[qwen-code-dev-bot]

Summary

Establish the first secure Electron foundation for the macOS-first desktop roadmap. This slice adds the main-process lifecycle, a one-method context-isolated preload bridge, hardened BrowserWindow defaults, local-only shell loading, navigation and popup denial, and the build step required to bundle a sandbox-compatible CommonJS preload.

Motivation

The desktop roadmap needs a real Electron process boundary before renderer layout, terminal continuity, and live workbench behavior can be added safely. Keeping this boundary in its own PR makes the security contract independently reviewable.

Reviewer Test Plan

• Verify the desktop window keeps sandboxing and context isolation enabled while renderer-side Node integration remains disabled.
• Verify the preload surface exposes only bootstrap state and cannot dispatch arbitrary IPC channels.
• Verify the main process blocks top-level navigation and new windows and loads no remote URL.
• Verify the standard CLI build, typecheck, unit, integration, and smoke commands remain green.

Verification

• Build: pass
• Typecheck: pass
• Unit: 901 pass
• Integration: 265 pass
• Smoke: 5 pass

Linux Xvfb interaction and the macOS runner screenshot remain separate governed desktop slices.

Closes #127
Part of #106

[qwen-code-dev-bot]

E2E verification

• Repository: qwen-code-dev-bot/oh-my-cli
• Pull request: #128
• Commit: 7076b7fe756ff264f380c27fd98887e0e08d9cf4
• Evidence mode: terminal
• Result: PASS

Scenario	Command	Exit	Duration
integration	npm run test:integration	0	11.827s
smoke	npm run smoke	0	2.814s

Full immutable report