diff --git a/electron/preload.bundle.js b/electron/preload.bundle.js
index 7e32cc05..ef5d5bb1 100644
--- a/electron/preload.bundle.js
+++ b/electron/preload.bundle.js
@@ -113,85 +113,6 @@ function isTrustedShellOrigin(url) {
     return isLocalBackendUrl(url);
 }
 
-/**
- * Whether window.open should create a child Electron window instead of the OS browser.
- * Local backend popouts and call.html must stay in Electron so they keep the app session.
- * @param {unknown} url
- * @returns {boolean}
- */
-function shouldOpenInElectronWindow(url) {
-    if (!url || typeof url !== "string") {
-        return false;
-    }
-    if (url.startsWith("blob:")) {
-        return isTrustedBlobUrl(url);
-    }
-    if (!isLocalBackendUrl(url)) {
-        return false;
-    }
-    const parsed = parseAbsoluteUrl(url);
-    if (!parsed) {
-        return false;
-    }
-    const pathname = parsed.pathname || "";
-    if (pathname === "/call.html" || pathname.endsWith("/call.html")) {
-        return true;
-    }
-    return parsed.hash.startsWith("#/popout/");
-}
-
-/**
- * Whether the main frame may navigate to this URL inside Electron (local app shell).
- * External http(s) links must open in the system browser instead.
- * data: and file: are denied. blob: is allowed only when the inner origin is local.
- * @param {unknown} url
- * @returns {boolean}
- */
-function shouldAllowInWindowNavigation(url) {
-    if (!url || typeof url !== "string") {
-        return false;
-    }
-    if (url.startsWith("blob:")) {
-        return isTrustedBlobUrl(url);
-    }
-    return isLocalBackendUrl(url);
-}
-
-/**
- * URL of the renderer frame that invoked an ipcMain handler.
- * Prefers senderFrame.url, then sender.getURL().
- * @param {unknown} event
- * @returns {string}
- */
-function senderUrlFromIpcEvent(event) {
-    if (!event || typeof event !== "object") {
-        return "";
-    }
-    const frame = event.senderFrame;
-    if (frame && typeof frame.url === "string" && frame.url) {
-        return frame.url;
-    }
-    const sender = event.sender;
-    if (sender && typeof sender.getURL === "function") {
-        try {
-            const url = sender.getURL();
-            return typeof url === "string" ? url : "";
-        } catch {
-            return "";
-        }
-    }
-    return "";
-}
-
-/**
- * Whether ipcMain may run for this invoke. Same allowlist as preload.
- * @param {unknown} event
- * @returns {boolean}
- */
-function isTrustedIpcEvent(event) {
-    return isTrustedShellOrigin(senderUrlFromIpcEvent(event));
-}
-
 const { ipcRenderer, contextBridge } = require("electron");
 function originAllowed() {
     if (typeof location === "undefined") {
diff --git a/meshchatx.rsm b/meshchatx.rsm
index 380b65c8..c08e4962 100644
Binary files a/meshchatx.rsm and b/meshchatx.rsm differ
diff --git a/scripts/bundle-electron-preload.cjs b/scripts/bundle-electron-preload.cjs
index d789b74e..4337ff49 100644
--- a/scripts/bundle-electron-preload.cjs
+++ b/scripts/bundle-electron-preload.cjs
@@ -17,10 +17,14 @@ const outPath = path.join(root, "electron", "preload.bundle.js");
 const shellSource = fs.readFileSync(shellPath, "utf8");
 const preloadSource = fs.readFileSync(preloadPath, "utf8");
 
-const shellBody = shellSource
-    .replace(/^"use strict";\s*/m, "")
-    .replace(/\nmodule\.exports\s*=\s*\{[\s\S]*$/m, "")
-    .trim();
+const shellBody = (() => {
+    let body = shellSource.replace(/^"use strict";\s*/m, "");
+    const preloadOnlyCut = body.indexOf("/**\n * Whether window.open should create");
+    if (preloadOnlyCut >= 0) {
+        return body.slice(0, preloadOnlyCut).trim();
+    }
+    return body.replace(/\nmodule\.exports\s*=\s*\{[\s\S]*$/m, "").trim();
+})();
 
 const preloadBody = preloadSource
     .replace(/const \{ isTrustedShellOrigin \} = require\("\.\/shellOrigin"\);\s*/m, "")