interlockd 0.1.0__py3-none-any.whl

interlockd/mcp_server.py

@@ -0,0 +1,211 @@
+"""`interlock mcp`: Interlock as an MCP server (stdio, JSON-RPC 2.0, newline-delimited), for use inside an agent.
+
+Advisory and read-only by design. Enforcement lives in the hooks, which the agent cannot skip; this server only
+answers questions: what would the gate decide for this action, what was stopped and why, are my MCP servers risky,
+is protection on. It can make an agent more careful, never less: no tool approves an action, changes the mode, or
+edits policy (`suggest_rule_override` returns a snippet for a human to apply).
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+import tempfile
+from pathlib import Path
+from typing import Any, TextIO
+
+from . import __version__
+from .config import Settings
+
+PROTOCOL_VERSION = "2025-06-18"
+
+TOOLS: list[dict[str, Any]] = [
+    {"name": "check_action",
+     "description": ("Ask Interlock what its gate would decide for an action BEFORE you take it: a shell command, or "
+                     "any tool with arguments. Returns allow / ask / block with the rules that fired. Advisory: the "
+                     "real gate still runs on the actual call."),
+     "inputSchema": {"type": "object", "properties": {
+         "command": {"type": "string", "description": "A shell command to check"},
+         "tool": {"type": "string", "description": "Tool name, e.g. Bash, Write, WebFetch (default: Bash when command is set)"},
+         "arguments": {"type": "object", "description": "Tool arguments, e.g. {\"file_path\": \"...\"}"},
+         "cwd": {"type": "string", "description": "Working directory (default: the server's cwd)"}}}},
+    {"name": "explain_decision",
+     "description": "Explain an Interlock decision: why a call was blocked, asked, warned on, or withheld. Pass an event_id, or omit it for the most recent stop.",
+     "inputSchema": {"type": "object", "properties": {"event_id": {"type": "string"}}}},
+    {"name": "recent_decisions",
+     "description": "List recent Interlock decisions (newest first). Set only_stops to see just blocks, asks, warnings, and withholds.",
+     "inputSchema": {"type": "object", "properties": {"limit": {"type": "integer", "default": 10, "maximum": 50},
+                                                      "only_stops": {"type": "boolean", "default": True}}}},
+    {"name": "scan_mcp_servers",
+     "description": "Audit the MCP servers and agent settings on this machine (static; nothing is run or contacted; secrets are never shown).",
+     "inputSchema": {"type": "object", "properties": {"project": {"type": "string"}}}},
+    {"name": "interlock_status",
+     "description": "Is Interlock protecting this machine? Daemon, mode, policy, hooks per agent, shim integrity.",
+     "inputSchema": {"type": "object", "properties": {}}},
+    {"name": "suggest_rule_override",
+     "description": ("Draft the policy snippet that would change how one rule behaves (e.g. a false positive). Returns "
+                     "YAML for the user to review and add themselves; it does not change any policy."),
+     "inputSchema": {"type": "object", "required": ["rule_id", "action"], "properties": {
+         "rule_id": {"type": "string"}, "action": {"type": "string", "enum": ["block", "ask", "flag", "allow"]},
+         "reason": {"type": "string"}}}},
+]
+
+
+class InterlockMCP:
+    def __init__(self, settings: Settings | None = None):
+        self.settings = settings or Settings.load()
+
+    # ---- tools
+    def check_action(self, command: str | None = None, tool: str | None = None, arguments: dict | None = None,
+                     cwd: str | None = None) -> dict:
+        from .models import AdapterInfo, Context, Identity, InterlockEvent, ToolCall
+        from .pipeline import Daemon
+        from .policy import load_policy
+        from .store.memory import MemoryRepository
+        from .store.spool import Spool
+
+        if not command and not tool:
+            return {"error": "pass a command, or a tool with arguments"}
+        args = dict(arguments or {})
+        if command:
+            args.setdefault("command", command)
+        name = tool or "Bash"
+        cwd = cwd or str(Path.cwd())
+        pol = load_policy(cwd, home=self.settings.home)
+        pol.mode = "enforce"                      # answer "what would enforce do", whatever the live mode is
+        if not pol.trust.workspace_roots:
+            pol.trust.workspace_roots = [cwd]
+        with tempfile.TemporaryDirectory() as td:   # nothing from a what-if lands in the real audit log
+            d = Daemon(self.settings, spool=Spool(Path(td)), repo=MemoryRepository(), policy=pol)
+            v = d.decide(InterlockEvent(kind="pre_action", adapter=AdapterInfo(name="interlock-mcp", version=__version__),
+                                        identity=Identity(agent_type="interlock-mcp"), tool_call=ToolCall(name=name, arguments=args),
+                                        context=Context(cwd=cwd)))
+        return {"decision": v.disposition, "reason": v.reason,
+                "rules": [{"rule": f.rule, "category": f.category, "severity": f.severity, "subject": f.subject}
+                          for f in v.findings if f.rule],
+                "note": ("Advisory. The gate decides on the real call. If this is blocked and the user truly needs it, "
+                         "ask the user; do not rephrase or split the action to get around the rule.") if v.disposition != "allow" else ""}
+
+    def _records(self, limit: int = 500) -> list[dict]:
+        from .store.spool import Spool
+
+        sd = self.settings.spool_dir
+        recs = Spool(sd, fsync=False).iter_records(limit=limit) if sd.exists() else []
+        return [r for r in recs if not str(r.get("session_id") or "").startswith("interlock-selftest")]
+
+    def explain_decision(self, event_id: str | None = None) -> dict:
+        from .det.describe import why
+
+        recs = self._records()
+        rec = next((r for r in recs if r.get("event_id") == event_id), None) if event_id else \
+            next((r for r in recs if r.get("disposition") in ("block", "ask", "warn", "withhold")), None)
+        if not rec:
+            return {"error": "no such decision" if event_id else "no recent blocks, asks, warnings, or withholds"}
+        return {"event_id": rec.get("event_id"), "at": rec.get("received_at"), "agent": rec.get("agent_type"),
+                "tool": rec.get("tool_name"), "kind": rec.get("kind"), "decision": rec.get("disposition"),
+                "mode": rec.get("mode"), "reason": rec.get("reason"),
+                "rules": [{"rule": f.get("rule"), "category": f.get("category"), "severity": f.get("severity"),
+                           "detector": f.get("detector"), "score": f.get("score"), "why": why(f.get("rule"))}
+                          for f in rec.get("findings") or []],
+                "what_to_do": ("Pursue the user's goal another legitimate way, or ask the user. If this is a false "
+                               "positive, the user can override the rule (see suggest_rule_override).")}
+
+    def recent_decisions(self, limit: int = 10, only_stops: bool = True) -> dict:
+        limit = max(1, min(int(limit or 10), 50))
+        out = []
+        for r in self._records():
+            if only_stops and r.get("disposition") not in ("block", "ask", "warn", "withhold"):
+                continue
+            a = r.get("arguments") or {}
+            out.append({"event_id": r.get("event_id"), "at": r.get("received_at"), "agent": r.get("agent_type"),
+                        "tool": r.get("tool_name"), "decision": r.get("disposition"), "mode": r.get("mode"),
+                        "target": str(a.get("command") or a.get("file_path") or a.get("path") or a.get("url") or "")[:120],
+                        "reason": (r.get("reason") or "")[:160]})
+            if len(out) >= limit:
+                break
+        return {"decisions": out}
+
+    def scan_mcp_servers(self, project: str | None = None) -> dict:
+        from .scan import run_scan
+
+        r = run_scan(Path.home(), self.settings.home, Path(project or Path.cwd()).expanduser().resolve())
+        j = r.to_json()
+        return {"servers": [{k: s[k] for k in ("agent", "name", "transport", "command", "url", "disabled")} for s in j["servers"]],
+                "findings": [f for f in j["findings"] if f["severity"] != "info"]}
+
+    def interlock_status(self) -> dict:
+        from .insights import run_doctor
+
+        checks = run_doctor(self.settings.home, self.settings.listen,
+                            self.settings.workspace_roots[0] if self.settings.workspace_roots else None)
+        return {"ok": all(c.ok or c.warn for c in checks),
+                "checks": [{"check": c.name, "ok": c.ok, "warning": c.warn, "detail": c.detail, "fix": c.fix} for c in checks]}
+
+    def suggest_rule_override(self, rule_id: str, action: str, reason: str | None = None) -> dict:
+        from .det import (
+            RULES,
+            packs,  # noqa: F401  registers the rules
+        )
+
+        if rule_id not in RULES:
+            return {"error": f"unknown rule {rule_id!r}", "hint": "rule ids appear in check_action and explain_decision results"}
+        snippet = f"packs:\n  overrides:\n    {rule_id}: {{ action: {action} }}" + (f"   # {reason}" if reason else "")
+        return {"apply_to": str(self.settings.home / "policy.yaml") + " (user) or <repo>/.interlock/policy.yaml (workspace)",
+                "yaml": snippet, "note": "Interlock does not apply this. The user reviews it, adds it, and runs `interlock restart`."}
+
+    # ---- JSON-RPC
+    def call(self, name: str, args: dict) -> dict:
+        fn = {t["name"]: getattr(self, t["name"]) for t in TOOLS}.get(name)
+        if fn is None:
+            raise KeyError(name)
+        return fn(**{k: v for k, v in (args or {}).items() if v is not None})
+
+    def handle(self, msg: dict) -> dict | None:
+        method, mid = msg.get("method"), msg.get("id")
+        if mid is None:                        # notification (e.g. notifications/initialized)
+            return None
+        try:
+            if method == "initialize":
+                result = {"protocolVersion": (msg.get("params") or {}).get("protocolVersion") or PROTOCOL_VERSION,
+                          "capabilities": {"tools": {"listChanged": False}},
+                          "serverInfo": {"name": "interlock", "version": __version__},
+                          "instructions": ("Interlock guards this machine's agent tool calls. Use check_action before "
+                                           "risky shell, git, network, or file actions; use explain_decision when "
+                                           "something was blocked. Never try to get around a block.")}
+            elif method == "ping":
+                result = {}
+            elif method == "tools/list":
+                result = {"tools": TOOLS}
+            elif method == "tools/call":
+                p = msg.get("params") or {}
+                try:
+                    out = self.call(p.get("name", ""), p.get("arguments") or {})
+                    result = {"content": [{"type": "text", "text": json.dumps(out, indent=2, default=str)}],
+                              "structuredContent": out, "isError": "error" in out}
+                except KeyError:
+                    return {"jsonrpc": "2.0", "id": mid, "error": {"code": -32602, "message": f"unknown tool {p.get('name')!r}"}}
+                except TypeError as e:
+                    result = {"content": [{"type": "text", "text": f"bad arguments: {e}"}], "isError": True}
+            else:
+                return {"jsonrpc": "2.0", "id": mid, "error": {"code": -32601, "message": f"method not found: {method}"}}
+        except Exception as e:  # noqa: BLE001  a tool failure must not kill the server
+            result = {"content": [{"type": "text", "text": f"{type(e).__name__}: {e}"}], "isError": True}
+        return {"jsonrpc": "2.0", "id": mid, "result": result}
+
+    def serve(self, stdin: TextIO = sys.stdin, stdout: TextIO = sys.stdout) -> int:
+        for line in stdin:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                msg = json.loads(line)
+            except ValueError:
+                stdout.write(json.dumps({"jsonrpc": "2.0", "id": None, "error": {"code": -32700, "message": "parse error"}}) + "\n")
+                stdout.flush()
+                continue
+            for m in (msg if isinstance(msg, list) else [msg]):
+                reply = self.handle(m) if isinstance(m, dict) else None
+                if reply is not None:
+                    stdout.write(json.dumps(reply, default=str) + "\n")
+                    stdout.flush()
+        return 0

interlockd/models.py

@@ -0,0 +1,98 @@
+"""Wire and audit models. Field names follow phase1-design.md §5.1 and §7."""
+
+from __future__ import annotations
+
+from typing import Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field
+
+Kind = Literal["pre_action", "post_action"]
+Disposition = Literal["allow", "ask", "block", "pass", "warn", "withhold"]
+Mode = Literal["shadow", "enforce"]
+
+
+class Strict(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+
+class AdapterInfo(Strict):
+    name: str
+    version: str = "0"
+
+
+class Identity(Strict):
+    agent_id: str = ""
+    agent_type: str = ""
+    agent_workspace: str = ""
+    agent_user: str = ""
+
+
+class ToolCall(Strict):
+    id: str | None = None
+    name: str
+    arguments: dict[str, Any] = Field(default_factory=dict)
+
+
+class UserMessage(Strict):
+    n: int
+    text: str
+
+
+class Context(Strict):
+    cwd: str | None = None
+    user_messages: list[UserMessage] | None = None
+    prior_tool_calls: list[dict[str, Any]] = Field(default_factory=list)
+    mcp_server: dict[str, Any] | None = None
+    permission_mode: str | None = None
+    transcript_path: str | None = None   # harness transcript the daemon may read for user messages
+
+
+class ToolResult(Strict):
+    content: str
+    truncated: bool = False
+    evidence: dict[str, Any] = Field(default_factory=dict)
+
+
+class Capabilities(Strict):
+    ask: bool = False
+    rewrite: bool = False
+    withhold: bool = False
+
+
+class InterlockEvent(Strict):
+    kind: Kind
+    adapter: AdapterInfo
+    identity: Identity = Field(default_factory=Identity)
+    session_hint: str | None = None
+    tool_call: ToolCall
+    context: Context = Field(default_factory=Context)
+    result: ToolResult | None = None
+    capabilities: Capabilities = Field(default_factory=Capabilities)
+
+
+class Finding(Strict):
+    category: str
+    severity: Literal["low", "medium", "high", "critical"] = "medium"
+    rule: str | None = None
+    detector: str
+    path: str | None = None
+    start: int | None = None
+    end: int | None = None
+    score: float = 1.0
+    subject: str | None = None
+    whitelisted: bool = False
+
+
+class Verdict(Strict):
+    event_id: str
+    disposition: Disposition
+    reason: str | None = None
+    notice: str | None = None
+    updated_arguments: dict[str, Any] | None = None
+    findings: list[Finding] = Field(default_factory=list)
+    unjudged: list[str] = Field(default_factory=list)
+    mode: Mode
+    tier: int
+    action_class: str
+    timing_ms: dict[str, float] = Field(default_factory=dict)
+    explanation_pending: bool = False

interlockd/normalize/__init__.py

@@ -0,0 +1 @@
+"""Harness payload normalizers."""

interlockd/normalize/claude_code.py

@@ -0,0 +1,89 @@
+"""Claude Code (and Codex, which uses the same event schema) hook payload -> InterlockEvent.
+
+Documented PreToolUse fields: session_id, prompt_id, transcript_path, cwd, permission_mode, tool_name, tool_input,
+tool_use_id, mcp_server {name, source}. PostToolUse adds tool_response (shape depends on the tool; Bash carries
+stdout/stderr and may carry bashEditDiff.changedFiles). Written to the published contract; the first real capture
+replaces this docstring with measured facts, as adapters/kiro/PAYLOADS.md did for Kiro.
+"""
+
+from __future__ import annotations
+
+import getpass
+import json
+import socket
+from typing import Any
+
+from ..models import AdapterInfo, Capabilities, Context, Identity, InterlockEvent, ToolCall, ToolResult
+from .kiro import workspace_name
+
+CLAUDE_CAPABILITIES = Capabilities(ask=True, rewrite=True, withhold=True)
+CODEX_CAPABILITIES = Capabilities(ask=True, rewrite=True, withhold=True)   # via decision "block" (measured)
+
+
+def _response_text(resp: Any) -> tuple[str, dict[str, Any]]:
+    """Flatten a tool_response into text plus structured evidence."""
+    evidence: dict[str, Any] = {}
+    if resp is None:
+        return "", evidence
+    if isinstance(resp, str):
+        return resp, evidence
+    if isinstance(resp, dict):
+        for k in ("exit_code", "exitCode", "returncode", "interrupted", "duration_ms"):
+            if k in resp:
+                evidence[k] = resp[k]
+        diff = resp.get("bashEditDiff")
+        if isinstance(diff, dict):
+            evidence["changed_files"] = diff.get("changedFiles") or []
+            for k in ("moreFiles", "unavailable", "skipped", "shared"):
+                if k in diff:
+                    evidence[f"changed_files_{k}"] = diff[k]
+        parts = []
+        for k in ("stdout", "stderr", "output", "content", "text", "result", "file", "message"):
+            v = resp.get(k)
+            if isinstance(v, str) and v:
+                parts.append(v)
+            elif isinstance(v, dict) and isinstance(v.get("content"), str):
+                parts.append(v["content"])
+        if parts:
+            return "\n".join(parts), evidence
+        return json.dumps(resp, ensure_ascii=False)[:200_000], evidence
+    if isinstance(resp, list):
+        texts = [b.get("text", "") if isinstance(b, dict) else str(b) for b in resp]
+        return "\n".join(t for t in texts if t), evidence
+    return str(resp), evidence
+
+
+def normalize_claude_code(payload: dict[str, Any], *, agent_type: str = "claude-code", agent_id: str = "",
+                          adapter_version: str = "0") -> InterlockEvent:
+    hook = str(payload.get("hook_event_name") or "")
+    kind = "post_action" if hook.lower() in ("posttooluse", "posttoolusefailure") else "pre_action"
+    cwd = payload.get("cwd")
+    tool_input = payload.get("tool_input")
+    if not isinstance(tool_input, dict):
+        tool_input = {"value": tool_input} if tool_input is not None else {}
+    result = None
+    if kind == "post_action":
+        text, evidence = _response_text(payload.get("tool_response"))
+        if hook.lower() == "posttoolusefailure":
+            evidence["failed"] = True
+            if payload.get("error"):
+                text = text or str(payload.get("error"))
+        result = ToolResult(content=text, evidence=evidence)
+    mcp = payload.get("mcp_server") if isinstance(payload.get("mcp_server"), dict) else None
+    caps = CLAUDE_CAPABILITIES if agent_type == "claude-code" else CODEX_CAPABILITIES
+    return InterlockEvent(
+        kind=kind,
+        adapter=AdapterInfo(name=agent_type, version=adapter_version),
+        identity=Identity(
+            agent_id=agent_id or f"{agent_type}-{socket.gethostname().split('.')[0]}",
+            agent_type=agent_type,
+            agent_workspace=workspace_name(cwd),
+            agent_user=getpass.getuser(),
+        ),
+        session_hint=payload.get("session_id"),
+        tool_call=ToolCall(id=payload.get("tool_use_id"), name=str(payload.get("tool_name") or ""), arguments=tool_input),
+        context=Context(cwd=cwd, user_messages=None, mcp_server=mcp, permission_mode=payload.get("permission_mode"),
+                        transcript_path=payload.get("transcript_path")),
+        result=result,
+        capabilities=caps,
+    )

interlockd/normalize/cursor.py

@@ -0,0 +1,59 @@
+"""Cursor agent hook payload -> InterlockEvent (https://cursor.com/docs/agent/hooks, read 2026-10-17).
+
+Interlock registers `preToolUse` and `postToolUse` (one generic pair for every tool type: Shell, Read, Write, Grep,
+Delete, Task, MCP:<tool>). The shell-specific `beforeShellExecution` / `afterShellExecution` shapes are accepted too.
+Measured 2026-10-18 on the Cursor CLI (cursor-agent 2026.10.16): see adapters/cursor/PAYLOADS.md.
+"""
+
+from __future__ import annotations
+
+import getpass
+import json
+import socket
+from typing import Any
+
+from ..models import AdapterInfo, Capabilities, Context, Identity, InterlockEvent, ToolCall, ToolResult
+from .claude_code import _response_text
+from .kiro import workspace_name
+
+POST_EVENTS = {"posttooluse", "posttoolusefailure", "aftershellexecution", "aftermcpexecution"}
+
+
+def normalize_cursor(payload: dict[str, Any], *, agent_id: str = "", adapter_version: str = "0") -> InterlockEvent:
+    hook = str(payload.get("hook_event_name") or "")
+    kind = "post_action" if hook.lower() in POST_EVENTS else "pre_action"
+    roots = payload.get("workspace_roots") or []
+    cwd = payload.get("cwd") or (roots[0] if roots else None)
+    name = str(payload.get("tool_name") or "")
+    args = payload.get("tool_input")
+    if hook.lower() in ("beforeshellexecution", "aftershellexecution"):
+        name, args = "Shell", {"command": payload.get("command", "")}
+    if not isinstance(args, dict):
+        args = {"value": args} if args is not None else {}
+    result = None
+    if kind == "post_action":
+        raw = payload.get("tool_output", payload.get("output", payload.get("result_json")))
+        if isinstance(raw, str) and raw[:1] in "{[":   # measured: Cursor sends tool_output as a JSON string
+            try:
+                raw = json.loads(raw)
+            except ValueError:
+                pass
+        text, evidence = _response_text(raw)
+        if hook.lower() == "posttoolusefailure":
+            evidence["failed"] = True
+            text = text or str(payload.get("error_message") or "")
+        result = ToolResult(content=text, evidence=evidence)
+    is_mcp = name.startswith("MCP:") or bool(payload.get("mcp_server_name"))
+    return InterlockEvent(
+        kind=kind,
+        adapter=AdapterInfo(name="cursor", version=adapter_version),
+        identity=Identity(agent_id=agent_id or f"cursor-{socket.gethostname().split('.')[0]}", agent_type="cursor",
+                          agent_workspace=workspace_name(cwd), agent_user=getpass.getuser()),
+        session_hint=payload.get("conversation_id"),
+        tool_call=ToolCall(id=payload.get("tool_use_id"), name=name, arguments=args),
+        context=Context(cwd=cwd, mcp_server={"name": payload["mcp_server_name"]} if payload.get("mcp_server_name") else None,
+                        transcript_path=payload.get("transcript_path")),
+        result=result,
+        # ask is "accepted by the schema but not enforced for preToolUse"; output replacement is MCP-only
+        capabilities=Capabilities(ask=False, rewrite=True, withhold=is_mcp),
+    )

interlockd/normalize/gemini_cli.py

@@ -0,0 +1,55 @@
+"""Gemini CLI hook payload -> InterlockEvent (https://geminicli.com/docs/hooks/reference/, read 2026-10-17).
+
+`BeforeTool` / `AfterTool` cover every tool, including shell (`run_shell_command`) and MCP (`mcp_<server>_<tool>`).
+AfterTool carries `tool_response {llmContent, returnDisplay, error}`. Built from the documentation; not yet captured
+from a running Gemini CLI (see adapters/gemini-cli/PAYLOADS.md).
+"""
+
+from __future__ import annotations
+
+import getpass
+import socket
+from typing import Any
+
+from ..models import AdapterInfo, Capabilities, Context, Identity, InterlockEvent, ToolCall, ToolResult
+from .claude_code import _response_text
+from .kiro import workspace_name
+
+
+def _gemini_text(resp: Any) -> tuple[str, dict[str, Any]]:
+    if isinstance(resp, dict) and ("llmContent" in resp or "returnDisplay" in resp):
+        text, evidence = _response_text(resp.get("llmContent"))
+        if not text:
+            text, _ = _response_text(resp.get("returnDisplay"))
+        if resp.get("error"):
+            evidence["failed"] = True
+            text = text or str(resp["error"])
+        return text, evidence
+    return _response_text(resp)
+
+
+def normalize_gemini_cli(payload: dict[str, Any], *, agent_id: str = "", adapter_version: str = "0") -> InterlockEvent:
+    hook = str(payload.get("hook_event_name") or "")
+    kind = "post_action" if hook.lower() == "aftertool" else "pre_action"
+    cwd = payload.get("cwd")
+    args = payload.get("tool_input")
+    if not isinstance(args, dict):
+        args = {"value": args} if args is not None else {}
+    result = None
+    if kind == "post_action":
+        text, evidence = _gemini_text(payload.get("tool_response"))
+        result = ToolResult(content=text, evidence=evidence)
+    name = str(payload.get("tool_name") or "")
+    mcp = payload.get("mcp_context") if isinstance(payload.get("mcp_context"), dict) else None
+    return InterlockEvent(
+        kind=kind,
+        adapter=AdapterInfo(name="gemini-cli", version=adapter_version),
+        identity=Identity(agent_id=agent_id or f"gemini-cli-{socket.gethostname().split('.')[0]}", agent_type="gemini-cli",
+                          agent_workspace=workspace_name(cwd), agent_user=getpass.getuser()),
+        session_hint=payload.get("session_id"),
+        tool_call=ToolCall(name=name, arguments=args),
+        context=Context(cwd=cwd, mcp_server=mcp, transcript_path=payload.get("transcript_path")),
+        result=result,
+        # no documented ask; AfterTool deny replaces the result the model sees
+        capabilities=Capabilities(ask=False, rewrite=True, withhold=True),
+    )

interlockd/normalize/kiro.py

@@ -0,0 +1,65 @@
+"""Kiro hook payload -> InterlockEvent. Field mapping per adapters/kiro/PAYLOADS.md §8."""
+
+from __future__ import annotations
+
+import getpass
+import os
+import re
+import socket
+from typing import Any
+
+from ..models import AdapterInfo, Capabilities, Context, Identity, InterlockEvent, ToolCall, ToolResult
+from ..paths import find_git_root
+
+_EXIT = re.compile(r"Exit Code:\s*(-?\d+)\s*$")
+
+KIRO_CAPABILITIES = Capabilities(ask=False, rewrite=False, withhold=False)
+
+
+def default_agent_id() -> str:
+    return f"kiro-{socket.gethostname().split('.')[0]}"
+
+
+def workspace_name(cwd: str | None) -> str:
+    root = find_git_root(cwd) if cwd else None
+    base = root or cwd or ""
+    return os.path.basename(os.path.normpath(base)) if base else ""
+
+
+def normalize_kiro(payload: dict[str, Any], *, agent_id: str = "", adapter_version: str = "0") -> InterlockEvent:
+    hook = payload.get("hook_event_name") or ""
+    kind = "post_action" if hook.lower() == "posttooluse" else "pre_action"
+    cwd = payload.get("cwd")
+    tool_name = str(payload.get("tool_name") or "")
+    tool_input = payload.get("tool_input")
+    if not isinstance(tool_input, dict):
+        tool_input = {"value": tool_input} if tool_input is not None else {}
+
+    result = None
+    if kind == "post_action":
+        content = payload.get("tool_response")
+        if content is None:
+            content = ""
+        if not isinstance(content, str):
+            content = str(content)
+        evidence: dict[str, Any] = {}
+        m = _EXIT.search(content.strip()[-64:])
+        if m:
+            evidence["exit_code"] = int(m.group(1))
+        result = ToolResult(content=content, evidence=evidence)
+
+    return InterlockEvent(
+        kind=kind,
+        adapter=AdapterInfo(name="kiro", version=adapter_version),
+        identity=Identity(
+            agent_id=agent_id or default_agent_id(),
+            agent_type="kiro",
+            agent_workspace=workspace_name(cwd),
+            agent_user=getpass.getuser(),
+        ),
+        session_hint=payload.get("session_id"),
+        tool_call=ToolCall(id=None, name=tool_name, arguments=tool_input),
+        context=Context(cwd=cwd, user_messages=None),
+        result=result,
+        capabilities=KIRO_CAPABILITIES,
+    )