220
IPC
also inter-process communication, contextBridge
A named channel between the window and the shell. Not a function that runs anything.
What is IPC?
IPC is a message between processes. The window sends a channel name and structured arguments. The shell handles that channel and returns a result. A generic “invoke this string” channel is remote code execution with extra steps.
Why does IPC matter when vibe coding?
The usual draft exposes `ipcRenderer.invoke(channel, ...args)` to the page, then switches on the channel in one giant handler. Any script in the page can call any channel.
How do you do IPC?
One function per action, registered in a preload with contextBridge. Validate arguments in the shell. No channel name that comes from the page as data.
How do you ask a model for IPC?
Expose only (action) from the preload. Arguments are (shape). Validate them in the main process. Do not pass a channel name or a function from the renderer.
What goes wrong with IPC?
Sending the whole file path and trusting it. The page can point that path at secrets.