Harden Windows DLP enforcement and Electron runtime packaging

tests/clipboard-review.test.mjs

@@ -59,3 +59,15 @@ test('clipboard completion metadata follows actual commit and native write, neve
  events.length=0;options.inspect=async()=>({decision:'block',ruleId:'blocked'});assert.equal((await createClipboardGuard(options).perform('paste',wc)).completed,false);assert.equal(events.length,0);
  options.inspect=async()=>({decision:'allow'});options.writeClipboard=async()=>{c={...c,navigationId:c.navigationId+1};};assert.equal((await createClipboardGuard(options).perform('copy',wc)).completed,false);assert.equal(events.length,0);
 });
+
+test('paste rereads external clipboard per gesture and never swaps approved bytes during asynchronous scan',async()=>{
+ const frame={},wc={mainFrame:frame,focusedFrame:frame};let clipboard='First public clipboard',context={ready:true,tabId:'71911cdc-a390-4e73-a604-d98d05fd52a5',activation:1,policy:defaultPolicy(),url:'https://company.example/',navigationId:1,webContents:wc};
+ const scanned=[],inserted=[],events=[];let waiting=deferred(),started=deferred();
+ const guard=createClipboardGuard({getContext:()=>context,stage:async()=>({text:''}),validate:async()=>({completed:true}),commit:async args=>{inserted.push(args.text);return {completed:true};},discard:async()=>{},readClipboard:async()=>clipboard,writeClipboard:async()=>{},inspect:async bytes=>{scanned.push(bytes.toString());started.resolve();return waiting.promise;},audit:async(kind,ruleId,facts)=>events.push({kind,ruleId,facts})});
+ const first=guard.perform('paste',wc);await started.promise;clipboard='Secret Roadmap changed by external app';waiting.resolve({decision:'allow'});assert.equal((await first).completed,true);assert.deepEqual(inserted,['First public clipboard']);
+ waiting=deferred();started=deferred();const second=guard.perform('paste',wc);await started.promise;assert.equal(scanned.at(-1),clipboard);waiting.resolve({decision:'block',ruleId:'company-secret'});assert.equal((await second).completed,false);assert.deepEqual(inserted,['First public clipboard']);
+ clipboard='Third public clipboard';waiting=deferred();started=deferred();const third=guard.perform('paste',wc);await started.promise;context={...context,policy:{...context.policy,version:context.policy.version+1}};waiting.resolve({decision:'allow'});assert.equal((await third).completed,false);assert.deepEqual(inserted,['First public clipboard']);
+ assert.ok(events.some(e=>e.kind==='clipboard.paste'&&e.facts.action==='paste'&&e.facts.sessionId===context.tabId&&e.facts.outcome==='authorized'));
+ assert.ok(events.some(e=>e.kind==='clipboard.block'&&e.ruleId==='company-secret'));
+ assert.equal(JSON.stringify(events).includes('clipboard changed by external'),false);assert.equal(JSON.stringify(events).includes('Secret Roadmap'),false);assert.equal(JSON.stringify(events).includes('First public clipboard'),false);
+});