---
title: "Claude Desktop — Analysis Workflow"
description: "Documentation: Claude Desktop — Analysis Workflow"
type: reference
tags: [claude-desktop, tools, lsp, ast-grep, cdp, workflow]
timestamp: 2026-06-24
---

# Claude Desktop — Analysis Workflow

Surface analysis toolset for reverse engineering the Electron bundle.

## Tool Stack

| Tool | Type | Use | Limit |
|------------|------|-----|--------|
| **LSP (tsserver)** | Semantic navigation | `documentSymbol`, `hover`, `findReferences`, `goToDefinition` | < 10 MB/file |
| **ast-grep** | Structural query (AST) | Pattern matching on syntax tree | No limit |
| **grep** | Text search | Literal strings, regex | No limit |
| **Bezetacil CDP** | Runtime introspection | `executeJavaScript`, `Fetch.enable`, `Network.enable` | App must be running |

## Setup

### LSP

```bash
# Install
npm install -g typescript-language-server typescript

# settings.json
{
  "env": { "ENABLE_LSP_TOOL": "1" },
  "enabledPlugins": { "typescript-lsp@claude-plugins-official": true }
}
```

### jsconfig.json (in the bundle workdir)

```json
{
  "compilerOptions": {
    "allowJs": true,
    "checkJs": false,
    "moduleResolution": "node",
    "target": "es2022",
    "module": "es2022"
  },
  "include": [".vite/**/*.js"],
  "exclude": ["node_modules"]
}
```

### ast-grep

```bash
brew install ast-grep
```

Query examples:

```bash
# Find Object.freeze in bundle
ast-grep --pattern 'Object.freeze($OBJ)' .vite/build/index.js --json

# Find specific strings (properties preserved by Terser)
ast-grep --pattern '"desktopBootFeatures"' .vite/build/index.js --json

# Find ct() calls — feature flag checks
ast-grep --pattern 'ct($STR)' .vite/build/index.js --json
```

## Extraction Techniques

### 1. CDP — Remote Bundle Extraction

With the app running in 1p mode, use `webContents.debugger`:

```javascript
// List scripts loaded in DOM
wc.executeJavaScript(`
  JSON.stringify({
    scripts: Array.from(document.querySelectorAll('script[src]'))
      .map(s => s.src)
  })
`)

// Download content via Node.js https.get()
```

### 2. CDP — Runtime Feature Extraction

```javascript
// Access global object
wc.executeJavaScript(`
  JSON.stringify(window.desktopBootFeatures)
`)
```

### 3. Static Analysis — Feature Flags

```bash
# Extract all ct() calls → list of IDs
grep -oP 'ct\("\d{10}"\)' .vite/build/index.js | sort -u
```

### 4. Static Analysis — Code Mapping

With LSP configured:
- `documentSymbol` on `main-Bh0l-09t.js` → complete React bundle structure
- `hover` on specific symbols → type inference
- `workspaceSymbol` → cross-file search (requires indexing)

## Typical Workflow

```
1. Grep/ast-grep → find suspicious pattern
2. LSP hover → understand type and signature
3. LSP documentSymbol → map file structure
4. LSP findReferences → trace all usages
5. CDP executeJavaScript → confirm in 1p runtime
```

## Limitations

- **LSP:** Does not load files > 10 MB (14 MB main bundle)
- **ast-grep:** Requires valid syntax (minified OK, as long as parser doesn't break)
- **CDP:** Only works with app running in 1p

## References

- [[claude-desktop-bundles]] — Bundle structure
- [[claude-desktop-feature-flags]] — Feature flags
- [[bezetacil-toolset]] — ASAR pipeline and CDP harness