Q120: every IPC call passes one gate - the app's own page, input checked against a typed contract

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/app/create-window.ts

@@ -1,5 +1,6 @@
 import { BrowserWindow } from "electron";
 import { join } from "node:path";
+import { pathToFileURL } from "node:url";
 import { attachMainWindowSecurity } from "./window-security";
 
 export interface CreateWindowOptions {
@@ -10,6 +11,11 @@ export interface CreateWindowOptions {
   language: string;
 }
 
+/** The one page the main window may show and the IPC gate trusts: the dev server in development, the built index.html otherwise. */
+export function appPageUrl(options: Pick<CreateWindowOptions, "devServerUrl" | "rendererDist">): string {
+  return options.devServerUrl ?? pathToFileURL(join(options.rendererDist, "index.html")).href;
+}
+
 export function createMainWindow(options: CreateWindowOptions): BrowserWindow {
   const win = new BrowserWindow({
     width: 1280,
@@ -33,10 +39,7 @@ export function createMainWindow(options: CreateWindowOptions): BrowserWindow {
     },
   });
 
-  attachMainWindowSecurity(
-    win,
-    options.devServerUrl ? new URL(options.devServerUrl).origin : null,
-  );
+  attachMainWindowSecurity(win, appPageUrl(options));
   win.once("ready-to-show", () => win.show());
 
   if (options.devServerUrl) {