Harden Windows DLP enforcement and Electron runtime packaging

tests/worker-policy-boundary.test.mjs

@@ -0,0 +1,27 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync} from 'node:crypto';
+import {createRequire} from 'node:module';
+import {defaultPolicy,PolicySchema,signPolicy,verifyPolicy} from '../packages/core/policy.mjs';
+import {AgentGrantSchema} from '../packages/core/security.mjs';
+const {startAgentControl}=createRequire(import.meta.url)('../apps/browser/agent-control.cjs');
+const {requestAgent}=createRequire(import.meta.url)('../apps/browser/agent-transport-client.cjs');
+
+test('worker gate defaults off and survives signed policy verification',()=>{
+ const p=defaultPolicy();assert.equal(p.browser.allowAgentBackgroundWorkers,false);
+ delete p.browser.allowAgentBackgroundWorkers;
+ assert.equal(PolicySchema.parse(p).browser.allowAgentBackgroundWorkers,false);
+ p.browser.allowAgentBackgroundWorkers=true;
+ const {privateKey,publicKey}=generateKeyPairSync('ed25519',{privateKeyEncoding:{type:'pkcs8',format:'pem'},publicKeyEncoding:{type:'spki',format:'pem'}});
+ assert.equal(verifyPolicy(signPolicy(p,privateKey),publicKey).browser.allowAgentBackgroundWorkers,true);
+ assert.equal(PolicySchema.safeParse({...p,browser:{...p.browser,allowAgentBackgroundWorkers:'true'}}).success,false);
+});
+
+test('background permission cannot become an executable agent RPC',async t=>{
+ const grant=AgentGrantSchema.parse({id:'worker-agent',name:'Worker',enabled:true,expiresAt:'2099-12-31T23:59:59Z',scopes:['network:background'],allowedHosts:['company.example'],generation:1});
+ assert.deepEqual(grant.scopes,['network:background']);let executed=0;
+ const api=await startAgentControl({authorize:async()=>({allowed:true,role:'agent',scopes:['network:background']}),actions:{'network:background':async()=>{executed++;}},audit:async()=>{}});
+ t.after(()=>api.close());
+ assert.equal((await requestAgent(api,{action:'network:background',args:{}})).status,400);
+ assert.equal(executed,0);
+});