fullcourtdefense-cli 1.18.11 → 1.19.0

package/dist/commands/daemon.js

@@ -51,6 +51,7 @@ const integrity_1 = require("../integrity");
 const machineIdentity_1 = require("../machineIdentity");
 const discoveryMarker_1 = require("../discoveryMarker");
 const selfUpdate_1 = require("../selfUpdate");
+const desktopChatGuard_1 = require("./desktopChatGuard");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
     red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
@@ -720,6 +721,7 @@ async function runDaemon(args, config) {
                 integrityOk: integrity.ok,
                 integrityReasons: integrity.reasons,
                 integrityCheckedAt: integrity.checkedAt,
+                desktopChatGuard: (0, desktopChatGuard_1.desktopChatGuardSupported)() && (0, desktopChatGuard_1.desktopChatGuardHealthy)(),
             });
             if (result && result.accepted > 0)
                 log(`Heartbeat: flushed ${result.accepted} spooled event(s).`);
@@ -746,6 +748,22 @@ async function runDaemon(args, config) {
     // for a condition the very next line repairs.
     await reprotect(['startup pass']);
     await heartbeat();
+    // Claude Desktop chat guard (Windows, advisory): Claude Desktop's regular
+    // chat has no hook and never hits an MCP server, so it is the one machine
+    // surface neither hooks nor the gateway can see. Supervise the advisory guard
+    // in-process here (auto-restart is built into the guard itself).
+    let desktopChatGuard;
+    if (creds.shieldId && (0, desktopChatGuard_1.desktopChatGuardSupported)()) {
+        desktopChatGuard = (0, desktopChatGuard_1.startDesktopChatGuard)({
+            apiUrl: creds.apiUrl,
+            shieldId: creds.shieldId,
+            shieldKey: creds.shieldKey,
+            quiet,
+            log,
+        });
+        if (desktopChatGuard)
+            log('Claude Desktop chat guard: supervising (advisory — warns on secrets typed into Claude Desktop).');
+    }
     // Fresh machines have never uploaded an inventory (MSI/onboard defers the
     // initial discovery to keep setup fast), so the dashboard shows "Never" for
     // discovery + posture until the daily scheduled job fires — up to 24h later.
@@ -833,6 +851,8 @@ async function runDaemon(args, config) {
             clearTimeout(initialDiscoverTimer);
         if (debounceTimer)
             clearTimeout(debounceTimer);
+        if (desktopChatGuard)
+            desktopChatGuard.stop();
         for (const watcher of watchers.values())
             watcher.close();
         for (const watcher of rootWatchers.values())

package/dist/commands/desktopChatGuard.d.ts

@@ -0,0 +1,43 @@
+import { BotGuardConfig } from '../config';
+export interface DesktopChatGuardArgs {
+    apiUrl?: string;
+    shieldId?: string;
+    shieldKey?: string;
+    /** Suppress OS toasts (still spools findings). */
+    quiet?: string;
+}
+/** Only meaningful where Claude Desktop runs and UI Automation is available. */
+export declare function desktopChatGuardSupported(): boolean;
+/** True when the guard reported itself healthy within the last `withinMs`. */
+export declare function desktopChatGuardHealthy(withinMs?: number): boolean;
+/**
+ * The PowerShell watcher. Reads ONLY the focused element of the foreground
+ * Claude process (never the transcript), so it is low-noise and resilient to
+ * Claude UI changes. Emits `FCD:<base64 utf8>` lines on stdout when the text
+ * changes. Everything is wrapped in try/catch — it must never crash the host.
+ */
+export declare function desktopChatWatcherScript(): string;
+/** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
+export declare function decodeWatcherLine(line: string): string | undefined;
+export interface DesktopChatGuardHandle {
+    stop(): void;
+}
+interface GuardRuntime {
+    apiUrl: string;
+    shieldId?: string;
+    shieldKey?: string;
+    quiet: boolean;
+    log: (msg: string) => void;
+}
+/**
+ * Start the advisory guard. Returns a handle whose stop() tears down the
+ * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
+ */
+export declare function startDesktopChatGuard(runtime: GuardRuntime): DesktopChatGuardHandle | undefined;
+/**
+ * Foreground `desktop-chat-guard` command — runs the advisory guard in this
+ * process until interrupted. Mostly for manual testing; in production the
+ * daemon supervises the guard in-process (startDesktopChatGuard).
+ */
+export declare function desktopChatGuardCommand(args: DesktopChatGuardArgs, config: BotGuardConfig): Promise<void>;
+export {};

package/dist/commands/desktopChatGuard.js

@@ -0,0 +1,376 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.desktopChatGuardSupported = desktopChatGuardSupported;
+exports.desktopChatGuardHealthy = desktopChatGuardHealthy;
+exports.desktopChatWatcherScript = desktopChatWatcherScript;
+exports.decodeWatcherLine = decodeWatcherLine;
+exports.startDesktopChatGuard = startDesktopChatGuard;
+exports.desktopChatGuardCommand = desktopChatGuardCommand;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const readline = __importStar(require("readline"));
+const config_1 = require("../config");
+const localSafetySnapshot_1 = require("../localSafetySnapshot");
+const deterministicGuard_1 = require("./deterministicGuard");
+const telemetry_1 = require("../telemetry");
+const notify_1 = require("../notify");
+const machineIdentity_1 = require("../machineIdentity");
+const discoverPaths_1 = require("./discoverPaths");
+/**
+ * Claude Desktop chat guard (Windows, phase 1 — advisory).
+ *
+ * Claude Desktop's regular chat sends prompts straight to Anthropic's API — it
+ * exposes no hook and never touches an MCP server, so neither the Claude-format
+ * hooks nor the MCP gateway can see what a developer types there. This guard
+ * closes that blind spot with the SAME on-device deterministic engine used
+ * everywhere else (scanDeterministicPrompt): a lightweight PowerShell UI
+ * Automation watcher reads the text of the focused Claude Desktop input element
+ * and streams it (base64) to this process, which scans it locally and — on a
+ * finding — shows a native toast and reports a monitor event to the fleet.
+ *
+ * Phase 1 is advisory ONLY: no keyboard hook, no input mutation. It cannot
+ * break typing and presents no keylogger surface (it reads only the focused
+ * element of the foreground Claude process). Text is scanned in-process and is
+ * never uploaded — only finding metadata (item id + masked value) is spooled.
+ * Hard blocking is a later, org-policy-gated phase.
+ */
+const WATCHER_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-claude-desktop-watcher.ps1');
+const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-guard.json');
+const STDOUT_PREFIX = 'FCD:';
+/** Poll cadence for the foreground/focused-element read (ms). */
+const POLL_MS = 800;
+/** Don't re-toast the same finding value more often than this. */
+const TOAST_DEBOUNCE_MS = 60_000;
+/** Refresh the cached Local Safety snapshot on this cadence. */
+const SNAPSHOT_REFRESH_MS = 5 * 60_000;
+/** Watcher restart backoff bounds. */
+const RESTART_MIN_MS = 2_000;
+const RESTART_MAX_MS = 30_000;
+/** Only meaningful where Claude Desktop runs and UI Automation is available. */
+function desktopChatGuardSupported() {
+    return process.platform === 'win32' && (0, discoverPaths_1.claudeDesktopLikelyInstalled)();
+}
+function mask(value) {
+    const v = String(value || '');
+    if (v.length <= 8)
+        return '*'.repeat(v.length);
+    return `${v.slice(0, 4)}${'*'.repeat(Math.max(4, v.length - 8))}${v.slice(-4)}`;
+}
+function writeStatus(status) {
+    try {
+        fs.mkdirSync(path.dirname(STATUS_PATH), { recursive: true });
+        fs.writeFileSync(STATUS_PATH, JSON.stringify(status, null, 2), { encoding: 'utf8', mode: 0o600 });
+    }
+    catch { /* best-effort */ }
+}
+/** True when the guard reported itself healthy within the last `withinMs`. */
+function desktopChatGuardHealthy(withinMs = 15 * 60_000) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(STATUS_PATH, 'utf8'));
+        if (!parsed?.running || !parsed.heartbeatAt)
+            return false;
+        return Date.now() - new Date(parsed.heartbeatAt).getTime() < withinMs;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The PowerShell watcher. Reads ONLY the focused element of the foreground
+ * Claude process (never the transcript), so it is low-noise and resilient to
+ * Claude UI changes. Emits `FCD:<base64 utf8>` lines on stdout when the text
+ * changes. Everything is wrapped in try/catch — it must never crash the host.
+ */
+function desktopChatWatcherScript() {
+    return [
+        "$ErrorActionPreference = 'SilentlyContinue'",
+        'try {',
+        "  Add-Type -AssemblyName UIAutomationClient,UIAutomationTypes,WindowsBase | Out-Null",
+        '} catch { }',
+        'try {',
+        '  Add-Type -TypeDefinition @"',
+        'using System;',
+        'using System.Runtime.InteropServices;',
+        'public static class FcdWin {',
+        '  [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();',
+        '  [DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint pid);',
+        '}',
+        '"@',
+        '} catch { }',
+        '',
+        'function Get-FcdFocusedText {',
+        '  param([int]$OwnerPid)',
+        '  try {',
+        '    $focused = [System.Windows.Automation.AutomationElement]::FocusedElement',
+        '    if ($null -eq $focused) { return $null }',
+        '    if ($focused.Current.ProcessId -ne $OwnerPid) { return $null }',
+        '    $text = $null',
+        '    $vp = $null',
+        '    if ($focused.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$vp)) {',
+        '      $text = $vp.Current.Value',
+        '    }',
+        '    if ([string]::IsNullOrEmpty($text)) {',
+        '      $tp = $null',
+        '      if ($focused.TryGetCurrentPattern([System.Windows.Automation.TextPattern]::Pattern, [ref]$tp)) {',
+        '        $text = $tp.DocumentRange.GetText(20000)',
+        '      }',
+        '    }',
+        '    if ([string]::IsNullOrEmpty($text)) { $text = $focused.Current.Name }',
+        '    return $text',
+        '  } catch { return $null }',
+        '}',
+        '',
+        '$last = ""',
+        'while ($true) {',
+        "  Start-Sleep -Milliseconds " + POLL_MS,
+        '  try {',
+        '    $h = [FcdWin]::GetForegroundWindow()',
+        '    if ($h -eq [IntPtr]::Zero) { continue }',
+        '    $procId = 0',
+        '    [void][FcdWin]::GetWindowThreadProcessId($h, [ref]$procId)',
+        '    if ($procId -eq 0) { continue }',
+        '    $proc = Get-Process -Id $procId -ErrorAction SilentlyContinue',
+        "    if ($null -eq $proc -or $proc.ProcessName -ne 'Claude') { continue }",
+        '    $text = Get-FcdFocusedText -OwnerPid $procId',
+        '    if ([string]::IsNullOrEmpty($text)) { continue }',
+        '    if ($text.Length -gt 8000) { continue }',
+        '    if ($text -eq $last) { continue }',
+        '    $last = $text',
+        '    $bytes = [System.Text.Encoding]::UTF8.GetBytes($text)',
+        '    $b64 = [Convert]::ToBase64String($bytes)',
+        "    [Console]::Out.WriteLine('" + STDOUT_PREFIX + "' + $b64)",
+        '    [Console]::Out.Flush()',
+        '  } catch { }',
+        '}',
+        '',
+    ].join('\n');
+}
+/** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
+function decodeWatcherLine(line) {
+    if (!line.startsWith(STDOUT_PREFIX))
+        return undefined;
+    try {
+        return Buffer.from(line.slice(STDOUT_PREFIX.length), 'base64').toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+function ensureWatcherScript() {
+    fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(), { encoding: 'utf8' });
+    return WATCHER_PS1_PATH;
+}
+/**
+ * Start the advisory guard. Returns a handle whose stop() tears down the
+ * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
+ */
+function startDesktopChatGuard(runtime) {
+    if (!desktopChatGuardSupported())
+        return undefined;
+    const startedAt = new Date().toISOString();
+    let stopped = false;
+    let child;
+    let restartTimer;
+    let restartDelay = RESTART_MIN_MS;
+    let findings = 0;
+    const lastToastAt = new Map();
+    let scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(undefined);
+    const identity = (0, machineIdentity_1.getMachineIdentity)();
+    const refreshSnapshot = async () => {
+        if (!runtime.shieldId)
+            return;
+        try {
+            const snapshot = await (0, localSafetySnapshot_1.loadLocalSafetySnapshot)({
+                apiUrl: runtime.apiUrl,
+                shieldId: runtime.shieldId,
+                shieldKey: runtime.shieldKey,
+                developerName: identity.developerName,
+                machineName: identity.hostname,
+            });
+            scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot);
+        }
+        catch { /* offline — keep last options */ }
+    };
+    // heartbeatAt lets the daemon/console tell "guard alive" from "stale".
+    const heartbeat = () => writeStatus({
+        running: !stopped,
+        findings,
+        startedAt,
+        heartbeatAt: new Date().toISOString(),
+    });
+    const handleText = (text) => {
+        if (!text.trim())
+            return;
+        const finding = (0, deterministicGuard_1.scanDeterministicPrompt)(text, scanOptions);
+        if (!finding)
+            return;
+        findings += 1;
+        const masked = mask(finding.evidence || '');
+        heartbeat();
+        // Monitor semantics: advisory phase never blocks, so the decision is
+        // 'allow' with a "would block" evidence note (same shape shell-guard uses
+        // in monitor mode), which the Activity log renders as a monitor finding.
+        (0, telemetry_1.spoolEvent)({
+            decision: 'allow',
+            toolName: 'claude_desktop_chat',
+            operation: 'prompt',
+            reason: `would block: ${finding.reason}`,
+            ruleId: finding.ruleId,
+            category: finding.category,
+            categoryId: finding.categoryId,
+            itemId: finding.itemId,
+            source: finding.source,
+            evidence: masked,
+            explanation: finding.explanation,
+            policyHash: finding.policyHash,
+        });
+        (0, telemetry_1.triggerFlush)();
+        const key = `${finding.itemId}:${masked}`;
+        const now = Date.now();
+        const last = lastToastAt.get(key) || 0;
+        if (!runtime.quiet && now - last > TOAST_DEBOUNCE_MS) {
+            lastToastAt.set(key, now);
+            (0, notify_1.notifyOs)({
+                title: 'FullCourtDefense: secret in Claude Desktop',
+                message: `${finding.reason}. Remove it before sending — this text has not been protected.`,
+            });
+        }
+        runtime.log(`Claude Desktop chat finding: ${finding.itemId} (${finding.reason}).`);
+    };
+    const spawnWatcher = () => {
+        if (stopped)
+            return;
+        let scriptPath;
+        try {
+            scriptPath = ensureWatcherScript();
+        }
+        catch (error) {
+            runtime.log(`Claude Desktop guard: cannot write watcher script: ${error.message}`);
+            scheduleRestart();
+            return;
+        }
+        child = (0, child_process_1.spawn)('powershell', [
+            '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden', '-File', scriptPath,
+        ], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
+        if (!child.stdout) {
+            scheduleRestart();
+            return;
+        }
+        const rl = readline.createInterface({ input: child.stdout });
+        rl.on('line', (line) => {
+            const text = decodeWatcherLine(line);
+            if (text === undefined)
+                return;
+            restartDelay = RESTART_MIN_MS; // healthy output resets backoff
+            handleText(text);
+        });
+        child.on('exit', () => { rl.close(); if (!stopped)
+            scheduleRestart(); });
+        child.on('error', () => { if (!stopped)
+            scheduleRestart(); });
+        runtime.log('Claude Desktop chat guard: watcher started (advisory).');
+        heartbeat();
+    };
+    const scheduleRestart = () => {
+        if (stopped || restartTimer)
+            return;
+        restartTimer = setTimeout(() => {
+            restartTimer = undefined;
+            spawnWatcher();
+        }, restartDelay);
+        restartDelay = Math.min(RESTART_MAX_MS, restartDelay * 2);
+    };
+    void refreshSnapshot();
+    const snapshotTimer = setInterval(() => { void refreshSnapshot(); }, SNAPSHOT_REFRESH_MS);
+    const heartbeatTimer = setInterval(heartbeat, 60_000);
+    spawnWatcher();
+    return {
+        stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            clearInterval(snapshotTimer);
+            clearInterval(heartbeatTimer);
+            if (restartTimer) {
+                clearTimeout(restartTimer);
+                restartTimer = undefined;
+            }
+            try {
+                child?.kill();
+            }
+            catch { /* ignore */ }
+            writeStatus({ running: false, findings, startedAt });
+        },
+    };
+}
+/**
+ * Foreground `desktop-chat-guard` command — runs the advisory guard in this
+ * process until interrupted. Mostly for manual testing; in production the
+ * daemon supervises the guard in-process (startDesktopChatGuard).
+ */
+async function desktopChatGuardCommand(args, config) {
+    if (process.platform !== 'win32') {
+        console.error('The Claude Desktop chat guard is Windows-only.');
+        process.exit(1);
+    }
+    if (!(0, discoverPaths_1.claudeDesktopLikelyInstalled)()) {
+        console.error('Claude Desktop was not detected on this machine — nothing to guard.');
+        process.exit(1);
+    }
+    const creds = (0, config_1.resolveCliCredentials)(config, {
+        shieldId: args.shieldId,
+        shieldKey: args.shieldKey,
+        apiUrl: args.apiUrl,
+    });
+    const handle = startDesktopChatGuard({
+        apiUrl: creds.apiUrl,
+        shieldId: creds.shieldId,
+        shieldKey: creds.shieldKey,
+        quiet: args.quiet === 'true',
+        log: (msg) => console.log(msg),
+    });
+    if (!handle) {
+        console.error('Claude Desktop chat guard is not supported on this machine.');
+        process.exit(1);
+    }
+    console.log('FullCourtDefense Claude Desktop chat guard running (advisory). Stop with Ctrl+C.');
+    const shutdown = () => { handle.stop(); process.exit(0); };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+    await new Promise(() => { });
+}

package/dist/commands/hook.d.ts

@@ -33,4 +33,19 @@ export interface HookArgs {
     approvalTimeoutMs?: string;
     approvalPollMs?: string;
 }
+type HookEvent = 'prompt' | 'shell' | 'mcp' | 'file' | 'read' | 'unknown';
+/**
+ * Claude-format hooks (Claude Code, VS Code Copilot agent mode, GitHub Copilot
+ * CLI — all share the same schema) send `hook_event_name` + `tool_name` +
+ * `tool_input` on stdin. Normalize that payload into the field shapes the rest
+ * of this file already understands (command/file_path/tool_name/tool_input),
+ * and map the tool onto our event taxonomy.
+ *
+ * Returns null when the payload is not Claude-format.
+ */
+export declare function normalizeClaudePayload(payload: Record<string, unknown>): {
+    event: HookEvent | 'ignore';
+    payload: Record<string, unknown>;
+} | null;
 export declare function hookCommand(args: HookArgs, config: BotGuardConfig): Promise<void>;
+export {};

package/dist/commands/hook.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeClaudePayload = normalizeClaudePayload;
 exports.hookCommand = hookCommand;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -122,6 +123,12 @@ function normalizeClaudePayload(payload) {
     const hookEventName = str(payload.hook_event_name);
     if (!hookEventName)
         return null;
+    // Cursor now also includes `hook_event_name`, using lower-camel names such
+    // as beforeSubmitPrompt/beforeShellExecution. Treating presence alone as a
+    // Claude discriminator turned every Cursor event into "unknown" and allowed
+    // it. Claude-family lifecycle names are PascalCase.
+    if (/^[a-z]/.test(hookEventName))
+        return null;
     if (hookEventName === 'UserPromptSubmit') {
         return { event: 'prompt', payload };
     }

package/dist/commands/installClaudeHook.js

@@ -253,6 +253,7 @@ async function installClaudeHookCommand(args, config) {
     console.log(`${COLOR.gray}Scope:${COLOR.reset} ${projectScope ? 'project (.claude/settings.json)' : 'machine-wide (~/.claude/settings.json)'}`);
     console.log(`${COLOR.gray}File:${COLOR.reset}  ${file}`);
     console.log(`${COLOR.gray}Covers:${COLOR.reset} Claude Code, VS Code Copilot agent mode, GitHub Copilot CLI (all read this file)`);
+    console.log(`${COLOR.gray}Note:${COLOR.reset} Claude Desktop's regular chat has no hook — it is protected separately by the Windows chat guard the daemon runs (advisory).`);
     const parts = [];
     if (wantTools)
         parts.push('tool calls (shell / MCP / file writes / reads) checked against org Action Policies + Local Safety rules');

package/dist/index.js

@@ -52,6 +52,7 @@ const installAll_1 = require("./commands/installAll");
 const onboard_1 = require("./commands/onboard");
 const autoProtect_1 = require("./commands/autoProtect");
 const daemon_1 = require("./commands/daemon");
+const desktopChatGuard_1 = require("./commands/desktopChatGuard");
 const windowsAudit_1 = require("./commands/windowsAudit");
 const shellGuard_1 = require("./commands/shellGuard");
 const cmdGuard_1 = require("./commands/cmdGuard");
@@ -845,6 +846,16 @@ async function main() {
             await (0, daemon_1.daemonCommand)(args, config);
             break;
         }
+        case 'desktop-chat-guard': {
+            const args = {
+                apiUrl: flags['api-url'],
+                shieldId: flags['shield-id'],
+                shieldKey: flags['shield-key'],
+                quiet: flags.quiet,
+            };
+            await (0, desktopChatGuard_1.desktopChatGuardCommand)(args, config);
+            break;
+        }
         case 'install-cursor-mcp-gateway': {
             const args = {
                 ...buildGatewayArgs(),

package/dist/telemetry.d.ts

@@ -34,6 +34,8 @@ export interface FlushInput {
     integrityCheckedAt?: string;
     /** Set only by the resident process; distinguishes daemon liveness from hook flushes. */
     daemon?: boolean;
+    /** Windows Claude Desktop chat guard liveness (advisory prompt protection). */
+    desktopChatGuard?: boolean;
     timeoutMs?: number;
 }
 /** Drain the spool to the backend in one batch (+ optional heartbeat). Returns accepted count. */

package/dist/telemetry.js

@@ -164,6 +164,7 @@ async function flushSpool(input) {
                         integrityCheckedAt: input.integrityCheckedAt,
                         daemon: input.daemon === true,
                         coverage: 'hooks',
+                        desktopChatGuard: input.desktopChatGuard === true,
                         hostname: identity.hostname,
                         // Windows-only: current PowerShell audit coverage (ScriptBlock
                         // Logging + Transcription). Keeps the fleet dashboard's coverage

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.18.11"
+  "version": "1.19.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.18.11",
+  "version": "1.19.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -15,6 +15,7 @@
   "scripts": {
     "build": "tsc && node scripts/copy-attack-corpus.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
+    "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
     "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
     "test:shell-audit": "npm run build && node scripts/test-shell-audit.js",
     "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",