Agent WranglersWeb code inside desktop apps
Apps built with Electron or Tauri run web code next to the operating system. Isolate the page, check every message and link, and store tokens in the keychain.
- Required 1
- Recommended 3
Required
Keep web content away from the operating system
DSK-10Every app window runs with Node.js access off, context isolation on and the sandbox on. The page reaches the system only through a short list of named functions, and loads only code packaged with the app.
Recommended
Check the sender and content of every message to the main process
DSK-11Each handler in the main process checks which window and page sent the message and validates every argument against a schema. A path or command never comes from the page as is.
Open outside links only after checking the address
DSK-12Block navigation and new windows away from the app's own pages. Hand a link to the system browser only when its scheme is
https:ormailto:.Keep tokens in the system keychain
DSK-13Store sign-in tokens and keys in the operating system's credential store, which is the Mac Keychain, Windows Credential Manager or the Linux Secret Service. Never write them to a settings file or local storage.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps">Agent Wranglers desktop apps, extensions and CLIs playbook</a>. In code you write, add a comment next to it with the same link.