Harden Windows DLP enforcement and Electron runtime packaging

apps/server/app.mjs

@@ -12,7 +12,7 @@ import {runApprovedAI} from './ai-gateway.mjs';
 import { z } from 'zod';
 import { randomUUID,timingSafeEqual } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
-import { PolicySchema, inspect, inspectForAI, allowsConfidentialLocal } from '../../packages/core/policy.mjs';
+import { PolicySchema, inspect } from '../../packages/core/policy.mjs';
 import { digest, token } from './store.mjs';
 import {policyPublisher} from './policy-review.mjs';
 import {installPolicyHistory} from './policy-history.mjs';
@@ -20,7 +20,6 @@ import {installUserProfiles} from './user-profiles.mjs';
 import {installPolicyGroups} from './policy-groups.mjs';
 import { adminMiddleware, authRoutes,cookie } from './auth.mjs';
 import {bootstrapAllowed,normalizePrincipal} from './admin-access.mjs';
-import { tracer } from './telemetry.mjs';
 import { toECS,toCEF } from '../../packages/core/siem.mjs';
 import {installSIEMRoutes} from './siem.mjs';
 import {createCompanyNewsReader} from './company-news.mjs';
@@ -123,9 +122,12 @@ export function createApp(store,config) {
   });
   app.get('/api/device/start-page/news',device,async(req,res)=>{try{const p=store.effectivePolicy(req.device.id);if(Date.parse(p.expiresAt)<=Date.now())return res.status(403).json({error:'Policy expired'});const news=await readCompanyNews(p);res.json({policyVersion:p.version,news});}catch{res.status(502).json({error:'Company news unavailable'});}});
   app.post('/api/device/ai',device,async(req,res,next)=>{
+    const controller=new AbortController(),cancel=()=>{if(!res.writableFinished)controller.abort();};
+    req.once('aborted',cancel);res.once('close',cancel);
     try{const b=z.object({prompt:z.string().min(1).max(100000)}).strict().parse(req.body),p=store.effectivePolicy(req.device.id);
-      const answer=await runApprovedAI({store,config,deviceId:req.device.id,policy:p,prompt:b.prompt});res.json({answer});
+      const answer=await runApprovedAI({store,config,deviceId:req.device.id,policy:p,prompt:b.prompt,signal:controller.signal});if(!controller.signal.aborted)res.json({answer});
     }catch(e){if([403,409,502].includes(e.status))return res.status(e.status).json({error:e.message,...(e.ruleId?{ruleId:e.ruleId}:{})});next(e);}
+    finally{req.removeListener('aborted',cancel);res.removeListener('close',cancel);}
   });
   app.use('/api/admin',admin);
   installSIEMRoutes(app,store,config);
@@ -154,7 +156,7 @@ export function createApp(store,config) {
     catch(error){store.db.exec('ROLLBACK');throw error;}
     res.json({ok:true,revoked:1});
   });
-  app.post('/api/admin/integrations/icap/probe',async(req,res,next)=>{
+  app.post('/api/admin/integrations/icap/probe',async(req,res,_next)=>{
     try{const settings=EnterpriseSchema.parse({icap:req.body}).icap;const result=await icapClient.probeIcap(settings,enterpriseInspection.deploymentTLS());store.event(null,'integration.tested',{actor:req.principal.sub,integration:'icap',ready:result.ready});res.json({...result,scope:'management-server',check:'options-only',contentSent:false});}
     catch{res.status(400).json({error:'ICAP configuration or deployment certificates are unavailable'});}
   });
@@ -271,16 +273,3 @@ export function createApp(store,config) {
   });
   return app;
 }
-async function readLimited(response,maxBytes) {
-  const chunks=[];let size=0;
-  for await(const chunk of response.body){size+=chunk.length;if(size>maxBytes){await response.body.cancel().catch(()=>{});throw Error('AI response too large');}chunks.push(chunk);}
-  return Buffer.concat(chunks).toString('utf8');
-}
-
-
-
-
-
-
-
-