fullcourtdefense-cli 1.19.0 → 1.20.0

package/dist/commands/daemon.js

@@ -758,11 +758,14 @@ async function runDaemon(args, config) {
             apiUrl: creds.apiUrl,
             shieldId: creds.shieldId,
             shieldKey: creds.shieldKey,
+            // Mode is resolved inside the guard: FCD_DESKTOP_CHAT_MODE env or the
+            // Local Safety snapshot's desktopChatMode hint; defaults to advisory warn.
+            mode: process.env.FCD_DESKTOP_CHAT_MODE,
             quiet,
             log,
         });
         if (desktopChatGuard)
-            log('Claude Desktop chat guard: supervising (advisory — warns on secrets typed into Claude Desktop).');
+            log('Claude Desktop chat guard: supervising (warns, or blocks the Enter send if block mode is enabled, on secrets typed into Claude Desktop).');
     }
     // Fresh machines have never uploaded an inventory (MSI/onboard defers the
     // initial discovery to keep setup fast), so the dashboard shows "Never" for

package/dist/commands/desktopChatGuard.d.ts

@@ -1,22 +1,67 @@
 import { BotGuardConfig } from '../config';
+import { LocalSafetySnapshot } from '../localSafetySnapshot';
+/**
+ * Claude Desktop chat guard (Windows).
+ *
+ * Claude Desktop's regular chat sends prompts straight to Anthropic's API — it
+ * exposes no hook and never touches an MCP server, so neither the Claude-format
+ * hooks nor the MCP gateway can see what a developer types there. This guard
+ * closes that blind spot with the SAME on-device deterministic engine used
+ * everywhere else (scanDeterministicPrompt).
+ *
+ * Two modes:
+ *   - warn  (default): advisory. A PowerShell UI Automation watcher reads the
+ *     focused Claude input, this process scans it locally, and on a finding it
+ *     toasts + reports a monitor event. No keyboard hook, no input mutation —
+ *     cannot break typing, no keylogger surface.
+ *   - block (org-policy opt-in): everything warn does, PLUS the watcher installs
+ *     a low-level keyboard hook that swallows the Enter "send" while a secret is
+ *     in the box, so the prompt cannot be sent to Anthropic.
+ *
+ * Safety model (why this cannot freeze/crash a machine):
+ *   1. ALL native code (the keyboard hook + its message pump) runs in the CHILD
+ *      PowerShell process. The Node daemon only does a fast regex scan and a
+ *      tiny file write; it is never in the keystroke hot path.
+ *   2. The hook callback does only a volatile-timestamp read + a cheap
+ *      foreground check, returning in microseconds — far under Windows'
+ *      LowLevelHooksTimeout. A slow LL hook is silently removed by Windows
+ *      (keys pass through); it FAILS OPEN, it never freezes the keyboard.
+ *   3. The block is armed as a short time WINDOW (auto-expires ~2s after the
+ *      last detection). If the daemon dies, stops arming, or the child is
+ *      killed, Enter is released within ~2s — the keyboard can never get stuck.
+ *   4. block mode is OFF by default; the hook is only installed when an org
+ *      opts in, so the default fleet behavior is the risk-free advisory mode.
+ *   5. Detection stays 100% in the shared Node deterministicGuard (single
+ *      source of truth); the child never re-implements detection.
+ *
+ * Text is scanned in-process and never uploaded — only finding metadata (item
+ * id + masked value) is spooled.
+ */
+export type DesktopChatMode = 'warn' | 'block';
 export interface DesktopChatGuardArgs {
     apiUrl?: string;
     shieldId?: string;
     shieldKey?: string;
+    /** 'warn' (default) or 'block'. */
+    mode?: string;
     /** Suppress OS toasts (still spools findings). */
     quiet?: string;
 }
 /** Only meaningful where Claude Desktop runs and UI Automation is available. */
 export declare function desktopChatGuardSupported(): boolean;
+/** Resolve the effective mode: explicit arg > env > snapshot hint > 'warn'. */
+export declare function resolveDesktopChatMode(explicit?: string, snapshot?: LocalSafetySnapshot): DesktopChatMode;
 /** True when the guard reported itself healthy within the last `withinMs`. */
 export declare function desktopChatGuardHealthy(withinMs?: number): boolean;
 /**
  * The PowerShell watcher. Reads ONLY the focused element of the foreground
  * Claude process (never the transcript), so it is low-noise and resilient to
  * Claude UI changes. Emits `FCD:<base64 utf8>` lines on stdout when the text
- * changes. Everything is wrapped in try/catch — it must never crash the host.
+ * changes. In block mode it also compiles the keyboard-hook helper and, each
+ * cycle, reads the arm file Node maintains to arm/expire the Enter block.
+ * Everything is wrapped in try/catch — it must never crash the host.
  */
-export declare function desktopChatWatcherScript(): string;
+export declare function desktopChatWatcherScript(mode?: DesktopChatMode): string;
 /** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
 export declare function decodeWatcherLine(line: string): string | undefined;
 export interface DesktopChatGuardHandle {
@@ -26,18 +71,19 @@ interface GuardRuntime {
     apiUrl: string;
     shieldId?: string;
     shieldKey?: string;
+    mode?: string;
     quiet: boolean;
     log: (msg: string) => void;
 }
 /**
- * Start the advisory guard. Returns a handle whose stop() tears down the
- * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
+ * Start the guard. Returns a handle whose stop() tears down the watcher and
+ * timers. Safe no-op (returns undefined) on unsupported platforms.
  */
 export declare function startDesktopChatGuard(runtime: GuardRuntime): DesktopChatGuardHandle | undefined;
 /**
- * Foreground `desktop-chat-guard` command — runs the advisory guard in this
- * process until interrupted. Mostly for manual testing; in production the
- * daemon supervises the guard in-process (startDesktopChatGuard).
+ * Foreground `desktop-chat-guard` command — runs the guard in this process
+ * until interrupted. Useful for manual testing (e.g. `--mode block`); in
+ * production the daemon supervises the guard in-process.
  */
 export declare function desktopChatGuardCommand(args: DesktopChatGuardArgs, config: BotGuardConfig): Promise<void>;
 export {};

package/dist/commands/desktopChatGuard.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.desktopChatGuardSupported = desktopChatGuardSupported;
+exports.resolveDesktopChatMode = resolveDesktopChatMode;
 exports.desktopChatGuardHealthy = desktopChatGuardHealthy;
 exports.desktopChatWatcherScript = desktopChatWatcherScript;
 exports.decodeWatcherLine = decodeWatcherLine;
@@ -51,29 +52,15 @@ const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const machineIdentity_1 = require("../machineIdentity");
 const discoverPaths_1 = require("./discoverPaths");
-/**
- * Claude Desktop chat guard (Windows, phase 1 — advisory).
- *
- * Claude Desktop's regular chat sends prompts straight to Anthropic's API — it
- * exposes no hook and never touches an MCP server, so neither the Claude-format
- * hooks nor the MCP gateway can see what a developer types there. This guard
- * closes that blind spot with the SAME on-device deterministic engine used
- * everywhere else (scanDeterministicPrompt): a lightweight PowerShell UI
- * Automation watcher reads the text of the focused Claude Desktop input element
- * and streams it (base64) to this process, which scans it locally and — on a
- * finding — shows a native toast and reports a monitor event to the fleet.
- *
- * Phase 1 is advisory ONLY: no keyboard hook, no input mutation. It cannot
- * break typing and presents no keylogger surface (it reads only the focused
- * element of the foreground Claude process). Text is scanned in-process and is
- * never uploaded — only finding metadata (item id + masked value) is spooled.
- * Hard blocking is a later, org-policy-gated phase.
- */
 const WATCHER_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-claude-desktop-watcher.ps1');
 const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-guard.json');
+/** Node writes an epoch-ms "block until" here; the watcher reads it each cycle. */
+const ARM_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-arm');
 const STDOUT_PREFIX = 'FCD:';
 /** Poll cadence for the foreground/focused-element read (ms). */
-const POLL_MS = 800;
+const POLL_MS = 250;
+/** How long each detection arms the Enter block (auto-expiry safety valve). */
+const ARM_WINDOW_MS = 2_000;
 /** Don't re-toast the same finding value more often than this. */
 const TOAST_DEBOUNCE_MS = 60_000;
 /** Refresh the cached Local Safety snapshot on this cadence. */
@@ -85,6 +72,12 @@ const RESTART_MAX_MS = 30_000;
 function desktopChatGuardSupported() {
     return process.platform === 'win32' && (0, discoverPaths_1.claudeDesktopLikelyInstalled)();
 }
+/** Resolve the effective mode: explicit arg > env > snapshot hint > 'warn'. */
+function resolveDesktopChatMode(explicit, snapshot) {
+    const raw = (explicit || process.env.FCD_DESKTOP_CHAT_MODE || snapshot?.desktopChatMode || 'warn')
+        .toString().toLowerCase();
+    return raw === 'block' ? 'block' : 'warn';
+}
 function mask(value) {
     const v = String(value || '');
     if (v.length <= 8)
@@ -110,17 +103,113 @@ function desktopChatGuardHealthy(withinMs = 15 * 60_000) {
         return false;
     }
 }
+/** Escape a JS string for embedding in a PowerShell single-quoted literal. */
+function psSingle(value) {
+    return value.replace(/'/g, "''");
+}
+/**
+ * The C# helper (compiled by Add-Type in the child) that owns the low-level
+ * keyboard hook. Only used in block mode. Design notes are in the file header:
+ * the callback is trivial (a volatile timestamp read + foreground check), the
+ * block auto-expires, and a periodic reinstall on the pump thread recovers from
+ * Windows silently removing the hook under sustained load.
+ */
+function keyboardHookCSharp() {
+    return [
+        'using System;',
+        'using System.Runtime.InteropServices;',
+        'using System.Threading;',
+        'using System.Diagnostics;',
+        'public static class FcdKbGuard {',
+        '  private const int WH_KEYBOARD_LL = 13;',
+        '  private const int WM_KEYDOWN = 0x0100;',
+        '  private const int WM_SYSKEYDOWN = 0x0104;',
+        '  private const uint VK_RETURN = 0x0D;',
+        '  private const int VK_SHIFT = 0x10;',
+        '  private const uint PM_REMOVE = 0x0001;',
+        '  [StructLayout(LayoutKind.Sequential)] private struct KBDLLHOOKSTRUCT { public uint vkCode; public uint scanCode; public uint flags; public uint time; public IntPtr dwExtraInfo; }',
+        '  [StructLayout(LayoutKind.Sequential)] private struct MSG { public IntPtr hwnd; public uint message; public IntPtr wParam; public IntPtr lParam; public uint time; public int ptx; public int pty; }',
+        '  private delegate IntPtr HookProc(int nCode, IntPtr wParam, IntPtr lParam);',
+        '  [DllImport("user32.dll", SetLastError=true)] private static extern IntPtr SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hMod, uint dwThreadId);',
+        '  [DllImport("user32.dll", SetLastError=true)] private static extern bool UnhookWindowsHookEx(IntPtr hhk);',
+        '  [DllImport("user32.dll")] private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);',
+        '  [DllImport("user32.dll")] private static extern short GetKeyState(int nVirtKey);',
+        '  [DllImport("user32.dll")] private static extern IntPtr GetForegroundWindow();',
+        '  [DllImport("user32.dll")] private static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint pid);',
+        '  [DllImport("kernel32.dll")] private static extern IntPtr GetModuleHandle(string name);',
+        '  [DllImport("user32.dll")] private static extern bool PeekMessage(out MSG msg, IntPtr hWnd, uint min, uint max, uint remove);',
+        '  private static IntPtr _hook = IntPtr.Zero;',
+        '  private static HookProc _proc;',
+        '  private static long _blockUntil = 0;',
+        '  private static long _blocked = 0;',
+        '  private static volatile bool _running = false;',
+        '  public static void ArmFor(long ms) { Interlocked.Exchange(ref _blockUntil, DateTime.UtcNow.Ticks + ms * TimeSpan.TicksPerMillisecond); }',
+        '  public static void Clear() { Interlocked.Exchange(ref _blockUntil, 0); }',
+        '  public static long Blocked() { return Interlocked.Read(ref _blocked); }',
+        '  private static bool ForegroundIsClaude() {',
+        '    try {',
+        '      IntPtr h = GetForegroundWindow(); if (h == IntPtr.Zero) return false;',
+        '      uint pid; GetWindowThreadProcessId(h, out pid); if (pid == 0) return false;',
+        '      Process p = Process.GetProcessById((int)pid);',
+        '      return p != null && string.Equals(p.ProcessName, "Claude", StringComparison.OrdinalIgnoreCase);',
+        '    } catch { return false; }',
+        '  }',
+        '  private static IntPtr Callback(int nCode, IntPtr wParam, IntPtr lParam) {',
+        '    try {',
+        '      if (nCode >= 0) {',
+        '        int m = wParam.ToInt32();',
+        '        if (m == WM_KEYDOWN || m == WM_SYSKEYDOWN) {',
+        '          KBDLLHOOKSTRUCT k = (KBDLLHOOKSTRUCT)Marshal.PtrToStructure(lParam, typeof(KBDLLHOOKSTRUCT));',
+        '          if (k.vkCode == VK_RETURN) {',
+        '            bool shift = (GetKeyState(VK_SHIFT) & 0x8000) != 0;',
+        '            if (!shift && DateTime.UtcNow.Ticks < Interlocked.Read(ref _blockUntil) && ForegroundIsClaude()) {',
+        '              Interlocked.Increment(ref _blocked);',
+        '              return (IntPtr)1;',
+        '            }',
+        '          }',
+        '        }',
+        '      }',
+        '    } catch { }',
+        '    return CallNextHookEx(_hook, nCode, wParam, lParam);',
+        '  }',
+        '  public static void Start() {',
+        '    if (_running) return; _running = true; _proc = Callback;',
+        '    Thread t = new Thread(delegate() {',
+        '      _hook = SetWindowsHookEx(WH_KEYBOARD_LL, _proc, GetModuleHandle(null), 0);',
+        '      int lastReinstall = Environment.TickCount;',
+        '      MSG msg;',
+        '      while (_running) {',
+        '        while (PeekMessage(out msg, IntPtr.Zero, 0, 0, PM_REMOVE)) { }',
+        '        Thread.Sleep(10);',
+        '        if (Environment.TickCount - lastReinstall > 60000) {',
+        '          try { if (_hook != IntPtr.Zero) UnhookWindowsHookEx(_hook); } catch { }',
+        '          _hook = SetWindowsHookEx(WH_KEYBOARD_LL, _proc, GetModuleHandle(null), 0);',
+        '          lastReinstall = Environment.TickCount;',
+        '        }',
+        '      }',
+        '      try { if (_hook != IntPtr.Zero) UnhookWindowsHookEx(_hook); } catch { }',
+        '      _hook = IntPtr.Zero;',
+        '    });',
+        '    t.IsBackground = true; t.Start();',
+        '  }',
+        '  public static void Stop() { _running = false; }',
+        '}',
+    ].join('\n');
+}
 /**
  * The PowerShell watcher. Reads ONLY the focused element of the foreground
  * Claude process (never the transcript), so it is low-noise and resilient to
  * Claude UI changes. Emits `FCD:<base64 utf8>` lines on stdout when the text
- * changes. Everything is wrapped in try/catch — it must never crash the host.
+ * changes. In block mode it also compiles the keyboard-hook helper and, each
+ * cycle, reads the arm file Node maintains to arm/expire the Enter block.
+ * Everything is wrapped in try/catch — it must never crash the host.
  */
-function desktopChatWatcherScript() {
-    return [
+function desktopChatWatcherScript(mode = 'warn') {
+    const armPathLiteral = psSingle(ARM_PATH);
+    const lines = [
         "$ErrorActionPreference = 'SilentlyContinue'",
         'try {',
-        "  Add-Type -AssemblyName UIAutomationClient,UIAutomationTypes,WindowsBase | Out-Null",
+        '  Add-Type -AssemblyName UIAutomationClient,UIAutomationTypes,WindowsBase | Out-Null',
         '} catch { }',
         'try {',
         '  Add-Type -TypeDefinition @"',
@@ -132,53 +221,31 @@ function desktopChatWatcherScript() {
         '}',
         '"@',
         '} catch { }',
-        '',
-        'function Get-FcdFocusedText {',
-        '  param([int]$OwnerPid)',
-        '  try {',
-        '    $focused = [System.Windows.Automation.AutomationElement]::FocusedElement',
-        '    if ($null -eq $focused) { return $null }',
-        '    if ($focused.Current.ProcessId -ne $OwnerPid) { return $null }',
-        '    $text = $null',
-        '    $vp = $null',
-        '    if ($focused.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$vp)) {',
-        '      $text = $vp.Current.Value',
-        '    }',
-        '    if ([string]::IsNullOrEmpty($text)) {',
-        '      $tp = $null',
-        '      if ($focused.TryGetCurrentPattern([System.Windows.Automation.TextPattern]::Pattern, [ref]$tp)) {',
-        '        $text = $tp.DocumentRange.GetText(20000)',
-        '      }',
-        '    }',
-        '    if ([string]::IsNullOrEmpty($text)) { $text = $focused.Current.Name }',
-        '    return $text',
-        '  } catch { return $null }',
-        '}',
-        '',
-        '$last = ""',
-        'while ($true) {',
-        "  Start-Sleep -Milliseconds " + POLL_MS,
-        '  try {',
-        '    $h = [FcdWin]::GetForegroundWindow()',
-        '    if ($h -eq [IntPtr]::Zero) { continue }',
-        '    $procId = 0',
-        '    [void][FcdWin]::GetWindowThreadProcessId($h, [ref]$procId)',
-        '    if ($procId -eq 0) { continue }',
-        '    $proc = Get-Process -Id $procId -ErrorAction SilentlyContinue',
-        "    if ($null -eq $proc -or $proc.ProcessName -ne 'Claude') { continue }",
-        '    $text = Get-FcdFocusedText -OwnerPid $procId',
-        '    if ([string]::IsNullOrEmpty($text)) { continue }',
-        '    if ($text.Length -gt 8000) { continue }',
-        '    if ($text -eq $last) { continue }',
-        '    $last = $text',
-        '    $bytes = [System.Text.Encoding]::UTF8.GetBytes($text)',
-        '    $b64 = [Convert]::ToBase64String($bytes)',
-        "    [Console]::Out.WriteLine('" + STDOUT_PREFIX + "' + $b64)",
-        '    [Console]::Out.Flush()',
-        '  } catch { }',
-        '}',
-        '',
-    ].join('\n');
+    ];
+    if (mode === 'block') {
+        lines.push('try {');
+        lines.push("  Add-Type -TypeDefinition @'");
+        for (const l of keyboardHookCSharp().split('\n'))
+            lines.push(l);
+        lines.push("'@");
+        lines.push('  [FcdKbGuard]::Start()');
+        lines.push('} catch { }');
+        lines.push(`$global:FcdArmPath = '${armPathLiteral}'`);
+    }
+    lines.push('', 'function Get-FcdFocusedText {', '  param([int]$OwnerPid)', '  try {', '    $focused = [System.Windows.Automation.AutomationElement]::FocusedElement', '    if ($null -eq $focused) { return $null }', '    if ($focused.Current.ProcessId -ne $OwnerPid) { return $null }', '    $text = $null', '    $vp = $null', '    if ($focused.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$vp)) {', '      $text = $vp.Current.Value', '    }', '    if ([string]::IsNullOrEmpty($text)) {', '      $tp = $null', '      if ($focused.TryGetCurrentPattern([System.Windows.Automation.TextPattern]::Pattern, [ref]$tp)) {', '        $text = $tp.DocumentRange.GetText(20000)', '      }', '    }', '    if ([string]::IsNullOrEmpty($text)) { $text = $focused.Current.Name }', '    return $text', '  } catch { return $null }', '}', '', '$last = ""', 'while ($true) {', '  Start-Sleep -Milliseconds ' + POLL_MS);
+    if (mode === 'block') {
+        // Arm/expire the Enter block from the file Node maintains. The C# side
+        // auto-expires too, so a missed cycle just releases the block early.
+        lines.push('  try {');
+        lines.push('    if (Test-Path $global:FcdArmPath) {');
+        lines.push('      $armUntil = [long](Get-Content -Raw -Path $global:FcdArmPath)');
+        lines.push('      $nowMs = [long]([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds())');
+        lines.push('      if ($armUntil -gt $nowMs) { [FcdKbGuard]::ArmFor($armUntil - $nowMs) } else { [FcdKbGuard]::Clear() }');
+        lines.push('    } else { [FcdKbGuard]::Clear() }');
+        lines.push('  } catch { }');
+    }
+    lines.push('  try {', '    $h = [FcdWin]::GetForegroundWindow()', '    if ($h -eq [IntPtr]::Zero) { continue }', '    $procId = 0', '    [void][FcdWin]::GetWindowThreadProcessId($h, [ref]$procId)', '    if ($procId -eq 0) { continue }', '    $proc = Get-Process -Id $procId -ErrorAction SilentlyContinue', "    if ($null -eq $proc -or $proc.ProcessName -ne 'Claude') { continue }", '    $text = Get-FcdFocusedText -OwnerPid $procId', '    if ([string]::IsNullOrEmpty($text)) { continue }', '    if ($text.Length -gt 8000) { continue }', '    if ($text -eq $last) { continue }', '    $last = $text', '    $bytes = [System.Text.Encoding]::UTF8.GetBytes($text)', '    $b64 = [Convert]::ToBase64String($bytes)', "    [Console]::Out.WriteLine('" + STDOUT_PREFIX + "' + $b64)", '    [Console]::Out.Flush()', '  } catch { }', '}', '');
+    return lines.join('\n');
 }
 /** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
 function decodeWatcherLine(line) {
@@ -191,13 +258,27 @@ function decodeWatcherLine(line) {
         return undefined;
     }
 }
-function ensureWatcherScript() {
-    fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(), { encoding: 'utf8' });
+function ensureWatcherScript(mode) {
+    fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(mode), { encoding: 'utf8' });
     return WATCHER_PS1_PATH;
 }
+/** Arm the Enter block for the standard window (block mode only). */
+function armBlock() {
+    try {
+        fs.mkdirSync(path.dirname(ARM_PATH), { recursive: true });
+        fs.writeFileSync(ARM_PATH, String(Date.now() + ARM_WINDOW_MS), { encoding: 'utf8', mode: 0o600 });
+    }
+    catch { /* best-effort — the C# side still auto-expires */ }
+}
+function clearArm() {
+    try {
+        fs.unlinkSync(ARM_PATH);
+    }
+    catch { /* not armed */ }
+}
 /**
- * Start the advisory guard. Returns a handle whose stop() tears down the
- * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
+ * Start the guard. Returns a handle whose stop() tears down the watcher and
+ * timers. Safe no-op (returns undefined) on unsupported platforms.
  */
 function startDesktopChatGuard(runtime) {
     if (!desktopChatGuardSupported())
@@ -208,9 +289,12 @@ function startDesktopChatGuard(runtime) {
     let restartTimer;
     let restartDelay = RESTART_MIN_MS;
     let findings = 0;
+    let blocksArmed = 0;
     const lastToastAt = new Map();
     let scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(undefined);
+    let mode = resolveDesktopChatMode(runtime.mode);
     const identity = (0, machineIdentity_1.getMachineIdentity)();
+    clearArm(); // never start with a stale armed window
     const refreshSnapshot = async () => {
         if (!runtime.shieldId)
             return;
@@ -223,13 +307,17 @@ function startDesktopChatGuard(runtime) {
                 machineName: identity.hostname,
             });
             scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot);
+            // Mode can be flipped centrally (snapshot) unless pinned by arg/env.
+            mode = resolveDesktopChatMode(runtime.mode, snapshot);
         }
-        catch { /* offline — keep last options */ }
+        catch { /* offline — keep last options/mode */ }
     };
     // heartbeatAt lets the daemon/console tell "guard alive" from "stale".
     const heartbeat = () => writeStatus({
         running: !stopped,
+        mode,
         findings,
+        blocksArmed,
         startedAt,
         heartbeatAt: new Date().toISOString(),
     });
@@ -237,19 +325,26 @@ function startDesktopChatGuard(runtime) {
         if (!text.trim())
             return;
         const finding = (0, deterministicGuard_1.scanDeterministicPrompt)(text, scanOptions);
-        if (!finding)
+        if (!finding) {
+            // No secret in the box → make sure the Enter block is not armed.
+            if (mode === 'block')
+                clearArm();
             return;
+        }
         findings += 1;
         const masked = mask(finding.evidence || '');
+        const blocking = mode === 'block';
+        if (blocking) {
+            armBlock();
+            blocksArmed += 1;
+        }
         heartbeat();
-        // Monitor semantics: advisory phase never blocks, so the decision is
-        // 'allow' with a "would block" evidence note (same shape shell-guard uses
-        // in monitor mode), which the Activity log renders as a monitor finding.
         (0, telemetry_1.spoolEvent)({
-            decision: 'allow',
+            // block mode enforces (Enter is swallowed); warn mode is monitor-only.
+            decision: blocking ? 'block' : 'allow',
             toolName: 'claude_desktop_chat',
             operation: 'prompt',
-            reason: `would block: ${finding.reason}`,
+            reason: blocking ? finding.reason : `would block: ${finding.reason}`,
             ruleId: finding.ruleId,
             category: finding.category,
             categoryId: finding.categoryId,
@@ -266,18 +361,20 @@ function startDesktopChatGuard(runtime) {
         if (!runtime.quiet && now - last > TOAST_DEBOUNCE_MS) {
             lastToastAt.set(key, now);
             (0, notify_1.notifyOs)({
-                title: 'FullCourtDefense: secret in Claude Desktop',
-                message: `${finding.reason}. Remove it before sending — this text has not been protected.`,
+                title: blocking ? 'FullCourtDefense: blocked in Claude Desktop' : 'FullCourtDefense: secret in Claude Desktop',
+                message: blocking
+                    ? `${finding.reason}. Sending is blocked — remove it to continue.`
+                    : `${finding.reason}. Remove it before sending — this text has not been protected.`,
             });
         }
-        runtime.log(`Claude Desktop chat finding: ${finding.itemId} (${finding.reason}).`);
+        runtime.log(`Claude Desktop chat ${blocking ? 'block' : 'finding'}: ${finding.itemId} (${finding.reason}).`);
     };
     const spawnWatcher = () => {
         if (stopped)
             return;
         let scriptPath;
         try {
-            scriptPath = ensureWatcherScript();
+            scriptPath = ensureWatcherScript(mode);
         }
         catch (error) {
             runtime.log(`Claude Desktop guard: cannot write watcher script: ${error.message}`);
@@ -299,11 +396,12 @@ function startDesktopChatGuard(runtime) {
             restartDelay = RESTART_MIN_MS; // healthy output resets backoff
             handleText(text);
         });
-        child.on('exit', () => { rl.close(); if (!stopped)
+        child.on('exit', () => { rl.close(); if (mode === 'block')
+            clearArm(); if (!stopped)
             scheduleRestart(); });
         child.on('error', () => { if (!stopped)
             scheduleRestart(); });
-        runtime.log('Claude Desktop chat guard: watcher started (advisory).');
+        runtime.log(`Claude Desktop chat guard: watcher started (${mode}).`);
         heartbeat();
     };
     const scheduleRestart = () => {
@@ -330,18 +428,19 @@ function startDesktopChatGuard(runtime) {
                 clearTimeout(restartTimer);
                 restartTimer = undefined;
             }
+            clearArm(); // release any armed Enter block immediately
             try {
                 child?.kill();
             }
             catch { /* ignore */ }
-            writeStatus({ running: false, findings, startedAt });
+            writeStatus({ running: false, mode, findings, blocksArmed, startedAt });
         },
     };
 }
 /**
- * Foreground `desktop-chat-guard` command — runs the advisory guard in this
- * process until interrupted. Mostly for manual testing; in production the
- * daemon supervises the guard in-process (startDesktopChatGuard).
+ * Foreground `desktop-chat-guard` command — runs the guard in this process
+ * until interrupted. Useful for manual testing (e.g. `--mode block`); in
+ * production the daemon supervises the guard in-process.
  */
 async function desktopChatGuardCommand(args, config) {
     if (process.platform !== 'win32') {
@@ -361,6 +460,7 @@ async function desktopChatGuardCommand(args, config) {
         apiUrl: creds.apiUrl,
         shieldId: creds.shieldId,
         shieldKey: creds.shieldKey,
+        mode: args.mode,
         quiet: args.quiet === 'true',
         log: (msg) => console.log(msg),
     });
@@ -368,7 +468,10 @@ async function desktopChatGuardCommand(args, config) {
         console.error('Claude Desktop chat guard is not supported on this machine.');
         process.exit(1);
     }
-    console.log('FullCourtDefense Claude Desktop chat guard running (advisory). Stop with Ctrl+C.');
+    const mode = resolveDesktopChatMode(args.mode);
+    console.log(`FullCourtDefense Claude Desktop chat guard running (${mode}). Stop with Ctrl+C.`);
+    if (mode === 'block')
+        console.log('Block mode: pressing Enter to send a message that contains a secret will be prevented while Claude Desktop is focused.');
     const shutdown = () => { handle.stop(); process.exit(0); };
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);

package/dist/commands/installClaudeHook.js

@@ -253,7 +253,7 @@ async function installClaudeHookCommand(args, config) {
     console.log(`${COLOR.gray}Scope:${COLOR.reset} ${projectScope ? 'project (.claude/settings.json)' : 'machine-wide (~/.claude/settings.json)'}`);
     console.log(`${COLOR.gray}File:${COLOR.reset}  ${file}`);
     console.log(`${COLOR.gray}Covers:${COLOR.reset} Claude Code, VS Code Copilot agent mode, GitHub Copilot CLI (all read this file)`);
-    console.log(`${COLOR.gray}Note:${COLOR.reset} Claude Desktop's regular chat has no hook — it is protected separately by the Windows chat guard the daemon runs (advisory).`);
+    console.log(`${COLOR.gray}Note:${COLOR.reset} Claude Desktop's regular chat has no hook — it is protected separately by the Windows chat guard the daemon runs (warns on secrets; can block the send in block mode).`);
     const parts = [];
     if (wantTools)
         parts.push('tool calls (shell / MCP / file writes / reads) checked against org Action Policies + Local Safety rules');

package/dist/index.js

@@ -851,6 +851,7 @@ async function main() {
                 apiUrl: flags['api-url'],
                 shieldId: flags['shield-id'],
                 shieldKey: flags['shield-key'],
+                mode: flags.mode,
                 quiet: flags.quiet,
             };
             await (0, desktopChatGuard_1.desktopChatGuardCommand)(args, config);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.19.0"
+  "version": "1.20.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {