From 8a28c21512f4890ae840a6e69a0487ac0c73e210 Mon Sep 17 00:00:00 2001
From: Amit Haridas <amit.wh@gmail.com>
Date: Sun, 23 Aug 2026 11:04:14 +0530
Subject: [PATCH] fix(plugins): whitelist plugin export-format IPC channels in
 preload.js

Task 17's three new IPC channels (plugin-export-formats-registered,
run-plugin-export-format, plugin-export-format-result) were missing
from preload.js's ALLOWED_SEND_CHANNELS/ALLOWED_RECEIVE_CHANNELS,
breaking the established convention that the allowlist is the
authoritative registry of every valid channel regardless of whether
it's accessed via window.electronAPI or raw ipcRenderer (see
toggle-sidebar-panel, set-current-file, save-recent-files).

Amit Haridas
---
 src/preload.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/preload.js b/src/preload.js
index 0baa6b4..acf5bed 100644
--- a/src/preload.js
+++ b/src/preload.js
@@ -36,6 +36,10 @@ const ALLOWED_SEND_CHANNELS = [
   'export-with-options',
   'export-spreadsheet',
 
+  // Plugin export formats
+  'plugin-export-formats-registered',
+  'plugin-export-format-result',
+
   // Batch conversion
   'batch-convert',
   'select-folder',
@@ -244,6 +248,9 @@ const ALLOWED_RECEIVE_CHANNELS = [
   'toggle-command-palette',
   'toggle-sidebar-panel',
   'toggle-bottom-panel',
+
+  // Plugin export formats
+  'run-plugin-export-format',
 ];
 
 /**