From 20f2e34687a691dd15b18c030d108b3b66d44098 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 14 Sep 2026 09:46:20 +0000
Subject: [PATCH] Disable RunAsNode and other unneeded Electron fuses

Harden packaged builds by flipping Electron fuses at build time via
electron-builder's electronFuses option:

- runAsNode: prevents ELECTRON_RUN_AS_NODE=1 from turning the signed
  app binary into a plain Node.js interpreter (CWE-269 class issue
  reported against many Electron apps)
- enableNodeOptionsEnvironmentVariable / enableNodeCliInspectArguments:
  ignore NODE_OPTIONS and --inspect in production
- enableEmbeddedAsarIntegrityValidation + onlyLoadAppFromAsar: only run
  app code from the validated app.asar

The app does not use process.fork or spawn its own binary as Node, so
disabling runAsNode has no functional impact. Fuses only apply to
packaged builds; yarn dev is unaffected.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DfreRgcsYVq144Sx5syDnr
---
 package.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/package.json b/package.json
index 6a70b7a1..9308c1a1 100644
--- a/package.json
+++ b/package.json
@@ -174,6 +174,13 @@
     "asar": {
       "smartUnpack": false
     },
+    "electronFuses": {
+      "runAsNode": false,
+      "enableNodeOptionsEnvironmentVariable": false,
+      "enableNodeCliInspectArguments": false,
+      "enableEmbeddedAsarIntegrityValidation": true,
+      "onlyLoadAppFromAsar": true
+    },
     "appId": "no.mifi.losslesscut",
     "artifactName": "${productName}-${os}-${arch}.${ext}",
     "extraResources": [