0006 — One renderer for web and desktop

Status: accepted

Decision

The application is one React/TypeScript renderer. A PlatformAdapter hides the differences: in the browser, the File System Access API or origin-private storage; on the desktop, a typed Electron bridge. Electron adds only:

• a sandboxed, context-isolated renderer without Node, served from a privileged custom scheme (falcad://app), never file://;
• blocked navigation and window creation, and permission requests denied by default;
• a preload that exposes exactly seven typed calls;
• folders chosen by the user in native dialogs, turned into opaque UUID handles bound to the requesting window. The renderer never sends a file path. Every IPC call checks the sender origin, and the main process confines all file access to the granted folder (realpath-checked).

An end-to-end test proves the renderer has no require or process and only the declared bridge, and that the main process refuses forged handles.

Consequences

Features ship once on every platform. Platform-specific abilities (native toolchains, USB) are reported through the capability registry, never assumed.