[ggrace519]

Description

Guest Open WebUI pages (including remote connections) could invoke the full privileged desktop API via window.electronAPI[requestData.type]. Remote webviews also received Open Terminal API keys. TLS verification was disabled on every Chromium session. Python, llama.cpp, and Hugging Face GGUF downloads were not checksummed. Linux always launched with --no-sandbox. Packaged Electron fuses were left at insecure defaults. macOS/Windows releases published unsigned fallbacks on codesign failure.

This PR allowlists guest IPC, scopes TLS exceptions to user-added connection origins, verifies downloaded artifacts, sandboxes shell windows, pins Electron to 39.8.10 (GHSA-h7rp-cf8h-j98x), keeps Cloudflare Access / SSO login inside the app, and fails closed on unsigned releases.

Production shell windows load app://renderer/… instead of file://. Dev (npm run dev) is unchanged.

Overlaps (maintainers may want to close or rebase):

• refac: webview message handling #253 (webview message handling) — this allowlists guest send() and does not index electronAPI with guest strings
• fix: allow OAuth popups to open inside Electron webview #218 / OAuth failure #175 (OAuth popups in Electron) — Access/OIDC popups share the guest session; chat links still open externally (Quality of Life Feat: Opening links in default browser #165)
• Feat: option to all ALL connections to auth using dedicated electron window. #217 (dedicated auth window)

Fork-only docs (CLAUDE.md, DECISIONS.md, develop-branch model) are not in this PR.

Security

• Guest send() allowlist: token:update, app:info, app:data, window:isFocused
• will-attach-webview forces sandbox / contextIsolation / no Node
• Terminal/OpenAI events only to the local-connection webview
• TLS default-verify; exceptions only for configured connection origins + localhost
• openExternal is http:/https:/mailto: only
• HF paths confined; GGUF SHA-256 from Hub LFS (?blobs=true)
• Python / llama.cpp downloads hashed; llama.cpp “latest” picks a release that actually has binaries
• Child env blocklist; llama --host/--port/--models-dir always from the desktop
• Linux --no-sandbox only for AppImage/snap/Flatpak/unpackaged/ELECTRON_DISABLE_SANDBOX=1
• Electron fuses at pack time; shell sandbox: true; drop @electron-toolkit/preload window.electron

Fixes

• Access/SSO stays in the webview (session cookies land; UI loads after callback)
• Tray Quit actually exits
• Guest no longer crashes on app:data (null instead of {} — Open WebUI +layout.svelte does not import appData)
• Quit waits for child processes

Infrastructure

• npm test (23 node:test cases on the security helpers)
• CI: typecheck, tests, eslint on src/main + preload

Related Issues

Related to #175, #165. Does not close those if #218 is the intended path for OAuth host allowlisting.

Verification

npm test          # 23 pass
npm run lint:main # exit 0
npx tsc --noEmit -p tsconfig.node.json --composite false

---

Contributor License Agreement

• By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.