quasarframework Quasar Electron Development
Use this skill with quasar-development for renderer UI and shared application concerns.
Map the process boundary
- Inspect
quasar.config.* > electron,src-electron/electron-main.*, every preload script, IPC definitions, packaging tool, and updater strategy. - Read the current Quasar Electron documentation and Electron security guidance.
- Add the mode with
quasar mode add electron. - Identify which code runs in main, preload, and renderer before editing.
Enforce Electron security
- Keep
contextIsolationenabled and renderer Node integration disabled. - Expose a narrow, typed preload API through
contextBridge; never expose rawipcRenderer, filesystem, shell, or process objects. - Validate IPC sender, channel, arguments, paths, URLs, and return data in the main process.
- Do not enable the deprecated
remotemodule. - Restrict navigation, new windows, permissions, protocols, and external URL opening. Allowlist schemes and destinations.
- Apply a strong Content Security Policy and avoid loading remote executable content.
- Treat renderer input as untrusted even when the app is local.
- Resolve packaged assets with Quasar's supported Electron runtime helpers when applicable.
Package deliberately
- Keep main/preload dependencies and native modules in the correct package scope.
- Rebuild and test native modules for each target architecture.
- Configure application identity, icons, file associations, protocols, signing, notarization, and artifact names for each OS.
- Design auto-update signing, rollout, rollback, and migration behavior before enabling it.
Validate
- Run
quasar dev -m electronand exercise main/preload/renderer interactions. - Add tests around IPC validation and privileged operations.
- Build with
quasar build -m electronusing the configured packager. - Install and launch packaged artifacts on every supported OS; test upgrade/uninstall behavior where relevant.
- Run tests, typecheck, lint, formatting, dependency audit, and inspect the packaged file set.