Harden Windows DLP enforcement and Electron runtime packaging

tests/agent-audit.test.mjs

@@ -3,6 +3,15 @@ import assert from 'node:assert/strict';
 import {randomUUID} from 'node:crypto';
 import audit from '../packages/core/agent-audit.cjs';
 import {toECS,toCEF} from '../packages/core/siem.mjs';
+
+test('worker audit retains immutable principal generation without inventing a foreground session',()=>{
+ const facts=audit.agentAuditFacts({action:'network:background',outcome:'completed',principalId:'worker-agent',credentialGeneration:3});
+ assert.equal(facts.scope,'network:background');assert.equal(facts.sessionId,undefined);
+ assert.deepEqual(audit.agentFactsForEvent('agent.action',facts),facts);
+ assert.equal(audit.agentFactsForEvent('agent.denied',facts),null);
+ assert.throws(()=>audit.agentAuditFacts({...facts,credentialGeneration:undefined}));
+ for(const key of ['body','cookies','authorization','initiator','url'])assert.throws(()=>audit.agentAuditFacts({...facts,[key]:'PRIVATE_WORKER_DATA'}));
+});
 test('agent audit binds every fixed action to its scope and rejects secret-bearing extras',()=>{
  for(const [action,scope] of Object.entries(audit.AGENT_SCOPES)){
   const outcome=action==='agent-request'?'denied':'completed';