Harden Windows DLP enforcement and Electron runtime packaging

tests/user-profiles.test.mjs

@@ -14,3 +14,5 @@ test('domain categories and intersected host allowances fail closed for disjoint
 test('profile publication enforces independent reviewers, role permissions, CAS, snapshots and restore',async t=>{const f=await fixture(t,true),profile=UserProfileSchema.parse({id:'executive',name:'Board',deviceIds:['one'],requireDocumentScan:true});const queued=await f.api('/api/admin/user-profiles/executive','PUT',{expectedVersion:1,profile},'operator','operator');assert.equal(queued.status,202);assert.equal(f.store.getRaw('userProfiles'),null);const body={payloadHash:queued.body.payloadHash,expectedVersion:1,approve:true};assert.equal((await f.api(`/api/admin/policy-reviews/${queued.body.reviewId}/approve`,'POST',body,'operator')).status,403);assert.equal((await f.api(`/api/admin/policy-reviews/${queued.body.reviewId}/approve`,'POST',body,'reviewer')).status,200);assert.equal((await f.api('/api/admin/user-profiles/executive','PUT',{expectedVersion:1,profile})).status,409);assert.equal((await f.api('/api/admin/user-profiles/executive','DELETE',{expectedVersion:2},'auditor','auditor')).status,403);assert.equal((await f.api('/api/admin/policy/history/2')).body.userProfiles.profiles[0].id,'executive');const restore=await f.api('/api/admin/policy/restore','POST',{sourceVersion:1,expectedVersion:2,approve:true});assert.equal(restore.status,202);assert.equal((await f.api(`/api/admin/policy-reviews/${restore.body.reviewId}/approve`,'POST',{payloadHash:restore.body.payloadHash,expectedVersion:2,approve:true},'reviewer')).status,200);assert.deepEqual(f.store.getRaw('userProfiles').profiles,[]);});
 
 test('enrollment cannot forge a verified SSO subject through client input or a named provisioning code',async t=>{const f=await fixture(t);const code='synthetic-provisioning-code-123456789';f.store.db.prepare('INSERT INTO enrollments VALUES(?,?,?)').run(digest(code),Date.now()+60000,'employee');const r=await fetch(f.base+'/api/device/enroll',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({code,name:'Forged label',platform:'win32',sub:'employee',verified_subject:'employee',user:'employee'})});assert.equal(r.status,200);const b=await r.json(),d=f.store.db.prepare('SELECT verified_subject,user FROM devices WHERE id=?').get(b.id);assert.equal(d.verified_subject,null);assert.equal(d.user,'employee');});
+
+test('agent background worker profiles only restrict and cannot widen central permission',()=>{const p=defaultPolicy(),inherit=UserProfileSchema.parse({id:'inherit',name:'Inherit',deviceIds:['one']}),deny=UserProfileSchema.parse({id:'deny',name:'Deny',deviceIds:['one'],features:{agentBackgroundWorkers:'deny'}});assert.equal(inherit.features.agentBackgroundWorkers,'inherit');assert.throws(()=>UserProfileSchema.parse({...deny,features:{agentBackgroundWorkers:'allow'}}));p.browser.allowAgentBackgroundWorkers=false;assert.equal(applyUserProfiles(p,{profiles:[inherit]},{id:'one'}).browser.allowAgentBackgroundWorkers,false);p.browser.allowAgentBackgroundWorkers=true;assert.equal(applyUserProfiles(p,{profiles:[inherit]},{id:'one'}).browser.allowAgentBackgroundWorkers,true);assert.equal(applyUserProfiles(p,{profiles:[inherit,deny]},{id:'one'}).browser.allowAgentBackgroundWorkers,false);assert.deepEqual(applyUserProfiles(p,{profiles:[inherit,deny]},{id:'one'}),applyUserProfiles(p,{profiles:[deny,inherit]},{id:'one'}));assert.equal(applyUserProfiles(p,{profiles:[deny]},{id:'other'}).browser.allowAgentBackgroundWorkers,true);});