---
title: "Web code inside desktop apps · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps
parts: 4
tokens_total: 3712
updated: 2026-10-22
tokens: 682
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Web code inside desktop apps

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Desktop apps, extensions and CLIs](https://agentwranglers.se/playbook/desktop-apps.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

> Apps built with Electron or Tauri run web code next to the operating system. Isolate the page, check every message and link, and store tokens in the keychain.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps">Agent Wranglers desktop apps, extensions and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- DSK-10 [Keep web content away from the operating system](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/isolate-web-content.md) · 964 tokens · updated 2026-10-22
  Every app window runs with Node.js access off, context isolation on and the sandbox on. The page reaches the system only through a short list of named functions, and loads only code packaged with the app.

## Recommended

- DSK-11 [Check the sender and content of every message to the main process](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/validate-ipc.md) · 1,006 tokens · updated 2026-10-22
  Each handler in the main process checks which window and page sent the message and validates every argument against a schema. A path or command never comes from the page as is.
- DSK-12 [Open outside links only after checking the address](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/safe-external-links.md) · 872 tokens · updated 2026-10-22
  Block navigation and new windows away from the app's own pages. Hand a link to the system browser only when its scheme is `https:` or `mailto:`.
- DSK-13 [Keep tokens in the system keychain](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/desktop-keychain.md) · 870 tokens · updated 2026-10-22
  Store sign-in tokens and keys in the operating system's credential store, which is the Mac Keychain, Windows Credential Manager or the Linux Secret Service. Never write them to a settings file or local storage.

- Previous: [Update integrity](https://agentwranglers.se/playbook/desktop-apps/update-integrity.md)
- Next: [Browser extensions](https://agentwranglers.se/playbook/desktop-apps/browser-extensions.md)
- [All chapters](https://agentwranglers.se/playbook/desktop-apps.md)