fullcourtdefense-cli 1.21.2 → 1.21.4

package/dist/commands/desktopChatGuard.js

@@ -60,17 +60,20 @@ const discoverPaths_1 = require("./discoverPaths");
  * closes that blind spot with the SAME on-device deterministic engine used
  * everywhere else (scanDeterministicPrompt).
  *
- * Reading the composer — why MSAA, not UI Automation:
- *   Claude Desktop is Electron/Chromium. Chromium's UI Automation support is
- *   "very limited" (their own docs) — the ProseMirror composer's text is never
- *   exposed through UIA Value/Text patterns (verified: a typed marker never
- *   appears in any UIA node). Chromium DOES fully implement MSAA/IAccessible
- *   (the API screen readers use). So the watcher reads the composer via
- *   oleacc's AccessibleObjectFromWindow on the Chrome_RenderWidgetHostHWND
- *   child window, walks the accessible tree, and reads accValue of the editable
- *   text node (ROLE_SYSTEM_TEXT). The AccessibleObjectFromWindow call itself
- *   wakes Chromium's accessibility tree, so no --force-renderer-accessibility
- *   or WM_GETOBJECT dance is needed.
+ * Reading the composer — MSAA + forced renderer accessibility:
+ *   Claude Desktop is Electron/Chromium. Chromium keeps web-content
+ *   accessibility OFF until it detects assistive tech, and on current Claude
+ *   builds NONE of the passive wake signals work from outside the process
+ *   (verified against Claude 1.20186: WM_GETOBJECT for OBJID_CLIENT and for the
+ *   custom screen-reader object id 1, SPI_SETSCREENREADER, a UIA FindAll walk,
+ *   and an NVDA-style IServiceProvider->IAccessible2 handshake all leave the
+ *   web area empty). Chromium documents exactly one reliable switch: launch the
+ *   app with --force-renderer-accessibility. So the guard ensures Claude runs
+ *   with that flag (a one-time, throttled relaunch when the flag is absent),
+ *   after which the composer text is exposed via MSAA: oleacc's
+ *   AccessibleObjectFromWindow on the main Chrome_WidgetWin_1 window, walk the
+ *   IAccessible tree, read accValue of the editable text node (ROLE_SYSTEM_TEXT
+ *   / 0x2A). Once the flag is present the guard never touches Claude again.
  *
  * Advisory ONLY: no keyboard hook, no input mutation, no keystroke capture. It
  * reads only the composer text of Claude Desktop's own window (scoped to the
@@ -86,9 +89,18 @@ const discoverPaths_1 = require("./discoverPaths");
  */
 const WATCHER_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-claude-desktop-watcher.ps1');
 const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-guard.json');
+/** Throttle marker for the one-time --force-renderer-accessibility relaunch. */
+const A11Y_RELAUNCH_MARKER = path.join(os.homedir(), '.fullcourtdefense', 'claude-a11y-relaunch.json');
+/** Never relaunch Claude more than once per this window (a paste-time restart
+ *  is disruptive; once the flag sticks it survives until Claude next updates). */
+const A11Y_RELAUNCH_THROTTLE_MS = 6 * 60 * 60_000;
+/** How often to re-check that Claude is still running with the a11y flag. */
+const A11Y_CHECK_INTERVAL_MS = 5 * 60_000;
 const STDOUT_PREFIX = 'FCD:';
-/** Poll cadence for the composer read (ms). */
-const POLL_MS = 800;
+/** Poll cadence for the composer read (ms). 800ms lost the race against a
+ *  fast paste+Enter (the composer clears before the next read); 250ms is still
+ *  negligible CPU for one MSAA tree walk. */
+const POLL_MS = 250;
 /** Don't re-toast the same finding value more often than this. */
 const TOAST_DEBOUNCE_MS = 60_000;
 /** Refresh the cached Local Safety snapshot on this cadence. */
@@ -154,6 +166,8 @@ function desktopChatWatcherScript() {
         '  [DllImport("user32.dll")] static extern int GetClassName(IntPtr h, StringBuilder sb, int max);',
         '  [DllImport("user32.dll")] static extern int GetWindowText(IntPtr h, StringBuilder sb, int max);',
         '  [DllImport("user32.dll")] static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);',
+        '  [DllImport("user32.dll")] static extern IntPtr SendMessage(IntPtr h, uint msg, IntPtr wParam, IntPtr lParam);',
+        '  const uint WM_GETOBJECT = 0x003D;',
         '  public delegate bool EnumProc(IntPtr h, IntPtr p);',
         '  public static IntPtr FindMain(HashSet<uint> pids) {',
         '    IntPtr result = IntPtr.Zero;',
@@ -193,9 +207,17 @@ function desktopChatWatcherScript() {
         '    try { AccessibleChildren(acc, 0, count, kids, out got); } catch { return; }',
         '    for (int i = 0; i < got; i++) { var ka = kids[i] as IAccessible; if (ka != null) Walk(ka, outp, depth + 1, budget); }',
         '  }',
+        '  public static void Wake(IntPtr main) {',
+        '    // Newer Claude Desktop builds no longer enable renderer accessibility',
+        '    // from AccessibleObjectFromWindow alone; Chromium turns it on when it',
+        '    // observes WM_GETOBJECT for OBJID_CLIENT on the render widget.',
+        '    foreach (var w in Widgets(main)) SendMessage(w, WM_GETOBJECT, IntPtr.Zero, new IntPtr(unchecked((int)OBJID_CLIENT)));',
+        '    SendMessage(main, WM_GETOBJECT, IntPtr.Zero, new IntPtr(unchecked((int)OBJID_CLIENT)));',
+        '  }',
         '  public static string[] ReadComposer(IntPtr main) {',
         '    var outp = new List<string>();',
-        '    foreach (var w in Widgets(main)) {',
+        '    var targets = Widgets(main); targets.Add(main);',
+        '    foreach (var w in targets) {',
         '      object o; int hr = AccessibleObjectFromWindow(w, OBJID_CLIENT, ref IID_IAccessible, out o);',
         '      if (hr != 0 || o == null) continue;',
         '      var acc = o as IAccessible; if (acc == null) continue;',
@@ -209,6 +231,7 @@ function desktopChatWatcherScript() {
         '} catch { }',
         '',
         '$last = ""',
+        '$lastWake = [DateTime]::MinValue',
         'while ($true) {',
         '  Start-Sleep -Milliseconds ' + POLL_MS,
         '  try {',
@@ -217,6 +240,7 @@ function desktopChatWatcherScript() {
         '    if ($pids.Count -eq 0) { continue }',
         '    $main = [FcdMsaa]::FindMain($pids)',
         '    if ($main -eq [IntPtr]::Zero) { continue }',
+        '    if (([DateTime]::UtcNow - $lastWake).TotalSeconds -ge 30) { [FcdMsaa]::Wake($main); $lastWake = [DateTime]::UtcNow }',
         '    $vals = [FcdMsaa]::ReadComposer($main)',
         '    if ($null -eq $vals -or $vals.Count -eq 0) { continue }',
         '    $parts = @()',
@@ -255,6 +279,92 @@ function ensureWatcherScript() {
     fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(), { encoding: 'utf8' });
     return WATCHER_PS1_PATH;
 }
+function relaunchThrottleOk() {
+    try {
+        const last = JSON.parse(fs.readFileSync(A11Y_RELAUNCH_MARKER, 'utf8')).lastAttemptAt || 0;
+        return Date.now() - last > A11Y_RELAUNCH_THROTTLE_MS;
+    }
+    catch {
+        return true;
+    }
+}
+function stampRelaunch() {
+    try {
+        fs.mkdirSync(path.dirname(A11Y_RELAUNCH_MARKER), { recursive: true });
+        fs.writeFileSync(A11Y_RELAUNCH_MARKER, JSON.stringify({ lastAttemptAt: Date.now() }), { encoding: 'utf8', mode: 0o600 });
+    }
+    catch { /* best-effort */ }
+}
+/**
+ * PowerShell that inspects the running Claude Desktop browser process and, when
+ * allowed, relaunches it with --force-renderer-accessibility. Chromium exposes
+ * web-content (the chat composer) to MSAA only when that switch is present, and
+ * no external/passive signal turns it on for current Claude builds. Emits a
+ * single `STATE:<...>` line so the caller can log/throttle honestly.
+ *
+ *   STATE:not-running       — nothing to do
+ *   STATE:has-flag          — already accessible, no action
+ *   STATE:relaunched        — was missing the flag; we restarted it with the flag
+ *   STATE:needs-flag        — missing the flag but relaunch not allowed (throttled)
+ *   STATE:error:<msg>
+ *
+ * Only ever targets processes named exactly 'claude.exe' from their own install
+ * root, and only restarts a process the user already had open.
+ */
+function ensureAccessibilityScript(allowRelaunch) {
+    return [
+        "$ErrorActionPreference = 'SilentlyContinue'",
+        "$procs = Get-CimInstance Win32_Process -Filter \"Name = 'claude.exe'\"",
+        'if (-not $procs) { Write-Output \'STATE:not-running\'; exit 0 }',
+        // The browser (main) process is the claude.exe with no --type= child switch.
+        "$main = $procs | Where-Object { $_.CommandLine -and ($_.CommandLine -notmatch '--type=') } | Select-Object -First 1",
+        "if (-not $main) { Write-Output 'STATE:not-running'; exit 0 }",
+        "if ($main.CommandLine -match '--force-renderer-accessibility') { Write-Output 'STATE:has-flag'; exit 0 }",
+        allowRelaunch ? '' : "Write-Output 'STATE:needs-flag'; exit 0",
+        "$exe = $main.ExecutablePath",
+        "if (-not $exe -or -not (Test-Path $exe)) { Write-Output 'STATE:error:no-exe'; exit 0 }",
+        'try {',
+        "  $procs | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }",
+        '  Start-Sleep -Milliseconds 1500',
+        "  Start-Process -FilePath $exe -ArgumentList '--force-renderer-accessibility'",
+        "  Write-Output 'STATE:relaunched'",
+        "} catch { Write-Output ('STATE:error:' + $_.Exception.Message) }",
+    ].filter(Boolean).join('\n');
+}
+/**
+ * Ensure Claude Desktop is running with renderer accessibility so the composer
+ * is readable. Non-blocking best-effort; throttled to at most one relaunch per
+ * A11Y_RELAUNCH_THROTTLE_MS. Safe no-op off-Windows or when Claude is closed.
+ */
+function ensureClaudeForceAccessibility(log) {
+    if (process.platform !== 'win32')
+        return;
+    const allow = relaunchThrottleOk();
+    const child = (0, child_process_1.spawn)('powershell', [
+        '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden',
+        '-Command', ensureAccessibilityScript(allow),
+    ], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
+    let out = '';
+    child.stdout?.on('data', (d) => { out += d.toString(); });
+    child.on('error', () => { });
+    child.on('exit', () => {
+        const state = (out.match(/STATE:(.*)/) || [])[1]?.trim();
+        if (state === 'relaunched') {
+            stampRelaunch();
+            log('Claude Desktop guard: relaunched Claude with --force-renderer-accessibility so the chat composer is readable.');
+        }
+        else if (state === 'needs-flag') {
+            log('Claude Desktop guard: Claude is running without accessibility; relaunch throttled — composer stays unreadable until the next allowed relaunch.');
+        }
+        else if (state && state.startsWith('error')) {
+            // An error can surface AFTER we already force-stopped Claude (Start-Process
+            // threw). Stamp the throttle regardless so a half-failed restart can never
+            // loop the kill every 5 minutes — wait the full window before retrying.
+            stampRelaunch();
+            log(`Claude Desktop guard: could not enable accessibility (${state}); backing off before retry.`);
+        }
+    });
+}
 /**
  * Start the advisory guard. Returns a handle whose stop() tears down the
  * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
@@ -327,6 +437,10 @@ function startDesktopChatGuard(runtime) {
             (0, notify_1.notifyOs)({
                 title: 'FullCourtDefense: secret in Claude Desktop',
                 message: `${finding.reason}. Remove it before sending — this text has not been protected.`,
+                // Security warning: use a top-most window, not a toast. Toasts are
+                // silently swallowed by Focus Assist / Do-Not-Disturb and per-app
+                // banner settings — verified in the field — which would hide the alert.
+                forceWindow: true,
             });
         }
         runtime.log(`Claude Desktop chat finding: ${finding.itemId} (${finding.reason}).`);
@@ -375,8 +489,10 @@ function startDesktopChatGuard(runtime) {
         restartDelay = Math.min(RESTART_MAX_MS, restartDelay * 2);
     };
     void refreshSnapshot();
+    ensureClaudeForceAccessibility(runtime.log);
     const snapshotTimer = setInterval(() => { void refreshSnapshot(); }, SNAPSHOT_REFRESH_MS);
     const heartbeatTimer = setInterval(heartbeat, 60_000);
+    const a11yTimer = setInterval(() => ensureClaudeForceAccessibility(runtime.log), A11Y_CHECK_INTERVAL_MS);
     spawnWatcher();
     return {
         stop() {
@@ -385,6 +501,7 @@ function startDesktopChatGuard(runtime) {
             stopped = true;
             clearInterval(snapshotTimer);
             clearInterval(heartbeatTimer);
+            clearInterval(a11yTimer);
             if (restartTimer) {
                 clearTimeout(restartTimer);
                 restartTimer = undefined;

package/dist/notify.d.ts

@@ -14,6 +14,13 @@ export interface OsNotification {
     message: string;
     /** Optional URL. Platforms that support click-through open it; others append it to the body. */
     url?: string;
+    /**
+     * Windows only: render a top-most alert WINDOW instead of a toast. Toasts are
+     * silently suppressed by Focus Assist / Do-Not-Disturb, per-app banner
+     * settings, and rapid-fire dedup — unacceptable for a security warning the
+     * user MUST see. A plain window is not a notification, so none of that applies.
+     */
+    forceWindow?: boolean;
 }
 /** Show a native OS notification. Best-effort, non-blocking, never throws. */
 export declare function notifyOs(n: OsNotification): void;

package/dist/notify.js

@@ -4,9 +4,17 @@ exports.notifyOs = notifyOs;
 exports.consoleUrl = consoleUrl;
 exports.approvalsConsoleUrl = approvalsConsoleUrl;
 const child_process_1 = require("child_process");
-function spawnDetached(command, args) {
+function spawnDetached(command, args, opts) {
     try {
-        const child = (0, child_process_1.spawn)(command, args, { detached: true, stdio: 'ignore', windowsHide: true });
+        const child = (0, child_process_1.spawn)(command, args, {
+            detached: true,
+            stdio: 'ignore',
+            // windowsHide sets the process show-state to SW_HIDE, which a GUI child's
+            // FIRST top-level window inherits — that silently hid the alert form.
+            // showWindow:true (used for the forced alert) must NOT hide it.
+            windowsHide: opts?.showWindow ? false : true,
+            env: opts?.env ? { ...process.env, ...opts.env } : process.env,
+        });
         child.unref();
     }
     catch { /* best-effort */ }
@@ -19,7 +27,59 @@ function psQuote(value) {
 function asQuote(value) {
     return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
+/**
+ * Top-most WinForms alert window. Unlike a toast, this is an ordinary window,
+ * so Focus Assist / Do-Not-Disturb and per-app notification settings cannot
+ * hide it. Auto-dismisses after ~12s so it never blocks the machine, and reads
+ * its text from env vars (no string interpolation into the script → no quoting
+ * or injection issues with arbitrary secret-adjacent message text).
+ */
+function notifyWindowsWindow(n) {
+    const body = n.url ? `${n.message}\n${n.url}` : n.message;
+    // Node composes the full label text (with real newlines) and hands it to
+    // PowerShell via an env var. The script does ZERO string concatenation or
+    // escaping — arbitrary secret-adjacent message text can never break parsing
+    // or inject code.
+    const script = [
+        "$ErrorActionPreference='SilentlyContinue';",
+        'Add-Type -AssemblyName System.Windows.Forms;',
+        'Add-Type -AssemblyName System.Drawing;',
+        '$f=New-Object System.Windows.Forms.Form;',
+        '$f.Text=$env:FCD_NOTIFY_TITLE;',
+        '$f.StartPosition="Manual";',
+        '$wa=[System.Windows.Forms.Screen]::PrimaryScreen.WorkingArea;',
+        '$f.Size=New-Object System.Drawing.Size(460,160);',
+        '$f.Location=New-Object System.Drawing.Point(($wa.Right-475),($wa.Bottom-180));',
+        '$f.TopMost=$true;',
+        '$f.FormBorderStyle="FixedDialog";',
+        '$f.MaximizeBox=$false; $f.MinimizeBox=$false; $f.ShowInTaskbar=$true;',
+        '$f.BackColor=[System.Drawing.Color]::FromArgb(180,30,40);',
+        '$l=New-Object System.Windows.Forms.Label;',
+        '$l.Text=$env:FCD_NOTIFY_TEXT;',
+        '$l.ForeColor=[System.Drawing.Color]::White;',
+        '$l.Font=New-Object System.Drawing.Font("Segoe UI",10,[System.Drawing.FontStyle]::Bold);',
+        '$l.Dock="Fill"; $l.Padding=New-Object System.Windows.Forms.Padding(14);',
+        '$f.Controls.Add($l);',
+        '$tm=New-Object System.Windows.Forms.Timer;',
+        '$tm.Interval=12000;',
+        '$tm.Add_Tick({$tm.Stop();$f.Close()});',
+        '$tm.Start();',
+        '$f.Add_Shown({$f.Activate();$f.BringToFront()});',
+        '[System.Windows.Forms.Application]::Run($f);',
+    ].join(' ');
+    spawnDetached('powershell', ['-NoProfile', '-NonInteractive', '-STA', '-Command', script], {
+        env: {
+            FCD_NOTIFY_TITLE: n.title,
+            FCD_NOTIFY_TEXT: `${n.title}\r\n\r\n${body}`,
+        },
+        showWindow: true,
+    });
+}
 function notifyWindows(n) {
+    if (n.forceWindow) {
+        notifyWindowsWindow(n);
+        return;
+    }
     const body = n.url ? `${n.message}\n${n.url}` : n.message;
     // WinRT toast via PowerShell — works from a plain console process for the
     // current user, no admin/UAC and no extra dependencies. Uses the stock

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.2"
+  "version": "1.21.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.2",
+  "version": "1.21.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {