Architecture Overview
Vast is an Electron desktop browser shell around Chromium page rendering and a React application interface.
Main process
Section titled “Main process”The main process owns privileged application behavior such as windows, browser sessions, storage boundaries, downloads, native dialogs, data migration, optional local services, and operations that should not be directly available to web content.
Application boundary
Section titled “Application boundary”The application renderer communicates with privileged functionality through a narrow, context-isolated bridge.
Normal websites do not receive that application bridge.
Renderer
Section titled “Renderer”The renderer contains the visible Vast interface: browser chrome, tabs, workspaces, Settings, New Tab, local tools, extension UI, and internal vast:// pages.
Web content
Section titled “Web content”Websites run as untrusted web content in sandboxed browser views. A site loaded in a Vast tab is not treated as part of the Vast application simply because it is displayed inside the same window.
Sessions and workspaces
Section titled “Sessions and workspaces”Workspace identity settings decide whether a browser session is isolated and persistent, temporary, or shared for compatibility. Proxy routing is attached to the workspace identity rather than being only a cosmetic workspace property.
Shared model
Section titled “Shared model”Shared TypeScript definitions describe persisted browser state and contracts for tabs, groups, workspaces, permissions, notes, downloads, macros, network devices, extension metadata, optional feature state, and user settings.
Storage boundary
Section titled “Storage boundary”Vast-owned profile data is accessed through the application boundary rather than allowing normal websites to read or write arbitrary browser files.
Optional local runtimes
Section titled “Optional local runtimes”Some Labs features have their own local runtime or OS capability. They remain separate from ordinary website privilege. Displaying a local tool inside Vast does not automatically grant that tool unrestricted access to the browser.
Security note
Section titled “Security note”This diagram is deliberately conceptual. Detailed privileged-channel names, signing logic, service topology, key material, anti-abuse controls, and private deployment mechanics are outside the scope of public documentation.