theseus/home-preload.js

// Preload for tab webContents that host the built-in home page. All non-
// settings tabs get this preload since we don't know in advance whether a
// tab will land on home.html; the corresponding IPC handlers in main.js
// validate the sender's URL is our own home.html file:// and reject any
// origin-mismatched call, so a third-party page can inspect the API's
// SHAPE but can't invoke it against local user data.
const { contextBridge, ipcRenderer } = require("electron");
contextBridge.exposeInMainWorld("home", {
  getCards: () => ipcRenderer.invoke("home-cards-get"),
  setCards: (cards) => ipcRenderer.invoke("home-cards-set", cards),
  resetCards: () => ipcRenderer.invoke("home-cards-reset"),
  navigate: (url) => ipcRenderer.invoke("navigate", url),
});