@electron/fuses 1.8.0: flipFuses

audit=false

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify @electron/fuses.flipFuses in pkg:npm/%40electron/fuses@1.8.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40electron/fuses@1.8.0
Demonstrate these symbols/APIs:
  - @electron/fuses.flipFuses
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:3957c7f9158539f52fcd8dc03f65a6a873e656b3e0899261341013f1f298c6cf","constraints":{"executionContext":"node"},"contract":["flipFuses modifies fuse wire bytes in target binary and returns number of sentinels updated","getCurrentFuseWire reads and decodes current fuse states from binary","flipFuses updates multiple sentinels in multi-architecture or universal binary","flipFuses rejects when sentinel magic bytes are absent in binary","flipFuses rejects on fuse wire version mismatch","flipFuses strictlyRequireAllFuses enforces explicit configuration for all fuses","flipFuses rejects configuration for fuse option exceeding wire length"],"goal":"verify @electron/fuses.flipFuses in pkg:npm/%40electron/fuses@1.8.0","kind":"HOW","packages":["pkg:npm/%40electron/fuses@1.8.0"],"schemaVersion":1,"symbols":["@electron/fuses.flipFuses"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40electron/fuses@1.8.0"],"schemaVersion":1,"subject":"pkg:npm/%40electron/fuses@1.8.0","symbols":["@electron/fuses.flipFuses"],"verifierAdapter":"node-typescript@1"}

{
  "name": "sample-electron-fuses",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-electron-fuses",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "@electron/fuses": "1.8.0"
      }
    },
    "node_modules/@electron/fuses": {
      "version": "1.8.0",
      "resolved": "https://registry.npmjs.org/@electron/fuses/-/fuses-1.8.0.tgz",
      "integrity": "sha512-zx0EIq78WlY/lBb1uXlziZmDZI4ubcCXIMJ4uGjXzZW0nS19TjSPeXPAjzzTmKQlJUZm0SbmZhPKP7tuQ1SsEw==",
      "license": "MIT",
      "dependencies": {
        "chalk": "^4.1.1",
        "fs-extra": "^9.0.1",
        "minimist": "^1.2.5"
      },
      "bin": {
        "electron-fuses": "dist/bin.js"
      }
    },
    "node_modules/ansi-styles": {
      "version": "4.3.0",
      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
      "license": "MIT",
      "dependencies": {
        "color-convert": "^2.0.1"
      },
      "engines": {
        "node": ">=8"
      },
      "funding": {
        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
      }
    },
    "node_modules/at-least-node": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
      "license": "ISC",
      "engines": {
        "node": ">= 4.0.0"
      }
    },
    "node_modules/chalk": {
      "version": "4.1.2",
      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
      "license": "MIT",
      "dependencies": {
        "ansi-styles": "^4.1.0",
        "supports-color": "^7.1.0"
      },
      "engines": {
        "node": ">=10"
      },
      "funding": {
        "url": "https://github.com/chalk/chalk?sponsor=1"
      }
    },
    "node_modules/color-convert": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
      "license": "MIT",
      "dependencies": {
        "color-name": "~1.1.4"
      },
      "engines": {
        "node": ">=7.0.0"
      }
    },
    "node_modules/color-name": {
      "version": "1.1.4",
      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
      "license": "MIT"
    },
    "node_modules/fs-extra": {
      "version": "9.1.0",
      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
      "license": "MIT",
      "dependencies": {
        "at-least-node": "^1.0.0",
        "graceful-fs": "^4.2.0",
        "jsonfile": "^6.0.1",
        "universalify": "^2.0.0"
      },
      "engines": {
        "node": ">=10"
      }
    },
    "node_modules/graceful-fs": {
      "version": "4.2.11",
      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
      "license": "ISC"
    },
    "node_modules/has-flag": {
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
      "license": "MIT",
      "engines": {
        "node": ">=8"
      }
    },
    "node_modules/jsonfile": {
      "version": "6.2.1",
      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
      "license": "MIT",
      "dependencies": {
        "universalify": "^2.0.0"
      },
      "optionalDependencies": {
        "graceful-fs": "^4.1.6"
      }
    },
    "node_modules/minimist": {
      "version": "1.2.8",
      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/ljharb"
      }
    },
    "node_modules/supports-color": {
      "version": "7.2.0",
      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
      "license": "MIT",
      "dependencies": {
        "has-flag": "^4.0.0"
      },
      "engines": {
        "node": ">=8"
      }
    },
    "node_modules/universalify": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
      "license": "MIT",
      "engines": {
        "node": ">= 10.0.0"
      }
    }
  }
}

{
  "name": "sample-electron-fuses",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "license": "MIT-0",
  "dependencies": {
    "@electron/fuses": "1.8.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify @electron/fuses.flipFuses in pkg:npm/%40electron/fuses@1.8.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40electron/fuses@1.8.0"
  ],
  "symbols": [
    "@electron/fuses.flipFuses"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

import assert from 'node:assert/strict';
import fs from 'node:fs/promises';
import path from 'node:path';
import os from 'node:os';
import {
  flipFuses,
  getCurrentFuseWire,
  FuseVersion,
  FuseV1Options,
} from '@electron/fuses';

const SENTINEL = 'dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX';
const sentinelBuf = Buffer.from(SENTINEL, 'utf8');

const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'fuses-contract-'));

try {
  // 1. flipFuses modifies fuse wire bytes in target binary and returns number of sentinels updated
  {
    const mockBin = path.join(tmpDir, 'electron-single');
    const wireBuf = Buffer.from([1, 8, 144, 144, 144, 144, 144, 144, 144, 144]);
    const binData = Buffer.concat([
      Buffer.from('ELF_HEADER_STUB'),
      sentinelBuf,
      wireBuf,
      Buffer.from('TRAILING_BINARY_SECTION'),
    ]);
    await fs.writeFile(mockBin, binData);

    const sentinelsUpdated = await flipFuses(mockBin, {
      version: FuseVersion.V1,
      [FuseV1Options.RunAsNode]: false,
      [FuseV1Options.EnableCookieEncryption]: true,
    });
    assert.equal(sentinelsUpdated, 1);

    const modifiedBuf = await fs.readFile(mockBin);
    const wirePos = modifiedBuf.indexOf(SENTINEL) + SENTINEL.length;
    assert.equal(modifiedBuf[wirePos], 1); // Fuse wire version
    assert.equal(modifiedBuf[wirePos + 1], 8); // Fuse wire length
    assert.equal(modifiedBuf[wirePos + 2 + FuseV1Options.RunAsNode], 48); // DISABLE ('0')
    assert.equal(modifiedBuf[wirePos + 2 + FuseV1Options.EnableCookieEncryption], 49); // ENABLE ('1')
    assert.equal(modifiedBuf[wirePos + 2 + FuseV1Options.EnableNodeOptionsEnvironmentVariable], 144); // INHERIT
  }

  // 2. getCurrentFuseWire reads and decodes current fuse states from binary
  {
    const mockBin = path.join(tmpDir, 'electron-single');
    const currentWire = await getCurrentFuseWire(mockBin);
    assert.equal(currentWire.version, '1');
    assert.equal(currentWire[FuseV1Options.RunAsNode], 48);
    assert.equal(currentWire[FuseV1Options.EnableCookieEncryption], 49);
    assert.equal(currentWire[FuseV1Options.EnableNodeOptionsEnvironmentVariable], 144);
    assert.equal(currentWire[FuseV1Options.EnableNodeCliInspectArguments], 144);
  }

  // 3. flipFuses updates multiple sentinels in multi-architecture or universal binary
  {
    const mockBin = path.join(tmpDir, 'electron-universal');
    const wireBuf1 = Buffer.from([1, 8, 144, 144, 144, 144, 144, 144, 144, 144]);
    const wireBuf2 = Buffer.from([1, 8, 144, 144, 144, 144, 144, 144, 144, 144]);
    const binData = Buffer.concat([
      Buffer.from('SLICE_ARM64_HEADER'),
      sentinelBuf,
      wireBuf1,
      Buffer.from('SLICE_X64_HEADER'),
      sentinelBuf,
      wireBuf2,
      Buffer.from('SLICE_TRAILER'),
    ]);
    await fs.writeFile(mockBin, binData);

    const sentinelsUpdated = await flipFuses(mockBin, {
      version: FuseVersion.V1,
      [FuseV1Options.RunAsNode]: false,
      [FuseV1Options.OnlyLoadAppFromAsar]: true,
    });
    assert.equal(sentinelsUpdated, 2);

    const modifiedBuf = await fs.readFile(mockBin);
    const firstPos = modifiedBuf.indexOf(SENTINEL) + SENTINEL.length;
    const secondPos = modifiedBuf.lastIndexOf(SENTINEL) + SENTINEL.length;

    assert.equal(modifiedBuf[firstPos + 2 + FuseV1Options.RunAsNode], 48);
    assert.equal(modifiedBuf[firstPos + 2 + FuseV1Options.OnlyLoadAppFromAsar], 49);
    assert.equal(modifiedBuf[secondPos + 2 + FuseV1Options.RunAsNode], 48);
    assert.equal(modifiedBuf[secondPos + 2 + FuseV1Options.OnlyLoadAppFromAsar], 49);
  }

  // 4. flipFuses rejects when sentinel magic bytes are absent in binary
  {
    const noSentinelBin = path.join(tmpDir, 'no-sentinel');
    await fs.writeFile(noSentinelBin, Buffer.from('arbitrary-binary-payload-without-fuses-sentinel'));

    await assert.rejects(
      () => flipFuses(noSentinelBin, { version: FuseVersion.V1 }),
      /Could not find sentinel in the provided Electron binary/
    );
  }

  // 5. flipFuses rejects on fuse wire version mismatch
  {
    const badVersionBin = path.join(tmpDir, 'bad-version');
    const badWire = Buffer.from([9, 8, 144, 144, 144, 144, 144, 144, 144, 144]);
    await fs.writeFile(badVersionBin, Buffer.concat([sentinelBuf, badWire]));

    await assert.rejects(
      () => flipFuses(badVersionBin, { version: FuseVersion.V1 }),
      /does not match/
    );
  }

  // 6. flipFuses strictlyRequireAllFuses enforces explicit configuration for all fuses
  {
    const strictBin = path.join(tmpDir, 'strict-wire');
    const wireBuf = Buffer.from([1, 8, 144, 144, 144, 144, 144, 144, 144, 144]);
    await fs.writeFile(strictBin, Buffer.concat([sentinelBuf, wireBuf]));

    // Incomplete config throws
    await assert.rejects(
      () =>
        flipFuses(strictBin, {
          version: FuseVersion.V1,
          strictlyRequireAllFuses: true,
          [FuseV1Options.RunAsNode]: true,
        }),
      /strictlyRequireAllFuses: Missing explicit configuration/
    );

    // Complete config succeeds
    const updatedCount = await flipFuses(strictBin, {
      version: FuseVersion.V1,
      strictlyRequireAllFuses: true,
      [FuseV1Options.RunAsNode]: false,
      [FuseV1Options.EnableCookieEncryption]: true,
      [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
      [FuseV1Options.EnableNodeCliInspectArguments]: false,
      [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
      [FuseV1Options.OnlyLoadAppFromAsar]: true,
      [FuseV1Options.LoadBrowserProcessSpecificV8Snapshot]: false,
      [FuseV1Options.GrantFileProtocolExtraPrivileges]: false,
    });
    assert.equal(updatedCount, 1);

    const wire = await getCurrentFuseWire(strictBin);
    assert.equal(wire[FuseV1Options.RunAsNode], 48);
    assert.equal(wire[FuseV1Options.EnableCookieEncryption], 49);
    assert.equal(wire[FuseV1Options.EnableEmbeddedAsarIntegrityValidation], 49);
    assert.equal(wire[FuseV1Options.OnlyLoadAppFromAsar], 49);
  }

  // 7. flipFuses rejects configuration for fuse option exceeding wire length
  {
    const shortWireBin = path.join(tmpDir, 'short-wire');
    const shortWireBuf = Buffer.from([1, 4, 144, 144, 144, 144]);
    await fs.writeFile(shortWireBin, Buffer.concat([sentinelBuf, shortWireBuf]));

    await assert.rejects(
      () =>
        flipFuses(shortWireBin, {
          version: FuseVersion.V1,
          [FuseV1Options.GrantFileProtocolExtraPrivileges]: true,
        }),
      /the fuse wire in this version of Electron is not long enough/
    );
  }

  console.log('Contract tests passed successfully.');
} finally {
  await fs.rm(tmpDir, { recursive: true, force: true });
}