fullcourtdefense-cli 1.21.7 → 1.21.8

package/dist/commands/clipboardScan.d.ts

@@ -0,0 +1,2 @@
+import { DeterministicFinding, LocalSafetyScanOptions } from './deterministicGuard';
+export declare function scanDeterministicClipboard(text: string, options?: LocalSafetyScanOptions): DeterministicFinding | undefined;

package/dist/commands/clipboardScan.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanDeterministicClipboard = scanDeterministicClipboard;
+const deterministicGuard_1 = require("./deterministicGuard");
+/**
+ * Clipboard scan for advisory paste protection (e.g. Claude Desktop, where the
+ * native chat has no hook and the MCP gateway can't see typed prompts). A
+ * recognizable credential sitting on the clipboard is a finding on its own —
+ * the very next action is a paste the guard cannot observe.
+ *
+ * This composes the SAME deterministic engine used everywhere else via its
+ * public API, so detection patterns and per-rule Local Safety toggles are
+ * identical. No new detection logic and no keyword list lives here.
+ *
+ *  - Prefixed secrets (sk-, ghp_, AKIA…) and keyword-adjacent high-entropy
+ *    strings are caught directly by scanDeterministicTextResponse.
+ *  - A clipboard that is ONE bare credential-shaped token has, by definition,
+ *    no surrounding keyword. We re-run the same contextual detector with a
+ *    synthetic keyword so its entropy + shape gate still decides — a lone hex
+ *    app secret (the exact WhatsApp-secret scenario) is caught, while a hash
+ *    embedded in a sentence or diff stays silent because it is never a lone
+ *    token.
+ */
+const LONE_TOKEN = /^[A-Za-z0-9_\-+/=]{24,256}$/;
+function scanDeterministicClipboard(text, options) {
+    const trimmed = (text || '').trim();
+    if (!trimmed)
+        return undefined;
+    const direct = (0, deterministicGuard_1.scanDeterministicTextResponse)(trimmed, options);
+    if (direct)
+        return direct;
+    if (LONE_TOKEN.test(trimmed)) {
+        // Inject a canonical keyword so the contextual detector's proximity check
+        // passes; its high-entropy gate still does the real work. The synthetic
+        // prefix is never surfaced — the finding's evidence comes from the token.
+        return (0, deterministicGuard_1.scanDeterministicTextResponse)(`api key ${trimmed}`, options);
+    }
+    return undefined;
+}

package/dist/commands/desktopChatGuard.d.ts

@@ -12,14 +12,24 @@ export declare function desktopChatGuardSupported(): boolean;
 export declare function desktopChatGuardHealthy(withinMs?: number): boolean;
 /**
  * The PowerShell watcher. Compiles a tiny MSAA reader (C# via Add-Type using
- * the .NET Framework compiler built into Windows), then — only while Claude is
- * the foreground process — reads the composer's editable text and emits
- * `FCD:<base64 utf8>` on stdout when it changes. Everything is wrapped in
- * try/catch — it must never crash the host.
+ * the .NET Framework compiler built into Windows), then — while the "Claude"
+ * process is running — reads the composer's editable text (emitting
+ * `FCD:<base64 utf8>`) and, only while Claude Desktop is the FOREGROUND window,
+ * the clipboard contents (emitting `FCDCLIP:<base64 utf8>`) when either
+ * changes. Everything is wrapped in try/catch — it must never crash the host,
+ * and it never writes to the clipboard or synthesizes input.
  */
 export declare function desktopChatWatcherScript(): string;
-/** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
-export declare function decodeWatcherLine(line: string): string | undefined;
+export type WatcherSource = 'composer' | 'clipboard';
+/**
+ * Decode one watcher line into { source, text } (undefined if not ours).
+ * `FCD:` lines are composer reads; `FCDCLIP:` lines are clipboard reads while
+ * Claude Desktop is focused.
+ */
+export declare function decodeWatcherLine(line: string): {
+    source: WatcherSource;
+    text: string;
+} | undefined;
 export interface DesktopChatGuardHandle {
     stop(): void;
 }

package/dist/commands/desktopChatGuard.js

@@ -47,6 +47,7 @@ const readline = __importStar(require("readline"));
 const config_1 = require("../config");
 const localSafetySnapshot_1 = require("../localSafetySnapshot");
 const deterministicGuard_1 = require("./deterministicGuard");
+const clipboardScan_1 = require("./clipboardScan");
 const telemetry_1 = require("../telemetry");
 const notify_1 = require("../notify");
 const machineIdentity_1 = require("../machineIdentity");
@@ -78,21 +79,27 @@ const discoverPaths_1 = require("./discoverPaths");
  *   The SUPPORTED protection surface for Claude Desktop is its MCP tool calls
  *   through the FCD gateway — that is where enforcement happens.
  *
- * Advisory ONLY: no keyboard hook, no input mutation, no keystroke capture. It
- * reads only the composer text of Claude Desktop's own window (scoped to the
- * "Claude" process — never any other application), scans it in-process, and —
- * on a finding — shows a native toast and reports a monitor event to the fleet.
- * Text is never uploaded; only finding metadata (item id + masked value) is
- * spooled. It cannot break typing and presents no keylogger surface.
+ * Paste protection (clipboard) — the reliable surface:
+ *   Because reading the composer is best-effort, the guard ALSO watches the
+ *   Windows clipboard, but ONLY while Claude Desktop is the foreground window.
+ *   When a developer pastes a secret into Claude (the exact scenario we keep
+ *   testing), the value is on the clipboard at that moment — the guard runs it
+ *   through the SAME deterministic engine and warns before it reaches the model.
+ *   Scoping to the Claude foreground window means a secret copied for any other
+ *   app is never inspected. This is app-agnostic detection reused only here.
  *
- * Deliberately NOT gated on the foreground window: a foreground check goes blind
- * the instant the user alt-tabs after typing, and MSAA reads Claude's composer
- * whether or not Claude is focused. Scoping to the Claude process (not the
- * active window) is what keeps this from ever reading other apps.
+ * Advisory ONLY: no keyboard hook, no input mutation, no keystroke capture, and
+ * it never writes to the clipboard. It reads the composer text and (only when
+ * Claude is focused) the clipboard, scans in-process, and — on a finding —
+ * shows a native warning window and reports a monitor event to the fleet. Text
+ * is never uploaded; only finding metadata (item id + masked value) is spooled.
+ * It cannot break typing and presents no keylogger surface.
  */
 const WATCHER_PS1_PATH = path.join(os.homedir(), '.fullcourtdefense-claude-desktop-watcher.ps1');
 const STATUS_PATH = path.join(os.homedir(), '.fullcourtdefense', 'claude-desktop-guard.json');
 const STDOUT_PREFIX = 'FCD:';
+/** Prefix for clipboard payloads (distinct from composer reads). */
+const CLIP_PREFIX = 'FCDCLIP:';
 /** Poll cadence for the composer read (ms). 800ms lost the race against a
  *  fast paste+Enter (the composer clears before the next read); 250ms is still
  *  negligible CPU for one MSAA tree walk. */
@@ -135,10 +142,12 @@ function desktopChatGuardHealthy(withinMs = 15 * 60_000) {
 }
 /**
  * The PowerShell watcher. Compiles a tiny MSAA reader (C# via Add-Type using
- * the .NET Framework compiler built into Windows), then — only while Claude is
- * the foreground process — reads the composer's editable text and emits
- * `FCD:<base64 utf8>` on stdout when it changes. Everything is wrapped in
- * try/catch — it must never crash the host.
+ * the .NET Framework compiler built into Windows), then — while the "Claude"
+ * process is running — reads the composer's editable text (emitting
+ * `FCD:<base64 utf8>`) and, only while Claude Desktop is the FOREGROUND window,
+ * the clipboard contents (emitting `FCDCLIP:<base64 utf8>`) when either
+ * changes. Everything is wrapped in try/catch — it must never crash the host,
+ * and it never writes to the clipboard or synthesizes input.
  */
 function desktopChatWatcherScript() {
     return [
@@ -163,8 +172,15 @@ function desktopChatWatcherScript() {
         '  [DllImport("user32.dll")] static extern int GetWindowText(IntPtr h, StringBuilder sb, int max);',
         '  [DllImport("user32.dll")] static extern uint GetWindowThreadProcessId(IntPtr h, out uint pid);',
         '  [DllImport("user32.dll")] static extern IntPtr SendMessage(IntPtr h, uint msg, IntPtr wParam, IntPtr lParam);',
+        '  [DllImport("user32.dll")] static extern IntPtr GetForegroundWindow();',
         '  const uint WM_GETOBJECT = 0x003D;',
         '  public delegate bool EnumProc(IntPtr h, IntPtr p);',
+        '  public static bool ClaudeIsForeground(HashSet<uint> pids) {',
+        '    IntPtr fg = GetForegroundWindow();',
+        '    if (fg == IntPtr.Zero) return false;',
+        '    uint pid; GetWindowThreadProcessId(fg, out pid);',
+        '    return pids.Contains(pid);',
+        '  }',
         '  public static IntPtr FindMain(HashSet<uint> pids) {',
         '    IntPtr result = IntPtr.Zero;',
         '    EnumWindows((h, p) => {',
@@ -227,6 +243,7 @@ function desktopChatWatcherScript() {
         '} catch { }',
         '',
         '$last = ""',
+        '$lastClip = ""',
         '$lastWake = [DateTime]::MinValue',
         'while ($true) {',
         '  Start-Sleep -Milliseconds ' + POLL_MS,
@@ -234,6 +251,19 @@ function desktopChatWatcherScript() {
         '    $pids = New-Object \'System.Collections.Generic.HashSet[uint32]\'',
         "    Get-Process -Name 'Claude' -ErrorAction SilentlyContinue | ForEach-Object { [void]$pids.Add([uint32]$_.Id) }",
         '    if ($pids.Count -eq 0) { continue }',
+        // Clipboard paste guard: only while Claude Desktop is the foreground app, so
+        // a copy staged for any OTHER application is never inspected or reported.
+        // The deterministic engine (parent process) decides if the text is a secret.
+        '    if ([FcdMsaa]::ClaudeIsForeground($pids)) {',
+        '      $clip = ""',
+        '      try { $clip = Get-Clipboard -Raw -ErrorAction SilentlyContinue } catch { }',
+        '      if (-not [string]::IsNullOrEmpty($clip) -and $clip.Length -le 8000 -and $clip -ne $lastClip) {',
+        '        $lastClip = $clip',
+        '        $cb = [System.Text.Encoding]::UTF8.GetBytes($clip)',
+        "        [Console]::Out.WriteLine('" + CLIP_PREFIX + "' + [Convert]::ToBase64String($cb))",
+        '        [Console]::Out.Flush()',
+        '      }',
+        '    }',
         '    $main = [FcdMsaa]::FindMain($pids)',
         '    if ($main -eq [IntPtr]::Zero) { continue }',
         '    if (([DateTime]::UtcNow - $lastWake).TotalSeconds -ge 30) { [FcdMsaa]::Wake($main); $lastWake = [DateTime]::UtcNow }',
@@ -260,12 +290,21 @@ function desktopChatWatcherScript() {
         '',
     ].join('\n');
 }
-/** Decode one `FCD:<base64>` watcher line into UTF-8 text (undefined if not ours). */
+/**
+ * Decode one watcher line into { source, text } (undefined if not ours).
+ * `FCD:` lines are composer reads; `FCDCLIP:` lines are clipboard reads while
+ * Claude Desktop is focused.
+ */
 function decodeWatcherLine(line) {
-    if (!line.startsWith(STDOUT_PREFIX))
+    const prefix = line.startsWith(CLIP_PREFIX)
+        ? { p: CLIP_PREFIX, source: 'clipboard' }
+        : line.startsWith(STDOUT_PREFIX)
+            ? { p: STDOUT_PREFIX, source: 'composer' }
+            : undefined;
+    if (!prefix)
         return undefined;
     try {
-        return Buffer.from(line.slice(STDOUT_PREFIX.length), 'base64').toString('utf8');
+        return { source: prefix.source, text: Buffer.from(line.slice(prefix.p.length), 'base64').toString('utf8') };
     }
     catch {
         return undefined;
@@ -312,10 +351,12 @@ function startDesktopChatGuard(runtime) {
         startedAt,
         heartbeatAt: new Date().toISOString(),
     });
-    const handleText = (text) => {
+    const handleText = (text, source) => {
         if (!text.trim())
             return;
-        const finding = (0, deterministicGuard_1.scanDeterministicPrompt)(text, scanOptions);
+        const finding = source === 'clipboard'
+            ? (0, clipboardScan_1.scanDeterministicClipboard)(text, scanOptions)
+            : (0, deterministicGuard_1.scanDeterministicPrompt)(text, scanOptions);
         if (!finding)
             return;
         findings += 1;
@@ -327,7 +368,7 @@ function startDesktopChatGuard(runtime) {
         (0, telemetry_1.spoolEvent)({
             decision: 'allow',
             toolName: 'claude_desktop_chat',
-            operation: 'prompt',
+            operation: source === 'clipboard' ? 'clipboard_paste' : 'prompt',
             reason: `would block: ${finding.reason}`,
             ruleId: finding.ruleId,
             category: finding.category,
@@ -339,21 +380,24 @@ function startDesktopChatGuard(runtime) {
             policyHash: finding.policyHash,
         });
         (0, telemetry_1.triggerFlush)();
-        const key = `${finding.itemId}:${masked}`;
+        const key = `${source}:${finding.itemId}:${masked}`;
         const now = Date.now();
         const last = lastToastAt.get(key) || 0;
         if (!runtime.quiet && now - last > TOAST_DEBOUNCE_MS) {
             lastToastAt.set(key, now);
+            const message = source === 'clipboard'
+                ? `${finding.reason} You just copied this — do NOT paste it into Claude Desktop; its chat is not protected.`
+                : `${finding.reason}. Remove it before sending — this text has not been protected.`;
             (0, notify_1.notifyOs)({
                 title: 'FullCourtDefense: secret in Claude Desktop',
-                message: `${finding.reason}. Remove it before sending — this text has not been protected.`,
+                message,
                 // Security warning: use a top-most window, not a toast. Toasts are
                 // silently swallowed by Focus Assist / Do-Not-Disturb and per-app
                 // banner settings — verified in the field — which would hide the alert.
                 forceWindow: true,
             });
         }
-        runtime.log(`Claude Desktop chat finding: ${finding.itemId} (${finding.reason}).`);
+        runtime.log(`Claude Desktop ${source} finding: ${finding.itemId} (${finding.reason}).`);
     };
     const spawnWatcher = () => {
         if (stopped)
@@ -376,11 +420,11 @@ function startDesktopChatGuard(runtime) {
         }
         const rl = readline.createInterface({ input: child.stdout });
         rl.on('line', (line) => {
-            const text = decodeWatcherLine(line);
-            if (text === undefined)
+            const decoded = decodeWatcherLine(line);
+            if (decoded === undefined)
                 return;
             restartDelay = RESTART_MIN_MS; // healthy output resets backoff
-            handleText(text);
+            handleText(decoded.text, decoded.source);
         });
         child.on('exit', () => { rl.close(); if (!stopped)
             scheduleRestart(); });

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.21.7"
+  "version": "1.21.8"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.21.7",
+  "version": "1.21.8",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {
@@ -35,6 +35,7 @@
     "test:posture-overhaul": "npm run build && node scripts/test-posture-overhaul.js",
     "test:dpapi-config": "npm run build && node scripts/test-dpapi-config.js",
     "test:desktop-chat-guard": "npm run build && node scripts/test-desktop-chat-guard.js",
+    "test:clipboard-scan": "npm run build && node scripts/test-clipboard-scan.js",
     "build:msi": "powershell -NoProfile -ExecutionPolicy Bypass -File installer/windows/Build-Msi.ps1",
     "prepublishOnly": "npm run build"
   },