Document Desktop Extensions in Claude Desktop scope

Author: RonCodes88

cli/src/detect/claude-desktop.ts

@@ -8,7 +8,7 @@
 // therefore install agentlock as an MCP server entry — that's the only
 // honest write we can do here.
 
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { appSupport } from "../util/paths.ts";
 import { claudeDesktopAgentlockState } from "./agentlock-state.ts";
@@ -31,13 +31,25 @@ export const claudeDesktop: Detector = {
   async detect(): Promise<Detection> {
     const configPath = claudeDesktopConfigPath();
     const dir = join(configPath, "..");
+    const extensionsRegistry = join(dir, "extensions-installations.json");
 
     const evidence: string[] = [];
     const dirExists = existsSync(dir);
     const configExists = existsSync(configPath);
     if (dirExists) evidence.push(`found ${dir}`);
     if (configExists) evidence.push(`found ${configPath}`);
 
+    // Count Desktop Extensions installed via Settings → Extensions UI.
+    // This is the registry agentlock now wraps in addition to the
+    // manual mcpServers path; surfacing the count tells the user up
+    // front how much surface area they're hardening.
+    const extensionCount = countInstalledExtensions(extensionsRegistry);
+    if (extensionCount > 0) {
+      evidence.push(
+        `found ${extensionCount} Desktop Extension${extensionCount === 1 ? "" : "s"} (${extensionsRegistry})`,
+      );
+    }
+
     const scopes: DetectedScope[] = [
       { kind: "global", path: configPath, exists: configExists },
     ];
@@ -57,15 +69,33 @@ export const claudeDesktop: Detector = {
       surfaces: ["mcp-stdio"],
       notes: dirExists
         ? [
-            "Install wraps every MCP server entry with `agentlock mcp-proxy` so each tools/call is gated by daemon policy. Originals preserved under _agentlock_original for clean uninstall.",
+            "Install wraps every MCP server entry (manual mcpServers + Desktop Extensions installed via Settings → Extensions UI) with `agentlock mcp-proxy` so each tools/call is gated by daemon policy. Manual mcpServers entries preserve originals under _agentlock_original; Desktop Extension bundle manifests stash originals under _meta.agentlock (MCPB v0.3+ schema slot).",
+            "Anthropic auto-updates may overwrite the wrap on extension version bumps — re-run `agentlock install` after extension updates.",
             "Coverage is the MCP slice only: not gated are Computer Use, integrated terminal, native connectors (Slack/GCal), Cowork's non-MCP paths, and Anthropic cloud features. For full local enforcement, use Claude Code.",
           ]
         : [
             "Claude Desktop not detected. Selecting it will create the config dir on install.",
-            "When Claude Desktop is in use, install wraps each MCP server — coverage is MCP-slice only (not Computer Use, terminal, connectors, or cloud features).",
+            "When Claude Desktop is in use, install wraps each MCP server (mcpServers + Desktop Extensions) — coverage is MCP-slice only (not Computer Use, terminal, connectors, or cloud features).",
           ],
       agentlockInstalled: al.installed,
       agentlockDaemonURL: al.daemonURL,
     };
   },
 };
+
+// countInstalledExtensions parses extensions-installations.json and
+// returns the number of installed Desktop Extensions. Returns 0 on any
+// parse error or missing file — the count is informational; we don't
+// want detection to fail loud on a malformed registry that the install
+// pipeline will gracefully no-op past anyway.
+function countInstalledExtensions(registryPath: string): number {
+  if (!existsSync(registryPath)) return 0;
+  try {
+    const parsed = JSON.parse(readFileSync(registryPath, "utf8")) as {
+      extensions?: Record<string, unknown>;
+    };
+    return Object.keys(parsed.extensions ?? {}).length;
+  } catch {
+    return 0;
+  }
+}

docs/status.md

@@ -8,7 +8,7 @@ Live status of every component shipped to the public repo. <span class="md-statu
 |---|---|
 | `agentlock detect` | <span class="md-status-pill shipped">Shipped</span> |
 | `agentlock install` (Claude Code, Codex CLI, Cursor, Gemini CLI) | <span class="md-status-pill shipped">Shipped</span> |
-| `agentlock install` (Claude Desktop) | <span class="md-status-pill shipped">Shipped</span> — **MCP-slice enforcement** via `agentlock mcp-proxy`. Wraps every user-installed MCP server and `.mcpb` Desktop Extension; each `tools/call` goes through daemon policy. **Not gated:** Computer Use (direct mouse/keyboard), integrated terminal, native connectors (Slack/GCal), and server-side features (web search, code interpreter). **Cowork coverage uncertain:** any MCP-mediated tool call Cowork makes IS gated; whether Cowork has separate non-MCP code paths is unverified — verify in your environment by running a Cowork task and checking the agentlock ledger. For full local enforcement of an agent harness, use Claude Code. Tracks [anthropics/claude-code#45514](https://github.com/anthropics/claude-code/issues/45514) for native PreToolUse parity. |
+| `agentlock install` (Claude Desktop) | <span class="md-status-pill shipped">Shipped</span> — wraps every MCP server entry through `agentlock mcp-proxy` so each `tools/call` goes through daemon policy. Both install paths covered: (a) manual `mcpServers` entries in `~/Library/Application Support/Claude/claude_desktop_config.json` (originals preserved under `_agentlock_original`); (b) Desktop Extensions installed via *Settings → Extensions* UI — each per-extension bundle manifest at `Claude Extensions/<ext-id>/manifest.json` is rewritten in place using the schema-blessed `_meta.agentlock` slot (MCPB v0.3+), with `manifest_version` bumped from 0.1/0.2 → 0.3 when needed so the slot validates. Originals stashed under `_meta.agentlock.original_*` for byte-clean restore. **Caveat:** Anthropic auto-updates overwrite the wrap on extension version bumps — re-run `agentlock install` after extension updates (a watcher closes this gap; tracked separately). Other surfaces remain out of scope: Computer Use, integrated terminal, native connectors (Slack/GCal), Cowork's non-MCP paths, server-side cloud features. For full local enforcement of an agent harness, use Claude Code. Tracks [anthropics/claude-code#45514](https://github.com/anthropics/claude-code/issues/45514) for native PreToolUse parity. |
 | `agentlock install` (OpenCode, Cline, Continue, VS Code Copilot) | <span class="md-status-pill not-yet">Not yet implemented</span> — detected but disabled in selector |
 | `agentlock install` (Codex Desktop, Openclaw, Nemoclaw, Hermesagent, Pi) | <span class="md-status-pill not-yet">Not yet implemented</span> — roadmap; awaiting per-app hook/config investigation |
 | `agentlock install --tier {unattested,software,totp}` | <span class="md-status-pill shipped">Shipped</span> |