Runtime flow
1
Renderer calls the preload API
Pages call methods exposed on
window.context, such as createServer, startServer, listServerFiles, or installModrinthProject.2
Preload forwards through IPC
The preload bridge maps each method to
ipcRenderer.invoke(...) or subscribes to events such as console output, server status, backup progress, and ngrok URL changes.3
Main process performs the work
The Electron main process validates input, touches disk, starts Java, downloads content, creates archives, or manages ngrok.
4
Renderer receives state updates
The UI refreshes server records, console lines, stats, backup progress, analytics, and tunnel URLs from IPC responses and events.
Main data paths
Catalyst stores mutable data under Electron’suserData directory:
Safety boundaries
Renderer sandbox
The window runs with
contextIsolation and sandbox enabled. The renderer does not get raw Node.js access.Safe file paths
File operations resolve paths inside a server root and reject traversal, absolute paths, and unsafe names.
Zip import checks
Imported archives need a manifest, are size limited, and are protected against zip-slip paths.
Confirmed AI actions
The AI assistant can propose changes, but server commands and file/property writes require confirmation.
