interlockd 0.1.0__py3-none-any.whl

interlockd/__init__.py

@@ -0,0 +1,3 @@
+"""Interlock daemon package."""
+
+__version__ = "0.1.0"

interlockd/__main__.py

@@ -0,0 +1,7 @@
+"""`python -m interlockd` runs the CLI (the background service uses this form)."""
+
+import sys
+
+from .cli import main
+
+sys.exit(main())

interlockd/aibom.py

@@ -0,0 +1,136 @@
+"""`interlock aibom`: a CycloneDX 1.6 AI bill of materials for the agent stack on this machine (or a repo).
+
+Components: the agents found (application), each stdio MCP server (application, with a package URL when it is
+launched from npm / PyPI / a container image, and whether that version is pinned), models named in agent configs
+(machine-learning-model), and Interlock itself. Remote MCP servers are `services` with their endpoint. Tool
+definitions pinned by the MCP gateway are recorded as component properties (name + sha256). Env values, headers, and
+arguments that look like secrets are never included: only env and header *names*.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import uuid
+from datetime import UTC, datetime
+from pathlib import Path
+
+from . import __version__
+from .scan import LAUNCHERS, Server, _load, _npm_pinned, _package_arg, _pypi_pinned, discover
+
+
+def _purl(s: Server) -> tuple[str | None, str | None, bool | None]:
+    """(purl, version, pinned) for a launcher-fetched package or a container image."""
+    cmd = Path(s.command).name if s.command else ""
+    args = s.args
+    if cmd in ("pnpm", "yarn", "bun") and args[:1] in (["dlx"], ["x"]):
+        cmd, args = "npx", args[1:]
+    if cmd in LAUNCHERS:
+        spec = _package_arg(cmd, args)
+        if not spec:
+            return None, None, None
+        if LAUNCHERS[cmd] == "npm":
+            body = spec.removeprefix("@")
+            name, ver = (spec, None) if "@" not in body else (spec[: len(spec) - len(body.rsplit("@", 1)[1]) - 1], body.rsplit("@", 1)[1])
+            purl_name = name.replace("@", "%40", 1) if name.startswith("@") else name
+            return f"pkg:npm/{purl_name}" + (f"@{ver}" if ver else ""), ver, _npm_pinned(spec)
+        m = re.match(r"^([A-Za-z0-9_.\-\[\]]+?)(?:==|@)\s*([0-9][^,;\s]*)$", spec)
+        name, ver = (m.group(1), m.group(2)) if m else (re.split(r"[<>=@\[]", spec)[0], None)
+        return f"pkg:pypi/{name.lower()}" + (f"@{ver}" if ver else ""), ver, _pypi_pinned(spec)
+    if cmd in ("docker", "podman") and "run" in args:
+        image = next((a for a in args[args.index("run") + 1:] if not a.startswith("-") and "=" not in a), None)
+        if image:
+            repo, _, digest = image.partition("@")
+            repo, _, tag = repo.partition(":") if "/" not in repo.rsplit(":", 1)[-1] else (repo, "", "")
+            name = repo.rsplit("/", 1)[-1]
+            version = f"@{digest.replace(':', '%3A')}" if digest else ""
+            quals = [f"repository_url={repo}"] + ([f"tag={tag}"] if tag else [])
+            return f"pkg:oci/{name}{version}?{'&'.join(quals)}", digest or tag or None, bool(digest)
+    return None, None, None
+
+
+def _models(home: Path, project: Path) -> list[tuple[str, str]]:
+    """(agent, model) pairs named in agent configs."""
+    out = []
+    for agent, path, keys in (("codex", home / ".codex" / "config.toml", ("model",)),
+                              ("claude-code", home / ".claude" / "settings.json", ("model",)),
+                              ("claude-code", project / ".claude" / "settings.json", ("model",)),
+                              ("gemini-cli", home / ".gemini" / "settings.json", ("model",))):
+        d = _load(path) if path.is_file() else None
+        if isinstance(d, dict):
+            for k in keys:
+                v = d.get(k)
+                if isinstance(v, dict):
+                    v = v.get("name")
+                if isinstance(v, str) and v:
+                    out.append((agent, v))
+    return sorted(set(out))
+
+
+def build(home: Path, interlock_home: Path, project: Path) -> dict:
+    from .mcp_proxy import Pins
+    from .onboard import detect
+
+    servers, sources = discover(home, project)
+    pins = Pins(interlock_home / "mcp-pins.json").load()
+    components, services, deps = [], [], []
+    il_ref = "interlock"
+    components.append({"type": "application", "bom-ref": il_ref, "name": "interlock", "version": __version__,
+                       "purl": f"pkg:pypi/interlockd@{__version__}", "description": "Pre/post-action gate for AI agents"})
+    for d in detect(project):
+        if d.present:
+            components.append({"type": "application", "bom-ref": f"agent:{d.name}", "name": d.name,
+                               "properties": [{"name": "interlock:detected_by", "value": d.why or ""}]})
+    for agent, model in _models(home, project):
+        components.append({"type": "machine-learning-model", "bom-ref": f"model:{agent}:{model}", "name": model,
+                           "properties": [{"name": "interlock:configured_in", "value": agent}]})
+    for s in servers:
+        ref = f"mcp:{s.agent}:{s.name}"
+        props = [{"name": "interlock:agent", "value": s.agent}, {"name": "interlock:config", "value": s.source},
+                 {"name": "interlock:disabled", "value": str(s.disabled).lower()}]
+        props += [{"name": "interlock:env", "value": k} for k in sorted(s.env)]
+        for tool, meta in sorted((pins.get(s.name) or {}).items()):
+            props.append({"name": f"interlock:pinned_tool:{tool}", "value": meta.get("sha256", "")})
+        if s.url:
+            services.append({"bom-ref": ref, "name": s.name, "endpoints": [s.url],
+                             "properties": props + [{"name": "interlock:headers", "value": ",".join(sorted(s.headers))}]})
+        else:
+            purl, ver, pinned = _purl(s)
+            comp = {"type": "application", "bom-ref": ref, "name": s.name,
+                    "properties": props + [{"name": "interlock:command", "value": Path(s.command).name}]}
+            if purl:
+                comp["purl"] = purl
+                comp["properties"].append({"name": "interlock:pinned", "value": str(bool(pinned)).lower()})
+            if ver:
+                comp["version"] = ver
+            components.append(comp)
+        deps.append({"ref": f"agent:{s.agent}", "dependsOn": [ref]})
+    merged: dict[str, set] = {}
+    for d in deps:
+        merged.setdefault(d["ref"], set()).update(d["dependsOn"])
+    known = {c["bom-ref"] for c in components} | {s["bom-ref"] for s in services}
+    return {
+        "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": f"urn:uuid:{uuid.uuid4()}", "version": 1,
+        "metadata": {"timestamp": datetime.now(UTC).isoformat(timespec="seconds"),
+                     "tools": {"components": [{"type": "application", "name": "interlock", "version": __version__}]},
+                     "properties": [{"name": "interlock:sources", "value": ",".join(sources)}]},
+        "components": components,
+        **({"services": services} if services else {}),
+        "dependencies": [{"ref": r, "dependsOn": sorted(v)} for r, v in sorted(merged.items()) if r in known],
+    }
+
+
+def summary(bom: dict) -> str:
+    comps = bom["components"]
+    servers = [c for c in comps if c["bom-ref"].startswith("mcp:")]
+    unpinned = [c["name"] for c in servers if any(p["name"] == "interlock:pinned" and p["value"] == "false" for p in c.get("properties", []))]
+    lines = [f"AI bill of materials (CycloneDX {bom['specVersion']}):",
+             f"  agents   {sum(c['bom-ref'].startswith('agent:') for c in comps)}",
+             f"  models   {sum(c['type'] == 'machine-learning-model' for c in comps)}",
+             f"  mcp      {len(servers)} local server(s), {len(bom.get('services', []))} remote",
+             f"  unpinned {', '.join(unpinned) or 'none'}"]
+    return "\n".join(lines)
+
+
+def to_json(bom: dict) -> str:
+    return json.dumps(bom, indent=2)

interlockd/api.py

@@ -0,0 +1,307 @@
+"""Native HTTP API (design §5.1) on the standard library, loopback by default.
+
+  GET  /interlock/v1/health                 no auth
+  GET  /interlock/v1/limits                 bearer
+  POST /interlock/v1/decide                 bearer   InterlockEvent -> Verdict
+  POST /interlock/v1/hooks/kiro             bearer   raw Kiro hook payload -> Verdict (daemon normalizes)
+  GET  /interlock/v1/events/<event_id>      bearer
+  GET  /interlock/v1/events?workspace=&limit=  bearer  (tail)
+
+OGR conformance (design §5.2), served at the bare /v1 prefix the spec uses:
+  GET  /v1/health                           no auth
+  GET  /v1/limits                           bearer
+  POST /v1/evaluate                         bearer   GuardEvent -> OGR Verdict
+  POST /v1/heartbeat                        bearer
+  GET|POST|DELETE /mcp/<name>/<secret>      route secret   MCP gateway for remote servers (mcp_http.py)
+  GET  /v1/rules                            404      (optional per spec; not implemented)
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import socketserver
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from typing import Any
+from urllib.parse import parse_qs, urlparse
+
+from pydantic import ValidationError
+
+from . import __version__
+from .auth import check_bearer
+from .config import MAX_REQUEST_BYTES
+from .models import InterlockEvent
+from .normalize.claude_code import normalize_claude_code
+from .normalize.cursor import normalize_cursor
+from .normalize.gemini_cli import normalize_gemini_cli
+from .normalize.kiro import normalize_kiro
+from .normalize.more import normalize_antigravity, normalize_copilot, normalize_windsurf
+from .ogr import PROTOCOLS, evaluate_guard_event
+from .pipeline import Daemon
+from .render import (
+    render_antigravity,
+    render_claude_code,
+    render_copilot,
+    render_cursor,
+    render_gemini_cli,
+    render_text,
+)
+
+log = logging.getLogger("interlockd.api")
+
+
+class _Server(ThreadingHTTPServer):
+    """HTTPServer.server_bind resolves the host with socket.getfqdn(), a reverse-DNS lookup that can stall for tens
+    of seconds on machines with slow DNS (seen on CI runners). The daemon binds loopback; it never needs the name."""
+
+    def server_bind(self):
+        socketserver.TCPServer.server_bind(self)
+        host, port = self.server_address[:2]
+        self.server_name, self.server_port = str(host), port
+
+
+class _UnixServer(socketserver.ThreadingMixIn, socketserver.UnixStreamServer):
+    """The same API on a Unix socket created with mode 0600: only the owning user can connect at all."""
+    daemon_threads = True
+
+    def server_bind(self):
+        import os
+
+        path = self.server_address
+        if os.path.exists(path):
+            os.unlink(path)                       # a stale socket from a previous run
+        old = os.umask(0o177)
+        try:
+            super().server_bind()
+        finally:
+            os.umask(old)
+        os.chmod(path, 0o600)
+
+
+class ApiServer:
+    def __init__(self, daemon: Daemon, token: str, host: str, port: int, *, unix_socket: str | None = None):
+        self.daemon, self.token = daemon, token
+        handler = self._make_handler()
+        self.httpd = _Server((host, port), handler)
+        self.httpd.daemon_threads = True
+        self.unix = _UnixServer(unix_socket, handler) if unix_socket else None
+        self._thread: threading.Thread | None = None
+        self._unix_thread: threading.Thread | None = None
+
+    @property
+    def address(self) -> tuple[str, int]:
+        return self.httpd.server_address[0], self.httpd.server_address[1]
+
+    def serve_forever(self) -> None:
+        if self.unix is not None and self._unix_thread is None:
+            self._unix_thread = threading.Thread(target=self.unix.serve_forever, kwargs={"poll_interval": 0.5},
+                                                 name="interlock-api-unix", daemon=True)
+            self._unix_thread.start()
+        self.httpd.serve_forever(poll_interval=0.5)
+
+    def start_background(self) -> None:
+        self._thread = threading.Thread(target=self.serve_forever, name="interlock-api", daemon=True)
+        self._thread.start()
+
+    def shutdown(self) -> None:
+        self.httpd.shutdown()
+        self.httpd.server_close()
+        if self.unix is not None:
+            import os
+
+            if self._unix_thread is not None:      # socketserver.shutdown() blocks forever if its loop never started
+                self.unix.shutdown()
+            self.unix.server_close()
+            try:
+                os.unlink(self.unix.server_address)
+            except OSError:
+                pass
+
+    def _make_handler(self):
+        server = self
+
+        class Handler(BaseHTTPRequestHandler):
+            protocol_version = "HTTP/1.1"
+            server_version = f"interlockd/{__version__}"
+
+            def log_message(self, fmt, *args):  # quiet by default; the audit store is the log
+                log.debug(fmt, *args)
+
+            # -- helpers
+            def _send(self, status: int, body: dict[str, Any]) -> None:
+                data = json.dumps(body, separators=(",", ":")).encode()
+                self.send_response(status)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("Content-Length", str(len(data)))
+                self.end_headers()
+                self.wfile.write(data)
+
+            def _authed(self) -> bool:
+                if check_bearer(self.headers.get("Authorization"), server.token):
+                    return True
+                self._send(401, {"error": "unauthorized"})
+                return False
+
+            def _read_json(self) -> Any | None:
+                n = int(self.headers.get("Content-Length") or 0)
+                if n > MAX_REQUEST_BYTES:
+                    self._send(413, {"error": "request too large", "max_request_bytes": MAX_REQUEST_BYTES})
+                    return None
+                raw = self.rfile.read(n) if n else b""
+                try:
+                    return json.loads(raw or b"{}")
+                except json.JSONDecodeError as e:
+                    self._send(400, {"error": f"invalid json: {e.msg}"})
+                    return None
+
+            # -- routes
+            def _mcp(self, method: str) -> bool:
+                if not self.path.startswith("/mcp/"):
+                    return False
+                from .mcp_http import handle
+
+                return handle(self, server.daemon, method)
+
+            def do_DELETE(self) -> None:
+                if not self._mcp("DELETE"):
+                    self._send(404, {"error": "not found"})
+
+            def do_GET(self) -> None:
+                if self._mcp("GET"):
+                    return
+                u = urlparse(self.path)
+                if u.path == "/interlock/v1/health":
+                    s = server.daemon.settings
+                    self._send(200, {"status": "ok", "version": __version__, "mode": server.daemon.mode, "profile": s.profile,
+                                     "policy_sha256": server.daemon.policy_sha256})
+                    return
+                if u.path == "/v1/health":  # OGR health is unauthenticated per the spec
+                    self._send(200, {"status": "ok", "version": __version__, "provider": "interlock"})
+                    return
+                if not self._authed():
+                    return
+                if u.path == "/v1/limits":  # OGR
+                    self._send(200, {"max_request_bytes": MAX_REQUEST_BYTES, "protocols": list(PROTOCOLS),
+                                     "decisions": ["allow", "block"], "ask_maps_to_default": "block"})
+                    return
+                if u.path == "/v1/rules":  # optional per the OGR spec; Interlock does not expose it
+                    self._send(404, {"error": "rules endpoint not implemented"})
+                    return
+                if u.path == "/interlock/v1/limits":
+                    s = server.daemon.settings
+                    self._send(200, {"max_request_bytes": MAX_REQUEST_BYTES, "pre_timeout_ms": s.pre_timeout_ms,
+                                     "post_timeout_ms": s.post_timeout_ms, "fail_mode": server.daemon.policy.fail_mode, "mode": server.daemon.mode})
+                    return
+                if u.path.startswith("/interlock/v1/events/"):
+                    eid = u.path.rsplit("/", 1)[-1]
+                    rec = server.daemon.repo.get_event(eid) if server.daemon.repo else None
+                    if rec is None:
+                        rec = next((r for r in server.daemon.spool.iter_records() if r["event_id"] == eid), None)
+                    self._send(200, rec) if rec else self._send(404, {"error": "not found"})
+                    return
+                if u.path == "/interlock/v1/events":
+                    q = parse_qs(u.query)
+                    limit = min(int(q.get("limit", ["50"])[0]), 500)
+                    ws = q.get("workspace", [None])[0]
+                    rows = [r for r in server.daemon.spool.iter_records(limit=limit * 4)
+                            if ws is None or r.get("agent_workspace") == ws][:limit]
+                    self._send(200, {"events": rows})
+                    return
+                self._send(404, {"error": "not found"})
+
+            def do_POST(self) -> None:
+                if self._mcp("POST"):
+                    return
+                u = urlparse(self.path)
+                if u.path in ("/v1/evaluate", "/v1/heartbeat"):  # OGR conformance seat (design §5.2)
+                    if not self._authed():
+                        return
+                    body = self._read_json()
+                    if body is None:
+                        return
+                    if u.path == "/v1/heartbeat":
+                        self._send(200, {"status": "ok", "version": __version__, "provider": "interlock"})
+                        return
+                    try:
+                        ask = parse_qs(u.query).get("ask_maps_to", ["block"])[0]
+                        verdict = evaluate_guard_event(server.daemon, body, ask_maps_to=ask)
+                    except Exception as e:
+                        log.exception("ogr evaluate failed")
+                        self._send(400, {"error": f"evaluate failed: {type(e).__name__}: {e}"})
+                        return
+                    self._send(200, verdict)
+                    return
+                if u.path not in ("/interlock/v1/decide", "/interlock/v1/hooks/kiro", "/interlock/v1/hooks/claude-code",
+                                  "/interlock/v1/hooks/codex", "/interlock/v1/hooks/cursor", "/interlock/v1/hooks/gemini-cli",
+                                  "/interlock/v1/hooks/copilot-cli", "/interlock/v1/hooks/windsurf", "/interlock/v1/hooks/antigravity"):
+                    self._send(404, {"error": "not found"})
+                    return
+                if not self._authed():
+                    return
+                body = self._read_json()
+                if body is None:
+                    return
+                try:
+                    shim = body.get("adapter") or {}
+                    if u.path == "/interlock/v1/hooks/kiro":
+                        event = normalize_kiro(body.get("payload") or {}, agent_id=server.daemon.settings.agent_id,
+                                               adapter_version=str(shim.get("version", "0")))
+                    elif u.path == "/interlock/v1/hooks/cursor":
+                        event = normalize_cursor(body.get("payload") or {}, agent_id=server.daemon.settings.agent_id,
+                                                 adapter_version=str(shim.get("version", "0")))
+                    elif u.path in ("/interlock/v1/hooks/copilot-cli", "/interlock/v1/hooks/windsurf", "/interlock/v1/hooks/antigravity"):
+                        fn = {"copilot-cli": normalize_copilot, "windsurf": normalize_windsurf,
+                              "antigravity": normalize_antigravity}[u.path.rsplit("/", 1)[-1]]
+                        event = fn(body.get("payload") or {}, event=str(shim.get("event") or "pre"),
+                                   agent_id=server.daemon.settings.agent_id, adapter_version=str(shim.get("version", "0")))
+                    elif u.path == "/interlock/v1/hooks/gemini-cli":
+                        event = normalize_gemini_cli(body.get("payload") or {}, agent_id=server.daemon.settings.agent_id,
+                                                     adapter_version=str(shim.get("version", "0")))
+                    elif u.path.startswith("/interlock/v1/hooks/"):
+                        harness = u.path.rsplit("/", 1)[-1]
+                        payload = body.get("payload") or {}
+                        event = normalize_claude_code(payload, agent_type=harness, agent_id=server.daemon.settings.agent_id,
+                                                      adapter_version=str(shim.get("version", "0")))
+                    else:
+                        event = InterlockEvent.model_validate(body)
+                except ValidationError as e:
+                    self._send(400, {"error": "invalid event", "details": json.loads(e.json())[:5]})
+                    return
+                except Exception as e:  # noqa: BLE001  boundary: malformed hook payloads must never take the daemon down
+                    self._send(400, {"error": f"could not normalize payload: {type(e).__name__}"})
+                    return
+                try:
+                    verdict = server.daemon.decide(event)
+                except Exception as e:
+                    log.exception("decide failed")
+                    self._send(500, {"error": f"decide failed: {type(e).__name__}"})
+                    return
+                fmt = parse_qs(u.query).get("format", [""])[0]
+                if fmt == "text":
+                    data = render_text(verdict).encode()
+                    self.send_response(200)
+                    self.send_header("Content-Type", "text/plain; charset=utf-8")
+                    self.send_header("Content-Length", str(len(data)))
+                    self.end_headers()
+                    self.wfile.write(data)
+                    return
+                if fmt in ("claude-code", "cursor", "gemini-cli", "copilot-cli", "antigravity"):
+                    # The exact JSON the hook prints on stdout; an empty body means "no opinion" (the shim decides
+                    # how to express that to its harness).
+                    payload = (body.get("payload") or {}) if u.path.startswith("/interlock/v1/hooks/") else {}
+                    raw = payload.get("tool_output", payload.get("result_json")) if fmt == "cursor" else payload.get("tool_response")
+                    renderer = {"claude-code": render_claude_code, "cursor": render_cursor, "gemini-cli": render_gemini_cli,
+                                "copilot-cli": render_copilot, "antigravity": render_antigravity}[fmt]
+                    extra = {"harness": u.path.rsplit("/", 1)[-1]} if fmt == "claude-code" else {}
+                    out = renderer(verdict, kind=event.kind, tool_response=raw, **extra)
+                    data = json.dumps(out, separators=(",", ":")).encode() if out else b""
+                    self.send_response(200)
+                    self.send_header("Content-Type", "application/json")
+                    self.send_header("Content-Length", str(len(data)))
+                    self.end_headers()
+                    self.wfile.write(data)
+                    return
+                self._send(200, verdict.model_dump())
+
+        return Handler

interlockd/auth.py

@@ -0,0 +1,38 @@
+"""Per-install bearer token (design D6). Created on first serve, mode 0600, compared in constant time."""
+
+from __future__ import annotations
+
+import hmac
+import os
+import secrets
+from pathlib import Path
+
+
+def load_or_create_token(path: Path) -> str:
+    if path.exists():
+        return path.read_text().strip()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    token = secrets.token_urlsafe(32)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(token + "\n")
+    return token
+
+
+def check_bearer(header_value: str | None, token: str) -> bool:
+    if not header_value or not header_value.startswith("Bearer "):
+        return False
+    return hmac.compare_digest(header_value[7:].strip(), token)
+
+
+def rotate_token(path: Path) -> str:
+    """Replace the token atomically (mode 0600 from creation). Hooks read it per call; the daemon needs a restart."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    token = secrets.token_urlsafe(32)
+    tmp = path.with_name(path.name + ".new")
+    tmp.unlink(missing_ok=True)
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(token + "\n")
+    os.replace(tmp, path)
+    return token