'use strict';
// Check only switch names. Arguments, paths, credentials and agent payloads never enter errors.
const BLOCKED_SWITCHES=Object.freeze([
  'no-sandbox','disable-gpu-sandbox','disable-web-security','allow-running-insecure-content',
  'remote-debugging-port','remote-debugging-pipe','remote-debugging-socket-name',
  'load-extension','disable-extensions-except','disable-site-isolation-trials','disable-site-isolation-for-policy',
  'single-process','in-process-gpu','renderer-cmd-prefix','utility-cmd-prefix','gpu-launcher',
  'inspect','inspect-brk','inspect-wait','inspect-port','debug','debug-brk','debug-port'
]);
const failure=()=>{throw new Error('Unsafe browser startup configuration');};
function assertSecureStartup(commandLine,nodeExecArgv=process.execArgv){
  try{
    if(!commandLine||typeof commandLine.hasSwitch!=='function'||!Array.isArray(nodeExecArgv))return failure();
    for(const name of BLOCKED_SWITCHES){const present=commandLine.hasSwitch(name);if(typeof present!=='boolean'||present)return failure();}
    // Electron/Node can consume inspector flags before they reach Chromium's CommandLine.
    for(const argument of nodeExecArgv){if(typeof argument!=='string'||/^--(?:inspect(?:-brk|-wait|-port)?|debug(?:-brk|-port)?)(?:=|$)/.test(argument))return failure();}
    // NODE_OPTIONS can activate Node's inspector without appearing in process.execArgv.
    if(require('node:inspector').url())return failure();
    return true;
  }catch{return failure();}
}
module.exports={assertSecureStartup,BLOCKED_SWITCHES};