// Preload for tab webContents that host the built-in home page. All non- // settings tabs get this preload since we don't know in advance whether a // tab will land on home.html; the corresponding IPC handlers in main.js // validate the sender's URL is our own home.html file:// and reject any // origin-mismatched call, so a third-party page can inspect the API's // SHAPE but can't invoke it against local user data. const { contextBridge, ipcRenderer } = require("electron"); contextBridge.exposeInMainWorld("home", { getCards: () => ipcRenderer.invoke("home-cards-get"), setCards: (cards) => ipcRenderer.invoke("home-cards-set", cards), resetCards: () => ipcRenderer.invoke("home-cards-reset"), navigate: (url) => ipcRenderer.invoke("navigate", url), }); // Same preload also serves the branded error page (error.html). Handlers in // main.js sender-check for error.html so a random page seeing the API shape // can't drive navigation. contextBridge.exposeInMainWorld("errorpage", { retry: (url) => ipcRenderer.invoke("error-retry", url), goHome: () => ipcRenderer.invoke("error-home"), searchFor: (text) => ipcRenderer.invoke("error-search", text), registerOnSirius: (host) => ipcRenderer.invoke("error-register", host), openExternal: (url) => ipcRenderer.invoke("error-open-external", url), });