Harden Windows DLP enforcement and Electron runtime packaging

tests/startup-exit.test.mjs

@@ -0,0 +1,14 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import vm from 'node:vm';
+import {readFileSync} from 'node:fs';
+import {createRequire} from 'node:module';
+const require=createRequire(import.meta.url);
+test('actual main startup exits with fixed diagnostics before unsafe runtime initialization',()=>{
+ const source=readFileSync(new URL('../apps/browser/main.cjs',import.meta.url),'utf8');
+ const prefix=source.slice(0,source.indexOf('// Force Chromium sandboxing'));
+ const exits=[],messages=[],sentinel=Error('Fixture process terminated');
+ const context={require:name=>name==='electron'?{app:{commandLine:{hasSwitch:flag=>flag==='inspect'}}}:require('../apps/browser/'+name.slice(2)),process:{exit:code=>{exits.push(code);throw sentinel;}},console:{error:message=>messages.push(message)}};
+ assert.throws(()=>vm.runInNewContext(prefix,context),error=>error===sentinel);
+ assert.deepEqual(exits,[1]);assert.deepEqual(messages,['Managed browser startup denied']);
+});