interlockd 0.1.0__py3-none-any.whl

interlockd/insights.py

@@ -0,0 +1,316 @@
+"""`interlock report` (what the gate decided, from the local spool) and `interlock doctor` (is protection actually on).
+
+Both read only local state: the spool, the install manifest, the hook files, and the daemon's health endpoint.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+import urllib.request
+from collections import Counter
+from dataclasses import dataclass, field
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+from typing import Any
+
+from . import __version__
+
+STOPPED = ("block", "ask", "withhold")
+
+
+# ------------------------------------------------------------------------------------------------ report
+
+
+@dataclass
+class Report:
+    days: int
+    total: int = 0
+    pre: int = 0
+    post: int = 0
+    by_disposition: Counter = field(default_factory=Counter)
+    shadow_would: Counter = field(default_factory=Counter)     # decisions recorded in shadow that enforce would apply
+    enforced: Counter = field(default_factory=Counter)
+    rules: Counter = field(default_factory=Counter)
+    agents: Counter = field(default_factory=Counter)
+    examples: list[dict] = field(default_factory=list)
+    latencies: list[float] = field(default_factory=list)
+    unjudged: int = 0
+    gateway_hidden: list[str] = field(default_factory=list)     # "server/tool: reason" from the MCP gateway log
+    gateway_pinned: int = 0
+
+    def p(self, q: float) -> float:
+        xs = sorted(self.latencies)
+        return round(xs[min(len(xs) - 1, int(q * len(xs)))], 1) if xs else 0.0
+
+
+def _detail(rec: dict) -> str:
+    a = rec.get("arguments") or {}
+    d = a.get("command") or a.get("path") or a.get("file_path") or a.get("url") or a.get("query") or ""
+    return str(d).replace("\n", " ")[:90]
+
+
+def build_report(records: list[dict], *, days: int = 7, now: datetime | None = None) -> Report:
+    now = now or datetime.now(UTC)
+    cutoff = now - timedelta(days=days)
+    r = Report(days=days)
+    for rec in records:
+        if str(rec.get("session_id") or "").startswith("interlock-selftest"):
+            continue
+        try:
+            ts = datetime.fromisoformat(rec.get("received_at", ""))
+        except ValueError:
+            continue
+        if ts < cutoff:
+            continue
+        r.total += 1
+        r.pre += rec.get("kind") == "pre_action"
+        r.post += rec.get("kind") == "post_action"
+        disp = rec.get("disposition", "?")
+        r.by_disposition[disp] += 1
+        r.agents[rec.get("agent_type") or rec.get("adapter") or "?"] += 1
+        if rec.get("unjudged"):
+            r.unjudged += 1
+        t = (rec.get("timing_ms") or {}).get("total")
+        if isinstance(t, (int, float)):
+            r.latencies.append(float(t))
+        if disp in STOPPED or disp == "warn":
+            (r.shadow_would if rec.get("mode") == "shadow" else r.enforced)[disp] += 1
+            for f in rec.get("findings") or []:
+                if f.get("rule") and not str(f.get("category", "")).startswith("x.interlock"):
+                    r.rules[f["rule"]] += 1
+            if disp in STOPPED and len(r.examples) < 8:
+                r.examples.append({"at": rec.get("received_at", "")[:16].replace("T", " "), "disposition": disp,
+                                   "mode": rec.get("mode"), "tool": rec.get("tool_name"), "detail": _detail(rec),
+                                   "reason": (rec.get("reason") or "")[:90]})
+    return r
+
+
+def add_gateway_log(r: Report, log: Path, *, now: datetime | None = None) -> None:
+    """Tool-list interventions live in ~/.interlock/mcp-proxy.log (calls and results are already in the spool)."""
+    if not log.exists():
+        return
+    cutoff = ((now or datetime.now(UTC)) - timedelta(days=r.days)).strftime("%Y-%m-%dT%H:%M:%SZ")
+    for line in log.read_text(errors="replace").splitlines():
+        if line[:20] < cutoff:
+            continue
+        try:
+            server = line.split("[", 1)[1].split("]", 1)[0]
+            msg = line.split("] ", 1)[1]
+        except IndexError:
+            continue
+        for marker in ("hid tool ", "would hide (shadow) tool "):
+            if msg.startswith(marker):
+                tool, _, why = msg[len(marker):].partition(": ")
+                entry = f"{server}/{tool}: {why[:80]}" + (" (shadow)" if "shadow" in marker else "")
+                if entry not in r.gateway_hidden:
+                    r.gateway_hidden.append(entry)
+        if msg.startswith("pinned "):
+            r.gateway_pinned += int(msg.split()[1])
+
+
+def format_report(r: Report) -> str:
+    if r.total == 0 and not r.gateway_hidden:
+        return (f"No decisions recorded in the last {r.days} days. Is the daemon running and are hooks installed? "
+                "Try `interlock doctor`.")
+    lines = [f"Interlock report: last {r.days} days", "",
+             f"  {r.total} decisions ({r.pre} before a tool ran, {r.post} on tool results) across "
+             + ", ".join(f"{n} {a}" for a, n in r.agents.most_common()),
+             f"  latency p50 {r.p(0.5)} ms, p95 {r.p(0.95)} ms"]
+    if r.shadow_would:
+        lines.append("  in shadow mode, enforce would have: " + ", ".join(
+            f"{_verb(d)} {n}" for d, n in r.shadow_would.most_common()))
+    if r.enforced:
+        lines.append("  enforced: " + ", ".join(f"{_verb(d)} {n}" for d, n in r.enforced.most_common()))
+    if not r.shadow_would and not r.enforced:
+        lines.append("  nothing was blocked, asked, or withheld")
+    if r.unjudged:
+        lines.append(f"  {r.unjudged} decisions were partly unjudged (a detector was unavailable)")
+    if r.rules:
+        lines += ["", "Top rules:"] + [f"  {n:>4}  {rule}" for rule, n in r.rules.most_common(8)]
+    if r.gateway_hidden or r.gateway_pinned:
+        lines += ["", f"MCP gateway: {r.gateway_pinned} tool definitions pinned; hidden from the agent:"]
+        lines += [f"  {h}" for h in r.gateway_hidden[:10]] or ["  none"]
+    if r.examples:
+        lines += ["", "Recent stops:"] + [
+            f"  {e['at']}  {e['disposition']:<8}{' (shadow)' if e['mode'] == 'shadow' else '         '} {e['tool']:<10} {e['detail']}"
+            for e in r.examples]
+    if r.shadow_would:
+        lines += ["", ("Ready to enforce? `interlock enforce`. Too noisy? override a rule in ~/.interlock/policy.yaml "
+                       "(packs.overrides) and rerun this report.")]
+    return "\n".join(lines)
+
+
+def _verb(d: str) -> str:
+    return {"block": "blocked", "ask": "asked on", "withhold": "withheld", "warn": "warned on"}.get(d, d)
+
+
+# ------------------------------------------------------------------------------------------------ doctor
+
+
+@dataclass
+class Check:
+    ok: bool
+    name: str
+    detail: str
+    fix: str = ""
+    warn: bool = False      # a soft finding: reported, does not fail the run
+
+
+def _health(listen: str) -> dict[str, Any] | None:
+    host, _, port = listen.rpartition(":")
+    try:
+        with urllib.request.urlopen(f"http://{host or '127.0.0.1'}:{port}/interlock/v1/health", timeout=1.5) as r:
+            return json.loads(r.read().decode())
+    except Exception:  # noqa: BLE001
+        return None
+
+
+def expected_shim(harness: str) -> str | None:
+    from .cli import CLAUDE_SHIM_SRC, HOOK_SHIMS
+
+    if harness in ("claude-code", "codex", "cursor", "gemini-cli", "copilot-cli", "windsurf", "antigravity"):
+        return CLAUDE_SHIM_SRC.read_text().replace("__HARNESS__", harness)
+    if harness == "kiro":
+        return HOOK_SHIMS["sh"].read_text()
+    if harness == "opencode":
+        from . import __version__
+        from .cli import OPENCODE_PLUGIN_SRC
+
+        return OPENCODE_PLUGIN_SRC.read_text().replace("__VERSION__", __version__)
+    return None
+
+
+def _has_interlock_hook(f: Path, home: Path) -> str | None:
+    """The shim path an existing hook file points at, if it is one of ours (covers installs made before the manifest)."""
+    if not f.exists():
+        return None
+    text = f.read_text(errors="replace")
+    for name in ("claude-code", "codex", "cursor", "gemini-cli", "copilot-cli", "windsurf", "antigravity", "kiro"):
+        shim_dir = str(home / "adapters" / name)
+        if shim_dir in text:
+            for shim in (home / "adapters" / name).glob("interlock-hook.*"):
+                if str(shim) in text:
+                    return str(shim)
+    return None
+
+
+def run_doctor(home: Path, listen: str, workspace_root: str | None = None) -> list[Check]:
+    from .onboard import Manifest, detect
+    from .policy import load_policy
+
+    out: list[Check] = []
+    token = home / "token"
+    if not token.exists():
+        out.append(Check(False, "token", f"{token} missing", "run `interlock init`"))
+    else:
+        mode = stat.S_IMODE(token.stat().st_mode)
+        out.append(Check(mode & 0o077 == 0, "token", f"{token} mode {oct(mode)}", f"chmod 600 {token}"))
+        if token.stat().st_uid != os.getuid():
+            out.append(Check(False, "token owner", "token is owned by another user", f"chown $USER {token}"))
+
+    h = _health(listen)
+    if h is None:
+        out.append(Check(False, "daemon", f"not answering on http://{listen}", "run `interlock start`; logs in ~/.interlock/interlockd.log"))
+    else:
+        out.append(Check(True, "daemon", f"running {h.get('version')} on http://{listen}, mode {h.get('mode')}"))
+        if h.get("version") != __version__:
+            out.append(Check(False, "version", f"daemon {h.get('version')} vs CLI {__version__}", "run `interlock restart`"))
+
+    try:
+        pol = load_policy(workspace_root, home=home)      # the same layers the daemon loads
+        live = (h or {}).get("mode") or pol.mode
+        out.append(Check(True, "policy", f"valid: {pol.source_paths or ['built-in defaults']}, mode {pol.mode}"))
+        if h and h.get("mode") != pol.mode:
+            out.append(Check(True, "mode", f"daemon runs {h.get('mode')} but the policy on disk says {pol.mode}",
+                             "run `interlock restart` to apply the policy", warn=True))
+        from .policy_lint import lint
+
+        issues = lint(pol)
+        errs = [i for i in issues if i.level == "error"]
+        if errs:
+            out.append(Check(False, "policy lint", f"{errs[0].where}: {errs[0].message}" + (f" (+{len(errs) - 1} more)" if len(errs) > 1 else ""),
+                             "interlock policy lint"))
+        if live == "shadow":
+            out.append(Check(True, "mode", "shadow: decisions are recorded, nothing is blocked", "`interlock enforce` when ready", warn=True))
+    except Exception as e:  # noqa: BLE001
+        out.append(Check(False, "policy", f"invalid: {str(e)[:160]}", f"fix {home / 'policy.yaml'}"))
+
+    man = Manifest.load(home)
+    hooked = set()
+    for hk in (man.hooks if man else []):
+        f, marker = Path(hk["file"]), hk["marker"]
+        hooked.add(hk["harness"])
+        if not f.exists() or marker not in f.read_text():
+            out.append(Check(False, f"hooks {hk['harness']}", f"Interlock hook missing from {f} (removed or edited)",
+                             f"run `interlock init --yes --harness {hk['harness']}`"))
+            continue
+        shim = Path(marker)
+        want = expected_shim(hk["harness"])
+        if not shim.exists():
+            out.append(Check(False, f"hooks {hk['harness']}", f"shim {shim} missing", "run `interlock init --yes`"))
+        elif want is not None and shim.read_text() != want:
+            out.append(Check(False, f"hooks {hk['harness']}", f"shim {shim} differs from the installed version (tampered or outdated)",
+                             "run `interlock init --yes` to reinstall it"))
+        else:
+            out.append(Check(True, f"hooks {hk['harness']}", f"{f}"))
+    for d in detect():
+        if not (d.present and d.target) or d.name in hooked:
+            continue
+        shim = _has_interlock_hook(d.target, home)
+        if shim:
+            hooked.add(d.name)
+            want = expected_shim(d.name)
+            same = Path(shim).exists() and (want is None or Path(shim).read_text() == want)
+            out.append(Check(same, f"hooks {d.name}", f"{d.target} (installed with `interlock install`)" if same else
+                             f"shim {shim} differs from the packaged version (tampered or outdated)",
+                             "" if same else f"run `interlock init --yes --harness {d.name}`"))
+        else:
+            out.append(Check(True, f"hooks {d.name}", f"{d.name} is installed but not protected",
+                             f"run `interlock init --yes --harness {d.name}`", warn=True))
+    if not hooked:
+        out.append(Check(False, "hooks", "no Interlock hooks found in any harness", "run `interlock init`"))
+
+    sd = home / "spool"
+    if sd.exists():
+        from .store.spool import Spool
+
+        r = Spool(sd, fsync=False).verify()
+        out.append(Check(r["ok"], "audit log", f"intact: {r['records']} chained records" + (f" (+{r['legacy']} legacy)" if r["legacy"] else "")
+                         if r["ok"] else f"BROKEN at {r['break']['segment']} line {r['break']['line']}: {r['break']['reason']}",
+                         "" if r["ok"] else "investigate: the local audit log was modified outside Interlock"))
+    try:
+        from . import gateway
+
+        rows = [c for c in gateway.status() if c.action in ("wrapped", "unwrapped")]   # coverable stdio servers
+        bare = [f"{c.agent}/{c.server}" for c in rows if c.action == "unwrapped"]
+        if rows:
+            out.append(Check(True, "mcp gateway", (f"{len(rows) - len(bare)} of {len(rows)} stdio MCP servers go through the gateway"
+                                                  + (f"; not: {', '.join(bare[:5])}" if bare else "")),
+                             "interlock gateway wrap" if bare else "", warn=bool(bare)))
+    except Exception as e:  # noqa: BLE001  a config we can't parse must not break doctor
+        out.append(Check(True, "mcp gateway", f"could not read MCP configs ({type(e).__name__})", warn=True))
+
+    log = home / "hook.log"
+    if log.exists():
+        recent = [ln for ln in log.read_text(errors="replace").splitlines()[-200:] if "unjudged" in ln or "inert" in ln]
+        cutoff = (datetime.now(UTC) - timedelta(days=1)).strftime("%Y-%m-%dT%H:%M:%SZ")
+        last_day = [ln for ln in recent if ln[:20] >= cutoff]
+        if last_day:
+            out.append(Check(True, "fail-open", f"{len(last_day)} hook calls in the last day could not reach the daemon "
+                             f"(see {log})", "keep the daemon running: `interlock start`", warn=True))
+    return out
+
+
+def format_doctor(checks: list[Check]) -> tuple[str, int]:
+    lines, failed = [], 0
+    for c in checks:
+        mark = "!" if c.warn else ("✓" if c.ok else "✗")
+        failed += (not c.ok) and not c.warn
+        lines.append(f"  {mark} {c.name:<18} {c.detail}")
+        if (not c.ok or c.warn) and c.fix:
+            lines.append(f"    {'':<18} → {c.fix}")
+    lines.append("")
+    lines.append("All checks passed." if failed == 0 else f"{failed} problem{'s' if failed > 1 else ''} found.")
+    return "\n".join(lines), (1 if failed else 0)

interlockd/integrations/__init__.py

@@ -0,0 +1,2 @@
+"""In-process integrations for agent frameworks (Strands Agents, LangChain / LangGraph). Each imports its framework
+lazily, so interlockd itself never depends on them."""

interlockd/integrations/client.py

@@ -0,0 +1,85 @@
+"""A small client for the local Interlock daemon, shared by framework integrations.
+
+    from interlockd.integrations.client import InterlockClient
+    v = InterlockClient().decide("pre_action", "shell", {"command": "git push --force origin main"})
+    if InterlockClient.stops(v): ...
+
+Reads the token, the daemon address, and the fail mode from ~/.interlock (or INTERLOCK_HOME / INTERLOCK_URL), like
+the hook shims. Returns the daemon's verdict dict, or None when the daemon can't be reached (apply `fails_closed()`).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import urllib.request
+from pathlib import Path
+from typing import Any
+
+from .. import __version__
+
+
+class InterlockClient:
+    def __init__(self, *, home: str | Path | None = None, url: str | None = None, token: str | None = None,
+                 agent_type: str = "sdk", session: str | None = None, timeout: float = 1.5):
+        self.home = Path(home or os.environ.get("INTERLOCK_HOME") or "~/.interlock").expanduser()
+        self._url, self._token = url or os.environ.get("INTERLOCK_URL"), token
+        self.agent_type, self.session, self.timeout = agent_type, session, timeout
+
+    @property
+    def url(self) -> str:
+        if self._url:
+            return self._url.rstrip("/")
+        try:
+            listen = json.loads((self.home / "daemon.json").read_text()).get("listen") or "127.0.0.1:7391"
+        except (OSError, ValueError):
+            listen = "127.0.0.1:7391"
+        return f"http://{listen}"
+
+    @property
+    def token(self) -> str:
+        if self._token is None:
+            try:
+                self._token = (self.home / "token").read_text().strip()
+            except OSError:
+                self._token = ""
+        return self._token
+
+    def fails_closed(self) -> bool:
+        env = os.environ.get("INTERLOCK_FAIL_MODE")
+        if env in ("open", "closed"):
+            return env == "closed"
+        try:
+            return json.loads((self.home / "fail-mode.json").read_text()).get("default") == "closed"
+        except (OSError, ValueError):
+            return False
+
+    def decide(self, kind: str, tool: str, arguments: dict | None = None, *, content: str | None = None,
+               session: str | None = None, cwd: str | None = None, withhold: bool = True) -> dict[str, Any] | None:
+        if not self.token:
+            return None
+        event: dict[str, Any] = {
+            "kind": kind, "adapter": {"name": self.agent_type, "version": __version__},
+            "session_hint": session or self.session, "identity": {"agent_type": self.agent_type},
+            "tool_call": {"name": str(tool), "arguments": arguments if isinstance(arguments, dict) else {"value": arguments}},
+            "context": {"cwd": cwd or os.getcwd()}, "capabilities": {"ask": False, "rewrite": False, "withhold": withhold}}
+        if content is not None:
+            event["result"] = {"content": content[:200_000]}
+        req = urllib.request.Request(f"{self.url}/interlock/v1/decide", data=json.dumps(event).encode(), method="POST")
+        req.add_header("authorization", f"Bearer {self.token}")
+        req.add_header("content-type", "application/json")
+        try:
+            with urllib.request.urlopen(req, timeout=self.timeout if kind == "pre_action" else self.timeout + 1) as r:
+                return json.loads(r.read())
+        except Exception:  # noqa: BLE001  unreachable daemon: the caller applies fails_closed()
+            return None
+
+    @staticmethod
+    def stops(v: dict | None) -> bool:
+        return bool(v) and v.get("mode") == "enforce" and v.get("disposition") in ("block", "ask")
+
+    @staticmethod
+    def withholds(v: dict | None) -> bool:
+        return bool(v) and v.get("mode") == "enforce" and v.get("disposition") == "withhold"
+
+    UNREACHABLE = "[interlock] This action was NOT executed: the Interlock daemon is unreachable and this machine fails closed."

interlockd/integrations/langchain.py

@@ -0,0 +1,59 @@
+"""Interlock for LangChain and LangGraph: wrap tools so every call is gated and every result checked.
+
+    from interlockd.integrations.langchain import guard_tools
+    tools = guard_tools([search, shell, ...])
+    agent = create_react_agent(model, tools)          # or ToolNode(tools), AgentExecutor(tools=tools)
+
+A refused call returns Interlock's notice as the tool's output (the tool never runs), which the model reads like any
+tool error; a withheld result is replaced by the notice. Built against langchain-core 1.6.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from .client import InterlockClient
+
+
+def guard_tools(tools: list[Any], client: InterlockClient | None = None, *, session: str | None = None) -> list[Any]:
+    from langchain_core.tools import BaseTool
+
+    client = client or InterlockClient(agent_type="langchain")
+
+    class GuardedTool(BaseTool):
+        inner: Any = None
+
+        def _decide_pre(self, args: dict) -> str | None:
+            v = client.decide("pre_action", self.name, args, session=session)
+            if v is None:
+                return InterlockClient.UNREACHABLE if client.fails_closed() else None
+            return (v.get("notice") or f"[interlock] refused: {v.get('reason')}") if InterlockClient.stops(v) else None
+
+        def _decide_post(self, args: dict, out: Any) -> Any:
+            text = out if isinstance(out, str) else str(getattr(out, "content", out))
+            v = client.decide("post_action", self.name, args, content=text, session=session)
+            return (v.get("notice") or "[interlock] tool result withheld") if InterlockClient.withholds(v) else out
+
+        def _run(self, *args: Any, **kwargs: Any) -> Any:
+            kwargs.pop("run_manager", None)
+            refusal = self._decide_pre(kwargs)
+            if refusal:
+                return refusal
+            return self._decide_post(kwargs, self.inner.invoke(kwargs if kwargs else (args[0] if args else {})))
+
+        async def _arun(self, *args: Any, **kwargs: Any) -> Any:
+            kwargs.pop("run_manager", None)
+            refusal = self._decide_pre(kwargs)
+            if refusal:
+                return refusal
+            return self._decide_post(kwargs, await self.inner.ainvoke(kwargs if kwargs else (args[0] if args else {})))
+
+    out = []
+    for t in tools:
+        if not isinstance(t, BaseTool):
+            from langchain_core.tools import tool as as_tool
+
+            t = as_tool(t)
+        out.append(GuardedTool(name=t.name, description=t.description, args_schema=t.args_schema, inner=t,
+                               return_direct=getattr(t, "return_direct", False)))
+    return out

interlockd/integrations/openai_agents.py

@@ -0,0 +1,72 @@
+"""Interlock for the OpenAI Agents SDK: native tool guardrails on every function tool.
+
+    from agents import Agent
+    from interlockd.integrations.openai_agents import guard_agent_tools
+    agent = guard_agent_tools(Agent(name="dev", tools=[shell, search]))
+
+Uses the SDK's own ToolInputGuardrail / ToolOutputGuardrail: a refused call or a withheld result becomes
+`reject_content(<notice>)`, so the tool never runs (or its output is replaced) and the model reads the notice.
+Built against openai-agents 0.24.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+from .client import InterlockClient
+
+
+def interlock_guardrails(client: InterlockClient | None = None, *, session: str | None = None):
+    """(input_guardrail, output_guardrail) to add to any FunctionTool."""
+    from agents import ToolGuardrailFunctionOutput, tool_input_guardrail, tool_output_guardrail
+
+    client = client or InterlockClient(agent_type="openai-agents")
+
+    def _args(ctx: Any) -> dict:
+        raw = getattr(ctx, "tool_arguments", None) or "{}"
+        try:
+            v = json.loads(raw) if isinstance(raw, str) else raw
+        except ValueError:
+            v = {"value": raw}
+        return v if isinstance(v, dict) else {"value": v}
+
+    @tool_input_guardrail(name="interlock")
+    def interlock_input(data: Any) -> Any:
+        ctx = data.context
+        v = client.decide("pre_action", ctx.tool_name, _args(ctx), session=session)
+        if v is None:
+            return ToolGuardrailFunctionOutput.reject_content(InterlockClient.UNREACHABLE) if client.fails_closed() \
+                else ToolGuardrailFunctionOutput.allow()
+        if InterlockClient.stops(v):
+            return ToolGuardrailFunctionOutput.reject_content(v.get("notice") or f"[interlock] refused: {v.get('reason')}",
+                                                               output_info={"rules": [f.get("rule") for f in v.get("findings") or []]})
+        return ToolGuardrailFunctionOutput.allow()
+
+    @tool_output_guardrail(name="interlock")
+    def interlock_output(data: Any) -> Any:
+        ctx = data.context
+        out = data.output
+        text = out if isinstance(out, str) else json.dumps(out, default=str)
+        v = client.decide("post_action", ctx.tool_name, _args(ctx), content=text, session=session)
+        if InterlockClient.withholds(v):
+            return ToolGuardrailFunctionOutput.reject_content(v.get("notice") or "[interlock] tool result withheld")
+        return ToolGuardrailFunctionOutput.allow()
+
+    return interlock_input, interlock_output
+
+
+def guard_agent_tools(agent: Any, client: InterlockClient | None = None, *, session: str | None = None) -> Any:
+    """Attach Interlock's guardrails to every FunctionTool on the agent (idempotent). Returns the agent."""
+    from agents import FunctionTool
+
+    gin, gout = interlock_guardrails(client, session=session)
+    for t in agent.tools:
+        if isinstance(t, FunctionTool):
+            ins = list(t.tool_input_guardrails or [])
+            outs = list(t.tool_output_guardrails or [])
+            if not any(getattr(g, "name", None) == "interlock" for g in ins):
+                t.tool_input_guardrails = [*ins, gin]
+            if not any(getattr(g, "name", None) == "interlock" for g in outs):
+                t.tool_output_guardrails = [*outs, gout]
+    return agent

interlockd/integrations/strands.py

@@ -0,0 +1,69 @@
+"""Interlock for Strands Agents: a HookProvider that gates every tool call and checks every tool result.
+
+    from strands import Agent
+    from interlockd.integrations.strands import InterlockHooks
+    agent = Agent(tools=[...], hooks=[InterlockHooks()])
+
+BeforeToolCallEvent: a refusal sets `cancel_tool` to Interlock's notice (Strands returns it to the model as an error
+tool result, and the tool never runs). AfterToolCallEvent: a withhold replaces `result` with the notice. Measured
+against strands-agents 1.61.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+from .client import InterlockClient
+
+
+def _text(result: Any) -> str:
+    if isinstance(result, dict):
+        parts = []
+        for c in result.get("content") or []:
+            if isinstance(c, dict):
+                if isinstance(c.get("text"), str):
+                    parts.append(c["text"])
+                elif "json" in c:
+                    parts.append(json.dumps(c["json"]))
+        return "\n".join(parts)
+    return "" if result is None else str(result)
+
+
+class InterlockHooks:
+    """Strands HookProvider (duck-typed; Strands checks `register_hooks`)."""
+
+    def __init__(self, client: InterlockClient | None = None, *, session: str | None = None):
+        self.client = client or InterlockClient(agent_type="strands")
+        self.session = session
+
+    def register_hooks(self, registry: Any, **kwargs: Any) -> None:
+        from strands.hooks import AfterToolCallEvent, BeforeToolCallEvent
+
+        registry.add_callback(BeforeToolCallEvent, self.before_tool)
+        registry.add_callback(AfterToolCallEvent, self.after_tool)
+
+    def _session(self, event: Any) -> str | None:
+        return self.session or getattr(getattr(event, "agent", None), "agent_id", None) or getattr(getattr(event, "agent", None), "name", None)
+
+    def before_tool(self, event: Any) -> None:
+        tu = event.tool_use
+        v = self.client.decide("pre_action", tu.get("name", ""), tu.get("input") or {}, session=self._session(event))
+        if v is None:
+            if self.client.fails_closed():
+                event.cancel_tool = InterlockClient.UNREACHABLE
+            return
+        if InterlockClient.stops(v):
+            event.cancel_tool = v.get("notice") or f"[interlock] refused: {v.get('reason')}"
+
+    def after_tool(self, event: Any) -> None:
+        if getattr(event, "cancel_message", None) or not isinstance(event.result, dict):
+            return
+        text = _text(event.result)
+        if not text.strip():
+            return
+        tu = event.tool_use
+        v = self.client.decide("post_action", tu.get("name", ""), tu.get("input") or {}, content=text, session=self._session(event))
+        if InterlockClient.withholds(v):
+            event.result = {"toolUseId": event.result.get("toolUseId", tu.get("toolUseId")), "status": "success",
+                            "content": [{"text": v.get("notice") or "[interlock] tool result withheld"}]}