ci(build): flip Electron fuses in packaged builds

package.json

@@ -85,6 +85,7 @@
   },
   "devDependencies": {
     "@discordapp/twemoji": "16.0.1",
+    "@electron/fuses": "2.1.3",
     "@electron/notarize": "3.1.1",
     "@graphql-codegen/cli": "7.4.5",
     "@graphql-codegen/schema-ast": "6.1.1",

scripts/afterPack.js

@@ -1,5 +1,6 @@
 const path = require('node:path');
 const fs = require('node:fs');
+const { flipFuses, FuseVersion, FuseV1Options } = require('@electron/fuses');
 
 const builderConfig = require('../electron-builder');
 const electronLanguages = builderConfig.electronLanguages;
@@ -23,9 +24,71 @@ const afterPack = async (context) => {
     removeUnusedLocales(appOutDir, appName);
   }
 
+  flipElectronFuses(appOutDir, appName, platform);
+
   logAfterPackProgress('Completed');
 };
 
+/**
+ * Locates the packaged application binary for the current platform.
+ *
+ * @param {string} appOutDir
+ * @param {string} appName
+ * @param {string} platform electron-builder's platform key
+ * @returns {string}
+ */
+const getExecutablePath = (appOutDir, appName, platform) => {
+  switch (platform) {
+    case 'darwin':
+      return path.join(appOutDir, `${appName}.app`, 'Contents', 'MacOS', appName);
+    case 'win32':
+      return path.join(appOutDir, `${appName}.exe`);
+    default:
+      return path.join(appOutDir, appName);
+  }
+};
+
+/**
+ * Hardens the packaged binary by flipping Electron's fuse wire.
+ *
+ * Without this the app ships on fuse version 1, which leaves RunAsNode enabled
+ * and every other switch at its permissive framework default. With RunAsNode on,
+ * ELECTRON_RUN_AS_NODE=1 <app> starts the binary as a plain Node runtime,
+ * dropping the Electron sandbox entirely.
+ *
+ * EnableEmbeddedAsarIntegrityValidation is deliberately NOT enabled here: it
+ * requires the matching `asarIntegrity` build option, and enabling it without
+ * that will stop the app launching.
+ *
+ * @param {string} appOutDir
+ * @param {string} appName
+ * @param {string} platform
+ */
+const flipElectronFuses = (appOutDir, appName, platform) => {
+  logAfterPackProgress('flipping Electron fuses');
+
+  const executablePath = getExecutablePath(appOutDir, appName, platform);
+
+  if (!fs.existsSync(executablePath)) {
+    logAfterPackProgress(`skipping fuses, executable not found: ${executablePath}`);
+    return;
+  }
+
+  // NOTE: @electron/fuses v2 takes (executablePath, config). v1.x took
+  // (config, executablePath) -- swapping these throws at build time.
+  flipFuses(executablePath, {
+    version: FuseVersion.V1,
+
+    [FuseV1Options.RunAsNode]: false,
+    [FuseV1Options.EnableCookieEncryption]: true,
+    [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+    [FuseV1Options.EnableNodeCliInspectArguments]: false,
+    [FuseV1Options.OnlyLoadAppFromAsar]: true,
+  });
+
+  logAfterPackProgress('fuses flipped');
+};
+
 /**
  * Removes unused locales for macOS builds.
  * @param {string} appOutDir