Main-process setup — registerNextOP

Import from the nextop-app/main subpath and call it inside app.whenReady(), after the BrowserWindow is created.

// electron/main.ts
import { app, BrowserWindow } from "electron"
import path from "path"
import { startNextServer } from "./startNext"
import { registerNextOP } from "nextop-app/main"

let mainWindow = null

app.whenReady().then(async () => {
  mainWindow = new BrowserWindow({
    width: 1200,
    height: 800,
    show: false,
    backgroundColor: "#0a0a0a",
    webPreferences: {
      preload: path.join(__dirname, "preload.js"),
      contextIsolation: true,
      nodeIntegration: false,
      sandbox: true,
    },
  })

  mainWindow.once("ready-to-show", () => mainWindow?.show())

  registerNextOP(mainWindow, {
    fs:    { mode: "allowed", allowedRoots: [app.getPath("userData")] },
    shell: { mode: "none", allowedCommands: [], requireConsent: true },
  })

  const dev = !app.isPackaged
  const nextServer = await startNextServer(dev ? process.cwd() : app.getAppPath(), dev)
  await mainWindow.loadURL(`http://127.0.0.1:${nextServer.port}`)
})

Signature

function registerNextOP(mainWindow: BrowserWindow | null, options?: NextOPOptions): void

It registers every ipcMain handler the hooks rely on, and attaches navigation guards to the main window and to every future web-contents-created.

NextOPOptions

type NextOPOptions = {
  fs?: {
    mode?: 'all' | 'allowed' | 'none'   // default: 'allowed'
    allowedRoots?: string[]             // used when mode === 'allowed'
  }
  shell?: {
    mode?: 'all' | 'allowed' | 'none'   // default: 'none'
    allowedCommands?: string[]          // used when mode === 'allowed'
    requireConsent?: boolean            // default: true
  }
}

See the Security Model for the full semantics.