Electron

Overview

Electron is a framework for building cross-platform desktop applications using web technologies. It combines a Node.js main process for system access and window management with Chromium renderer processes for the UI, communicating via IPC with context isolation and preload scripts for security.

Instructions

• When starting a project, install electron as a dev dependency (npm install --save-dev electron), or scaffold with Electron Forge (npm init electron-app@latest my-app). Point main in package.json at the main-process file and run with electron .. Current stable line: Electron 44 (checked 44.5.1).
• When setting up the architecture, create a main process for window management and system APIs, renderer processes for UI, and a preload script that exposes a small, named API with contextBridge.exposeInMainWorld(). Never expose ipcRenderer itself.
• When implementing IPC, use ipcMain.handle() / ipcRenderer.invoke() for request-response, and webContents.send() for main-to-renderer push. Validate arguments and the sender (event.senderFrame.origin, not the URL) inside every handler.
• When accessing native APIs, use dialogs, file system, clipboard, notifications and shell in the main process and reach them from the renderer only through the preload bridge.
• When configuring security, rely on the defaults (contextIsolation: true since Electron 12, nodeIntegration: false, sandbox: true for renderers) and do not turn them off. Add a Content Security Policy, deny unexpected navigation with will-navigate and webContents.setWindowOpenHandler(), never pass untrusted URLs to shell.openExternal, and flip unused fuses (runAsNode, nodeCliInspect) with @electron/fuses.
• When packaging, use Electron Forge (makers: Squirrel.Windows or WiX/MSI, DMG/ZIP, deb/rpm/AppImage via community makers) or electron-builder; sign Windows builds and sign plus notarize macOS builds.
• When implementing auto-updates, use the built-in autoUpdater (Squirrel) with a static storage URL or update.electronjs.org for public GitHub repos, or electron-updater from electron-builder, which supports GitHub Releases or a generic server, differential downloads, and a stagingPercentage field in the release metadata for staged rollouts. autoUpdater does not work on Linux; updates there come through the package manager or AppImage updaters.
• When the renderer crashes, handle webContents.on("render-process-gone", ...) and app.on("child-process-gone", ...), and reload or show an error window.

Minimal secure skeleton