Implement managed browser security, individual agents and observability

tests/download-gate.test.mjs

@@ -36,3 +36,17 @@ test('magic-byte executable and mismatch blocks precede scanner, dialog and OS w
 test('no-scanner downloads require explicit central approval and carry actual safe forensic facts',async()=>{
  const f=setup();f.context.policy.security.yara.enabled=false;assert.equal((await f.gate(f.input)).reason,'malware-scanner-required');f.context.policy.fileTransfers={download:{allowWithoutMalwareScanner:true}};const v=await f.gate(f.input);assert.equal(v.released,true);assert.equal(v.facts.detectedType,'text');assert.equal(v.facts.size,15);
 });
+test('opt-in terminal evidence carries inspected metadata and sanitized source URL',async()=>{
+ const events=[];const f=setup({audit:async(...args)=>events.push(args)});f.context.policy.evidence={enabled:true,captureDownloads:true};
+ assert.equal((await f.gate({...f.input,url:'https://user:[email protected]/file?token=secret#private'})).released,true);
+ assert.equal(events.find(e=>e[0]==='download.scan')[4],undefined);const e=events.find(e=>e[0]==='download.released')[4];
+ assert.equal(e.sourceUrl,'https://example.com/file');assert.equal(e.bytes,15);assert.equal(e.sha256,createHash('sha256').update('benign download').digest('hex'));assert.equal(e.decision,'allow');assert.equal('content' in e,false);
+});
+test('disabled, cancelled or stale downloads cannot enqueue protected evidence',async()=>{
+ for(const settings of [{enabled:false,captureDownloads:true},{enabled:true,captureDownloads:false},undefined]){const events=[];const f=setup({audit:async(...args)=>events.push(args)});f.context.policy.evidence=settings;await f.gate(f.input);assert.ok(events.every(e=>!e[4]));}
+ const events=[];const f=setup({choosePath:async()=>null,audit:async(...args)=>events.push(args)});f.context.policy.evidence={enabled:true,captureDownloads:true};assert.equal((await f.gate(f.input)).reason,'user-cancelled');assert.ok(events.every(e=>!e[4]));
+ let current=true;const stale=[];const g=setup({isCurrent:()=>current,scan:async()=>{current=false;return {decision:'block',ruleId:'malware'};},audit:async(...args)=>stale.push(args)});g.context.policy.evidence={enabled:true,captureDownloads:true};await g.gate(g.input);assert.ok(stale.every(e=>!e[4]));
+});
+test('malware rejection captures complete blocked facts without filesystem release',async()=>{
+ const events=[];const f=setup({scan:async()=>({decision:'block',ruleId:'malware'}),audit:async(...args)=>events.push(args)});f.context.policy.evidence={enabled:true,captureDownloads:true};assert.equal((await f.gate(f.input)).released,false);assert.equal(events[0][4].decision,'block');assert.equal(events[0][4].ruleId,'malware');assert.equal(f.calls.includes('write'),false);
+});