fix(startup): preserve Electron WebContents receivers

tests/browser-security.test.ts

@@ -96,6 +96,37 @@ describe("browser-security", () => {
     });
   });
 
+  it("keeps native WebContents receivers when registering main-window security", () => {
+    const listeners = new Map<string, NavigationHandler>();
+    const webContents = {
+      on(this: unknown, event: string, listener: NavigationHandler) {
+        if (this !== webContents) {
+          throw new TypeError("WebContents receiver missing");
+        }
+        listeners.set(event, listener);
+      },
+      setWindowOpenHandler(this: unknown, _handler: WindowOpenHandler) {
+        if (this !== webContents) {
+          throw new TypeError("WebContents receiver missing");
+        }
+      },
+      session: {
+        setPermissionRequestHandler(this: unknown, _handler: PermissionHandler) {
+          if (this !== webContents.session) {
+            throw new TypeError("Session receiver missing");
+          }
+        }
+      }
+    };
+
+    expect(() => applyMainWindowSecurity({ webContents }, {
+      rendererUrl: "http://localhost:5180",
+      externalHosts: githubOnly
+    })).not.toThrow();
+    expect(listeners.has("will-navigate")).toBe(true);
+    expect(listeners.has("will-redirect")).toBe(true);
+  });
+
   it("denies main-window navigation to an untrusted origin", () => {
     const harness = createWindow();
     applyMainWindowSecurity(harness.window, {

tests/ipc-security.test.ts

@@ -40,6 +40,25 @@ describe("ipc-security", () => {
     })).not.toThrow();
   });
 
+  it("accepts packaged renderer IPC despite Windows path casing differences", () => {
+    const platform = Object.getOwnPropertyDescriptor(process, "platform");
+    Object.defineProperty(process, "platform", { configurable: true, value: "win32" });
+    try {
+      const appPath = path.join("C:", "Program Files", "MDD", "resources", "app.asar");
+      const rendererUrl = "file:///c:/program%20files/mdd/resources/app.asar/build/renderer/index.html";
+
+      expect(() => assertTrustedIpcSender(eventFor(rendererUrl), {
+        isPackaged: true,
+        devServerUrl: "http://localhost:5180",
+        appPath
+      })).not.toThrow();
+    } finally {
+      if (platform) {
+        Object.defineProperty(process, "platform", platform);
+      }
+    }
+  });
+
   it("rejects IPC from local files outside the packaged renderer tree", () => {
     const appPath = path.join("C:", "Program Files", "MDD", "resources", "app.asar");
     const attackerUrl = pathToFileURL(path.join("C:", "Users", "Public", "attacker.html")).toString();