Claude Desktop — Analysis Workflow

Surface analysis toolset for reverse engineering the Electron bundle.

Tool Stack

Tool	Type	Use	Limit
LSP (tsserver)	Semantic navigation	documentSymbol, hover, findReferences, goToDefinition	< 10 MB/file
ast-grep	Structural query (AST)	Pattern matching on syntax tree	No limit
grep	Text search	Literal strings, regex	No limit
Bezetacil CDP	Runtime introspection	executeJavaScript, Fetch.enable, Network.enable	App must be running

Setup

LSP

# Install
npm install -g typescript-language-server typescript

# settings.json
{
  "env": { "ENABLE_LSP_TOOL": "1" },
  "enabledPlugins": { "typescript-lsp@claude-plugins-official": true }
}

jsconfig.json (in the bundle workdir)

{
  "compilerOptions": {
    "allowJs": true,
    "checkJs": false,
    "moduleResolution": "node",
    "target": "es2022",
    "module": "es2022"
  },
  "include": [".vite/**/*.js"],
  "exclude": ["node_modules"]
}

ast-grep

brew install ast-grep

Query examples:

# Find Object.freeze in bundle
ast-grep --pattern 'Object.freeze($OBJ)' .vite/build/index.js --json

# Find specific strings (properties preserved by Terser)
ast-grep --pattern '"desktopBootFeatures"' .vite/build/index.js --json

# Find ct() calls — feature flag checks
ast-grep --pattern 'ct($STR)' .vite/build/index.js --json

Extraction Techniques

1. CDP — Remote Bundle Extraction

With the app running in 1p mode, use webContents.debugger:

// List scripts loaded in DOM
wc.executeJavaScript(`
  JSON.stringify({
    scripts: Array.from(document.querySelectorAll('script[src]'))
      .map(s => s.src)
  })
`)

// Download content via Node.js https.get()

2. CDP — Runtime Feature Extraction

// Access global object
wc.executeJavaScript(`
  JSON.stringify(window.desktopBootFeatures)
`)

3. Static Analysis — Feature Flags

# Extract all ct() calls → list of IDs
grep -oP 'ct\("\d{10}"\)' .vite/build/index.js | sort -u

4. Static Analysis — Code Mapping

With LSP configured:

• documentSymbol on main-Bh0l-09t.js → complete React bundle structure
• hover on specific symbols → type inference
• workspaceSymbol → cross-file search (requires indexing)

Typical Workflow

1. Grep/ast-grep → find suspicious pattern
2. LSP hover → understand type and signature
3. LSP documentSymbol → map file structure
4. LSP findReferences → trace all usages
5. CDP executeJavaScript → confirm in 1p runtime

Limitations

• LSP: Does not load files > 10 MB (14 MB main bundle)
• ast-grep: Requires valid syntax (minified OK, as long as parser doesn't break)
• CDP: Only works with app running in 1p

References

• claude-desktop-bundles — Bundle structure
• claude-desktop-feature-flags — Feature flags
• bezetacil-toolset — ASAR pipeline and CDP harness