fullcourtdefense-cli 1.21.6 → 1.21.7

package/dist/commands/desktopChatGuard.js

@@ -60,20 +60,23 @@ const discoverPaths_1 = require("./discoverPaths");
  * closes that blind spot with the SAME on-device deterministic engine used
  * everywhere else (scanDeterministicPrompt).
  *
- * Reading the composer — MSAA + forced renderer accessibility:
+ * Reading the composer — MSAA, passive best-effort:
  *   Claude Desktop is Electron/Chromium. Chromium keeps web-content
  *   accessibility OFF until it detects assistive tech, and on current Claude
- *   builds NONE of the passive wake signals work from outside the process
+ *   builds no passive wake signal turns it on from outside the process
  *   (verified against Claude 1.20186: WM_GETOBJECT for OBJID_CLIENT and for the
  *   custom screen-reader object id 1, SPI_SETSCREENREADER, a UIA FindAll walk,
  *   and an NVDA-style IServiceProvider->IAccessible2 handshake all leave the
- *   web area empty). Chromium documents exactly one reliable switch: launch the
- *   app with --force-renderer-accessibility. So the guard ensures Claude runs
- *   with that flag (a one-time, throttled relaunch when the flag is absent),
- *   after which the composer text is exposed via MSAA: oleacc's
- *   AccessibleObjectFromWindow on the main Chrome_WidgetWin_1 window, walk the
- *   IAccessible tree, read accValue of the editable text node (ROLE_SYSTEM_TEXT
- *   / 0x2A). Once the flag is present the guard never touches Claude again.
+ *   web area empty). The only reliable switch is launching Claude with
+ *   --force-renderer-accessibility — but force-restarting the user's app is
+ *   too disruptive for a fleet product, so we deliberately DON'T. The guard
+ *   reads via MSAA (oleacc's AccessibleObjectFromWindow on the main
+ *   Chrome_WidgetWin_1 window, accValue of ROLE_SYSTEM_TEXT / 0x2A nodes) and
+ *   simply works when accessibility happens to be active (screen-reader users,
+ *   older builds, or the app launched with the flag) and stays silent when not.
+ *
+ *   The SUPPORTED protection surface for Claude Desktop is its MCP tool calls
+ *   through the FCD gateway — that is where enforcement happens.
  *
  * Advisory ONLY: no keyboard hook, no input mutation, no keystroke capture. It
  * reads only the composer text of Claude Desktop's own window (scoped to the
@@ -89,13 +92,6 @@ const discoverPaths_1 = require("./discoverPaths");
  */
 const WATCHER_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-claude-desktop-watcher.ps1');
 const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-guard.json');
-/** Throttle marker for the one-time --force-renderer-accessibility relaunch. */
-const A11Y_RELAUNCH_MARKER = path.join(os.homedir(), '.fullcourtdefense', 'claude-a11y-relaunch.json');
-/** Never relaunch Claude more than once per this window (a paste-time restart
- *  is disruptive; once the flag sticks it survives until Claude next updates). */
-const A11Y_RELAUNCH_THROTTLE_MS = 6 * 60 * 60_000;
-/** How often to re-check that Claude is still running with the a11y flag. */
-const A11Y_CHECK_INTERVAL_MS = 5 * 60_000;
 const STDOUT_PREFIX = 'FCD:';
 /** Poll cadence for the composer read (ms). 800ms lost the race against a
  *  fast paste+Enter (the composer clears before the next read); 250ms is still
@@ -279,137 +275,6 @@ function ensureWatcherScript() {
     fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(), { encoding: 'utf8' });
     return WATCHER_PS1_PATH;
 }
-function relaunchThrottleOk(currentClaudeCreated) {
-    try {
-        const marker = JSON.parse(fs.readFileSync(A11Y_RELAUNCH_MARKER, 'utf8'));
-        const last = marker.lastAttemptAt || 0;
-        const sinceLast = Date.now() - last;
-        // Hard floor: never two relaunches within 15 minutes regardless of
-        // instance tracking — bounds the worst case if a relaunched Claude drops
-        // our flag (e.g. MSIX self-restart) so we can't kill it in a loop.
-        if (sinceLast < 15 * 60_000)
-            return false;
-        // Claude was restarted (update, crash, user quit/reopen) since our last
-        // relaunch attempt — the old throttle must not leave the composer blind.
-        // Legacy markers without claudeCreated also take this path once, then
-        // start tracking the instance.
-        if (currentClaudeCreated && marker.claudeCreated !== currentClaudeCreated) {
-            return true;
-        }
-        return sinceLast > A11Y_RELAUNCH_THROTTLE_MS;
-    }
-    catch {
-        return true;
-    }
-}
-function stampRelaunch(claudeCreated) {
-    try {
-        fs.mkdirSync(path.dirname(A11Y_RELAUNCH_MARKER), { recursive: true });
-        fs.writeFileSync(A11Y_RELAUNCH_MARKER, JSON.stringify({
-            lastAttemptAt: Date.now(),
-            ...(claudeCreated ? { claudeCreated } : {}),
-        }), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch { /* best-effort */ }
-}
-/**
- * PowerShell that inspects the running Claude Desktop browser process and, when
- * allowed, relaunches it with --force-renderer-accessibility. Chromium exposes
- * web-content (the chat composer) to MSAA only when that switch is present, and
- * no external/passive signal turns it on for current Claude builds. Emits a
- * single `STATE:<...>` line so the caller can log/throttle honestly.
- *
- *   STATE:not-running       — nothing to do
- *   STATE:has-flag          — already accessible, no action
- *   STATE:relaunched        — was missing the flag; we restarted it with the flag
- *   STATE:needs-flag        — missing the flag but relaunch not allowed (throttled)
- *   STATE:error:<msg>
- *
- * Only ever targets processes named exactly 'claude.exe' from their own install
- * root, and only restarts a process the user already had open.
- */
-function ensureAccessibilityScript(allowRelaunch) {
-    return [
-        "$ErrorActionPreference = 'SilentlyContinue'",
-        "$procs = Get-CimInstance Win32_Process -Filter \"Name = 'claude.exe'\"",
-        'if (-not $procs) { Write-Output \'STATE:not-running\'; exit 0 }',
-        // The browser (main) process is the claude.exe with no --type= child switch.
-        "$main = $procs | Where-Object { $_.CommandLine -and ($_.CommandLine -notmatch '--type=') } | Select-Object -First 1",
-        "if (-not $main) { Write-Output 'STATE:not-running'; exit 0 }",
-        "$created = $main.CreationDate",
-        "if ($main.CommandLine -match '--force-renderer-accessibility') { Write-Output ('STATE:has-flag:' + $created); exit 0 }",
-        allowRelaunch ? '' : "Write-Output ('STATE:needs-flag:' + $created); exit 0",
-        "$exe = $main.ExecutablePath",
-        "if (-not $exe -or -not (Test-Path $exe)) { Write-Output 'STATE:error:no-exe'; exit 0 }",
-        'try {',
-        "  $procs | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }",
-        '  Start-Sleep -Milliseconds 1500',
-        "  Start-Process -FilePath $exe -ArgumentList '--force-renderer-accessibility'",
-        "  Write-Output ('STATE:relaunched:' + $created)",
-        "} catch { Write-Output ('STATE:error:' + $_.Exception.Message) }",
-    ].filter(Boolean).join('\n');
-}
-function parseAccessibilityState(out) {
-    const match = out.match(/STATE:([^:\r\n]+)(?::(.+))?/);
-    if (!match)
-        return { state: '' };
-    return { state: match[1].trim(), claudeCreated: match[2]?.trim() };
-}
-/**
- * Ensure Claude Desktop is running with renderer accessibility so the composer
- * is readable. Non-blocking best-effort; throttled to at most one relaunch per
- * A11Y_RELAUNCH_THROTTLE_MS for the SAME Claude process instance. A fresh
- * Claude restart (update, MSI, user reopen) bypasses the throttle.
- */
-function ensureClaudeForceAccessibility(log) {
-    if (process.platform !== 'win32')
-        return;
-    // Probe first without committing to relaunch so we can compare process age
-    // against the throttle marker before deciding.
-    const probe = (0, child_process_1.spawn)('powershell', [
-        '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden',
-        '-Command', ensureAccessibilityScript(false),
-    ], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
-    let probeOut = '';
-    probe.stdout?.on('data', (d) => { probeOut += d.toString(); });
-    probe.on('error', () => { });
-    probe.on('exit', () => {
-        const { state, claudeCreated } = parseAccessibilityState(probeOut);
-        if (!state || state === 'not-running' || state.startsWith('has-flag'))
-            return;
-        if (!state.startsWith('needs-flag')) {
-            if (state.startsWith('error'))
-                log(`Claude Desktop guard: accessibility probe failed (${state}).`);
-            return;
-        }
-        const allow = relaunchThrottleOk(claudeCreated);
-        if (!allow) {
-            log('Claude Desktop guard: Claude is running without accessibility; relaunch throttled — composer stays unreadable until the next allowed relaunch.');
-            return;
-        }
-        const child = (0, child_process_1.spawn)('powershell', [
-            '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden',
-            '-Command', ensureAccessibilityScript(true),
-        ], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
-        let out = '';
-        child.stdout?.on('data', (d) => { out += d.toString(); });
-        child.on('error', () => { });
-        child.on('exit', () => {
-            const result = parseAccessibilityState(out);
-            if (result.state === 'relaunched') {
-                stampRelaunch(result.claudeCreated || claudeCreated);
-                log('Claude Desktop guard: relaunched Claude with --force-renderer-accessibility so the chat composer is readable.');
-            }
-            else if (result.state.startsWith('error')) {
-                // An error can surface AFTER we already force-stopped Claude (Start-Process
-                // threw). Stamp the throttle regardless so a half-failed restart can never
-                // loop the kill every 5 minutes — wait the full window before retrying.
-                stampRelaunch(result.claudeCreated || claudeCreated);
-                log(`Claude Desktop guard: could not enable accessibility (${result.state}); backing off before retry.`);
-            }
-        });
-    });
-}
 /**
  * Start the advisory guard. Returns a handle whose stop() tears down the
  * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
@@ -534,10 +399,8 @@ function startDesktopChatGuard(runtime) {
         restartDelay = Math.min(RESTART_MAX_MS, restartDelay * 2);
     };
     void refreshSnapshot();
-    ensureClaudeForceAccessibility(runtime.log);
     const snapshotTimer = setInterval(() => { void refreshSnapshot(); }, SNAPSHOT_REFRESH_MS);
     const heartbeatTimer = setInterval(heartbeat, 60_000);
-    const a11yTimer = setInterval(() => ensureClaudeForceAccessibility(runtime.log), A11Y_CHECK_INTERVAL_MS);
     spawnWatcher();
     return {
         stop() {
@@ -546,7 +409,6 @@ function startDesktopChatGuard(runtime) {
             stopped = true;
             clearInterval(snapshotTimer);
             clearInterval(heartbeatTimer);
-            clearInterval(a11yTimer);
             if (restartTimer) {
                 clearTimeout(restartTimer);
                 restartTimer = undefined;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.6"
+  "version": "1.21.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.6",
+  "version": "1.21.7",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {