fullcourtdefense-cli 1.20.1 → 1.21.1

package/dist/commands/daemon.js

@@ -758,14 +758,11 @@ async function runDaemon(args, config) {
             apiUrl: creds.apiUrl,
             shieldId: creds.shieldId,
             shieldKey: creds.shieldKey,
-            // Mode is resolved inside the guard: FCD_DESKTOP_CHAT_MODE env or the
-            // Local Safety snapshot's desktopChatMode hint; defaults to advisory warn.
-            mode: process.env.FCD_DESKTOP_CHAT_MODE,
             quiet,
             log,
         });
         if (desktopChatGuard)
-            log('Claude Desktop chat guard: supervising (warns, or blocks the Enter send if block mode is enabled, on secrets typed into Claude Desktop).');
+            log('Claude Desktop chat guard: supervising (advisory — warns on secrets typed into Claude Desktop).');
     }
     // Fresh machines have never uploaded an inventory (MSI/onboard defers the
     // initial discovery to keep setup fast), so the dashboard shows "Never" for

package/dist/commands/desktopChatGuard.d.ts

@@ -1,67 +1,23 @@
 import { BotGuardConfig } from '../config';
-import { LocalSafetySnapshot } from '../localSafetySnapshot';
-/**
- * Claude Desktop chat guard (Windows).
- *
- * Claude Desktop's regular chat sends prompts straight to Anthropic's API — it
- * exposes no hook and never touches an MCP server, so neither the Claude-format
- * hooks nor the MCP gateway can see what a developer types there. This guard
- * closes that blind spot with the SAME on-device deterministic engine used
- * everywhere else (scanDeterministicPrompt).
- *
- * Two modes:
- *   - warn  (default): advisory. A PowerShell UI Automation watcher reads the
- *     focused Claude input, this process scans it locally, and on a finding it
- *     toasts + reports a monitor event. No keyboard hook, no input mutation —
- *     cannot break typing, no keylogger surface.
- *   - block (org-policy opt-in): everything warn does, PLUS the watcher installs
- *     a low-level keyboard hook that swallows the Enter "send" while a secret is
- *     in the box, so the prompt cannot be sent to Anthropic.
- *
- * Safety model (why this cannot freeze/crash a machine):
- *   1. ALL native code (the keyboard hook + its message pump) runs in the CHILD
- *      PowerShell process. The Node daemon only does a fast regex scan and a
- *      tiny file write; it is never in the keystroke hot path.
- *   2. The hook callback does only a volatile-timestamp read + a cheap
- *      foreground check, returning in microseconds — far under Windows'
- *      LowLevelHooksTimeout. A slow LL hook is silently removed by Windows
- *      (keys pass through); it FAILS OPEN, it never freezes the keyboard.
- *   3. The block is armed as a short time WINDOW (auto-expires ~2s after the
- *      last detection). If the daemon dies, stops arming, or the child is
- *      killed, Enter is released within ~2s — the keyboard can never get stuck.
- *   4. block mode is OFF by default; the hook is only installed when an org
- *      opts in, so the default fleet behavior is the risk-free advisory mode.
- *   5. Detection stays 100% in the shared Node deterministicGuard (single
- *      source of truth); the child never re-implements detection.
- *
- * Text is scanned in-process and never uploaded — only finding metadata (item
- * id + masked value) is spooled.
- */
-export type DesktopChatMode = 'warn' | 'block';
 export interface DesktopChatGuardArgs {
     apiUrl?: string;
     shieldId?: string;
     shieldKey?: string;
-    /** 'warn' (default) or 'block'. */
-    mode?: string;
     /** Suppress OS toasts (still spools findings). */
     quiet?: string;
 }
-/** Only meaningful where Claude Desktop runs and UI Automation is available. */
+/** Only meaningful where Claude Desktop runs and MSAA is available. */
 export declare function desktopChatGuardSupported(): boolean;
-/** Resolve the effective mode: explicit arg > env > snapshot hint > 'warn'. */
-export declare function resolveDesktopChatMode(explicit?: string, snapshot?: LocalSafetySnapshot): DesktopChatMode;
 /** True when the guard reported itself healthy within the last `withinMs`. */
 export declare function desktopChatGuardHealthy(withinMs?: number): boolean;
 /**
- * The PowerShell watcher. Reads ONLY the focused element of the foreground
- * Claude process (never the transcript), so it is low-noise and resilient to
- * Claude UI changes. Emits `FCD:<base64 utf8>` lines on stdout when the text
- * changes. In block mode it also compiles the keyboard-hook helper and, each
- * cycle, reads the arm file Node maintains to arm/expire the Enter block.
- * Everything is wrapped in try/catch — it must never crash the host.
+ * The PowerShell watcher. Compiles a tiny MSAA reader (C# via Add-Type using
+ * the .NET Framework compiler built into Windows), then — only while Claude is
+ * the foreground process — reads the composer's editable text and emits
+ * `FCD:<base64 utf8>` on stdout when it changes. Everything is wrapped in
+ * try/catch — it must never crash the host.
  */
-export declare function desktopChatWatcherScript(mode?: DesktopChatMode): string;
+export declare function desktopChatWatcherScript(): string;
 /** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
 export declare function decodeWatcherLine(line: string): string | undefined;
 export interface DesktopChatGuardHandle {
@@ -71,19 +27,18 @@ interface GuardRuntime {
     apiUrl: string;
     shieldId?: string;
     shieldKey?: string;
-    mode?: string;
     quiet: boolean;
     log: (msg: string) => void;
 }
 /**
- * Start the guard. Returns a handle whose stop() tears down the watcher and
- * timers. Safe no-op (returns undefined) on unsupported platforms.
+ * Start the advisory guard. Returns a handle whose stop() tears down the
+ * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
  */
 export declare function startDesktopChatGuard(runtime: GuardRuntime): DesktopChatGuardHandle | undefined;
 /**
- * Foreground `desktop-chat-guard` command — runs the guard in this process
- * until interrupted. Useful for manual testing (e.g. `--mode block`); in
- * production the daemon supervises the guard in-process.
+ * Foreground `desktop-chat-guard` command — runs the advisory guard in this
+ * process until interrupted. Mostly for manual testing; in production the
+ * daemon supervises the guard in-process (startDesktopChatGuard).
  */
 export declare function desktopChatGuardCommand(args: DesktopChatGuardArgs, config: BotGuardConfig): Promise<void>;
 export {};

package/dist/commands/desktopChatGuard.js

@@ -34,7 +34,6 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.desktopChatGuardSupported = desktopChatGuardSupported;
-exports.resolveDesktopChatMode = resolveDesktopChatMode;
 exports.desktopChatGuardHealthy = desktopChatGuardHealthy;
 exports.desktopChatWatcherScript = desktopChatWatcherScript;
 exports.decodeWatcherLine = decodeWatcherLine;
@@ -52,15 +51,44 @@ const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const machineIdentity_1 = require("../machineIdentity");
 const discoverPaths_1 = require("./discoverPaths");
+/**
+ * Claude Desktop chat guard (Windows, advisory).
+ *
+ * Claude Desktop's regular chat sends prompts straight to Anthropic's API — it
+ * exposes no hook and never touches an MCP server, so neither the Claude-format
+ * hooks nor the MCP gateway can see what a developer types there. This guard
+ * closes that blind spot with the SAME on-device deterministic engine used
+ * everywhere else (scanDeterministicPrompt).
+ *
+ * Reading the composer — why MSAA, not UI Automation:
+ *   Claude Desktop is Electron/Chromium. Chromium's UI Automation support is
+ *   "very limited" (their own docs) — the ProseMirror composer's text is never
+ *   exposed through UIA Value/Text patterns (verified: a typed marker never
+ *   appears in any UIA node). Chromium DOES fully implement MSAA/IAccessible
+ *   (the API screen readers use). So the watcher reads the composer via
+ *   oleacc's AccessibleObjectFromWindow on the Chrome_RenderWidgetHostHWND
+ *   child window, walks the accessible tree, and reads accValue of the editable
+ *   text node (ROLE_SYSTEM_TEXT). The AccessibleObjectFromWindow call itself
+ *   wakes Chromium's accessibility tree, so no --force-renderer-accessibility
+ *   or WM_GETOBJECT dance is needed.
+ *
+ * Advisory ONLY: no keyboard hook, no input mutation, no keystroke capture. It
+ * reads only the composer text of Claude Desktop's own window (scoped to the
+ * "Claude" process — never any other application), scans it in-process, and —
+ * on a finding — shows a native toast and reports a monitor event to the fleet.
+ * Text is never uploaded; only finding metadata (item id + masked value) is
+ * spooled. It cannot break typing and presents no keylogger surface.
+ *
+ * Deliberately NOT gated on the foreground window: a foreground check goes blind
+ * the instant the user alt-tabs after typing, and MSAA reads Claude's composer
+ * whether or not Claude is focused. Scoping to the Claude process (not the
+ * active window) is what keeps this from ever reading other apps.
+ */
 const WATCHER_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-claude-desktop-watcher.ps1');
 const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-guard.json');
-/** Node writes an epoch-ms "block until" here; the watcher reads it each cycle. */
-const ARM_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-arm');
 const STDOUT_PREFIX = 'FCD:';
-/** Poll cadence for the foreground/focused-element read (ms). */
-const POLL_MS = 250;
-/** How long each detection arms the Enter block (auto-expiry safety valve). */
-const ARM_WINDOW_MS = 2_000;
+/** Poll cadence for the composer read (ms). */
+const POLL_MS = 800;
 /** Don't re-toast the same finding value more often than this. */
 const TOAST_DEBOUNCE_MS = 60_000;
 /** Refresh the cached Local Safety snapshot on this cadence. */
@@ -68,16 +96,10 @@ const SNAPSHOT_REFRESH_MS = 5 * 60_000;
 /** Watcher restart backoff bounds. */
 const RESTART_MIN_MS = 2_000;
 const RESTART_MAX_MS = 30_000;
-/** Only meaningful where Claude Desktop runs and UI Automation is available. */
+/** Only meaningful where Claude Desktop runs and MSAA is available. */
 function desktopChatGuardSupported() {
     return process.platform === 'win32' && (0, discoverPaths_1.claudeDesktopLikelyInstalled)();
 }
-/** Resolve the effective mode: explicit arg > env > snapshot hint > 'warn'. */
-function resolveDesktopChatMode(explicit, snapshot) {
-    const raw = (explicit || process.env.FCD_DESKTOP_CHAT_MODE || snapshot?.desktopChatMode || 'warn')
-        .toString().toLowerCase();
-    return raw === 'block' ? 'block' : 'warn';
-}
 function mask(value) {
     const v = String(value || '');
     if (v.length <= 8)
@@ -103,158 +125,120 @@ function desktopChatGuardHealthy(withinMs = 15 * 60_000) {
         return false;
     }
 }
-/** Escape a JS string for embedding in a PowerShell single-quoted literal. */
-function psSingle(value) {
-    return value.replace(/'/g, "''");
-}
 /**
- * The C# helper (compiled by Add-Type in the child) that owns the low-level
- * keyboard hook. Only used in block mode. Design notes are in the file header:
- * the callback is trivial (a volatile timestamp read + foreground check), the
- * block auto-expires, and a periodic reinstall on the pump thread recovers from
- * Windows silently removing the hook under sustained load.
+ * The PowerShell watcher. Compiles a tiny MSAA reader (C# via Add-Type using
+ * the .NET Framework compiler built into Windows), then — only while Claude is
+ * the foreground process — reads the composer's editable text and emits
+ * `FCD:<base64 utf8>` on stdout when it changes. Everything is wrapped in
+ * try/catch — it must never crash the host.
  */
-function keyboardHookCSharp() {
+function desktopChatWatcherScript() {
     return [
+        "$ErrorActionPreference = 'SilentlyContinue'",
+        '[void][System.Reflection.Assembly]::LoadWithPartialName(\'Accessibility\')',
+        'try {',
+        "  Add-Type -ReferencedAssemblies 'Accessibility' -TypeDefinition @'",
         'using System;',
+        'using System.Text;',
+        'using System.Collections.Generic;',
         'using System.Runtime.InteropServices;',
-        'using System.Threading;',
-        'using System.Diagnostics;',
-        'public static class FcdKbGuard {',
-        '  private const int WH_KEYBOARD_LL = 13;',
-        '  private const int WM_KEYDOWN = 0x0100;',
-        '  private const int WM_SYSKEYDOWN = 0x0104;',
-        '  private const uint VK_RETURN = 0x0D;',
-        '  private const int VK_SHIFT = 0x10;',
-        '  private const uint PM_REMOVE = 0x0001;',
-        '  [StructLayout(LayoutKind.Sequential)] private struct KBDLLHOOKSTRUCT { public uint vkCode; public uint scanCode; public uint flags; public uint time; public IntPtr dwExtraInfo; }',
-        '  [StructLayout(LayoutKind.Sequential)] private struct MSG { public IntPtr hwnd; public uint message; public IntPtr wParam; public IntPtr lParam; public uint time; public int ptx; public int pty; }',
-        '  private delegate IntPtr HookProc(int nCode, IntPtr wParam, IntPtr lParam);',
-        '  [DllImport("user32.dll", SetLastError=true)] private static extern IntPtr SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hMod, uint dwThreadId);',
-        '  [DllImport("user32.dll", SetLastError=true)] private static extern bool UnhookWindowsHookEx(IntPtr hhk);',
-        '  [DllImport("user32.dll")] private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);',
-        '  [DllImport("user32.dll")] private static extern short GetKeyState(int nVirtKey);',
-        '  [DllImport("user32.dll")] private static extern IntPtr GetForegroundWindow();',
-        '  [DllImport("user32.dll")] private static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint pid);',
-        '  [DllImport("kernel32.dll")] private static extern IntPtr GetModuleHandle(string name);',
-        '  [DllImport("user32.dll")] private static extern bool PeekMessage(out MSG msg, IntPtr hWnd, uint min, uint max, uint remove);',
-        '  private static IntPtr _hook = IntPtr.Zero;',
-        '  private static HookProc _proc;',
-        '  private static long _blockUntil = 0;',
-        '  private static long _blocked = 0;',
-        '  private static volatile bool _running = false;',
-        '  public static void ArmFor(long ms) { Interlocked.Exchange(ref _blockUntil, DateTime.UtcNow.Ticks + ms * TimeSpan.TicksPerMillisecond); }',
-        '  public static void Clear() { Interlocked.Exchange(ref _blockUntil, 0); }',
-        '  public static long Blocked() { return Interlocked.Read(ref _blocked); }',
-        '  private static bool ForegroundIsClaude() {',
-        '    try {',
-        '      IntPtr h = GetForegroundWindow(); if (h == IntPtr.Zero) return false;',
-        '      uint pid; GetWindowThreadProcessId(h, out pid); if (pid == 0) return false;',
-        '      Process p = Process.GetProcessById((int)pid);',
-        '      return p != null && string.Equals(p.ProcessName, "Claude", StringComparison.OrdinalIgnoreCase);',
-        '    } catch { return false; }',
+        'using Accessibility;',
+        'public static class FcdMsaa {',
+        '  const uint OBJID_CLIENT = 0xFFFFFFFC;',
+        '  const int ROLE_TEXT = 0x2A;',
+        '  static Guid IID_IAccessible = new Guid("618736e0-3c3d-11cf-810c-00aa00389b71");',
+        '  [DllImport("oleacc.dll")] static extern int AccessibleObjectFromWindow(IntPtr hwnd, uint id, ref Guid iid, [MarshalAs(UnmanagedType.Interface)] out object ppv);',
+        '  [DllImport("oleacc.dll")] static extern int AccessibleChildren(IAccessible acc, int start, int count, [Out] object[] kids, out int got);',
+        '  [DllImport("user32.dll")] static extern bool EnumWindows(EnumProc cb, IntPtr p);',
+        '  [DllImport("user32.dll")] static extern bool EnumChildWindows(IntPtr parent, EnumProc cb, IntPtr p);',
+        '  [DllImport("user32.dll")] static extern int GetClassName(IntPtr h, StringBuilder sb, int max);',
+        '  [DllImport("user32.dll")] static extern int GetWindowText(IntPtr h, StringBuilder sb, int max);',
+        '  [DllImport("user32.dll")] static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);',
+        '  public delegate bool EnumProc(IntPtr h, IntPtr p);',
+        '  public static IntPtr FindMain(HashSet<uint> pids) {',
+        '    IntPtr result = IntPtr.Zero;',
+        '    EnumWindows((h, p) => {',
+        '      uint pid; GetWindowThreadProcessId(h, out pid);',
+        '      if (pids.Contains(pid)) {',
+        '        var cn = new StringBuilder(256); GetClassName(h, cn, 256);',
+        '        var tt = new StringBuilder(256); GetWindowText(h, tt, 256);',
+        '        if (cn.ToString().StartsWith("Chrome_WidgetWin_1") && tt.ToString().Trim().Length > 0) { result = h; return false; }',
+        '      }',
+        '      return true;',
+        '    }, IntPtr.Zero);',
+        '    return result;',
         '  }',
-        '  private static IntPtr Callback(int nCode, IntPtr wParam, IntPtr lParam) {',
+        '  static List<IntPtr> Widgets(IntPtr parent) {',
+        '    var l = new List<IntPtr>();',
+        '    EnumChildWindows(parent, (h, p) => {',
+        '      var cn = new StringBuilder(256); GetClassName(h, cn, 256);',
+        '      if (cn.ToString().StartsWith("Chrome_RenderWidgetHostHWND")) l.Add(h);',
+        '      return true;',
+        '    }, IntPtr.Zero);',
+        '    return l;',
+        '  }',
+        '  static void Walk(IAccessible acc, List<string> outp, int depth, int[] budget) {',
+        '    if (acc == null || depth > 40 || budget[0] <= 0) return; budget[0]--;',
         '    try {',
-        '      if (nCode >= 0) {',
-        '        int m = wParam.ToInt32();',
-        '        if (m == WM_KEYDOWN || m == WM_SYSKEYDOWN) {',
-        '          KBDLLHOOKSTRUCT k = (KBDLLHOOKSTRUCT)Marshal.PtrToStructure(lParam, typeof(KBDLLHOOKSTRUCT));',
-        '          if (k.vkCode == VK_RETURN) {',
-        '            bool shift = (GetKeyState(VK_SHIFT) & 0x8000) != 0;',
-        '            if (!shift && DateTime.UtcNow.Ticks < Interlocked.Read(ref _blockUntil) && ForegroundIsClaude()) {',
-        '              Interlocked.Increment(ref _blocked);',
-        '              return (IntPtr)1;',
-        '            }',
-        '          }',
-        '        }',
+        '      object self = 0; int role = 0;',
+        '      try { role = Convert.ToInt32(acc.get_accRole(self)); } catch {}',
+        '      if (role == ROLE_TEXT) {',
+        '        string v = null; try { v = acc.get_accValue(self); } catch {}',
+        '        if (!string.IsNullOrEmpty(v)) outp.Add(v);',
         '      }',
-        '    } catch { }',
-        '    return CallNextHookEx(_hook, nCode, wParam, lParam);',
+        '    } catch {}',
+        '    int count = 0; try { count = acc.accChildCount; } catch { return; }',
+        '    if (count <= 0) return;',
+        '    var kids = new object[count]; int got = 0;',
+        '    try { AccessibleChildren(acc, 0, count, kids, out got); } catch { return; }',
+        '    for (int i = 0; i < got; i++) { var ka = kids[i] as IAccessible; if (ka != null) Walk(ka, outp, depth + 1, budget); }',
         '  }',
-        '  public static void Start() {',
-        '    if (_running) return; _running = true; _proc = Callback;',
-        '    Thread t = new Thread(delegate() {',
-        '      _hook = SetWindowsHookEx(WH_KEYBOARD_LL, _proc, GetModuleHandle(null), 0);',
-        '      int lastReinstall = Environment.TickCount;',
-        '      MSG msg;',
-        '      while (_running) {',
-        '        while (PeekMessage(out msg, IntPtr.Zero, 0, 0, PM_REMOVE)) { }',
-        '        Thread.Sleep(10);',
-        '        if (Environment.TickCount - lastReinstall > 60000) {',
-        '          try { if (_hook != IntPtr.Zero) UnhookWindowsHookEx(_hook); } catch { }',
-        '          _hook = SetWindowsHookEx(WH_KEYBOARD_LL, _proc, GetModuleHandle(null), 0);',
-        '          lastReinstall = Environment.TickCount;',
-        '        }',
-        '      }',
-        '      try { if (_hook != IntPtr.Zero) UnhookWindowsHookEx(_hook); } catch { }',
-        '      _hook = IntPtr.Zero;',
-        '    });',
-        '    t.IsBackground = true; t.Start();',
+        '  public static string[] ReadComposer(IntPtr main) {',
+        '    var outp = new List<string>();',
+        '    foreach (var w in Widgets(main)) {',
+        '      object o; int hr = AccessibleObjectFromWindow(w, OBJID_CLIENT, ref IID_IAccessible, out o);',
+        '      if (hr != 0 || o == null) continue;',
+        '      var acc = o as IAccessible; if (acc == null) continue;',
+        '      var budget = new int[] { 5000 };',
+        '      Walk(acc, outp, 0, budget);',
+        '    }',
+        '    return outp.ToArray();',
         '  }',
-        '  public static void Stop() { _running = false; }',
         '}',
-    ].join('\n');
-}
-/**
- * The PowerShell watcher. Reads ONLY the focused element of the foreground
- * Claude process (never the transcript), so it is low-noise and resilient to
- * Claude UI changes. Emits `FCD:<base64 utf8>` lines on stdout when the text
- * changes. In block mode it also compiles the keyboard-hook helper and, each
- * cycle, reads the arm file Node maintains to arm/expire the Enter block.
- * Everything is wrapped in try/catch — it must never crash the host.
- */
-function desktopChatWatcherScript(mode = 'warn') {
-    const armPathLiteral = psSingle(ARM_PATH);
-    const lines = [
-        "$ErrorActionPreference = 'SilentlyContinue'",
-        'try {',
-        '  Add-Type -AssemblyName UIAutomationClient,UIAutomationTypes,WindowsBase | Out-Null',
+        "'@",
         '} catch { }',
-        'try {',
-        '  Add-Type -TypeDefinition @"',
-        'using System;',
-        'using System.Runtime.InteropServices;',
-        'public static class FcdWin {',
-        '  [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();',
-        '  [DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint pid);',
+        '',
+        '$last = ""',
+        'while ($true) {',
+        '  Start-Sleep -Milliseconds ' + POLL_MS,
+        '  try {',
+        '    $pids = New-Object \'System.Collections.Generic.HashSet[uint32]\'',
+        "    Get-Process -Name 'Claude' -ErrorAction SilentlyContinue | ForEach-Object { [void]$pids.Add([uint32]$_.Id) }",
+        '    if ($pids.Count -eq 0) { continue }',
+        '    $main = [FcdMsaa]::FindMain($pids)',
+        '    if ($main -eq [IntPtr]::Zero) { continue }',
+        '    $vals = [FcdMsaa]::ReadComposer($main)',
+        '    if ($null -eq $vals -or $vals.Count -eq 0) { continue }',
+        '    $parts = @()',
+        '    foreach ($v in $vals) {',
+        "      if ([string]::IsNullOrEmpty($v)) { continue }",
+        "      if ($v -eq 'Write a message.') { continue }",
+        '      if ($v.Length -gt 8000) { continue }',
+        '      $parts += $v',
+        '    }',
+        '    if ($parts.Count -eq 0) { continue }',
+        "    $joined = [string]::Join(\"`n\", $parts)",
+        '    if ([string]::IsNullOrEmpty($joined)) { continue }',
+        '    if ($joined -eq $last) { continue }',
+        '    $last = $joined',
+        '    $bytes = [System.Text.Encoding]::UTF8.GetBytes($joined)',
+        '    $b64 = [Convert]::ToBase64String($bytes)',
+        "    [Console]::Out.WriteLine('" + STDOUT_PREFIX + "' + $b64)",
+        '    [Console]::Out.Flush()',
+        '  } catch { }',
         '}',
-        '"@',
-        '} catch { }',
-    ];
-    if (mode === 'block') {
-        // The keyboard-hook helper is compiled at runtime by Add-Type using the C#
-        // compiler built into the .NET Framework (a core Windows component — no SDK
-        // or dev tools needed). If that ever fails on a locked-down machine, the
-        // catch leaves $global:FcdBlockReady false and the guard silently degrades
-        // to advisory warn mode: it still reads text, detects, toasts, and reports.
-        lines.push('$global:FcdBlockReady = $false');
-        lines.push(`$global:FcdArmPath = '${armPathLiteral}'`);
-        lines.push('try {');
-        lines.push("  Add-Type -TypeDefinition @'");
-        for (const l of keyboardHookCSharp().split('\n'))
-            lines.push(l);
-        lines.push("'@");
-        lines.push('  [FcdKbGuard]::Start()');
-        lines.push('  $global:FcdBlockReady = $true');
-        lines.push('} catch { $global:FcdBlockReady = $false }');
-    }
-    lines.push('', 'function Get-FcdFocusedText {', '  param([int]$OwnerPid)', '  try {', '    $focused = [System.Windows.Automation.AutomationElement]::FocusedElement', '    if ($null -eq $focused) { return $null }', '    if ($focused.Current.ProcessId -ne $OwnerPid) { return $null }', '    $text = $null', '    $vp = $null', '    if ($focused.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$vp)) {', '      $text = $vp.Current.Value', '    }', '    if ([string]::IsNullOrEmpty($text)) {', '      $tp = $null', '      if ($focused.TryGetCurrentPattern([System.Windows.Automation.TextPattern]::Pattern, [ref]$tp)) {', '        $text = $tp.DocumentRange.GetText(20000)', '      }', '    }', '    if ([string]::IsNullOrEmpty($text)) { $text = $focused.Current.Name }', '    return $text', '  } catch { return $null }', '}', '', '$last = ""', 'while ($true) {', '  Start-Sleep -Milliseconds ' + POLL_MS);
-    if (mode === 'block') {
-        // Arm/expire the Enter block from the file Node maintains. The C# side
-        // auto-expires too, so a missed cycle just releases the block early.
-        lines.push('  if ($global:FcdBlockReady) {');
-        lines.push('    try {');
-        lines.push('      if (Test-Path $global:FcdArmPath) {');
-        lines.push('        $armUntil = [long](Get-Content -Raw -Path $global:FcdArmPath)');
-        lines.push('        $nowMs = [long]([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds())');
-        lines.push('        if ($armUntil -gt $nowMs) { [FcdKbGuard]::ArmFor($armUntil - $nowMs) } else { [FcdKbGuard]::Clear() }');
-        lines.push('      } else { [FcdKbGuard]::Clear() }');
-        lines.push('    } catch { }');
-        lines.push('  }');
-    }
-    lines.push('  try {', '    $h = [FcdWin]::GetForegroundWindow()', '    if ($h -eq [IntPtr]::Zero) { continue }', '    $procId = 0', '    [void][FcdWin]::GetWindowThreadProcessId($h, [ref]$procId)', '    if ($procId -eq 0) { continue }', '    $proc = Get-Process -Id $procId -ErrorAction SilentlyContinue', "    if ($null -eq $proc -or $proc.ProcessName -ne 'Claude') { continue }", '    $text = Get-FcdFocusedText -OwnerPid $procId', '    if ([string]::IsNullOrEmpty($text)) { continue }', '    if ($text.Length -gt 8000) { continue }', '    if ($text -eq $last) { continue }', '    $last = $text', '    $bytes = [System.Text.Encoding]::UTF8.GetBytes($text)', '    $b64 = [Convert]::ToBase64String($bytes)', "    [Console]::Out.WriteLine('" + STDOUT_PREFIX + "' + $b64)", '    [Console]::Out.Flush()', '  } catch { }', '}', '');
-    return lines.join('\n');
+        '',
+    ].join('\n');
 }
 /** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
 function decodeWatcherLine(line) {
@@ -267,27 +251,13 @@ function decodeWatcherLine(line) {
         return undefined;
     }
 }
-function ensureWatcherScript(mode) {
-    fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(mode), { encoding: 'utf8' });
+function ensureWatcherScript() {
+    fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(), { encoding: 'utf8' });
     return WATCHER_PS1_PATH;
 }
-/** Arm the Enter block for the standard window (block mode only). */
-function armBlock() {
-    try {
-        fs.mkdirSync(path.dirname(ARM_PATH), { recursive: true });
-        fs.writeFileSync(ARM_PATH, String(Date.now() + ARM_WINDOW_MS), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch { /* best-effort — the C# side still auto-expires */ }
-}
-function clearArm() {
-    try {
-        fs.unlinkSync(ARM_PATH);
-    }
-    catch { /* not armed */ }
-}
 /**
- * Start the guard. Returns a handle whose stop() tears down the watcher and
- * timers. Safe no-op (returns undefined) on unsupported platforms.
+ * Start the advisory guard. Returns a handle whose stop() tears down the
+ * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
  */
 function startDesktopChatGuard(runtime) {
     if (!desktopChatGuardSupported())
@@ -298,12 +268,9 @@ function startDesktopChatGuard(runtime) {
     let restartTimer;
     let restartDelay = RESTART_MIN_MS;
     let findings = 0;
-    let blocksArmed = 0;
     const lastToastAt = new Map();
     let scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(undefined);
-    let mode = resolveDesktopChatMode(runtime.mode);
     const identity = (0, machineIdentity_1.getMachineIdentity)();
-    clearArm(); // never start with a stale armed window
     const refreshSnapshot = async () => {
         if (!runtime.shieldId)
             return;
@@ -316,17 +283,12 @@ function startDesktopChatGuard(runtime) {
                 machineName: identity.hostname,
             });
             scanOptions = (0, localSafetySnapshot_1.snapshotToScanOptions)(snapshot);
-            // Mode can be flipped centrally (snapshot) unless pinned by arg/env.
-            mode = resolveDesktopChatMode(runtime.mode, snapshot);
         }
-        catch { /* offline — keep last options/mode */ }
+        catch { /* offline — keep last options */ }
     };
-    // heartbeatAt lets the daemon/console tell "guard alive" from "stale".
     const heartbeat = () => writeStatus({
         running: !stopped,
-        mode,
         findings,
-        blocksArmed,
         startedAt,
         heartbeatAt: new Date().toISOString(),
     });
@@ -334,26 +296,19 @@ function startDesktopChatGuard(runtime) {
         if (!text.trim())
             return;
         const finding = (0, deterministicGuard_1.scanDeterministicPrompt)(text, scanOptions);
-        if (!finding) {
-            // No secret in the box → make sure the Enter block is not armed.
-            if (mode === 'block')
-                clearArm();
+        if (!finding)
             return;
-        }
         findings += 1;
         const masked = mask(finding.evidence || '');
-        const blocking = mode === 'block';
-        if (blocking) {
-            armBlock();
-            blocksArmed += 1;
-        }
         heartbeat();
+        // Monitor semantics: advisory phase never blocks, so the decision is
+        // 'allow' with a "would block" evidence note (same shape shell-guard uses
+        // in monitor mode), which the Activity log renders as a monitor finding.
         (0, telemetry_1.spoolEvent)({
-            // block mode enforces (Enter is swallowed); warn mode is monitor-only.
-            decision: blocking ? 'block' : 'allow',
+            decision: 'allow',
             toolName: 'claude_desktop_chat',
             operation: 'prompt',
-            reason: blocking ? finding.reason : `would block: ${finding.reason}`,
+            reason: `would block: ${finding.reason}`,
             ruleId: finding.ruleId,
             category: finding.category,
             categoryId: finding.categoryId,
@@ -370,20 +325,18 @@ function startDesktopChatGuard(runtime) {
         if (!runtime.quiet && now - last > TOAST_DEBOUNCE_MS) {
             lastToastAt.set(key, now);
             (0, notify_1.notifyOs)({
-                title: blocking ? 'FullCourtDefense: blocked in Claude Desktop' : 'FullCourtDefense: secret in Claude Desktop',
-                message: blocking
-                    ? `${finding.reason}. Sending is blocked — remove it to continue.`
-                    : `${finding.reason}. Remove it before sending — this text has not been protected.`,
+                title: 'FullCourtDefense: secret in Claude Desktop',
+                message: `${finding.reason}. Remove it before sending — this text has not been protected.`,
             });
         }
-        runtime.log(`Claude Desktop chat ${blocking ? 'block' : 'finding'}: ${finding.itemId} (${finding.reason}).`);
+        runtime.log(`Claude Desktop chat finding: ${finding.itemId} (${finding.reason}).`);
     };
     const spawnWatcher = () => {
         if (stopped)
             return;
         let scriptPath;
         try {
-            scriptPath = ensureWatcherScript(mode);
+            scriptPath = ensureWatcherScript();
         }
         catch (error) {
             runtime.log(`Claude Desktop guard: cannot write watcher script: ${error.message}`);
@@ -405,12 +358,11 @@ function startDesktopChatGuard(runtime) {
             restartDelay = RESTART_MIN_MS; // healthy output resets backoff
             handleText(text);
         });
-        child.on('exit', () => { rl.close(); if (mode === 'block')
-            clearArm(); if (!stopped)
+        child.on('exit', () => { rl.close(); if (!stopped)
             scheduleRestart(); });
         child.on('error', () => { if (!stopped)
             scheduleRestart(); });
-        runtime.log(`Claude Desktop chat guard: watcher started (${mode}).`);
+        runtime.log('Claude Desktop chat guard: watcher started (advisory).');
         heartbeat();
     };
     const scheduleRestart = () => {
@@ -437,19 +389,18 @@ function startDesktopChatGuard(runtime) {
                 clearTimeout(restartTimer);
                 restartTimer = undefined;
             }
-            clearArm(); // release any armed Enter block immediately
             try {
                 child?.kill();
             }
             catch { /* ignore */ }
-            writeStatus({ running: false, mode, findings, blocksArmed, startedAt });
+            writeStatus({ running: false, findings, startedAt });
         },
     };
 }
 /**
- * Foreground `desktop-chat-guard` command — runs the guard in this process
- * until interrupted. Useful for manual testing (e.g. `--mode block`); in
- * production the daemon supervises the guard in-process.
+ * Foreground `desktop-chat-guard` command — runs the advisory guard in this
+ * process until interrupted. Mostly for manual testing; in production the
+ * daemon supervises the guard in-process (startDesktopChatGuard).
  */
 async function desktopChatGuardCommand(args, config) {
     if (process.platform !== 'win32') {
@@ -469,7 +420,6 @@ async function desktopChatGuardCommand(args, config) {
         apiUrl: creds.apiUrl,
         shieldId: creds.shieldId,
         shieldKey: creds.shieldKey,
-        mode: args.mode,
         quiet: args.quiet === 'true',
         log: (msg) => console.log(msg),
     });
@@ -477,10 +427,7 @@ async function desktopChatGuardCommand(args, config) {
         console.error('Claude Desktop chat guard is not supported on this machine.');
         process.exit(1);
     }
-    const mode = resolveDesktopChatMode(args.mode);
-    console.log(`FullCourtDefense Claude Desktop chat guard running (${mode}). Stop with Ctrl+C.`);
-    if (mode === 'block')
-        console.log('Block mode: pressing Enter to send a message that contains a secret will be prevented while Claude Desktop is focused.');
+    console.log('FullCourtDefense Claude Desktop chat guard running (advisory). Stop with Ctrl+C.');
     const shutdown = () => { handle.stop(); process.exit(0); };
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);

package/dist/commands/hook.js

@@ -593,10 +593,18 @@ async function hookCommand(args, config) {
                 decision.agent_message = agentMsg;
         }
         dbg({ phase: 'verdict', event, format: hookFormat, blocked, decision });
+        if (hookFormat === 'claude' && event === 'prompt' && blocked) {
+            // Claude Desktop/Code variants do not all honor the structured
+            // UserPromptSubmit decision consistently. Exit 2 is the documented hard
+            // block contract: stderr is shown as the rejection reason and the prompt
+            // is not sent to the model.
+            process.stderr.write(userMsg || agentMsg || 'Blocked by FullCourtDefense.');
+            process.exit(2);
+        }
         process.stdout.write(JSON.stringify(decision));
-        // ALWAYS exit 0 so the client uses our JSON verdict. Exit 2 is interpreted as
-        // `permission: "deny"`, which beforeSubmitPrompt ignores (it uses `continue`),
-        // so exiting 2 would silently let blocked prompts through.
+        // Cursor must exit 0 so it consumes the JSON verdict. In particular,
+        // beforeSubmitPrompt ignores an exit-2 permission denial and uses
+        // `{ continue: false }`.
         process.exit(0);
     };
     // Claude-format lifecycle events with no pre-execution surface (PostToolUse,

package/dist/commands/installClaudeHook.js

@@ -253,7 +253,7 @@ async function installClaudeHookCommand(args, config) {
     console.log(`${COLOR.gray}Scope:${COLOR.reset} ${projectScope ? 'project (.claude/settings.json)' : 'machine-wide (~/.claude/settings.json)'}`);
     console.log(`${COLOR.gray}File:${COLOR.reset}  ${file}`);
     console.log(`${COLOR.gray}Covers:${COLOR.reset} Claude Code, VS Code Copilot agent mode, GitHub Copilot CLI (all read this file)`);
-    console.log(`${COLOR.gray}Note:${COLOR.reset} Claude Desktop's regular chat has no hook — it is protected separately by the Windows chat guard the daemon runs (warns on secrets; can block the send in block mode).`);
+    console.log(`${COLOR.gray}Note:${COLOR.reset} Claude Desktop's regular chat has no hook — it is protected separately by the Windows chat guard the daemon runs (advisory).`);
     const parts = [];
     if (wantTools)
         parts.push('tool calls (shell / MCP / file writes / reads) checked against org Action Policies + Local Safety rules');

package/dist/index.js

@@ -851,7 +851,6 @@ async function main() {
                 apiUrl: flags['api-url'],
                 shieldId: flags['shield-id'],
                 shieldKey: flags['shield-key'],
-                mode: flags.mode,
                 quiet: flags.quiet,
             };
             await (0, desktopChatGuard_1.desktopChatGuardCommand)(args, config);

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.20.1"
+  "version": "1.21.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.20.1",
+  "version": "1.21.1",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -15,7 +15,6 @@
   "scripts": {
     "build": "tsc && node scripts/copy-attack-corpus.js",
     "test:deterministic-guard": "npm run build && node scripts/test-deterministic-guard.js",
-    "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
     "test:taint-ledger": "npm run build && node scripts/test-taint-ledger.js",
     "test:shell-audit": "npm run build && node scripts/test-shell-audit.js",
     "test:shell-guard": "npm run build && node scripts/test-shell-guard.js",
@@ -35,6 +34,7 @@
     "test:integrity": "npm run build && node scripts/test-integrity.js",
     "test:posture-overhaul": "npm run build && node scripts/test-posture-overhaul.js",
     "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",
+    "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
     "prepublishOnly": "npm run build"
   },