fullcourtdefense-cli 1.21.6 → 1.21.8

package/dist/commands/clipboardScan.d.ts

@@ -0,0 +1,2 @@
+import { DeterministicFinding, LocalSafetyScanOptions } from './deterministicGuard';
+export declare function scanDeterministicClipboard(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/clipboardScan.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanDeterministicClipboard = scanDeterministicClipboard;
+const deterministicGuard_1 = require("./deterministicGuard");
+/**
+ * Clipboard scan for advisory paste protection (e.g. Claude Desktop, where the
+ * native chat has no hook and the MCP gateway can't see typed prompts). A
+ * recognizable credential sitting on the clipboard is a finding on its own —
+ * the very next action is a paste the guard cannot observe.
+ *
+ * This composes the SAME deterministic engine used everywhere else via its
+ * public API, so detection patterns and per-rule Local Safety toggles are
+ * identical. No new detection logic and no keyword list lives here.
+ *
+ *  - Prefixed secrets (sk-, ghp_, AKIA…) and keyword-adjacent high-entropy
+ *    strings are caught directly by scanDeterministicTextResponse.
+ *  - A clipboard that is ONE bare credential-shaped token has, by definition,
+ *    no surrounding keyword. We re-run the same contextual detector with a
+ *    synthetic keyword so its entropy + shape gate still decides — a lone hex
+ *    app secret (the exact WhatsApp-secret scenario) is caught, while a hash
+ *    embedded in a sentence or diff stays silent because it is never a lone
+ *    token.
+ */
+const LONE_TOKEN = /^[A-Za-z0-9_\-+/=]{24,256}$/;
+function scanDeterministicClipboard(text, options) {
+    const trimmed = (text || '').trim();
+    if (!trimmed)
+        return undefined;
+    const direct = (0, deterministicGuard_1.scanDeterministicTextResponse)(trimmed, options);
+    if (direct)
+        return direct;
+    if (LONE_TOKEN.test(trimmed)) {
+        // Inject a canonical keyword so the contextual detector's proximity check
+        // passes; its high-entropy gate still does the real work. The synthetic
+        // prefix is never surfaced — the finding's evidence comes from the token.
+        return (0, deterministicGuard_1.scanDeterministicTextResponse)(`api key ${trimmed}`, options);
+    }
+    return undefined;
+}

package/dist/commands/desktopChatGuard.d.ts

@@ -12,14 +12,24 @@ export declare function desktopChatGuardSupported(): boolean;
 export declare function desktopChatGuardHealthy(withinMs?: number): boolean;
 /**
  * The PowerShell watcher. Compiles a tiny MSAA reader (C# via Add-Type using
- * the .NET Framework compiler built into Windows), then — only while Claude is
- * the foreground process — reads the composer's editable text and emits
- * `FCD:<base64 utf8>` on stdout when it changes. Everything is wrapped in
- * try/catch — it must never crash the host.
+ * the .NET Framework compiler built into Windows), then — while the "Claude"
+ * process is running — reads the composer's editable text (emitting
+ * `FCD:<base64 utf8>`) and, only while Claude Desktop is the FOREGROUND window,
+ * the clipboard contents (emitting `FCDCLIP:<base64 utf8>`) when either
+ * changes. Everything is wrapped in try/catch — it must never crash the host,
+ * and it never writes to the clipboard or synthesizes input.
  */
 export declare function desktopChatWatcherScript(): string;
-/** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
-export declare function decodeWatcherLine(line: string): string | undefined;
+export type WatcherSource = 'composer' | 'clipboard';
+/**
+ * Decode one watcher line into { source, text } (undefined if not ours).
+ * `FCD:` lines are composer reads; `FCDCLIP:` lines are clipboard reads while
+ * Claude Desktop is focused.
+ */
+export declare function decodeWatcherLine(line: string): {
+    source: WatcherSource;
+    text: string;
+} | undefined;
 export interface DesktopChatGuardHandle {
     stop(): void;
 }

package/dist/commands/desktopChatGuard.js

@@ -47,6 +47,7 @@ const readline = __importStar(require("readline"));
 const config_1 = require("../config");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const deterministicGuard_1 = require("./deterministicGuard");
+const clipboardScan_1 = require("./clipboardScan");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const machineIdentity_1 = require("../machineIdentity");
@@ -60,43 +61,45 @@ const discoverPaths_1 = require("./discoverPaths");
  * closes that blind spot with the SAME on-device deterministic engine used
  * everywhere else (scanDeterministicPrompt).
  *
- * Reading the composer — MSAA + forced renderer accessibility:
+ * Reading the composer — MSAA, passive best-effort:
  *   Claude Desktop is Electron/Chromium. Chromium keeps web-content
  *   accessibility OFF until it detects assistive tech, and on current Claude
- *   builds NONE of the passive wake signals work from outside the process
+ *   builds no passive wake signal turns it on from outside the process
  *   (verified against Claude 1.20186: WM_GETOBJECT for OBJID_CLIENT and for the
  *   custom screen-reader object id 1, SPI_SETSCREENREADER, a UIA FindAll walk,
  *   and an NVDA-style IServiceProvider->IAccessible2 handshake all leave the
- *   web area empty). Chromium documents exactly one reliable switch: launch the
- *   app with --force-renderer-accessibility. So the guard ensures Claude runs
- *   with that flag (a one-time, throttled relaunch when the flag is absent),
- *   after which the composer text is exposed via MSAA: oleacc's
- *   AccessibleObjectFromWindow on the main Chrome_WidgetWin_1 window, walk the
- *   IAccessible tree, read accValue of the editable text node (ROLE_SYSTEM_TEXT
- *   / 0x2A). Once the flag is present the guard never touches Claude again.
+ *   web area empty). The only reliable switch is launching Claude with
+ *   --force-renderer-accessibility — but force-restarting the user's app is
+ *   too disruptive for a fleet product, so we deliberately DON'T. The guard
+ *   reads via MSAA (oleacc's AccessibleObjectFromWindow on the main
+ *   Chrome_WidgetWin_1 window, accValue of ROLE_SYSTEM_TEXT / 0x2A nodes) and
+ *   simply works when accessibility happens to be active (screen-reader users,
+ *   older builds, or the app launched with the flag) and stays silent when not.
  *
- * Advisory ONLY: no keyboard hook, no input mutation, no keystroke capture. It
- * reads only the composer text of Claude Desktop's own window (scoped to the
- * "Claude" process — never any other application), scans it in-process, and —
- * on a finding — shows a native toast and reports a monitor event to the fleet.
- * Text is never uploaded; only finding metadata (item id + masked value) is
- * spooled. It cannot break typing and presents no keylogger surface.
+ *   The SUPPORTED protection surface for Claude Desktop is its MCP tool calls
+ *   through the FCD gateway — that is where enforcement happens.
  *
- * Deliberately NOT gated on the foreground window: a foreground check goes blind
- * the instant the user alt-tabs after typing, and MSAA reads Claude's composer
- * whether or not Claude is focused. Scoping to the Claude process (not the
- * active window) is what keeps this from ever reading other apps.
+ * Paste protection (clipboard) — the reliable surface:
+ *   Because reading the composer is best-effort, the guard ALSO watches the
+ *   Windows clipboard, but ONLY while Claude Desktop is the foreground window.
+ *   When a developer pastes a secret into Claude (the exact scenario we keep
+ *   testing), the value is on the clipboard at that moment — the guard runs it
+ *   through the SAME deterministic engine and warns before it reaches the model.
+ *   Scoping to the Claude foreground window means a secret copied for any other
+ *   app is never inspected. This is app-agnostic detection reused only here.
+ *
+ * Advisory ONLY: no keyboard hook, no input mutation, no keystroke capture, and
+ * it never writes to the clipboard. It reads the composer text and (only when
+ * Claude is focused) the clipboard, scans in-process, and — on a finding —
+ * shows a native warning window and reports a monitor event to the fleet. Text
+ * is never uploaded; only finding metadata (item id + masked value) is spooled.
+ * It cannot break typing and presents no keylogger surface.
  */
 const WATCHER_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-claude-desktop-watcher.ps1');
 const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-guard.json');
-/** Throttle marker for the one-time --force-renderer-accessibility relaunch. */
-const A11Y_RELAUNCH_MARKER = path.join(os.homedir(), '.fullcourtdefense', 'claude-a11y-relaunch.json');
-/** Never relaunch Claude more than once per this window (a paste-time restart
- *  is disruptive; once the flag sticks it survives until Claude next updates). */
-const A11Y_RELAUNCH_THROTTLE_MS = 6 * 60 * 60_000;
-/** How often to re-check that Claude is still running with the a11y flag. */
-const A11Y_CHECK_INTERVAL_MS = 5 * 60_000;
 const STDOUT_PREFIX = 'FCD:';
+/** Prefix for clipboard payloads (distinct from composer reads). */
+const CLIP_PREFIX = 'FCDCLIP:';
 /** Poll cadence for the composer read (ms). 800ms lost the race against a
  *  fast paste+Enter (the composer clears before the next read); 250ms is still
  *  negligible CPU for one MSAA tree walk. */
@@ -139,10 +142,12 @@ function desktopChatGuardHealthy(withinMs = 15 * 60_000) {
 }
 /**
  * The PowerShell watcher. Compiles a tiny MSAA reader (C# via Add-Type using
- * the .NET Framework compiler built into Windows), then — only while Claude is
- * the foreground process — reads the composer's editable text and emits
- * `FCD:<base64 utf8>` on stdout when it changes. Everything is wrapped in
- * try/catch — it must never crash the host.
+ * the .NET Framework compiler built into Windows), then — while the "Claude"
+ * process is running — reads the composer's editable text (emitting
+ * `FCD:<base64 utf8>`) and, only while Claude Desktop is the FOREGROUND window,
+ * the clipboard contents (emitting `FCDCLIP:<base64 utf8>`) when either
+ * changes. Everything is wrapped in try/catch — it must never crash the host,
+ * and it never writes to the clipboard or synthesizes input.
  */
 function desktopChatWatcherScript() {
     return [
@@ -167,8 +172,15 @@ function desktopChatWatcherScript() {
         '  [DllImport("user32.dll")] static extern int GetWindowText(IntPtr h, StringBuilder sb, int max);',
         '  [DllImport("user32.dll")] static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);',
         '  [DllImport("user32.dll")] static extern IntPtr SendMessage(IntPtr h, uint msg, IntPtr wParam, IntPtr lParam);',
+        '  [DllImport("user32.dll")] static extern IntPtr GetForegroundWindow();',
         '  const uint WM_GETOBJECT = 0x003D;',
         '  public delegate bool EnumProc(IntPtr h, IntPtr p);',
+        '  public static bool ClaudeIsForeground(HashSet<uint> pids) {',
+        '    IntPtr fg = GetForegroundWindow();',
+        '    if (fg == IntPtr.Zero) return false;',
+        '    uint pid; GetWindowThreadProcessId(fg, out pid);',
+        '    return pids.Contains(pid);',
+        '  }',
         '  public static IntPtr FindMain(HashSet<uint> pids) {',
         '    IntPtr result = IntPtr.Zero;',
         '    EnumWindows((h, p) => {',
@@ -231,6 +243,7 @@ function desktopChatWatcherScript() {
         '} catch { }',
         '',
         '$last = ""',
+        '$lastClip = ""',
         '$lastWake = [DateTime]::MinValue',
         'while ($true) {',
         '  Start-Sleep -Milliseconds ' + POLL_MS,
@@ -238,6 +251,19 @@ function desktopChatWatcherScript() {
         '    $pids = New-Object \'System.Collections.Generic.HashSet[uint32]\'',
         "    Get-Process -Name 'Claude' -ErrorAction SilentlyContinue | ForEach-Object { [void]$pids.Add([uint32]$_.Id) }",
         '    if ($pids.Count -eq 0) { continue }',
+        // Clipboard paste guard: only while Claude Desktop is the foreground app, so
+        // a copy staged for any OTHER application is never inspected or reported.
+        // The deterministic engine (parent process) decides if the text is a secret.
+        '    if ([FcdMsaa]::ClaudeIsForeground($pids)) {',
+        '      $clip = ""',
+        '      try { $clip = Get-Clipboard -Raw -ErrorAction SilentlyContinue } catch { }',
+        '      if (-not [string]::IsNullOrEmpty($clip) -and $clip.Length -le 8000 -and $clip -ne $lastClip) {',
+        '        $lastClip = $clip',
+        '        $cb = [System.Text.Encoding]::UTF8.GetBytes($clip)',
+        "        [Console]::Out.WriteLine('" + CLIP_PREFIX + "' + [Convert]::ToBase64String($cb))",
+        '        [Console]::Out.Flush()',
+        '      }',
+        '    }',
         '    $main = [FcdMsaa]::FindMain($pids)',
         '    if ($main -eq [IntPtr]::Zero) { continue }',
         '    if (([DateTime]::UtcNow - $lastWake).TotalSeconds -ge 30) { [FcdMsaa]::Wake($main); $lastWake = [DateTime]::UtcNow }',
@@ -264,12 +290,21 @@ function desktopChatWatcherScript() {
         '',
     ].join('\n');
 }
-/** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
+/**
+ * Decode one watcher line into { source, text } (undefined if not ours).
+ * `FCD:` lines are composer reads; `FCDCLIP:` lines are clipboard reads while
+ * Claude Desktop is focused.
+ */
 function decodeWatcherLine(line) {
-    if (!line.startsWith(STDOUT_PREFIX))
+    const prefix = line.startsWith(CLIP_PREFIX)
+        ? { p: CLIP_PREFIX, source: 'clipboard' }
+        : line.startsWith(STDOUT_PREFIX)
+            ? { p: STDOUT_PREFIX, source: 'composer' }
+            : undefined;
+    if (!prefix)
         return undefined;
     try {
-        return Buffer.from(line.slice(STDOUT_PREFIX.length), 'base64').toString('utf8');
+        return { source: prefix.source, text: Buffer.from(line.slice(prefix.p.length), 'base64').toString('utf8') };
     }
     catch {
         return undefined;
@@ -279,137 +314,6 @@ function ensureWatcherScript() {
     fs.writeFileSync(WATCHER_PS1_PATH, desktopChatWatcherScript(), { encoding: 'utf8' });
     return WATCHER_PS1_PATH;
 }
-function relaunchThrottleOk(currentClaudeCreated) {
-    try {
-        const marker = JSON.parse(fs.readFileSync(A11Y_RELAUNCH_MARKER, 'utf8'));
-        const last = marker.lastAttemptAt || 0;
-        const sinceLast = Date.now() - last;
-        // Hard floor: never two relaunches within 15 minutes regardless of
-        // instance tracking — bounds the worst case if a relaunched Claude drops
-        // our flag (e.g. MSIX self-restart) so we can't kill it in a loop.
-        if (sinceLast < 15 * 60_000)
-            return false;
-        // Claude was restarted (update, crash, user quit/reopen) since our last
-        // relaunch attempt — the old throttle must not leave the composer blind.
-        // Legacy markers without claudeCreated also take this path once, then
-        // start tracking the instance.
-        if (currentClaudeCreated && marker.claudeCreated !== currentClaudeCreated) {
-            return true;
-        }
-        return sinceLast > A11Y_RELAUNCH_THROTTLE_MS;
-    }
-    catch {
-        return true;
-    }
-}
-function stampRelaunch(claudeCreated) {
-    try {
-        fs.mkdirSync(path.dirname(A11Y_RELAUNCH_MARKER), { recursive: true });
-        fs.writeFileSync(A11Y_RELAUNCH_MARKER, JSON.stringify({
-            lastAttemptAt: Date.now(),
-            ...(claudeCreated ? { claudeCreated } : {}),
-        }), { encoding: 'utf8', mode: 0o600 });
-    }
-    catch { /* best-effort */ }
-}
-/**
- * PowerShell that inspects the running Claude Desktop browser process and, when
- * allowed, relaunches it with --force-renderer-accessibility. Chromium exposes
- * web-content (the chat composer) to MSAA only when that switch is present, and
- * no external/passive signal turns it on for current Claude builds. Emits a
- * single `STATE:<...>` line so the caller can log/throttle honestly.
- *
- *   STATE:not-running       — nothing to do
- *   STATE:has-flag          — already accessible, no action
- *   STATE:relaunched        — was missing the flag; we restarted it with the flag
- *   STATE:needs-flag        — missing the flag but relaunch not allowed (throttled)
- *   STATE:error:<msg>
- *
- * Only ever targets processes named exactly 'claude.exe' from their own install
- * root, and only restarts a process the user already had open.
- */
-function ensureAccessibilityScript(allowRelaunch) {
-    return [
-        "$ErrorActionPreference = 'SilentlyContinue'",
-        "$procs = Get-CimInstance Win32_Process -Filter \"Name = 'claude.exe'\"",
-        'if (-not $procs) { Write-Output \'STATE:not-running\'; exit 0 }',
-        // The browser (main) process is the claude.exe with no --type= child switch.
-        "$main = $procs | Where-Object { $_.CommandLine -and ($_.CommandLine -notmatch '--type=') } | Select-Object -First 1",
-        "if (-not $main) { Write-Output 'STATE:not-running'; exit 0 }",
-        "$created = $main.CreationDate",
-        "if ($main.CommandLine -match '--force-renderer-accessibility') { Write-Output ('STATE:has-flag:' + $created); exit 0 }",
-        allowRelaunch ? '' : "Write-Output ('STATE:needs-flag:' + $created); exit 0",
-        "$exe = $main.ExecutablePath",
-        "if (-not $exe -or -not (Test-Path $exe)) { Write-Output 'STATE:error:no-exe'; exit 0 }",
-        'try {',
-        "  $procs | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }",
-        '  Start-Sleep -Milliseconds 1500',
-        "  Start-Process -FilePath $exe -ArgumentList '--force-renderer-accessibility'",
-        "  Write-Output ('STATE:relaunched:' + $created)",
-        "} catch { Write-Output ('STATE:error:' + $_.Exception.Message) }",
-    ].filter(Boolean).join('\n');
-}
-function parseAccessibilityState(out) {
-    const match = out.match(/STATE:([^:\r\n]+)(?::(.+))?/);
-    if (!match)
-        return { state: '' };
-    return { state: match[1].trim(), claudeCreated: match[2]?.trim() };
-}
-/**
- * Ensure Claude Desktop is running with renderer accessibility so the composer
- * is readable. Non-blocking best-effort; throttled to at most one relaunch per
- * A11Y_RELAUNCH_THROTTLE_MS for the SAME Claude process instance. A fresh
- * Claude restart (update, MSI, user reopen) bypasses the throttle.
- */
-function ensureClaudeForceAccessibility(log) {
-    if (process.platform !== 'win32')
-        return;
-    // Probe first without committing to relaunch so we can compare process age
-    // against the throttle marker before deciding.
-    const probe = (0, child_process_1.spawn)('powershell', [
-        '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden',
-        '-Command', ensureAccessibilityScript(false),
-    ], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
-    let probeOut = '';
-    probe.stdout?.on('data', (d) => { probeOut += d.toString(); });
-    probe.on('error', () => { });
-    probe.on('exit', () => {
-        const { state, claudeCreated } = parseAccessibilityState(probeOut);
-        if (!state || state === 'not-running' || state.startsWith('has-flag'))
-            return;
-        if (!state.startsWith('needs-flag')) {
-            if (state.startsWith('error'))
-                log(`Claude Desktop guard: accessibility probe failed (${state}).`);
-            return;
-        }
-        const allow = relaunchThrottleOk(claudeCreated);
-        if (!allow) {
-            log('Claude Desktop guard: Claude is running without accessibility; relaunch throttled — composer stays unreadable until the next allowed relaunch.');
-            return;
-        }
-        const child = (0, child_process_1.spawn)('powershell', [
-            '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden',
-            '-Command', ensureAccessibilityScript(true),
-        ], { windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] });
-        let out = '';
-        child.stdout?.on('data', (d) => { out += d.toString(); });
-        child.on('error', () => { });
-        child.on('exit', () => {
-            const result = parseAccessibilityState(out);
-            if (result.state === 'relaunched') {
-                stampRelaunch(result.claudeCreated || claudeCreated);
-                log('Claude Desktop guard: relaunched Claude with --force-renderer-accessibility so the chat composer is readable.');
-            }
-            else if (result.state.startsWith('error')) {
-                // An error can surface AFTER we already force-stopped Claude (Start-Process
-                // threw). Stamp the throttle regardless so a half-failed restart can never
-                // loop the kill every 5 minutes — wait the full window before retrying.
-                stampRelaunch(result.claudeCreated || claudeCreated);
-                log(`Claude Desktop guard: could not enable accessibility (${result.state}); backing off before retry.`);
-            }
-        });
-    });
-}
 /**
  * Start the advisory guard. Returns a handle whose stop() tears down the
  * watcher and timers. Safe no-op (returns undefined) on unsupported platforms.
@@ -447,10 +351,12 @@ function startDesktopChatGuard(runtime) {
         startedAt,
         heartbeatAt: new Date().toISOString(),
     });
-    const handleText = (text) => {
+    const handleText = (text, source) => {
         if (!text.trim())
             return;
-        const finding = (0, deterministicGuard_1.scanDeterministicPrompt)(text, scanOptions);
+        const finding = source === 'clipboard'
+            ? (0, clipboardScan_1.scanDeterministicClipboard)(text, scanOptions)
+            : (0, deterministicGuard_1.scanDeterministicPrompt)(text, scanOptions);
         if (!finding)
             return;
         findings += 1;
@@ -462,7 +368,7 @@ function startDesktopChatGuard(runtime) {
         (0, telemetry_1.spoolEvent)({
             decision: 'allow',
             toolName: 'claude_desktop_chat',
-            operation: 'prompt',
+            operation: source === 'clipboard' ? 'clipboard_paste' : 'prompt',
             reason: `would block: ${finding.reason}`,
             ruleId: finding.ruleId,
             category: finding.category,
@@ -474,21 +380,24 @@ function startDesktopChatGuard(runtime) {
             policyHash: finding.policyHash,
         });
         (0, telemetry_1.triggerFlush)();
-        const key = `${finding.itemId}:${masked}`;
+        const key = `${source}:${finding.itemId}:${masked}`;
         const now = Date.now();
         const last = lastToastAt.get(key) || 0;
         if (!runtime.quiet && now - last > TOAST_DEBOUNCE_MS) {
             lastToastAt.set(key, now);
+            const message = source === 'clipboard'
+                ? `${finding.reason} You just copied this — do NOT paste it into Claude Desktop; its chat is not protected.`
+                : `${finding.reason}. Remove it before sending — this text has not been protected.`;
             (0, notify_1.notifyOs)({
                 title: 'FullCourtDefense: secret in Claude Desktop',
-                message: `${finding.reason}. Remove it before sending — this text has not been protected.`,
+                message,
                 // Security warning: use a top-most window, not a toast. Toasts are
                 // silently swallowed by Focus Assist / Do-Not-Disturb and per-app
                 // banner settings — verified in the field — which would hide the alert.
                 forceWindow: true,
             });
         }
-        runtime.log(`Claude Desktop chat finding: ${finding.itemId} (${finding.reason}).`);
+        runtime.log(`Claude Desktop ${source} finding: ${finding.itemId} (${finding.reason}).`);
     };
     const spawnWatcher = () => {
         if (stopped)
@@ -511,11 +420,11 @@ function startDesktopChatGuard(runtime) {
         }
         const rl = readline.createInterface({ input: child.stdout });
         rl.on('line', (line) => {
-            const text = decodeWatcherLine(line);
-            if (text === undefined)
+            const decoded = decodeWatcherLine(line);
+            if (decoded === undefined)
                 return;
             restartDelay = RESTART_MIN_MS; // healthy output resets backoff
-            handleText(text);
+            handleText(decoded.text, decoded.source);
         });
         child.on('exit', () => { rl.close(); if (!stopped)
             scheduleRestart(); });
@@ -534,10 +443,8 @@ function startDesktopChatGuard(runtime) {
         restartDelay = Math.min(RESTART_MAX_MS, restartDelay * 2);
     };
     void refreshSnapshot();
-    ensureClaudeForceAccessibility(runtime.log);
     const snapshotTimer = setInterval(() => { void refreshSnapshot(); }, SNAPSHOT_REFRESH_MS);
     const heartbeatTimer = setInterval(heartbeat, 60_000);
-    const a11yTimer = setInterval(() => ensureClaudeForceAccessibility(runtime.log), A11Y_CHECK_INTERVAL_MS);
     spawnWatcher();
     return {
         stop() {
@@ -546,7 +453,6 @@ function startDesktopChatGuard(runtime) {
             stopped = true;
             clearInterval(snapshotTimer);
             clearInterval(heartbeatTimer);
-            clearInterval(a11yTimer);
             if (restartTimer) {
                 clearTimeout(restartTimer);
                 restartTimer = undefined;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.6"
+  "version": "1.21.8"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.6",
+  "version": "1.21.8",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -35,6 +35,7 @@
     "test:posture-overhaul": "npm run build && node scripts/test-posture-overhaul.js",
     "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",
     "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
+    "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
     "prepublishOnly": "npm run build"
   },