Harden Windows DLP enforcement and Electron runtime packaging

packages/core/policy.mjs

@@ -13,6 +13,7 @@ import {UserAccessSchema} from './user-profiles.mjs';
 import {LibraryPolicySchema} from './library.mjs';
 import {BrandSchema,StartPageSchema} from './branding.mjs';
 import {EvidencePolicySchema} from './evidence.mjs';
+import {inspectionTextVariants} from './text-variants.mjs';
 
 const host = z.string().max(253).regex(/^(\*\.)?[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/i);
 export const PolicySchema = z.object({
@@ -29,6 +30,7 @@ export const PolicySchema = z.object({
   browser: z.object({
     homeUrl: z.string().url(), allowedHosts: z.array(host).max(200), blockedHosts: z.array(host).max(200),
     allowDownloads: z.boolean(), allowDevTools: z.boolean(), allowWebSockets: z.boolean(),
+    allowAgentBackgroundWorkers: z.boolean().default(false),
     settings: ManagedSettingsSchema, bookmarks: BookmarksSchema
   }),
   proxy: z.discriminatedUnion('mode', [
@@ -103,9 +105,9 @@ export function inspect(bytes, policy) {
   try { text = new TextDecoder('utf-8',{fatal:true}).decode(data); }
   catch { return {decision:'block',ruleId:'uninspectable'}; }
   if(text.includes('\0')) return {decision:'block',ruleId:'uninspectable'};
-  const variants = [text];
-  try { variants.push(decodeURIComponent(text.replace(/\+/g,' '))); } catch {}
-  try { variants.push(JSON.stringify(JSON.parse(text))); } catch {}
+  let variants;
+  try{variants=inspectionTextVariants(text,policy.dlp.maxBytes);}
+  catch{return {decision:'block',ruleId:'normalization-limit'};}
   for(const value of variants) {
     let fragments;for(const r of policy.dlp.rules)if(r.kind==='fragment-sha256'){fragments??=fragmentHashes(value);if(fragments.has(r.value.toLowerCase()))return {decision:'block',ruleId:r.id};}
     for(const phrase of policy.security?.content?.blockedPhrases||[])if(value.normalize('NFKC').toLowerCase().includes(phrase.normalize('NFKC').toLowerCase()))return {decision:'block',ruleId:'content-blocklist'};