[Windows] Alt+V image paste spawns three PowerShell processes; ~1-2.6 s per paste with endpoint protection

Environment

• Claude Code 2.1.296, native Windows build
• Windows 11 Pro 10.0.26300, Windows Terminal (inside Herdr 0.9.3)
• Malwarebytes Premium (consumer) with real-time protection enabled
• Clipboard image: 2560x1380 screenshot (~215 KB PNG)

What happens

Every Alt+V image paste on Windows starts three separate powershell.exe processes, one after another:

1. powershell.exe -NoProfile -NonInteractive -Sta -Command "Add-Type -AssemblyName System.Windows.Forms; if (-not [System.Windows.Forms.Clipboard]::ContainsImage()) ..." (does the clipboard hold an image?)
2. powershell.exe -NoProfile -NonInteractive -Sta -Command "Add-Type -AssemblyName System.Windows.Forms; $img = [System.Windows.Forms.Clipboard]::GetImage() ..." (save it to a temp PNG)
3. powershell.exe -NoProfile -Command "Remove-Item -Force -LiteralPath '...\Temp\claude\claude_...'" (delete the temp PNG)

Each Windows PowerShell 5.1 start costs ~0.3-0.7 s on its own, and endpoint protection that inspects script/PowerShell launches (here Malwarebytes "Advanced script and fileless protection", AMSI-based) adds to each one. The paste feels noticeably slower than in other TUIs on the same machine (OpenCode pastes the same image roughly 3-4x faster).

Measurements

Timestamps from a process watcher (process creation time of each spawn, parent = the Claude Code process), same 2560x1380 image each time:

| Run | 1. ContainsImage | 2. GetImage + save | 3. Remove-Item > image ready | Total |
|---|---|---|---|---|
| Malwarebytes on, script protection on (first paste after re-enabling) | 1.80 s | 0.71 s | 0.06 s | 2.57 s |
| Malwarebytes on, script protection off | 0.39 s | 0.52 s | 0.07 s | 0.98 s |
| Malwarebytes on, script protection on | 0.71 s | 0.84 s | 0.07 s | 1.61 s |

For comparison, a single PowerShell process that checks, reads and saves the clipboard image took 0.36 s on the same machine.

Expected

One process per paste, or none:

• Merge steps 1-3 into a single PowerShell invocation (check, GetImage(), save, and print the PNG as base64 to stdout, so no temp file needs deleting), and delete the temp file from Node (fs.rm) instead of spawning Remove-Item.
• Better: read the clipboard natively (Win32 OpenClipboard/GetClipboardData(CF_DIB) through a small native helper or the existing binary), avoiding PowerShell entirely. This also avoids every AV/AMSI scan of a -Command script.

Merging alone would cut the paste to roughly a third of the current time on machines with endpoint protection, which is common on corporate Windows machines.

Workaround

Save the screenshot to a file and reference its path in the prompt (no PowerShell is spawned).