@electron/fuses 1.8.0

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/%40electron/fuses@1.8.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40electron/fuses@1.8.0
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:e86c4633d1bb469d9c35beda7ea70bc62f142c3da958042c377c66dca31232e6","constraints":{"executionContext":"node"},"contract":["flipFuses and getCurrentFuseWire are exported as functions alongside FuseVersion and FuseV1Options","getCurrentFuseWire parses fuse wire configuration from binary containing fuse sentinel","flipFuses flips specified fuses in binary and updates wire states","getCurrentFuseWire and flipFuses throw error when sentinel is missing in target binary","flipFuses throws error when strictlyRequireAllFuses is enabled and unconfigured fuses exist","flipFuses succeeds when strictlyRequireAllFuses is enabled and all fuses are explicitly configured"],"goal":"verify pkg:npm/%40electron/fuses@1.8.0","kind":"HOW","packages":["pkg:npm/%40electron/fuses@1.8.0"],"schemaVersion":1},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40electron/fuses@1.8.0"],"schemaVersion":1,"subject":"pkg:npm/%40electron/fuses@1.8.0","verifierAdapter":"node-typescript@1"}

{
  "name": "sample-electron-fuses",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-electron-fuses",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "@electron/fuses": "1.8.0"
      }
    },
    "node_modules/@electron/fuses": {
      "version": "1.8.0",
      "resolved": "https://registry.npmjs.org/@electron/fuses/-/fuses-1.8.0.tgz",
      "integrity": "sha512-zx0EIq78WlY/lBb1uXlziZmDZI4ubcCXIMJ4uGjXzZW0nS19TjSPeXPAjzzTmKQlJUZm0SbmZhPKP7tuQ1SsEw==",
      "license": "MIT",
      "dependencies": {
        "chalk": "^4.1.1",
        "fs-extra": "^9.0.1",
        "minimist": "^1.2.5"
      },
      "bin": {
        "electron-fuses": "dist/bin.js"
      }
    },
    "node_modules/ansi-styles": {
      "version": "4.3.0",
      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
      "license": "MIT",
      "dependencies": {
        "color-convert": "^2.0.1"
      },
      "engines": {
        "node": ">=8"
      },
      "funding": {
        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
      }
    },
    "node_modules/at-least-node": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
      "license": "ISC",
      "engines": {
        "node": ">= 4.0.0"
      }
    },
    "node_modules/chalk": {
      "version": "4.1.2",
      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
      "license": "MIT",
      "dependencies": {
        "ansi-styles": "^4.1.0",
        "supports-color": "^7.1.0"
      },
      "engines": {
        "node": ">=10"
      },
      "funding": {
        "url": "https://github.com/chalk/chalk?sponsor=1"
      }
    },
    "node_modules/color-convert": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
      "license": "MIT",
      "dependencies": {
        "color-name": "~1.1.4"
      },
      "engines": {
        "node": ">=7.0.0"
      }
    },
    "node_modules/color-name": {
      "version": "1.1.4",
      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
      "license": "MIT"
    },
    "node_modules/fs-extra": {
      "version": "9.1.0",
      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
      "license": "MIT",
      "dependencies": {
        "at-least-node": "^1.0.0",
        "graceful-fs": "^4.2.0",
        "jsonfile": "^6.0.1",
        "universalify": "^2.0.0"
      },
      "engines": {
        "node": ">=10"
      }
    },
    "node_modules/graceful-fs": {
      "version": "4.2.11",
      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
      "license": "ISC"
    },
    "node_modules/has-flag": {
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
      "license": "MIT",
      "engines": {
        "node": ">=8"
      }
    },
    "node_modules/jsonfile": {
      "version": "6.2.1",
      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
      "license": "MIT",
      "dependencies": {
        "universalify": "^2.0.0"
      },
      "optionalDependencies": {
        "graceful-fs": "^4.1.6"
      }
    },
    "node_modules/minimist": {
      "version": "1.2.8",
      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/ljharb"
      }
    },
    "node_modules/supports-color": {
      "version": "7.2.0",
      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
      "license": "MIT",
      "dependencies": {
        "has-flag": "^4.0.0"
      },
      "engines": {
        "node": ">=8"
      }
    },
    "node_modules/universalify": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
      "license": "MIT",
      "engines": {
        "node": ">= 10.0.0"
      }
    }
  }
}

{
  "name": "sample-electron-fuses",
  "version": "1.0.0",
  "private": true,
  "license": "MIT-0",
  "main": "src/index.js",
  "dependencies": {
    "@electron/fuses": "1.8.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/%40electron/fuses@1.8.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40electron/fuses@1.8.0"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

const {
  flipFuses,
  getCurrentFuseWire,
  FuseVersion,
  FuseV1Options
} = require('@electron/fuses');

/**
 * Reads fuse states from an Electron binary containing fuse wire.
 *
 * @param {string} binaryPath - Path to the Electron executable.
 * @returns {Promise<object>} Fuse configuration wire map.
 */
async function readFuses(binaryPath) {
  return getCurrentFuseWire(binaryPath);
}

/**
 * Flips fuse settings in an Electron binary.
 *
 * @param {string} binaryPath - Path to the Electron executable.
 * @param {object} config - Fuse configuration.
 * @returns {Promise<number>} Number of sentinels modified.
 */
async function updateFuses(binaryPath, config) {
  return flipFuses(binaryPath, config);
}

module.exports = {
  flipFuses,
  getCurrentFuseWire,
  FuseVersion,
  FuseV1Options,
  readFuses,
  updateFuses
};

import assert from 'node:assert/strict';
import { createRequire } from 'node:module';
import fs from 'node:fs';
import path from 'node:path';
import os from 'node:os';

const require = createRequire(import.meta.url);
const electronFuses = require('@electron/fuses');
const {
  flipFuses,
  getCurrentFuseWire,
  FuseVersion,
  FuseV1Options,
  readFuses,
  updateFuses
} = require('../src/index.js');

const SENTINEL = 'dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX';

// 1. flipFuses and getCurrentFuseWire are exported as functions alongside FuseVersion and FuseV1Options
assert.equal(typeof flipFuses, 'function', 'flipFuses must be a function');
assert.equal(typeof getCurrentFuseWire, 'function', 'getCurrentFuseWire must be a function');
assert.strictEqual(flipFuses, electronFuses.flipFuses, 'flipFuses must match @electron/fuses.flipFuses');
assert.strictEqual(getCurrentFuseWire, electronFuses.getCurrentFuseWire, 'getCurrentFuseWire must match @electron/fuses.getCurrentFuseWire');
assert.strictEqual(FuseVersion.V1, '1', 'FuseVersion.V1 must be "1"');
assert.strictEqual(FuseV1Options.RunAsNode, 0, 'FuseV1Options.RunAsNode must be 0');
assert.strictEqual(FuseV1Options.EnableCookieEncryption, 1, 'FuseV1Options.EnableCookieEncryption must be 1');
assert.strictEqual(FuseV1Options.OnlyLoadAppFromAsar, 5, 'FuseV1Options.OnlyLoadAppFromAsar must be 5');

const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fuses-contract-'));

function createMockBinary(filename, version = 1, length = 8, states = [48, 48, 48, 48, 48, 48, 48, 48]) {
  const filePath = path.join(tempDir, filename);
  const header = Buffer.from('MOCK_ELF_HEADER_DATA');
  const sentinel = Buffer.from(SENTINEL, 'utf8');
  const wire = Buffer.from([version, length, ...states]);
  const footer = Buffer.from('TRAILING_BINARY_PAYLOAD');
  fs.writeFileSync(filePath, Buffer.concat([header, sentinel, wire, footer]));
  return filePath;
}

try {
  // 2. getCurrentFuseWire parses fuse wire configuration from binary containing fuse sentinel
  const testBinary1 = createMockBinary('electron_app_1.bin');
  const initialWire = await readFuses(testBinary1);
  assert.equal(initialWire.version, '1', 'wire version must match binary wire version');
  assert.equal(initialWire[FuseV1Options.RunAsNode], 48, 'RunAsNode should initially be 48 (DISABLE)');
  assert.equal(initialWire[FuseV1Options.OnlyLoadAppFromAsar], 48, 'OnlyLoadAppFromAsar should initially be 48 (DISABLE)');

  // 3. flipFuses flips specified fuses in binary and updates wire states
  const sentinelsFlipped = await updateFuses(testBinary1, {
    version: FuseVersion.V1,
    [FuseV1Options.RunAsNode]: false,
    [FuseV1Options.EnableCookieEncryption]: true,
    [FuseV1Options.OnlyLoadAppFromAsar]: true
  });
  assert.equal(sentinelsFlipped, 1, 'must flip exactly 1 sentinel in single-binary file');

  const updatedWire = await readFuses(testBinary1);
  assert.equal(updatedWire[FuseV1Options.RunAsNode], 48, 'RunAsNode should remain 48 (DISABLE)');
  assert.equal(updatedWire[FuseV1Options.EnableCookieEncryption], 49, 'EnableCookieEncryption should be 49 (ENABLE)');
  assert.equal(updatedWire[FuseV1Options.OnlyLoadAppFromAsar], 49, 'OnlyLoadAppFromAsar should be 49 (ENABLE)');

  // 4. getCurrentFuseWire and flipFuses throw error when sentinel is missing in target binary
  const binaryWithoutSentinel = path.join(tempDir, 'invalid_binary.bin');
  fs.writeFileSync(binaryWithoutSentinel, Buffer.from('PLAIN_BINARY_WITHOUT_FUSE_SENTINEL'));

  await assert.rejects(
    async () => readFuses(binaryWithoutSentinel),
    /Could not find sentinel in the provided Electron binary/,
    'readFuses must reject when sentinel is missing'
  );

  await assert.rejects(
    async () => updateFuses(binaryWithoutSentinel, {
      version: FuseVersion.V1,
      [FuseV1Options.RunAsNode]: false
    }),
    /Could not find sentinel in the provided Electron binary/,
    'updateFuses must reject when sentinel is missing'
  );

  // 5. flipFuses throws error when strictlyRequireAllFuses is enabled and unconfigured fuses exist
  const testBinary2 = createMockBinary('electron_app_2.bin');
  await assert.rejects(
    async () => updateFuses(testBinary2, {
      version: FuseVersion.V1,
      strictlyRequireAllFuses: true,
      [FuseV1Options.RunAsNode]: false
    }),
    /strictlyRequireAllFuses: Missing explicit configuration for fuse/,
    'updateFuses with strictlyRequireAllFuses must reject when some fuses are omitted'
  );

  // 6. flipFuses succeeds when strictlyRequireAllFuses is enabled and all fuses are explicitly configured
  const strictCount = await updateFuses(testBinary2, {
    version: FuseVersion.V1,
    strictlyRequireAllFuses: true,
    [FuseV1Options.RunAsNode]: false,
    [FuseV1Options.EnableCookieEncryption]: true,
    [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
    [FuseV1Options.EnableNodeCliInspectArguments]: false,
    [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: false,
    [FuseV1Options.OnlyLoadAppFromAsar]: true,
    [FuseV1Options.LoadBrowserProcessSpecificV8Snapshot]: false,
    [FuseV1Options.GrantFileProtocolExtraPrivileges]: false
  });
  assert.equal(strictCount, 1, 'strictly configured fuses should flip successfully');

  const strictWire = await readFuses(testBinary2);
  assert.equal(strictWire[FuseV1Options.EnableCookieEncryption], 49, 'EnableCookieEncryption must be 49');
  assert.equal(strictWire[FuseV1Options.OnlyLoadAppFromAsar], 49, 'OnlyLoadAppFromAsar must be 49');
  assert.equal(strictWire[FuseV1Options.RunAsNode], 48, 'RunAsNode must be 48');

  console.log('Contract tests passed successfully.');
} finally {
  fs.rmSync(tempDir, { recursive: true, force: true });
}