fullcourtdefense-cli 1.21.2 → 1.21.3

package/dist/commands/desktopChatGuard.js

@@ -60,17 +60,20 @@ const discoverPaths_1 = require("./discoverPaths");
  * closes that blind spot with the SAME on-device deterministic engine used
  * everywhere else (scanDeterministicPrompt).
  *
- * Reading the composer — why MSAA, not UI Automation:
- *   Claude Desktop is Electron/Chromium. Chromium's UI Automation support is
- *   "very limited" (their own docs) — the ProseMirror composer's text is never
- *   exposed through UIA Value/Text patterns (verified: a typed marker never
- *   appears in any UIA node). Chromium DOES fully implement MSAA/IAccessible
- *   (the API screen readers use). So the watcher reads the composer via
- *   oleacc's AccessibleObjectFromWindow on the Chrome_RenderWidgetHostHWND
- *   child window, walks the accessible tree, and reads accValue of the editable
- *   text node (ROLE_SYSTEM_TEXT). The AccessibleObjectFromWindow call itself
- *   wakes Chromium's accessibility tree, so no --force-renderer-accessibility
- *   or WM_GETOBJECT dance is needed.
+ * Reading the composer — MSAA + forced renderer accessibility:
+ *   Claude Desktop is Electron/Chromium. Chromium keeps web-content
+ *   accessibility OFF until it detects assistive tech, and on current Claude
+ *   builds NONE of the passive wake signals work from outside the process
+ *   (verified against Claude 1.20186: WM_GETOBJECT for OBJID_CLIENT and for the
+ *   custom screen-reader object id 1, SPI_SETSCREENREADER, a UIA FindAll walk,
+ *   and an NVDA-style IServiceProvider->IAccessible2 handshake all leave the
+ *   web area empty). Chromium documents exactly one reliable switch: launch the
+ *   app with --force-renderer-accessibility. So the guard ensures Claude runs
+ *   with that flag (a one-time, throttled relaunch when the flag is absent),
+ *   after which the composer text is exposed via MSAA: oleacc's
+ *   AccessibleObjectFromWindow on the main Chrome_WidgetWin_1 window, walk the
+ *   IAccessible tree, read accValue of the editable text node (ROLE_SYSTEM_TEXT
+ *   / 0x2A). Once the flag is present the guard never touches Claude again.
  *
  * Advisory ONLY: no keyboard hook, no input mutation, no keystroke capture. It
  * reads only the composer text of Claude Desktop's own window (scoped to the
@@ -86,9 +89,18 @@ const discoverPaths_1 = require("./discoverPaths");
  */
 const WATCHER_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-claude-desktop-watcher.ps1');
 const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-guard.json');
+/** Throttle marker for the one-time --force-renderer-accessibility relaunch. */
+const A11Y_RELAUNCH_MARKER = path.join(os.homedir(), '.fullcourtdefense', 'claude-a11y-relaunch.json');
+/** Never relaunch Claude more than once per this window (a paste-time restart
+ *  is disruptive; once the flag sticks it survives until Claude next updates). */
+const A11Y_RELAUNCH_THROTTLE_MS = 6 * 60 * 60_000;
+/** How often to re-check that Claude is still running with the a11y flag. */
+const A11Y_CHECK_INTERVAL_MS = 5 * 60_000;
 const STDOUT_PREFIX = 'FCD:';
-/** Poll cadence for the composer read (ms). */
-const POLL_MS = 800;
+/** Poll cadence for the composer read (ms). 800ms lost the race against a
+ *  fast paste+Enter (the composer clears before the next read); 250ms is still
+ *  negligible CPU for one MSAA tree walk. */
+const POLL_MS = 250;
 /** Don't re-toast the same finding value more often than this. */
 const TOAST_DEBOUNCE_MS = 60_000;
 /** Refresh the cached Local Safety snapshot on this cadence. */
@@ -154,6 +166,8 @@ function desktopChatWatcherScript() {
         '  [DllImport("user32.dll")] static extern int GetClassName(IntPtr h, StringBuilder sb, int max);',
         '  [DllImport("user32.dll")] static extern int GetWindowText(IntPtr h, StringBuilder sb, int max);',
         '  [DllImport("user32.dll")] static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);',
+        '  [DllImport("user32.dll")] static extern IntPtr SendMessage(IntPtr h, uint msg, IntPtr wParam, IntPtr lParam);',
+        '  const uint WM_GETOBJECT = 0x003D;',
         '  public delegate bool EnumProc(IntPtr h, IntPtr p);',
         '  public static IntPtr FindMain(HashSet<uint> pids) {',
         '    IntPtr result = IntPtr.Zero;',
@@ -193,9 +207,17 @@ function desktopChatWatcherScript() {
         '    try { AccessibleChildren(acc, 0, count, kids, out got); } catch { return; }',
         '    for (int i = 0; i < got; i++) { var ka = kids[i] as IAccessible; if (ka != null) Walk(ka, outp, depth + 1, budget); }',
         '  }',
+        '  public static void Wake(IntPtr main) {',
+        '    // Newer Claude Desktop builds no longer enable renderer accessibility',
+        '    // from AccessibleObjectFromWindow alone; Chromium turns it on when it',
+        '    // observes WM_GETOBJECT for OBJID_CLIENT on the render widget.',
+        '    foreach (var w in Widgets(main)) SendMessage(w, WM_GETOBJECT, IntPtr.Zero, new IntPtr(unchecked((int)OBJID_CLIENT)));',
+        '    SendMessage(main, WM_GETOBJECT, IntPtr.Zero, new IntPtr(unchecked((int)OBJID_CLIENT)));',
+        '  }',
         '  public static string[] ReadComposer(IntPtr main) {',
         '    var outp = new List<string>();',
-        '    foreach (var w in Widgets(main)) {',
+        '    var targets = Widgets(main); targets.Add(main);',
+        '    foreach (var w in targets) {',
         '      object o; int hr = AccessibleObjectFromWindow(w, OBJID_CLIENT, ref IID_IAccessible, out o);',
         '      if (hr != 0 || o == null) continue;',
         '      var acc = o as IAccessible; if (acc == null) continue;',
@@ -209,6 +231,7 @@ function desktopChatWatcherScript() {
         '} catch { }',
         '',
         '$last = ""',
+        '$lastWake = [DateTime]::MinValue',
         'while ($true) {',
         '  Start-Sleep -Milliseconds ' + POLL_MS,
         '  try {',
@@ -217,6 +240,7 @@ function desktopChatWatcherScript() {
         '    if ($pids.Count -eq 0) { continue }',
         '    $main = [FcdMsaa]::FindMain($pids)',
         '    if ($main -eq [IntPtr]::Zero) { continue }',
+        '    if (([DateTime]::UtcNow - $lastWake).TotalSeconds -ge 30) { [FcdMsaa]::Wake($main); $lastWake = [DateTime]::UtcNow }',
         '    $vals = [FcdMsaa]::ReadComposer($main)',
         '    if ($null -eq $vals -or $vals.Count -eq 0) { continue }',
         '    $parts = @()',
@@ -255,6 +279,92 @@ function ensureWatcherScript() {
     fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(), { encoding: 'utf8' });
     return WATCHER_PS1_PATH;
 }
+function relaunchThrottleOk() {
+    try {
+        const last = JSON.parse(fs.readFileSync(A11Y_RELAUNCH_MARKER, 'utf8')).lastAttemptAt || 0;
+        return Date.now() - last > A11Y_RELAUNCH_THROTTLE_MS;
+    }
+    catch {
+        return true;
+    }
+}
+function stampRelaunch() {
+    try {
+        fs.mkdirSync(path.dirname(A11Y_RELAUNCH_MARKER), { recursive: true });
+        fs.writeFileSync(A11Y_RELAUNCH_MARKER, JSON.stringify({ lastAttemptAt: Date.now() }), { encoding: 'utf8', mode: 0o600 });
+    }
+    catch { /* best-effort */ }
+}
+/**
+ * PowerShell that inspects the running Claude Desktop browser process and, when
+ * allowed, relaunches it with --force-renderer-accessibility. Chromium exposes
+ * web-content (the chat composer) to MSAA only when that switch is present, and
+ * no external/passive signal turns it on for current Claude builds. Emits a
+ * single `STATE:<...>` line so the caller can log/throttle honestly.
+ *
+ *   STATE:not-running       — nothing to do
+ *   STATE:has-flag          — already accessible, no action
+ *   STATE:relaunched        — was missing the flag; we restarted it with the flag
+ *   STATE:needs-flag        — missing the flag but relaunch not allowed (throttled)
+ *   STATE:error:<msg>
+ *
+ * Only ever targets processes named exactly 'claude.exe' from their own install
+ * root, and only restarts a process the user already had open.
+ */
+function ensureAccessibilityScript(allowRelaunch) {
+    return [
+        "$ErrorActionPreference = 'SilentlyContinue'",
+        "$procs = Get-CimInstance Win32_Process -Filter \"Name = 'claude.exe'\"",
+        'if (-not $procs) { Write-Output \'STATE:not-running\'; exit 0 }',
+        // The browser (main) process is the claude.exe with no --type= child switch.
+        "$main = $procs | Where-Object { $_.CommandLine -and ($_.CommandLine -notmatch '--type=') } | Select-Object -First 1",
+        "if (-not $main) { Write-Output 'STATE:not-running'; exit 0 }",
+        "if ($main.CommandLine -match '--force-renderer-accessibility') { Write-Output 'STATE:has-flag'; exit 0 }",
+        allowRelaunch ? '' : "Write-Output 'STATE:needs-flag'; exit 0",
+        "$exe = $main.ExecutablePath",
+        "if (-not $exe -or -not (Test-Path $exe)) { Write-Output 'STATE:error:no-exe'; exit 0 }",
+        'try {',
+        "  $procs | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }",
+        '  Start-Sleep -Milliseconds 1500',
+        "  Start-Process -FilePath $exe -ArgumentList '--force-renderer-accessibility'",
+        "  Write-Output 'STATE:relaunched'",
+        "} catch { Write-Output ('STATE:error:' + $_.Exception.Message) }",
+    ].filter(Boolean).join('\n');
+}
+/**
+ * Ensure Claude Desktop is running with renderer accessibility so the composer
+ * is readable. Non-blocking best-effort; throttled to at most one relaunch per
+ * A11Y_RELAUNCH_THROTTLE_MS. Safe no-op off-Windows or when Claude is closed.
+ */
+function ensureClaudeForceAccessibility(log) {
+    if (process.platform !== 'win32')
+        return;
+    const allow = relaunchThrottleOk();
+    const child = (0, child_process_1.spawn)('powershell', [
+        '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden',
+        '-Command', ensureAccessibilityScript(allow),
+    ], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
+    let out = '';
+    child.stdout?.on('data', (d) => { out += d.toString(); });
+    child.on('error', () => { });
+    child.on('exit', () => {
+        const state = (out.match(/STATE:(.*)/) || [])[1]?.trim();
+        if (state === 'relaunched') {
+            stampRelaunch();
+            log('Claude Desktop guard: relaunched Claude with --force-renderer-accessibility so the chat composer is readable.');
+        }
+        else if (state === 'needs-flag') {
+            log('Claude Desktop guard: Claude is running without accessibility; relaunch throttled — composer stays unreadable until the next allowed relaunch.');
+        }
+        else if (state && state.startsWith('error')) {
+            // An error can surface AFTER we already force-stopped Claude (Start-Process
+            // threw). Stamp the throttle regardless so a half-failed restart can never
+            // loop the kill every 5 minutes — wait the full window before retrying.
+            stampRelaunch();
+            log(`Claude Desktop guard: could not enable accessibility (${state}); backing off before retry.`);
+        }
+    });
+}
 /**
  * Start the advisory guard. Returns a handle whose stop() tears down the
  * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
@@ -375,8 +485,10 @@ function startDesktopChatGuard(runtime) {
         restartDelay = Math.min(RESTART_MAX_MS, restartDelay * 2);
     };
     void refreshSnapshot();
+    ensureClaudeForceAccessibility(runtime.log);
     const snapshotTimer = setInterval(() => { void refreshSnapshot(); }, SNAPSHOT_REFRESH_MS);
     const heartbeatTimer = setInterval(heartbeat, 60_000);
+    const a11yTimer = setInterval(() => ensureClaudeForceAccessibility(runtime.log), A11Y_CHECK_INTERVAL_MS);
     spawnWatcher();
     return {
         stop() {
@@ -385,6 +497,7 @@ function startDesktopChatGuard(runtime) {
             stopped = true;
             clearInterval(snapshotTimer);
             clearInterval(heartbeatTimer);
+            clearInterval(a11yTimer);
             if (restartTimer) {
                 clearTimeout(restartTimer);
                 restartTimer = undefined;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.2"
+  "version": "1.21.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.2",
+  "version": "1.21.3",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {