fullcourtdefense-cli 1.21.3 → 1.21.4

package/dist/commands/desktopChatGuard.js

@@ -437,6 +437,10 @@ function startDesktopChatGuard(runtime) {
             (0, notify_1.notifyOs)({
                 title: 'FullCourtDefense: secret in Claude Desktop',
                 message: `${finding.reason}. Remove it before sending — this text has not been protected.`,
+                // Security warning: use a top-most window, not a toast. Toasts are
+                // silently swallowed by Focus Assist / Do-Not-Disturb and per-app
+                // banner settings — verified in the field — which would hide the alert.
+                forceWindow: true,
             });
         }
         runtime.log(`Claude Desktop chat finding: ${finding.itemId} (${finding.reason}).`);

package/dist/notify.d.ts

@@ -14,6 +14,13 @@ export interface OsNotification {
     message: string;
     /** Optional URL. Platforms that support click-through open it; others append it to the body. */
     url?: string;
+    /**
+     * Windows only: render a top-most alert WINDOW instead of a toast. Toasts are
+     * silently suppressed by Focus Assist / Do-Not-Disturb, per-app banner
+     * settings, and rapid-fire dedup — unacceptable for a security warning the
+     * user MUST see. A plain window is not a notification, so none of that applies.
+     */
+    forceWindow?: boolean;
 }
 /** Show a native OS notification. Best-effort, non-blocking, never throws. */
 export declare function notifyOs(n: OsNotification): void;

package/dist/notify.js

@@ -4,9 +4,17 @@ exports.notifyOs = notifyOs;
 exports.consoleUrl = consoleUrl;
 exports.approvalsConsoleUrl = approvalsConsoleUrl;
 const child_process_1 = require("child_process");
-function spawnDetached(command, args) {
+function spawnDetached(command, args, opts) {
     try {
-        const child = (0, child_process_1.spawn)(command, args, { detached: true, stdio: 'ignore', windowsHide: true });
+        const child = (0, child_process_1.spawn)(command, args, {
+            detached: true,
+            stdio: 'ignore',
+            // windowsHide sets the process show-state to SW_HIDE, which a GUI child's
+            // FIRST top-level window inherits — that silently hid the alert form.
+            // showWindow:true (used for the forced alert) must NOT hide it.
+            windowsHide: opts?.showWindow ? false : true,
+            env: opts?.env ? { ...process.env, ...opts.env } : process.env,
+        });
         child.unref();
     }
     catch { /* best-effort */ }
@@ -19,7 +27,59 @@ function psQuote(value) {
 function asQuote(value) {
     return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
+/**
+ * Top-most WinForms alert window. Unlike a toast, this is an ordinary window,
+ * so Focus Assist / Do-Not-Disturb and per-app notification settings cannot
+ * hide it. Auto-dismisses after ~12s so it never blocks the machine, and reads
+ * its text from env vars (no string interpolation into the script → no quoting
+ * or injection issues with arbitrary secret-adjacent message text).
+ */
+function notifyWindowsWindow(n) {
+    const body = n.url ? `${n.message}\n${n.url}` : n.message;
+    // Node composes the full label text (with real newlines) and hands it to
+    // PowerShell via an env var. The script does ZERO string concatenation or
+    // escaping — arbitrary secret-adjacent message text can never break parsing
+    // or inject code.
+    const script = [
+        "$ErrorActionPreference='SilentlyContinue';",
+        'Add-Type -AssemblyName System.Windows.Forms;',
+        'Add-Type -AssemblyName System.Drawing;',
+        '$f=New-Object System.Windows.Forms.Form;',
+        '$f.Text=$env:FCD_NOTIFY_TITLE;',
+        '$f.StartPosition="Manual";',
+        '$wa=[System.Windows.Forms.Screen]::PrimaryScreen.WorkingArea;',
+        '$f.Size=New-Object System.Drawing.Size(460,160);',
+        '$f.Location=New-Object System.Drawing.Point(($wa.Right-475),($wa.Bottom-180));',
+        '$f.TopMost=$true;',
+        '$f.FormBorderStyle="FixedDialog";',
+        '$f.MaximizeBox=$false; $f.MinimizeBox=$false; $f.ShowInTaskbar=$true;',
+        '$f.BackColor=[System.Drawing.Color]::FromArgb(180,30,40);',
+        '$l=New-Object System.Windows.Forms.Label;',
+        '$l.Text=$env:FCD_NOTIFY_TEXT;',
+        '$l.ForeColor=[System.Drawing.Color]::White;',
+        '$l.Font=New-Object System.Drawing.Font("Segoe UI",10,[System.Drawing.FontStyle]::Bold);',
+        '$l.Dock="Fill"; $l.Padding=New-Object System.Windows.Forms.Padding(14);',
+        '$f.Controls.Add($l);',
+        '$tm=New-Object System.Windows.Forms.Timer;',
+        '$tm.Interval=12000;',
+        '$tm.Add_Tick({$tm.Stop();$f.Close()});',
+        '$tm.Start();',
+        '$f.Add_Shown({$f.Activate();$f.BringToFront()});',
+        '[System.Windows.Forms.Application]::Run($f);',
+    ].join(' ');
+    spawnDetached('powershell', ['-NoProfile', '-NonInteractive', '-STA', '-Command', script], {
+        env: {
+            FCD_NOTIFY_TITLE: n.title,
+            FCD_NOTIFY_TEXT: `${n.title}\r\n\r\n${body}`,
+        },
+        showWindow: true,
+    });
+}
 function notifyWindows(n) {
+    if (n.forceWindow) {
+        notifyWindowsWindow(n);
+        return;
+    }
     const body = n.url ? `${n.message}\n${n.url}` : n.message;
     // WinRT toast via PowerShell — works from a plain console process for the
     // current user, no admin/UAC and no extra dependencies. Uses the stock

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.3"
+  "version": "1.21.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.3",
+  "version": "1.21.4",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {