first commit

apps/browser/dpapi.cjs

@@ -0,0 +1,20 @@
+const {app}=require('electron');
+const {spawn}=require('node:child_process');
+const path=require('node:path');
+function capabilityCrypto(operation,input){
+  const root=path.join(__dirname,'../..');
+  const python=app.isPackaged?path.join(process.resourcesPath,'python/python.exe'):path.join(root,'.runtime/windows/python/python.exe');
+  const script=app.isPackaged?path.join(process.resourcesPath,'inspector/dpapi.py'):path.join(root,'apps/inspector/dpapi.py');
+  if(!['protect','unprotect'].includes(operation)||Buffer.byteLength(input)>32768)return Promise.reject(Error('Capability rejected'));
+  return new Promise((resolve,reject)=>{
+    const environment={...process.env};for(const key of ['ADMIN_TOKEN','OIDC_CLIENT_SECRET','AI_API_KEY','INSPECTOR_TOKEN','SIEM_HTTP_TOKEN','SAFETYNET_PROXY_PASSWORD'])delete environment[key];
+    const child=spawn(python,[script,operation],{windowsHide:true,stdio:['pipe','pipe','pipe'],env:environment});let output='',settled=false;
+    const timer=setTimeout(()=>{child.kill();fail();},5000);
+    function fail(){if(!settled){settled=true;clearTimeout(timer);reject(Error('Windows capability protection failed'));}}
+    child.on('error',fail);child.stdin.on('error',fail);child.stderr.on('data',()=>{});
+    child.stdout.on('data',data=>{output+=data;if(output.length>65536){child.kill();fail();}});
+    child.on('close',code=>{if(code!==0||!output)return fail();if(!settled){settled=true;clearTimeout(timer);resolve(output);}});
+    child.stdin.end(input);
+  });
+}
+module.exports={capabilityCrypto};