morethanwords/tweb/master • b1f87b5 • 6 files, +224/-7
Fix XSS via forged Electron helpers in message links

Link hrefs were built by interpolating the URL into a javascript: string
literal, so an apostrophe in a URL escaped into code. The Electron check
guarding that path read the ambient electronHelpers global, which any
element id shadows — and Temml turns a message's \label{} into a raw id,
so message content could forge it in an ordinary browser.

Keep the URL as data and hand it to openExternal on click, require a
callable bridge, and namespace ids Temml renders from message content.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

morethanwords/tweb/master • c4618cc • 3 files, +63/-23
Fix Instant View math never rendering

Temml's lexer builds its token regex by concatenating string literals
holding raw lone surrogates (the surrogate-pair alternative,
"|[\uD800-\uDBFF][\uDC00-\uDFFF]"). Both the esbuild dev dep-optimizer
and the rolldown production build re-print that folded string with each
lone surrogate written as U+FFFD, degrading the class to
[<FFFD>d800-<FFFD>dbff]. The 0-<FFFD> range that falls out of it
swallows a backslash, so every control word lexed as a one-letter
command: \frac died with "Unsupported function name: \f", nothing but
bare symbols parsed, and renderLatexInto silently fell back to showing
the raw source. This was never dev-only — production shipped the same
broken regex.

Load the library as an asset no bundler re-prints: ?url plus a runtime
script load. Take the package's own terser-minified build, which escapes
the lone surrogates correctly and is 49KB gzip against the .mjs bundle's
115KB — lighter than the broken bundled copy's 59KB. The comment
claiming Temml PR #128 made a plain dynamic import safe was wrong.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

morethanwords/tweb/master • 4c5a237 • 2 files, +277/-10
Handle postMessage clone failures in SuperMessagePort

postMessage errors were swallowed with a log line, so a payload that could
not be structured-cloned left the caller's invoke promise pending forever
and dropped the task for every port.

Route every send through sendTask, which now retries a failed batch
per-inner-task, answers a result/ack that could not be cloned with an
explicit DATA_CLONE_ERROR, and rejects an invoke that reached no port at
all. Also record the invoke's payload name/method in `awaiting` so a
timed-out task can be identified from the log.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

morethanwords/tweb/master • 701e811 • 1 files, +3/-3
Fix join button label for channels with join requests

A broadcast channel that requires approval showed "Subscribe" instead of
"Request to Join": isBroadcast was tested before the request type, so the
request branch was unreachable for channels. Test the request type first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

#webk