Feature/electron security modernization

[jthrilly]

This pull request removes several legacy configuration files and updates the Node.js version used by the project. The main goal is to clean up the codebase by eliminating custom configuration logic that is no longer needed, likely due to updates in the project's build tooling or migration to a newer setup.

The most important changes are:

Node.js version update:

• Updated the Node.js version in .node-version from 14.21.3 to 22 to ensure the project uses a modern, supported Node.js runtime.

Configuration cleanup:

• Removed the custom environment variable and dotenv handling in config/env.js, which previously managed loading .env files and preparing environment variables for Webpack.
• Deleted config/nc-dev-utils.js, which contained utilities for Cordova/Electron builds and development server integration, indicating these features are no longer supported or are handled differently.
• Removed config/paths.js, which defined and resolved various project paths for the build process.
• Removed config/webpack.config.dev.js, the custom Webpack development configuration, suggesting a move to a standard or externally managed configuration.

[Copilot]

Pull request overview

This pull request modernizes the Electron security architecture by removing direct Node.js access from the renderer process and implementing a secure IPC bridge pattern. The changes eliminate legacy build tooling, remove deprecated server pairing functionality, and update the Node.js runtime to version 22.

Changes:

• Replaced direct Node.js access with a secure preload script and IPC-based API (electronAPI)
• Removed server discovery/pairing features and associated MDNS dependencies
• Migrated from custom Webpack configuration to electron-vite build system
• Updated Node.js from 14.21.3 to 22 and modernized dependencies

Reviewed changes

Copilot reviewed 96 out of 99 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/utils/electronAPI/index.js	New secure API abstraction layer for Electron IPC communication
src/utils/filesystem.js	Updated to use secure IPC instead of direct Node.js fs access
src/utils/Environment.js	Modified to detect Electron via secure API rather than window.require
src/utils/remote.js	Updated IPC event handlers to use secure electronAPI
src/utils/exportProcess.js	Refactored to use IPC-based export handlers instead of direct module access
public/preload/previewPreload.js	New preload script implementing secure IPC bridge with contextBridge
public/components/ipcHandlers.js	New main process IPC handlers for secure renderer communication
public/components/exportHandler.js	New export-related IPC handlers for main process
electron.vite.config.js	New build configuration replacing legacy Webpack setup
package.json	Updated dependencies and build scripts for electron-vite

Comments suppressed due to low confidence (5)

src/utils/networkFormat.js:1

• The errorMessage variable is used instead of error in the conditional check. Line 136 checks errorMessage instanceof Error but errorMessage is only assigned later and should be checking error instanceof Error.
  src/utils/protocol/getAssetUrl.js:1
• The code checks isElectron() but then also checks window.electronAPI?.env which is redundant. If isElectron() returns true, it already verifies window.electronAPI exists. However, the logic incorrectly assumes only Electron can be in development mode - Cordova can also be in development but this always returns false for it.
  src/utils/exportProcess.js:1
• The buildReformattedProtocols function is called every time export starts, but installedProtocols is unlikely to change during export. This could be cached or memoized to avoid recalculating protocol IDs on every export.
  src/utils/filesystem.js:1
• The getBuffer() method creates a new concatenated buffer on every call. For large files with many chunks, this could be memory-intensive. Consider implementing a more efficient streaming approach or caching the result if called multiple times.
  src/containers/App.js:1
• Polling for fullscreen state every second is inefficient. Consider adding IPC event listeners in the preload script for 'enter-full-screen' and 'leave-full-screen' events instead of polling, which would be more responsive and efficient.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The base64 detection logic is fragile. It only checks the first 100 characters and requires length > 1000, which could cause incorrect behavior for smaller binary files or text that happens to match the regex pattern. Consider using a more reliable method to differentiate between base64-encoded binary data and plain text, such as explicit encoding metadata.