@electron/fuses 1.8.0: FuseV1Options

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify @electron/fuses.FuseV1Options in pkg:npm/%40electron/fuses@1.8.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40electron/fuses@1.8.0
Demonstrate these symbols/APIs:
  - @electron/fuses.FuseV1Options

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:c40b0aeb5b5df8d58c51523e4123e98d7be39a7d1e7c2ca12ebe72f14dd1ed24","contract":["FuseV1Options exports numeric enum values 0 through 7 mapping to canonical Electron V1 fuse names","FuseV1Options enables configuring individual security fuses in mock Electron binary via flipFuses","getCurrentFuseWire returns wire states indexed by FuseV1Options numeric keys","flipFuses with strictlyRequireAllFuses fails when any FuseV1Options key is unconfigured","flipFuses with strictlyRequireAllFuses succeeds when all FuseV1Options keys are explicitly configured","flipFuses rejects configuring FuseV1Options exceeding the binary fuse wire length with descriptive error"],"goal":"verify @electron/fuses.FuseV1Options in pkg:npm/%40electron/fuses@1.8.0","kind":"HOW","packages":["pkg:npm/%40electron/fuses@1.8.0"],"schemaVersion":1,"symbols":["@electron/fuses.FuseV1Options"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40electron/fuses@1.8.0"],"schemaVersion":1,"subject":"pkg:npm/%40electron/fuses@1.8.0","symbols":["@electron/fuses.FuseV1Options"],"verifierAdapter":"node-typescript@1"}

{
  "name": "sample-electron-fuses-v1-options",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-electron-fuses-v1-options",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "@electron/fuses": "1.8.0"
      }
    },
    "node_modules/@electron/fuses": {
      "version": "1.8.0",
      "resolved": "https://registry.npmjs.org/@electron/fuses/-/fuses-1.8.0.tgz",
      "integrity": "sha512-zx0EIq78WlY/lBb1uXlziZmDZI4ubcCXIMJ4uGjXzZW0nS19TjSPeXPAjzzTmKQlJUZm0SbmZhPKP7tuQ1SsEw==",
      "license": "MIT",
      "dependencies": {
        "chalk": "^4.1.1",
        "fs-extra": "^9.0.1",
        "minimist": "^1.2.5"
      },
      "bin": {
        "electron-fuses": "dist/bin.js"
      }
    },
    "node_modules/ansi-styles": {
      "version": "4.3.0",
      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
      "license": "MIT",
      "dependencies": {
        "color-convert": "^2.0.1"
      },
      "engines": {
        "node": ">=8"
      },
      "funding": {
        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
      }
    },
    "node_modules/at-least-node": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
      "license": "ISC",
      "engines": {
        "node": ">= 4.0.0"
      }
    },
    "node_modules/chalk": {
      "version": "4.1.2",
      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
      "license": "MIT",
      "dependencies": {
        "ansi-styles": "^4.1.0",
        "supports-color": "^7.1.0"
      },
      "engines": {
        "node": ">=10"
      },
      "funding": {
        "url": "https://github.com/chalk/chalk?sponsor=1"
      }
    },
    "node_modules/color-convert": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
      "license": "MIT",
      "dependencies": {
        "color-name": "~1.1.4"
      },
      "engines": {
        "node": ">=7.0.0"
      }
    },
    "node_modules/color-name": {
      "version": "1.1.4",
      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
      "license": "MIT"
    },
    "node_modules/fs-extra": {
      "version": "9.1.0",
      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
      "license": "MIT",
      "dependencies": {
        "at-least-node": "^1.0.0",
        "graceful-fs": "^4.2.0",
        "jsonfile": "^6.0.1",
        "universalify": "^2.0.0"
      },
      "engines": {
        "node": ">=10"
      }
    },
    "node_modules/graceful-fs": {
      "version": "4.2.11",
      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
      "license": "ISC"
    },
    "node_modules/has-flag": {
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
      "license": "MIT",
      "engines": {
        "node": ">=8"
      }
    },
    "node_modules/jsonfile": {
      "version": "6.2.1",
      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
      "license": "MIT",
      "dependencies": {
        "universalify": "^2.0.0"
      },
      "optionalDependencies": {
        "graceful-fs": "^4.1.6"
      }
    },
    "node_modules/minimist": {
      "version": "1.2.8",
      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/ljharb"
      }
    },
    "node_modules/supports-color": {
      "version": "7.2.0",
      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
      "license": "MIT",
      "dependencies": {
        "has-flag": "^4.0.0"
      },
      "engines": {
        "node": ">=8"
      }
    },
    "node_modules/universalify": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
      "license": "MIT",
      "engines": {
        "node": ">= 10.0.0"
      }
    }
  }
}

{
  "name": "sample-electron-fuses-v1-options",
  "version": "1.0.0",
  "private": true,
  "license": "MIT-0",
  "main": "src/index.js",
  "dependencies": {
    "@electron/fuses": "1.8.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify @electron/fuses.FuseV1Options in pkg:npm/%40electron/fuses@1.8.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40electron/fuses@1.8.0"
  ],
  "symbols": [
    "@electron/fuses.FuseV1Options"
  ]
}

const {
  FuseV1Options,
  FuseVersion,
  flipFuses,
  getCurrentFuseWire
} = require('@electron/fuses');

/**
 * Creates a complete FuseV1Config ensuring all FuseV1Options are defined.
 *
 * @param {Partial<Record<FuseV1Options, boolean>>} customOptions
 * @returns {object}
 */
function createStrictFuseConfig(customOptions = {}) {
  const defaultFuses = {
    [FuseV1Options.RunAsNode]: false,
    [FuseV1Options.EnableCookieEncryption]: true,
    [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
    [FuseV1Options.EnableNodeCliInspectArguments]: false,
    [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
    [FuseV1Options.OnlyLoadAppFromAsar]: true,
    [FuseV1Options.LoadBrowserProcessSpecificV8Snapshot]: false,
    [FuseV1Options.GrantFileProtocolExtraPrivileges]: false
  };

  return {
    version: FuseVersion.V1,
    strictlyRequireAllFuses: true,
    ...defaultFuses,
    ...customOptions
  };
}

/**
 * Applies fuse options to an Electron executable.
 *
 * @param {string} binaryPath
 * @param {object} config
 * @returns {Promise<number>}
 */
async function configureFuses(binaryPath, config) {
  return flipFuses(binaryPath, config);
}

/**
 * Reads fuse state for a specific FuseV1Option from an Electron binary.
 *
 * @param {string} binaryPath
 * @param {number} optionKey
 * @returns {Promise<number>}
 */
async function getFuseState(binaryPath, optionKey) {
  const wire = await getCurrentFuseWire(binaryPath);
  return wire[optionKey];
}

module.exports = {
  FuseV1Options,
  FuseVersion,
  createStrictFuseConfig,
  configureFuses,
  getFuseState
};

import assert from 'node:assert/strict';
import { createRequire } from 'node:module';
import fs from 'node:fs';
import path from 'node:path';
import os from 'node:os';

const require = createRequire(import.meta.url);
const electronFuses = require('@electron/fuses');
const {
  FuseV1Options,
  FuseVersion,
  createStrictFuseConfig,
  configureFuses,
  getFuseState
} = require('../src/index.js');

const SENTINEL = 'dL7pKGdnNz796PbbjQWNKmHXBZaB9tsX';

// 1. FuseV1Options exports numeric enum values 0 through 7 mapping to canonical Electron V1 fuse names
assert.strictEqual(FuseV1Options.RunAsNode, 0);
assert.strictEqual(FuseV1Options.EnableCookieEncryption, 1);
assert.strictEqual(FuseV1Options.EnableNodeOptionsEnvironmentVariable, 2);
assert.strictEqual(FuseV1Options.EnableNodeCliInspectArguments, 3);
assert.strictEqual(FuseV1Options.EnableEmbeddedAsarIntegrityValidation, 4);
assert.strictEqual(FuseV1Options.OnlyLoadAppFromAsar, 5);
assert.strictEqual(FuseV1Options.LoadBrowserProcessSpecificV8Snapshot, 6);
assert.strictEqual(FuseV1Options.GrantFileProtocolExtraPrivileges, 7);

assert.strictEqual(FuseV1Options[0], 'RunAsNode');
assert.strictEqual(FuseV1Options[1], 'EnableCookieEncryption');
assert.strictEqual(FuseV1Options[2], 'EnableNodeOptionsEnvironmentVariable');
assert.strictEqual(FuseV1Options[3], 'EnableNodeCliInspectArguments');
assert.strictEqual(FuseV1Options[4], 'EnableEmbeddedAsarIntegrityValidation');
assert.strictEqual(FuseV1Options[5], 'OnlyLoadAppFromAsar');
assert.strictEqual(FuseV1Options[6], 'LoadBrowserProcessSpecificV8Snapshot');
assert.strictEqual(FuseV1Options[7], 'GrantFileProtocolExtraPrivileges');

const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fuses-v1-contract-'));

function createMockBinary(filename, wireLength = 8, states = null) {
  const filePath = path.join(tempDir, filename);
  const header = Buffer.from('MOCK_ELF_HEADER');
  const sentinel = Buffer.from(SENTINEL, 'utf8');
  const wireStates = states || new Array(wireLength).fill(48); // 48 = DISABLE
  const wire = Buffer.from([1, wireLength, ...wireStates]);
  const footer = Buffer.from('TRAILING_DATA');
  fs.writeFileSync(filePath, Buffer.concat([header, sentinel, wire, footer]));
  return filePath;
}

try {
  // 2. FuseV1Options enables configuring individual security fuses in mock Electron binary via flipFuses
  const binary1 = createMockBinary('app1.bin', 8);
  const flipCount = await electronFuses.flipFuses(binary1, {
    version: FuseVersion.V1,
    [FuseV1Options.EnableCookieEncryption]: true,
    [FuseV1Options.OnlyLoadAppFromAsar]: true,
    [FuseV1Options.RunAsNode]: false
  });
  assert.strictEqual(flipCount, 1, 'flipFuses should return number of sentinels modified');

  // 3. getCurrentFuseWire returns wire states indexed by FuseV1Options numeric keys
  const cookieEncState = await getFuseState(binary1, FuseV1Options.EnableCookieEncryption);
  const asarState = await getFuseState(binary1, FuseV1Options.OnlyLoadAppFromAsar);
  const runAsNodeState = await getFuseState(binary1, FuseV1Options.RunAsNode);
  assert.strictEqual(cookieEncState, 49, 'EnableCookieEncryption should be enabled (49)');
  assert.strictEqual(asarState, 49, 'OnlyLoadAppFromAsar should be enabled (49)');
  assert.strictEqual(runAsNodeState, 48, 'RunAsNode should remain disabled (48)');

  // 4. flipFuses with strictlyRequireAllFuses fails when any FuseV1Options key is unconfigured
  const binary2 = createMockBinary('app2.bin', 8);
  await assert.rejects(
    async () => {
      await configureFuses(binary2, {
        version: FuseVersion.V1,
        strictlyRequireAllFuses: true,
        [FuseV1Options.RunAsNode]: false
      });
    },
    /strictlyRequireAllFuses: Missing explicit configuration for fuse/
  );

  // 5. flipFuses with strictlyRequireAllFuses succeeds when all FuseV1Options keys are explicitly configured
  const strictConfig = createStrictFuseConfig({
    [FuseV1Options.GrantFileProtocolExtraPrivileges]: false
  });
  const strictResult = await configureFuses(binary2, strictConfig);
  assert.strictEqual(strictResult, 1, 'All fuses explicitly provided should succeed');

  const binary2Wire = await electronFuses.getCurrentFuseWire(binary2);
  assert.strictEqual(binary2Wire[FuseV1Options.EnableEmbeddedAsarIntegrityValidation], 49);
  assert.strictEqual(binary2Wire[FuseV1Options.GrantFileProtocolExtraPrivileges], 48);

  // 6. flipFuses rejects configuring FuseV1Options exceeding the binary fuse wire length with descriptive error
  const shortBinary = createMockBinary('app_short.bin', 4);
  await assert.rejects(
    async () => {
      await configureFuses(shortBinary, {
        version: FuseVersion.V1,
        [FuseV1Options.OnlyLoadAppFromAsar]: true
      });
    },
    /Trying to configure OnlyLoadAppFromAsar but the fuse wire in this version of Electron is not long enough/
  );

  console.log('Contract tests passed successfully.');
} finally {
  fs.rmSync(tempDir, { recursive: true, force: true });
}