fullcourtdefense-cli 1.18.12 → 1.20.0

package/dist/commands/daemon.js

@@ -51,6 +51,7 @@ const integrity_1 = require("../integrity");
 const machineIdentity_1 = require("../machineIdentity");
 const discoveryMarker_1 = require("../discoveryMarker");
 const selfUpdate_1 = require("../selfUpdate");
+const desktopChatGuard_1 = require("./desktopChatGuard");
 const COLOR = {
     reset: '\x1b[0m', bold: '\x1b[1m', dim: '\x1b[2m',
     red: '\x1b[31m', yellow: '\x1b[33m', green: '\x1b[32m', cyan: '\x1b[36m', gray: '\x1b[90m',
@@ -720,6 +721,7 @@ async function runDaemon(args, config) {
                 integrityOk: integrity.ok,
                 integrityReasons: integrity.reasons,
                 integrityCheckedAt: integrity.checkedAt,
+                desktopChatGuard: (0, desktopChatGuard_1.desktopChatGuardSupported)() && (0, desktopChatGuard_1.desktopChatGuardHealthy)(),
             });
             if (result && result.accepted > 0)
                 log(`Heartbeat: flushed ${result.accepted} spooled event(s).`);
@@ -746,6 +748,25 @@ async function runDaemon(args, config) {
     // for a condition the very next line repairs.
     await reprotect(['startup pass']);
     await heartbeat();
+    // Claude Desktop chat guard (Windows, advisory): Claude Desktop's regular
+    // chat has no hook and never hits an MCP server, so it is the one machine
+    // surface neither hooks nor the gateway can see. Supervise the advisory guard
+    // in-process here (auto-restart is built into the guard itself).
+    let desktopChatGuard;
+    if (creds.shieldId && (0, desktopChatGuard_1.desktopChatGuardSupported)()) {
+        desktopChatGuard = (0, desktopChatGuard_1.startDesktopChatGuard)({
+            apiUrl: creds.apiUrl,
+            shieldId: creds.shieldId,
+            shieldKey: creds.shieldKey,
+            // Mode is resolved inside the guard: FCD_DESKTOP_CHAT_MODE env or the
+            // Local Safety snapshot's desktopChatMode hint; defaults to advisory warn.
+            mode: process.env.FCD_DESKTOP_CHAT_MODE,
+            quiet,
+            log,
+        });
+        if (desktopChatGuard)
+            log('Claude Desktop chat guard: supervising (warns, or blocks the Enter send if block mode is enabled, on secrets typed into Claude Desktop).');
+    }
     // Fresh machines have never uploaded an inventory (MSI/onboard defers the
     // initial discovery to keep setup fast), so the dashboard shows "Never" for
     // discovery + posture until the daily scheduled job fires — up to 24h later.
@@ -833,6 +854,8 @@ async function runDaemon(args, config) {
             clearTimeout(initialDiscoverTimer);
         if (debounceTimer)
             clearTimeout(debounceTimer);
+        if (desktopChatGuard)
+            desktopChatGuard.stop();
         for (const watcher of watchers.values())
             watcher.close();
         for (const watcher of rootWatchers.values())

package/dist/commands/desktopChatGuard.d.ts

@@ -0,0 +1,89 @@
+import { BotGuardConfig } from '../config';
+import { LocalSafetySnapshot } from '../localSafetySnapshot';
+/**
+ * Claude Desktop chat guard (Windows).
+ *
+ * Claude Desktop's regular chat sends prompts straight to Anthropic's API — it
+ * exposes no hook and never touches an MCP server, so neither the Claude-format
+ * hooks nor the MCP gateway can see what a developer types there. This guard
+ * closes that blind spot with the SAME on-device deterministic engine used
+ * everywhere else (scanDeterministicPrompt).
+ *
+ * Two modes:
+ *   - warn  (default): advisory. A PowerShell UI Automation watcher reads the
+ *     focused Claude input, this process scans it locally, and on a finding it
+ *     toasts + reports a monitor event. No keyboard hook, no input mutation —
+ *     cannot break typing, no keylogger surface.
+ *   - block (org-policy opt-in): everything warn does, PLUS the watcher installs
+ *     a low-level keyboard hook that swallows the Enter "send" while a secret is
+ *     in the box, so the prompt cannot be sent to Anthropic.
+ *
+ * Safety model (why this cannot freeze/crash a machine):
+ *   1. ALL native code (the keyboard hook + its message pump) runs in the CHILD
+ *      PowerShell process. The Node daemon only does a fast regex scan and a
+ *      tiny file write; it is never in the keystroke hot path.
+ *   2. The hook callback does only a volatile-timestamp read + a cheap
+ *      foreground check, returning in microseconds — far under Windows'
+ *      LowLevelHooksTimeout. A slow LL hook is silently removed by Windows
+ *      (keys pass through); it FAILS OPEN, it never freezes the keyboard.
+ *   3. The block is armed as a short time WINDOW (auto-expires ~2s after the
+ *      last detection). If the daemon dies, stops arming, or the child is
+ *      killed, Enter is released within ~2s — the keyboard can never get stuck.
+ *   4. block mode is OFF by default; the hook is only installed when an org
+ *      opts in, so the default fleet behavior is the risk-free advisory mode.
+ *   5. Detection stays 100% in the shared Node deterministicGuard (single
+ *      source of truth); the child never re-implements detection.
+ *
+ * Text is scanned in-process and never uploaded — only finding metadata (item
+ * id + masked value) is spooled.
+ */
+export type DesktopChatMode = 'warn' | 'block';
+export interface DesktopChatGuardArgs {
+    apiUrl?: string;
+    shieldId?: string;
+    shieldKey?: string;
+    /** 'warn' (default) or 'block'. */
+    mode?: string;
+    /** Suppress OS toasts (still spools findings). */
+    quiet?: string;
+}
+/** Only meaningful where Claude Desktop runs and UI Automation is available. */
+export declare function desktopChatGuardSupported(): boolean;
+/** Resolve the effective mode: explicit arg > env > snapshot hint > 'warn'. */
+export declare function resolveDesktopChatMode(explicit?: string, snapshot?: LocalSafetySnapshot): DesktopChatMode;
+/** True when the guard reported itself healthy within the last `withinMs`. */
+export declare function desktopChatGuardHealthy(withinMs?: number): boolean;
+/**
+ * The PowerShell watcher. Reads ONLY the focused element of the foreground
+ * Claude process (never the transcript), so it is low-noise and resilient to
+ * Claude UI changes. Emits `FCD:<base64 utf8>` lines on stdout when the text
+ * changes. In block mode it also compiles the keyboard-hook helper and, each
+ * cycle, reads the arm file Node maintains to arm/expire the Enter block.
+ * Everything is wrapped in try/catch — it must never crash the host.
+ */
+export declare function desktopChatWatcherScript(mode?: DesktopChatMode): string;
+/** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
+export declare function decodeWatcherLine(line: string): string | undefined;
+export interface DesktopChatGuardHandle {
+    stop(): void;
+}
+interface GuardRuntime {
+    apiUrl: string;
+    shieldId?: string;
+    shieldKey?: string;
+    mode?: string;
+    quiet: boolean;
+    log: (msg: string) => void;
+}
+/**
+ * Start the guard. Returns a handle whose stop() tears down the watcher and
+ * timers. Safe no-op (returns undefined) on unsupported platforms.
+ */
+export declare function startDesktopChatGuard(runtime: GuardRuntime): DesktopChatGuardHandle | undefined;
+/**
+ * Foreground `desktop-chat-guard` command — runs the guard in this process
+ * until interrupted. Useful for manual testing (e.g. `--mode block`); in
+ * production the daemon supervises the guard in-process.
+ */
+export declare function desktopChatGuardCommand(args: DesktopChatGuardArgs, config: BotGuardConfig): Promise<void>;
+export {};

package/dist/commands/desktopChatGuard.js

@@ -0,0 +1,479 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.desktopChatGuardSupported = desktopChatGuardSupported;
+exports.resolveDesktopChatMode = resolveDesktopChatMode;
+exports.desktopChatGuardHealthy = desktopChatGuardHealthy;
+exports.desktopChatWatcherScript = desktopChatWatcherScript;
+exports.decodeWatcherLine = decodeWatcherLine;
+exports.startDesktopChatGuard = startDesktopChatGuard;
+exports.desktopChatGuardCommand = desktopChatGuardCommand;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const readline = __importStar(require("readline"));
+const config_1 = require("../config");
+const localSafetySnapshot_1 = require("../localSafetySnapshot");
+const deterministicGuard_1 = require("./deterministicGuard");
+const telemetry_1 = require("../telemetry");
+const notify_1 = require("../notify");
+const machineIdentity_1 = require("../machineIdentity");
+const discoverPaths_1 = require("./discoverPaths");
+const WATCHER_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-claude-desktop-watcher.ps1');
+const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-guard.json');
+/** Node writes an epoch-ms "block until" here; the watcher reads it each cycle. */
+const ARM_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-arm');
+const STDOUT_PREFIX = 'FCD:';
+/** Poll cadence for the foreground/focused-element read (ms). */
+const POLL_MS = 250;
+/** How long each detection arms the Enter block (auto-expiry safety valve). */
+const ARM_WINDOW_MS = 2_000;
+/** Don't re-toast the same finding value more often than this. */
+const TOAST_DEBOUNCE_MS = 60_000;
+/** Refresh the cached Local Safety snapshot on this cadence. */
+const SNAPSHOT_REFRESH_MS = 5 * 60_000;
+/** Watcher restart backoff bounds. */
+const RESTART_MIN_MS = 2_000;
+const RESTART_MAX_MS = 30_000;
+/** Only meaningful where Claude Desktop runs and UI Automation is available. */
+function desktopChatGuardSupported() {
+    return process.platform === 'win32' && (0, discoverPaths_1.claudeDesktopLikelyInstalled)();
+}
+/** Resolve the effective mode: explicit arg > env > snapshot hint > 'warn'. */
+function resolveDesktopChatMode(explicit, snapshot) {
+    const raw = (explicit || process.env.FCD_DESKTOP_CHAT_MODE || snapshot?.desktopChatMode || 'warn')
+        .toString().toLowerCase();
+    return raw === 'block' ? 'block' : 'warn';
+}
+function mask(value) {
+    const v = String(value || '');
+    if (v.length <= 8)
+        return '*'.repeat(v.length);
+    return `${v.slice(0, 4)}${'*'.repeat(Math.max(4, v.length - 8))}${v.slice(-4)}`;
+}
+function writeStatus(status) {
+    try {
+        fs.mkdirSync(path.dirname(STATUS_PATH), { recursive: true });
+        fs.writeFileSync(STATUS_PATH, JSON.stringify(status, null, 2), { encoding: 'utf8', mode: 0o600 });
+    }
+    catch { /* best-effort */ }
+}
+/** True when the guard reported itself healthy within the last `withinMs`. */
+function desktopChatGuardHealthy(withinMs = 15 * 60_000) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(STATUS_PATH, 'utf8'));
+        if (!parsed?.running || !parsed.heartbeatAt)
+            return false;
+        return Date.now() - new Date(parsed.heartbeatAt).getTime() < withinMs;
+    }
+    catch {
+        return false;
+    }
+}
+/** Escape a JS string for embedding in a PowerShell single-quoted literal. */
+function psSingle(value) {
+    return value.replace(/'/g, "''");
+}
+/**
+ * The C# helper (compiled by Add-Type in the child) that owns the low-level
+ * keyboard hook. Only used in block mode. Design notes are in the file header:
+ * the callback is trivial (a volatile timestamp read + foreground check), the
+ * block auto-expires, and a periodic reinstall on the pump thread recovers from
+ * Windows silently removing the hook under sustained load.
+ */
+function keyboardHookCSharp() {
+    return [
+        'using System;',
+        'using System.Runtime.InteropServices;',
+        'using System.Threading;',
+        'using System.Diagnostics;',
+        'public static class FcdKbGuard {',
+        '  private const int WH_KEYBOARD_LL = 13;',
+        '  private const int WM_KEYDOWN = 0x0100;',
+        '  private const int WM_SYSKEYDOWN = 0x0104;',
+        '  private const uint VK_RETURN = 0x0D;',
+        '  private const int VK_SHIFT = 0x10;',
+        '  private const uint PM_REMOVE = 0x0001;',
+        '  [StructLayout(LayoutKind.Sequential)] private struct KBDLLHOOKSTRUCT { public uint vkCode; public uint scanCode; public uint flags; public uint time; public IntPtr dwExtraInfo; }',
+        '  [StructLayout(LayoutKind.Sequential)] private struct MSG { public IntPtr hwnd; public uint message; public IntPtr wParam; public IntPtr lParam; public uint time; public int ptx; public int pty; }',
+        '  private delegate IntPtr HookProc(int nCode, IntPtr wParam, IntPtr lParam);',
+        '  [DllImport("user32.dll", SetLastError=true)] private static extern IntPtr SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hMod, uint dwThreadId);',
+        '  [DllImport("user32.dll", SetLastError=true)] private static extern bool UnhookWindowsHookEx(IntPtr hhk);',
+        '  [DllImport("user32.dll")] private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);',
+        '  [DllImport("user32.dll")] private static extern short GetKeyState(int nVirtKey);',
+        '  [DllImport("user32.dll")] private static extern IntPtr GetForegroundWindow();',
+        '  [DllImport("user32.dll")] private static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint pid);',
+        '  [DllImport("kernel32.dll")] private static extern IntPtr GetModuleHandle(string name);',
+        '  [DllImport("user32.dll")] private static extern bool PeekMessage(out MSG msg, IntPtr hWnd, uint min, uint max, uint remove);',
+        '  private static IntPtr _hook = IntPtr.Zero;',
+        '  private static HookProc _proc;',
+        '  private static long _blockUntil = 0;',
+        '  private static long _blocked = 0;',
+        '  private static volatile bool _running = false;',
+        '  public static void ArmFor(long ms) { Interlocked.Exchange(ref _blockUntil, DateTime.UtcNow.Ticks + ms * TimeSpan.TicksPerMillisecond); }',
+        '  public static void Clear() { Interlocked.Exchange(ref _blockUntil, 0); }',
+        '  public static long Blocked() { return Interlocked.Read(ref _blocked); }',
+        '  private static bool ForegroundIsClaude() {',
+        '    try {',
+        '      IntPtr h = GetForegroundWindow(); if (h == IntPtr.Zero) return false;',
+        '      uint pid; GetWindowThreadProcessId(h, out pid); if (pid == 0) return false;',
+        '      Process p = Process.GetProcessById((int)pid);',
+        '      return p != null && string.Equals(p.ProcessName, "Claude", StringComparison.OrdinalIgnoreCase);',
+        '    } catch { return false; }',
+        '  }',
+        '  private static IntPtr Callback(int nCode, IntPtr wParam, IntPtr lParam) {',
+        '    try {',
+        '      if (nCode >= 0) {',
+        '        int m = wParam.ToInt32();',
+        '        if (m == WM_KEYDOWN || m == WM_SYSKEYDOWN) {',
+        '          KBDLLHOOKSTRUCT k = (KBDLLHOOKSTRUCT)Marshal.PtrToStructure(lParam, typeof(KBDLLHOOKSTRUCT));',
+        '          if (k.vkCode == VK_RETURN) {',
+        '            bool shift = (GetKeyState(VK_SHIFT) & 0x8000) != 0;',
+        '            if (!shift && DateTime.UtcNow.Ticks < Interlocked.Read(ref _blockUntil) && ForegroundIsClaude()) {',
+        '              Interlocked.Increment(ref _blocked);',
+        '              return (IntPtr)1;',
+        '            }',
+        '          }',
+        '        }',
+        '      }',
+        '    } catch { }',
+        '    return CallNextHookEx(_hook, nCode, wParam, lParam);',
+        '  }',
+        '  public static void Start() {',
+        '    if (_running) return; _running = true; _proc = Callback;',
+        '    Thread t = new Thread(delegate() {',
+        '      _hook = SetWindowsHookEx(WH_KEYBOARD_LL, _proc, GetModuleHandle(null), 0);',
+        '      int lastReinstall = Environment.TickCount;',
+        '      MSG msg;',
+        '      while (_running) {',
+        '        while (PeekMessage(out msg, IntPtr.Zero, 0, 0, PM_REMOVE)) { }',
+        '        Thread.Sleep(10);',
+        '        if (Environment.TickCount - lastReinstall > 60000) {',
+        '          try { if (_hook != IntPtr.Zero) UnhookWindowsHookEx(_hook); } catch { }',
+        '          _hook = SetWindowsHookEx(WH_KEYBOARD_LL, _proc, GetModuleHandle(null), 0);',
+        '          lastReinstall = Environment.TickCount;',
+        '        }',
+        '      }',
+        '      try { if (_hook != IntPtr.Zero) UnhookWindowsHookEx(_hook); } catch { }',
+        '      _hook = IntPtr.Zero;',
+        '    });',
+        '    t.IsBackground = true; t.Start();',
+        '  }',
+        '  public static void Stop() { _running = false; }',
+        '}',
+    ].join('\n');
+}
+/**
+ * The PowerShell watcher. Reads ONLY the focused element of the foreground
+ * Claude process (never the transcript), so it is low-noise and resilient to
+ * Claude UI changes. Emits `FCD:<base64 utf8>` lines on stdout when the text
+ * changes. In block mode it also compiles the keyboard-hook helper and, each
+ * cycle, reads the arm file Node maintains to arm/expire the Enter block.
+ * Everything is wrapped in try/catch — it must never crash the host.
+ */
+function desktopChatWatcherScript(mode = 'warn') {
+    const armPathLiteral = psSingle(ARM_PATH);
+    const lines = [
+        "$ErrorActionPreference = 'SilentlyContinue'",
+        'try {',
+        '  Add-Type -AssemblyName UIAutomationClient,UIAutomationTypes,WindowsBase | Out-Null',
+        '} catch { }',
+        'try {',
+        '  Add-Type -TypeDefinition @"',
+        'using System;',
+        'using System.Runtime.InteropServices;',
+        'public static class FcdWin {',
+        '  [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();',
+        '  [DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint pid);',
+        '}',
+        '"@',
+        '} catch { }',
+    ];
+    if (mode === 'block') {
+        lines.push('try {');
+        lines.push("  Add-Type -TypeDefinition @'");
+        for (const l of keyboardHookCSharp().split('\n'))
+            lines.push(l);
+        lines.push("'@");
+        lines.push('  [FcdKbGuard]::Start()');
+        lines.push('} catch { }');
+        lines.push(`$global:FcdArmPath = '${armPathLiteral}'`);
+    }
+    lines.push('', 'function Get-FcdFocusedText {', '  param([int]$OwnerPid)', '  try {', '    $focused = [System.Windows.Automation.AutomationElement]::FocusedElement', '    if ($null -eq $focused) { return $null }', '    if ($focused.Current.ProcessId -ne $OwnerPid) { return $null }', '    $text = $null', '    $vp = $null', '    if ($focused.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$vp)) {', '      $text = $vp.Current.Value', '    }', '    if ([string]::IsNullOrEmpty($text)) {', '      $tp = $null', '      if ($focused.TryGetCurrentPattern([System.Windows.Automation.TextPattern]::Pattern, [ref]$tp)) {', '        $text = $tp.DocumentRange.GetText(20000)', '      }', '    }', '    if ([string]::IsNullOrEmpty($text)) { $text = $focused.Current.Name }', '    return $text', '  } catch { return $null }', '}', '', '$last = ""', 'while ($true) {', '  Start-Sleep -Milliseconds ' + POLL_MS);
+    if (mode === 'block') {
+        // Arm/expire the Enter block from the file Node maintains. The C# side
+        // auto-expires too, so a missed cycle just releases the block early.
+        lines.push('  try {');
+        lines.push('    if (Test-Path $global:FcdArmPath) {');
+        lines.push('      $armUntil = [long](Get-Content -Raw -Path $global:FcdArmPath)');
+        lines.push('      $nowMs = [long]([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds())');
+        lines.push('      if ($armUntil -gt $nowMs) { [FcdKbGuard]::ArmFor($armUntil - $nowMs) } else { [FcdKbGuard]::Clear() }');
+        lines.push('    } else { [FcdKbGuard]::Clear() }');
+        lines.push('  } catch { }');
+    }
+    lines.push('  try {', '    $h = [FcdWin]::GetForegroundWindow()', '    if ($h -eq [IntPtr]::Zero) { continue }', '    $procId = 0', '    [void][FcdWin]::GetWindowThreadProcessId($h, [ref]$procId)', '    if ($procId -eq 0) { continue }', '    $proc = Get-Process -Id $procId -ErrorAction SilentlyContinue', "    if ($null -eq $proc -or $proc.ProcessName -ne 'Claude') { continue }", '    $text = Get-FcdFocusedText -OwnerPid $procId', '    if ([string]::IsNullOrEmpty($text)) { continue }', '    if ($text.Length -gt 8000) { continue }', '    if ($text -eq $last) { continue }', '    $last = $text', '    $bytes = [System.Text.Encoding]::UTF8.GetBytes($text)', '    $b64 = [Convert]::ToBase64String($bytes)', "    [Console]::Out.WriteLine('" + STDOUT_PREFIX + "' + $b64)", '    [Console]::Out.Flush()', '  } catch { }', '}', '');
+    return lines.join('\n');
+}
+/** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
+function decodeWatcherLine(line) {
+    if (!line.startsWith(STDOUT_PREFIX))
+        return undefined;
+    try {
+        return Buffer.from(line.slice(STDOUT_PREFIX.length), 'base64').toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+function ensureWatcherScript(mode) {
+    fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(mode), { encoding: 'utf8' });
+    return WATCHER_PS1_PATH;
+}
+/** Arm the Enter block for the standard window (block mode only). */
+function armBlock() {
+    try {
+        fs.mkdirSync(path.dirname(ARM_PATH), { recursive: true });
+        fs.writeFileSync(ARM_PATH, String(Date.now() + ARM_WINDOW_MS), { encoding: 'utf8', mode: 0o600 });
+    }
+    catch { /* best-effort — the C# side still auto-expires */ }
+}
+function clearArm() {
+    try {
+        fs.unlinkSync(ARM_PATH);
+    }
+    catch { /* not armed */ }
+}
+/**
+ * Start the guard. Returns a handle whose stop() tears down the watcher and
+ * timers. Safe no-op (returns undefined) on unsupported platforms.
+ */
+function startDesktopChatGuard(runtime) {
+    if (!desktopChatGuardSupported())
+        return undefined;
+    const startedAt = new Date().toISOString();
+    let stopped = false;
+    let child;
+    let restartTimer;
+    let restartDelay = RESTART_MIN_MS;
+    let findings = 0;
+    let blocksArmed = 0;
+    const lastToastAt = new Map();
+    let scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(undefined);
+    let mode = resolveDesktopChatMode(runtime.mode);
+    const identity = (0, machineIdentity_1.getMachineIdentity)();
+    clearArm(); // never start with a stale armed window
+    const refreshSnapshot = async () => {
+        if (!runtime.shieldId)
+            return;
+        try {
+            const snapshot = await (0, localSafetySnapshot_1.loadLocalSafetySnapshot)({
+                apiUrl: runtime.apiUrl,
+                shieldId: runtime.shieldId,
+                shieldKey: runtime.shieldKey,
+                developerName: identity.developerName,
+                machineName: identity.hostname,
+            });
+            scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot);
+            // Mode can be flipped centrally (snapshot) unless pinned by arg/env.
+            mode = resolveDesktopChatMode(runtime.mode, snapshot);
+        }
+        catch { /* offline — keep last options/mode */ }
+    };
+    // heartbeatAt lets the daemon/console tell "guard alive" from "stale".
+    const heartbeat = () => writeStatus({
+        running: !stopped,
+        mode,
+        findings,
+        blocksArmed,
+        startedAt,
+        heartbeatAt: new Date().toISOString(),
+    });
+    const handleText = (text) => {
+        if (!text.trim())
+            return;
+        const finding = (0, deterministicGuard_1.scanDeterministicPrompt)(text, scanOptions);
+        if (!finding) {
+            // No secret in the box → make sure the Enter block is not armed.
+            if (mode === 'block')
+                clearArm();
+            return;
+        }
+        findings += 1;
+        const masked = mask(finding.evidence || '');
+        const blocking = mode === 'block';
+        if (blocking) {
+            armBlock();
+            blocksArmed += 1;
+        }
+        heartbeat();
+        (0, telemetry_1.spoolEvent)({
+            // block mode enforces (Enter is swallowed); warn mode is monitor-only.
+            decision: blocking ? 'block' : 'allow',
+            toolName: 'claude_desktop_chat',
+            operation: 'prompt',
+            reason: blocking ? finding.reason : `would block: ${finding.reason}`,
+            ruleId: finding.ruleId,
+            category: finding.category,
+            categoryId: finding.categoryId,
+            itemId: finding.itemId,
+            source: finding.source,
+            evidence: masked,
+            explanation: finding.explanation,
+            policyHash: finding.policyHash,
+        });
+        (0, telemetry_1.triggerFlush)();
+        const key = `${finding.itemId}:${masked}`;
+        const now = Date.now();
+        const last = lastToastAt.get(key) || 0;
+        if (!runtime.quiet && now - last > TOAST_DEBOUNCE_MS) {
+            lastToastAt.set(key, now);
+            (0, notify_1.notifyOs)({
+                title: blocking ? 'FullCourtDefense: blocked in Claude Desktop' : 'FullCourtDefense: secret in Claude Desktop',
+                message: blocking
+                    ? `${finding.reason}. Sending is blocked — remove it to continue.`
+                    : `${finding.reason}. Remove it before sending — this text has not been protected.`,
+            });
+        }
+        runtime.log(`Claude Desktop chat ${blocking ? 'block' : 'finding'}: ${finding.itemId} (${finding.reason}).`);
+    };
+    const spawnWatcher = () => {
+        if (stopped)
+            return;
+        let scriptPath;
+        try {
+            scriptPath = ensureWatcherScript(mode);
+        }
+        catch (error) {
+            runtime.log(`Claude Desktop guard: cannot write watcher script: ${error.message}`);
+            scheduleRestart();
+            return;
+        }
+        child = (0, child_process_1.spawn)('powershell', [
+            '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden', '-File', scriptPath,
+        ], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
+        if (!child.stdout) {
+            scheduleRestart();
+            return;
+        }
+        const rl = readline.createInterface({ input: child.stdout });
+        rl.on('line', (line) => {
+            const text = decodeWatcherLine(line);
+            if (text === undefined)
+                return;
+            restartDelay = RESTART_MIN_MS; // healthy output resets backoff
+            handleText(text);
+        });
+        child.on('exit', () => { rl.close(); if (mode === 'block')
+            clearArm(); if (!stopped)
+            scheduleRestart(); });
+        child.on('error', () => { if (!stopped)
+            scheduleRestart(); });
+        runtime.log(`Claude Desktop chat guard: watcher started (${mode}).`);
+        heartbeat();
+    };
+    const scheduleRestart = () => {
+        if (stopped || restartTimer)
+            return;
+        restartTimer = setTimeout(() => {
+            restartTimer = undefined;
+            spawnWatcher();
+        }, restartDelay);
+        restartDelay = Math.min(RESTART_MAX_MS, restartDelay * 2);
+    };
+    void refreshSnapshot();
+    const snapshotTimer = setInterval(() => { void refreshSnapshot(); }, SNAPSHOT_REFRESH_MS);
+    const heartbeatTimer = setInterval(heartbeat, 60_000);
+    spawnWatcher();
+    return {
+        stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            clearInterval(snapshotTimer);
+            clearInterval(heartbeatTimer);
+            if (restartTimer) {
+                clearTimeout(restartTimer);
+                restartTimer = undefined;
+            }
+            clearArm(); // release any armed Enter block immediately
+            try {
+                child?.kill();
+            }
+            catch { /* ignore */ }
+            writeStatus({ running: false, mode, findings, blocksArmed, startedAt });
+        },
+    };
+}
+/**
+ * Foreground `desktop-chat-guard` command — runs the guard in this process
+ * until interrupted. Useful for manual testing (e.g. `--mode block`); in
+ * production the daemon supervises the guard in-process.
+ */
+async function desktopChatGuardCommand(args, config) {
+    if (process.platform !== 'win32') {
+        console.error('The Claude Desktop chat guard is Windows-only.');
+        process.exit(1);
+    }
+    if (!(0, discoverPaths_1.claudeDesktopLikelyInstalled)()) {
+        console.error('Claude Desktop was not detected on this machine — nothing to guard.');
+        process.exit(1);
+    }
+    const creds = (0, config_1.resolveCliCredentials)(config, {
+        shieldId: args.shieldId,
+        shieldKey: args.shieldKey,
+        apiUrl: args.apiUrl,
+    });
+    const handle = startDesktopChatGuard({
+        apiUrl: creds.apiUrl,
+        shieldId: creds.shieldId,
+        shieldKey: creds.shieldKey,
+        mode: args.mode,
+        quiet: args.quiet === 'true',
+        log: (msg) => console.log(msg),
+    });
+    if (!handle) {
+        console.error('Claude Desktop chat guard is not supported on this machine.');
+        process.exit(1);
+    }
+    const mode = resolveDesktopChatMode(args.mode);
+    console.log(`FullCourtDefense Claude Desktop chat guard running (${mode}). Stop with Ctrl+C.`);
+    if (mode === 'block')
+        console.log('Block mode: pressing Enter to send a message that contains a secret will be prevented while Claude Desktop is focused.');
+    const shutdown = () => { handle.stop(); process.exit(0); };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+    await new Promise(() => { });
+}

package/dist/commands/installClaudeHook.js

@@ -253,6 +253,7 @@ async function installClaudeHookCommand(args, config) {
     console.log(`${COLOR.gray}Scope:${COLOR.reset} ${projectScope ? 'project (.claude/settings.json)' : 'machine-wide (~/.claude/settings.json)'}`);
     console.log(`${COLOR.gray}File:${COLOR.reset}  ${file}`);
     console.log(`${COLOR.gray}Covers:${COLOR.reset} Claude Code, VS Code Copilot agent mode, GitHub Copilot CLI (all read this file)`);
+    console.log(`${COLOR.gray}Note:${COLOR.reset} Claude Desktop's regular chat has no hook — it is protected separately by the Windows chat guard the daemon runs (warns on secrets; can block the send in block mode).`);
     const parts = [];
     if (wantTools)
         parts.push('tool calls (shell / MCP / file writes / reads) checked against org Action Policies + Local Safety rules');

package/dist/index.js

@@ -52,6 +52,7 @@ const installAll_1 = require("./commands/installAll");
 const onboard_1 = require("./commands/onboard");
 const autoProtect_1 = require("./commands/autoProtect");
 const daemon_1 = require("./commands/daemon");
+const desktopChatGuard_1 = require("./commands/desktopChatGuard");
 const windowsAudit_1 = require("./commands/windowsAudit");
 const shellGuard_1 = require("./commands/shellGuard");
 const cmdGuard_1 = require("./commands/cmdGuard");
@@ -845,6 +846,17 @@ async function main() {
             await (0, daemon_1.daemonCommand)(args, config);
             break;
         }
+        case 'desktop-chat-guard': {
+            const args = {
+                apiUrl: flags['api-url'],
+                shieldId: flags['shield-id'],
+                shieldKey: flags['shield-key'],
+                mode: flags.mode,
+                quiet: flags.quiet,
+            };
+            await (0, desktopChatGuard_1.desktopChatGuardCommand)(args, config);
+            break;
+        }
         case 'install-cursor-mcp-gateway': {
             const args = {
                 ...buildGatewayArgs(),

package/dist/telemetry.d.ts

@@ -34,6 +34,8 @@ export interface FlushInput {
     integrityCheckedAt?: string;
     /** Set only by the resident process; distinguishes daemon liveness from hook flushes. */
     daemon?: boolean;
+    /** Windows Claude Desktop chat guard liveness (advisory prompt protection). */
+    desktopChatGuard?: boolean;
     timeoutMs?: number;
 }
 /** Drain the spool to the backend in one batch (+ optional heartbeat). Returns accepted count. */

package/dist/telemetry.js

@@ -164,6 +164,7 @@ async function flushSpool(input) {
                         integrityCheckedAt: input.integrityCheckedAt,
                         daemon: input.daemon === true,
                         coverage: 'hooks',
+                        desktopChatGuard: input.desktopChatGuard === true,
                         hostname: identity.hostname,
                         // Windows-only: current PowerShell audit coverage (ScriptBlock
                         // Logging + Transcription). Keeps the fleet dashboard's coverage

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.18.12"
+  "version": "1.20.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.18.12",
+  "version": "1.20.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -15,6 +15,7 @@
   "scripts": {
     "build": "tsc && node scripts/copy-attack-corpus.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
+    "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
     "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
     "test:shell-audit": "npm run build && node scripts/test-shell-audit.js",
     "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",