fix(windows): auto-allow immutablerunner protocol in Brave

Author: rodrigo-fournier-immutable

sample/Tests/test/test_windows_helpers.py

@@ -846,6 +846,46 @@ def setup_browser_permissions():
     except Exception as e:
         print(f"Browser permission setup error: {e}")
 
+
+def setup_autolaunch_protocol_policy():
+    """
+    Configure Brave enterprise policy to allow external protocol launches without prompting.
+
+    Selenium cannot click the browser-level external protocol permission UI reliably.
+    This policy avoids the prompt entirely by allowing `immutablerunner:` to auto-launch
+    from the Passport origin.
+
+    Policy reference (Chromium/Edge naming):
+    - AutoLaunchProtocolsFromOrigins: JSON array of { protocol, allowed_origins }
+    - Registry path (Brave): HKCU\\Software\\Policies\\BraveSoftware\\Brave
+    """
+    print("Setting up Brave AutoLaunchProtocolsFromOrigins policy...")
+
+    # This must be REG_SZ containing JSON.
+    # Protocol must be lowercase and WITHOUT ':' (e.g. "immutablerunner", not "immutablerunner:").
+    policy_json = (
+        '[{"protocol":"immutablerunner","allowed_origins":["https://auth.immutable.com"]}]'
+    )
+
+    ps_script = f'''
+    $key = "HKCU:\\Software\\Policies\\BraveSoftware\\Brave"
+    if (!(Test-Path $key)) {{
+      New-Item -Path $key -Force | Out-Null
+    }}
+    New-ItemProperty -Path $key -Name "AutoLaunchProtocolsFromOrigins" -PropertyType String -Value '{policy_json}' -Force | Out-Null
+    Write-Host "Brave policy AutoLaunchProtocolsFromOrigins set."
+    '''
+
+    try:
+        result = subprocess.run(["powershell", "-Command", ps_script], capture_output=True, text=True, timeout=10)
+        if result.stdout:
+            print(result.stdout.strip())
+        if result.stderr:
+            # Non-fatal, but useful for debugging policy issues in CI.
+            print(result.stderr.strip())
+    except Exception as e:
+        print(f"Policy setup error: {e}")
+
 def setup_protocol_association():
     """Set up immutablerunner:// protocol association to avoid permission dialogs"""
     print("Setting up protocol association for immutablerunner://...")
@@ -919,6 +959,7 @@ def launch_browser():
     # Set up browser permissions and protocol association first
     setup_browser_permissions()
     setup_protocol_association()
+    setup_autolaunch_protocol_policy()
 
     browser_paths = [
         r"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"