Managed windows (`window.Electron.windows`)

Open, list, and control secondary BrowserWindows from the renderer, without ever handing Node/Electron access to untrusted content. Source: src/main/windows.ts, channel prefix windows:*. Always on, no config needed. This is the sanctioned replacement for window.open()/target="_blank", which this package denies outright (see Architecture: permission and navigation hardening).

The trust split: `appPath` vs `url`

create() opens a window in one of two fundamentally different trust levels — this is the core design of the module, not an incidental option:

appPath — a route inside your own app (e.g. '#/settings'). Trusted content you wrote, so the new window gets the full preload bridge, same as the main window. Resolution is pluggable via createElectronApp()'s resolveAppWindow option; by default it mirrors however the main window itself loads (dev URL, 'protocol', 'server', or 'file').
url — some other http(s) address. Untrusted content: it never gets the preload bridge, can't spawn further Electron windows, and any navigation away from that address is intercepted rather than followed inside Electron. Popups are denied as Electron windows; http(s) and any scheme listed in app.externalWindowAllowedSchemes (see App configuration) are handed off to the OS instead.

Methods

Method	Returns	Notes
`create(options?: ManagedWindowCreateOptions)`	`Promise<ManagedWindowInfo>`	See options table below.
`list()`	`Promise<ManagedWindowInfo[]>`	Every currently-open managed window.
`focus(id: number)`	`Promise<void>`
`close(id: number)`	`Promise<void>`
`show(id: number)`	`Promise<void>`
`hide(id: number)`	`Promise<void>`
`setBounds(id: number, bounds: Rect)`	`Promise<void>`	`Rect = { x, y, width, height }`.
`openExternal(url: string)`	`Promise<void>`	Hands a URL to the OS's default handler (`shell.openExternal`), bypassing Electron entirely.

`ManagedWindowCreateOptions`

Field	Type	Notes
`appPath`	`string`	Internal route — trusted, gets the preload bridge. Use `#/settings`-style hash routes so they also work in production `'file'` mode.
`url`	`string`	External `http(s)` URL — untrusted, no preload bridge.
`width`, `height`, `x`, `y`, `minWidth`, `minHeight`	`number`
`title`	`string`
`modal`	`boolean`
`alwaysOnTop`	`boolean`
`resizable`, `minimizable`, `maximizable`, `fullscreenable`	`boolean`
`backgroundColor`	`string`
`show`	`boolean`

`ManagedWindowInfo`

{ id, title, bounds, isVisible, isFocused, isMinimized, isMaximized, isFullScreen, isDestroyed }

Example

const settingsWin = await window.Electron.windows.create({
  appPath: '#/settings',
  width: 480,
  height: 600,
  modal: true,
});

const docs = await window.Electron.windows.create({ url: 'https://example.com/docs' });

await window.Electron.windows.setBounds(settingsWin.id, { x: 100, y: 100, width: 600, height: 700 });

`.safe`

Fully mirrored — every method above has a window.Electron.safe.windows.* twin. create() can fail with VALIDATION (e.g. an appPath over 2048 characters, or a url using a blocked scheme like javascript:/data:/vbscript:) or RUNTIME.

Managed windows (window.Electron.windows)

The trust split: appPath vs url