/install path as of 5bb2311 (v0.42.3). Not covered: native/tiny_ai.swift,
tjs.makeTempDir mode bits, txiki's TLS stack (mbedtls), tinyjs.app itself.