Architecture - ejGames

ejGames is a Tauri 2 app: a Rust core and a web interface in WebView2. The interface has two layers. The host (React) draws settings, editors and menus. The theme draws the library inside an isolated iframe.

src-tauri/src/     Rust core
  library/         folder scanning, exe detection (PE), folder watching
  metadata/        Steam GetItems, SteamGridDB, IGDB, matcher, rate-limited queue
  media/           image store + thumbnails, HLS trailer proxy/cache
  launcher/        ShellExecuteEx, "run as administrator", process tracker, sessions, Guide button
  achievements/    Steam schema, emulator files and local Steam stats (binary KeyValues)
  overlay/         transparent window over the game, global shortcut, notices and panel
  explore/         repack source (WordPress API), page reading, cache and images through ejg-media
  downloads/       lazy torrent engine (librqbit), queue, progress, install and game registration
  guides/          Steam community guides: HTML → safe blocks, saved guides and progress
  trainers/        FLiNG trainers: search, page, install, process during play and SendInput
  maps.rs          Map Genie catalog (sitemap), title matching and manual choice
  protocols.rs     ejg-media (Range) and ejg-theme / ejg-safe (CSP + sandbox)
  lifecycle.rs     window, tray, saver mode (EcoQoS + memory trim)
  update.rs        new versions from GitHub Releases (download + SHA-256 + passive installer)
src/               React host: settings, game editor, profiles, statistics, bridge to themes
sdk/               theme SDK (window.ejg) and utility kit
themes/            built-in themes
installer-app/     the installer that gets published (Tauri): carries the NSIS installer and runs it silently
docs/              this documentation (Mintlify)
examples/          the guide's example theme

Theme security

Each theme runs in an isolated iframe with a null origin, without allow-same-origin, and with a CSP that cuts off the network. WebView2 injects Tauri’s IPC into every frame, but Tauri rejects calls from null origins and the CSP blocks ipc.localhost. The theme only talks to the host through postMessage, and the host validates every call (src/host/bridge.ts). Map Genie maps are third-party iframes (sandbox without allow-top-navigation or allow-popups). They also receive Tauri’s IPC, but their calls arrive with origin https://mapgenie.io and Tauri rejects them: no command accepts remote origins. That is why Object.prototype is not frozen with freezePrototype (on Windows that would also enter those pages and break them) but with a script of our own that only acts on ejGames documents (lifecycle::FREEZE_OURS). If a theme hangs, a watchdog replaces it with the house theme, Moneda, served from another origin (ejg-safe), which means another process.

Data

%APPDATA%\ejGames\ holds library.db (SQLite), settings.json, logs\ejgames.log, cache\media (art, addressed by content), cache\trailers (LRU with a configurable size) and themes\ (user themes). With a portable.txt file next to the exe, everything goes to .\data.

​Theme security

​Data

Theme security

Data