Implement controlled app launch (T-401)

2026-07-19 21:10:59 +08:00
parent d0cf333394
commit 87083c387f
32 changed files with 1802 additions and 31 deletions
@@ -30,6 +30,24 @@
    "channel": {
      "const": "stable"
    },
+    "entrypoint": {
+      "type": "string",
+      "minLength": 1,
+      "$comment": "Optional for pre-T-401 v1 records; new installations write a runtime-validated safe relative payload path.",
+      "pattern": "^(?!/)(?! )(?!.*(/ ))(?!.*\\\\)(?!.*[:<>\"|?*])(?!\\.\\.?(/|$))(?!.*(/\\.\\.?)(/|$))(?!.*//)(?!.*[ .](/|$)).+$"
+    },
+    "working_directory": {
+      "type": "string",
+      "minLength": 1,
+      "$comment": "Optional for pre-T-401 v1 records; new installations write . or a runtime-validated safe relative payload directory.",
+      "pattern": "^(\\.|(?!/)(?! )(?!.*(/ ))(?!.*\\\\)(?!.*[:<>\"|?*])(?!\\.\\.?(/|$))(?!.*(/\\.\\.?)(/|$))(?!.*//)(?!.*[ .](/|$)).+)$"
+    },
+    "min_os": {
+      "enum": ["windows-7-sp1", "windows-10", "windows-11"]
+    },
+    "requires_admin": {
+      "type": "boolean"
+    },
    "files": {
      "type": "array",
      "items": {