v1.4: Block Claude from writing to the Desktop and AppData

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ClaudeRunner.cs

@@ -220,6 +220,8 @@ namespace QuickClaude
             Finished?.Invoke(error);
         }
 
+        // File writes also go through a guard hook ("QuickClaude.exe --guard-write") that blocks the
+        // Desktop and AppData, where OpenRules lets things open without asking.
         // Shell commands go through QuickClaude's own confirm box: a PreToolUse hook that runs
         // "QuickClaude.exe --confirm" (exec form, so no shell quoting). The dialog denies after
         // 2 minutes; the hook timeout is a bit longer so Claude Code never cuts it off first.
@@ -237,6 +239,12 @@ namespace QuickClaude
                         {
                             matcher = "Bash|PowerShell|Monitor", // Monitor also runs shell commands
                             hooks = new[] { new { type = "command", command = exe, args = new[] { "--confirm" }, timeout = 150 } }
+                        },
+                        new
+                        {
+                            // Never lets Claude write to the Desktop or AppData (see WriteGuard)
+                            matcher = "Write|Edit|MultiEdit|NotebookEdit",
+                            hooks = new[] { new { type = "command", command = exe, args = new[] { "--guard-write" }, timeout = 30 } }
                         }
                     }
                 }