It is possible to use this package with sandbox: true

[theogravity]

This is with the following security settings:

  contextIsolation: true,
  sandbox: true,
  nodeIntegration: false,

I was able to get around the limitation (which I think is because you can't use external node modules in the renderer preload process with the settings) by copying the packages/interprocess/src directory directly to my project (I created an ipc/interprocess subdir and had main and renderer processes be able to access it). I have not had any issues with bi-directional communication so far and was able to connect the invokers / handlers to the context bridge without issue.

I made sure to include the LICENSE and README.md file for proper attribution with the source code unmodified.

[daltonmenezes]

Hi @theogravity , the Electron docs say:

In order to allow renderer processes to communicate with the main process, preload scripts attached to sandboxed renderers will still have a polyfilled subset of Node.js APIs available. A require function similar to Node's require module is exposed, but can only import a subset of Electron and Node's built-in modules:
electron (only renderer process modules)
events
timers
url
In addition, the preload script also polyfills certain Node.js primitives as globals:
Buffer
process
clearImmediate
setImmediate
Because the require function is a polyfill with limited functionality, you will not be able to use CommonJS modules to separate your preload script into multiple files. If you need to split your preload code, use a bundler such as webpack or Parcel.
Note that because the environment presented to the preload script is substantially more privileged than that of a sandboxed renderer, it is still possible to leak privileged APIs to untrusted code running in the renderer process unless contextIsolation is enabled.

[theogravity]

Thank you so much for the clarification!

I haven't had issues though aside from trying to have separate preloader per browser window instance with esbuild / rollup, which I don't think is related to this project at all.