interlockd 0.1.0__py3-none-any.whl

interlockd/service.py

@@ -0,0 +1,247 @@
+"""Run the daemon as a background service: launchd (macOS), systemd --user (Linux), or a detached process.
+
+One `ServiceManager` per Interlock home. The service runs `<python> -m interlockd serve` with INTERLOCK_HOME set,
+logs to `<home>/interlockd.log`, and restarts on crash under launchd/systemd. The detached-process backend is the
+fallback (containers, CI, a Linux box without a user systemd) and records its pid in `<home>/interlockd.pid`.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import platform
+import shutil
+import signal
+import subprocess
+import sys
+import time
+import urllib.request
+from collections.abc import Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Literal
+
+Backend = Literal["launchd", "systemd", "process"]
+DEFAULT_HOME = Path("~/.interlock").expanduser()
+
+
+def _run(cmd: list[str]) -> subprocess.CompletedProcess:
+    return subprocess.run(cmd, capture_output=True, text=True, check=False)
+
+
+def detect_backend() -> Backend:
+    if platform.system() == "Darwin" and shutil.which("launchctl"):
+        return "launchd"
+    if platform.system() == "Linux" and shutil.which("systemctl"):
+        r = _run(["systemctl", "--user", "show-environment"])
+        if r.returncode == 0:
+            return "systemd"
+    return "process"
+
+
+@dataclass
+class ServiceStatus:
+    backend: Backend
+    installed: bool
+    running: bool
+    pid: int | None = None
+    detail: str = ""
+
+
+class ServiceManager:
+    def __init__(self, home: Path, *, listen: str = "127.0.0.1:7391", backend: Backend | None = None,
+                 python: str | None = None, runner: Callable[[list[str]], subprocess.CompletedProcess] = _run):
+        self.home = Path(home).expanduser()
+        self.listen = listen
+        self.backend: Backend = backend or detect_backend()
+        self.python = python or sys.executable
+        self._run = runner
+        # one service per home, so a test or second install never collides with the default one
+        suffix = "" if self.home.resolve() == DEFAULT_HOME.resolve() else "." + hashlib.sha256(
+            str(self.home.resolve()).encode()).hexdigest()[:8]
+        self.label = f"dev.interlock.daemon{suffix}"
+        self.unit = f"interlockd{suffix}.service"
+
+    # ---- paths
+    @property
+    def log_path(self) -> Path:
+        return self.home / "interlockd.log"
+
+    @property
+    def pid_path(self) -> Path:
+        return self.home / "interlockd.pid"
+
+    @property
+    def unit_path(self) -> Path:
+        if self.backend == "launchd":
+            return Path.home() / "Library" / "LaunchAgents" / f"{self.label}.plist"
+        if self.backend == "systemd":
+            return Path(os.environ.get("XDG_CONFIG_HOME", Path.home() / ".config")) / "systemd" / "user" / self.unit
+        return self.pid_path
+
+    def command(self) -> list[str]:
+        return [self.python, "-m", "interlockd", "--home", str(self.home), "serve", "--listen", self.listen]
+
+    # ---- unit files
+    def _plist(self) -> str:
+        args = "\n".join(f"    <string>{a}</string>" for a in self.command())
+        return f"""<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>{self.label}</string>
+  <key>ProgramArguments</key>
+  <array>
+{args}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict><key>INTERLOCK_HOME</key><string>{self.home}</string></dict>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
+  <key>ThrottleInterval</key><integer>10</integer>
+  <key>StandardOutPath</key><string>{self.log_path}</string>
+  <key>StandardErrorPath</key><string>{self.log_path}</string>
+</dict>
+</plist>
+"""
+
+    def _systemd_unit(self) -> str:
+        cmd = " ".join(f'"{a}"' if " " in a else a for a in self.command())
+        return f"""[Unit]
+Description=Interlock pre/post-action gate for AI agents
+After=default.target
+
+[Service]
+Environment=INTERLOCK_HOME={self.home}
+ExecStart={cmd}
+Restart=on-failure
+RestartSec=5
+StandardOutput=append:{self.log_path}
+StandardError=append:{self.log_path}
+
+[Install]
+WantedBy=default.target
+"""
+
+    # ---- lifecycle
+    def install(self) -> Path:
+        """Write the unit (launchd/systemd). The process backend has nothing to install."""
+        self.home.mkdir(parents=True, exist_ok=True)
+        if self.backend == "launchd":
+            self.unit_path.parent.mkdir(parents=True, exist_ok=True)
+            self.unit_path.write_text(self._plist())
+        elif self.backend == "systemd":
+            self.unit_path.parent.mkdir(parents=True, exist_ok=True)
+            self.unit_path.write_text(self._systemd_unit())
+            self._run(["systemctl", "--user", "daemon-reload"])
+            self._run(["systemctl", "--user", "enable", self.unit])
+        return self.unit_path
+
+    def start(self) -> None:
+        if self.backend == "launchd":
+            if not self.unit_path.exists():
+                self.install()
+            domain = f"gui/{os.getuid()}"
+            # bootout is asynchronous, so a bootstrap right after a stop can fail for a moment: retry briefly
+            for _ in range(15):
+                if self._run(["launchctl", "bootstrap", domain, str(self.unit_path)]).returncode == 0:
+                    break
+                if self._run(["launchctl", "kickstart", f"{domain}/{self.label}"]).returncode == 0:
+                    break   # already loaded
+                time.sleep(0.2)
+        elif self.backend == "systemd":
+            if not self.unit_path.exists():
+                self.install()
+            self._run(["systemctl", "--user", "start", self.unit])
+        else:
+            if self._pid_alive():
+                return
+            self.home.mkdir(parents=True, exist_ok=True)
+            log = open(self.log_path, "ab")  # noqa: SIM115  handed to the child
+            env = {**os.environ, "INTERLOCK_HOME": str(self.home)}
+            p = subprocess.Popen(self.command(), stdout=log, stderr=log, stdin=subprocess.DEVNULL, env=env,
+                                 start_new_session=True)
+            self.pid_path.write_text(str(p.pid))
+
+    def stop(self) -> None:
+        if self.backend == "launchd":
+            self._run(["launchctl", "bootout", f"gui/{os.getuid()}/{self.label}"])
+            # bootout returns before the job is torn down; a bootstrap before then fails with EIO
+            for _ in range(50):
+                if not self._launchd_loaded():
+                    break
+                time.sleep(0.2)
+        elif self.backend == "systemd":
+            self._run(["systemctl", "--user", "stop", self.unit])
+        pid = self._read_pid()
+        if pid and self._alive(pid):
+            os.kill(pid, signal.SIGTERM)
+            for _ in range(30):
+                if not self._alive(pid):
+                    break
+                time.sleep(0.1)
+        if self.pid_path.exists():
+            self.pid_path.unlink()
+
+    def restart(self) -> None:
+        if self.backend == "launchd":   # kill and relaunch in place; no unload/load race
+            r = self._run(["launchctl", "kickstart", "-k", f"gui/{os.getuid()}/{self.label}"])
+            if r.returncode == 0:
+                return
+        if self.backend == "systemd":
+            self._run(["systemctl", "--user", "restart", self.unit])
+            return
+        self.stop()
+        self.start()
+
+    def uninstall(self) -> None:
+        self.stop()
+        if self.backend == "systemd":
+            self._run(["systemctl", "--user", "disable", self.unit])
+        if self.backend in ("launchd", "systemd") and self.unit_path.exists():
+            self.unit_path.unlink()
+            if self.backend == "systemd":
+                self._run(["systemctl", "--user", "daemon-reload"])
+
+    def status(self) -> ServiceStatus:
+        installed = self.unit_path.exists() if self.backend != "process" else True
+        return ServiceStatus(self.backend, installed, self.healthy(), self._read_pid(), detail=str(self.unit_path))
+
+    # ---- health
+    def healthy(self, timeout: float = 1.0) -> bool:
+        host, _, port = self.listen.rpartition(":")
+        try:
+            with urllib.request.urlopen(f"http://{host or '127.0.0.1'}:{port}/interlock/v1/health", timeout=timeout) as r:
+                return r.status == 200
+        except Exception:  # noqa: BLE001
+            return False
+
+    def wait_healthy(self, seconds: float = 8.0) -> bool:
+        deadline = time.monotonic() + seconds
+        while time.monotonic() < deadline:
+            if self.healthy(timeout=0.5):
+                return True
+            time.sleep(0.2)
+        return False
+
+    def _launchd_loaded(self) -> bool:
+        return self._run(["launchctl", "print", f"gui/{os.getuid()}/{self.label}"]).returncode == 0
+
+    # ---- pid helpers
+    def _read_pid(self) -> int | None:
+        try:
+            return int(self.pid_path.read_text().strip())
+        except (OSError, ValueError):
+            return None
+
+    @staticmethod
+    def _alive(pid: int) -> bool:
+        try:
+            os.kill(pid, 0)
+            return True
+        except OSError:
+            return False
+
+    def _pid_alive(self) -> bool:
+        pid = self._read_pid()
+        return bool(pid and self._alive(pid))

interlockd/shims/claude-code/interlock-hook.sh

@@ -0,0 +1,113 @@
+#!/bin/sh
+# Interlock hook shim for JSON-on-stdin / JSON-on-stdout harnesses: Claude Code and Codex (PreToolUse/PostToolUse),
+# Cursor (preToolUse/postToolUse), Gemini CLI (BeforeTool/AfterTool). POSIX sh + curl.
+#
+# The daemon normalizes the payload and renders the exact reply each harness applies (deny with a reason, a warning,
+# or a replaced result), so this shim only forwards and prints. An empty daemon reply means "no opinion", which
+# leaves the harness's own permission system in charge; Interlock never auto-approves. Cursor treats exit 0 with
+# output that isn't valid permission JSON as a block, so for Cursor "no opinion" is a non-zero exit (fail-open).
+#
+# Also GitHub Copilot CLI, Windsurf (Cascade), and Antigravity CLI. Installers pass "pre" or "post" as $1 where the
+# payload does not name its event (Copilot's camelCase form). Windsurf blocks with exit 2 and a message on stderr.
+#
+# Install writes HARNESS into the copied shim: claude-code | codex | cursor | gemini-cli | copilot-cli | windsurf | antigravity.
+
+HARNESS="__HARNESS__"
+HOME_DIR="${INTERLOCK_HOME:-$HOME/.interlock}"
+PRE_TIMEOUT="${INTERLOCK_PRE_TIMEOUT_MS:-1500}"
+POST_TIMEOUT="${INTERLOCK_POST_TIMEOUT_MS:-2500}"
+VERSION="0.1.0"
+
+log_local() {
+  mkdir -p "$HOME_DIR" 2>/dev/null
+  printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" >> "$HOME_DIR/hook.log" 2>/dev/null
+}
+
+payload=$(cat)
+[ -n "$payload" ] || exit 0
+is_post=0
+EVENT="$1"
+case "$HARNESS" in
+  cursor)     case "$payload" in *'postToolUse'*|*'afterShellExecution'*|*'afterMCPExecution'*) is_post=1 ;; esac ;;
+  gemini-cli) case "$payload" in *'AfterTool'*) is_post=1 ;; esac ;;
+  windsurf)   case "$payload" in *'"agent_action_name":"post_'*|*'"agent_action_name": "post_'*) is_post=1 ;; esac ;;
+  *)          case "$payload" in *PostToolUse*|*postToolUse*) is_post=1 ;; esac ;;
+esac
+case "$EVENT" in post) is_post=1 ;; pre) is_post=0 ;; esac
+EVENT=pre; [ "$is_post" = 1 ] && EVENT=post
+timeout_ms=$PRE_TIMEOUT; [ "$is_post" = 1 ] && timeout_ms=$POST_TIMEOUT
+
+no_opinion() { # leave the decision to the harness
+  if [ "$HARNESS" = cursor ] && [ "$is_post" = 0 ]; then exit 1; fi
+  if [ "$HARNESS" = antigravity ]; then   # a pre-tool decision is required; post-tool hooks return {}
+    if [ "$is_post" = 0 ]; then printf '{"decision":"allow"}\n'; else printf '{}\n'; fi
+  fi
+  exit 0
+}
+
+token=""; [ -r "$HOME_DIR/token" ] && read -r token < "$HOME_DIR/token"
+if [ -z "$token" ]; then log_local "inert: no token at $HOME_DIR/token"; no_opinion; fi
+if [ -n "$INTERLOCK_URL" ]; then base="${INTERLOCK_URL%/}"
+else
+  listen=""
+  if [ -r "$HOME_DIR/daemon.json" ]; then
+    read -r line < "$HOME_DIR/daemon.json"
+    case "$line" in *'"listen": "'*) listen=${line#*'"listen": "'}; listen=${listen%%\"*} ;; esac
+  fi
+  base="http://${listen:-127.0.0.1:7391}"
+fi
+
+FORMAT=claude-code; case "$HARNESS" in cursor|gemini-cli|copilot-cli|antigravity) FORMAT=$HARNESS ;; windsurf) FORMAT=text ;; esac
+secs=$(( timeout_ms / 1000 )).$(( (timeout_ms % 1000) / 100 ))
+# prefer the daemon's Unix socket (mode 0600: only this user can connect) unless a URL was given explicitly
+sock=""; [ -z "$INTERLOCK_URL" ] && [ -S "$HOME_DIR/interlockd.sock" ] && sock="$HOME_DIR/interlockd.sock"
+if [ -n "$sock" ]; then base="http://localhost"; set -- --unix-socket "$sock"; else set --; fi
+reply=$(printf '{"adapter":{"name":"%s","version":"%s","event":"%s"},"payload":%s}' "$HARNESS" "$VERSION" "$EVENT" "$payload" | \
+  curl -sf -m "$secs" "$@" -H "authorization: Bearer $token" -H "content-type: application/json" \
+    --data-binary @- "$base/interlock/v1/hooks/$HARNESS?format=$FORMAT" 2>/dev/null)
+rc=$?
+
+if [ $rc -ne 0 ]; then
+  mode=open
+  case "$INTERLOCK_FAIL_MODE" in open|closed) mode=$INTERLOCK_FAIL_MODE ;; *)
+    [ -r "$HOME_DIR/fail-mode.json" ] && grep -q '"default": *"closed"' "$HOME_DIR/fail-mode.json" && mode=closed ;;
+  esac
+  case "$payload" in
+    *'"tool_name":"'*)  tool=${payload#*'"tool_name":"'} ;;
+    *'"tool_name": "'*) tool=${payload#*'"tool_name": "'} ;;
+    *) tool="?" ;;
+  esac
+  tool=${tool%%\"*}
+  kind=pre; [ "$is_post" = 1 ] && kind=post
+  log_local "unjudged harness=$HARNESS tool=$tool kind=$kind curl_rc=$rc fail_mode=$mode"
+  if [ "$is_post" = 0 ] && [ "$mode" = "closed" ]; then
+    msg='[interlock] This action was NOT executed: the Interlock daemon is unreachable and this workspace fails closed. Start it with `interlock start`, then retry.'
+    case "$HARNESS" in
+      cursor)     printf '{"permission":"deny","agent_message":"%s","user_message":"Interlock daemon unreachable (fail closed)"}\n' "$msg" ;;
+      gemini-cli|antigravity) printf '{"decision":"deny","reason":"%s"}\n' "$msg" ;;
+      copilot-cli) printf '{"permissionDecision":"deny","permissionDecisionReason":"%s"}\n' "$msg" ;;
+      windsurf)   printf '%s\n' "$msg" >&2; exit 2 ;;
+      *)          printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"%s"}}\n' "$msg" ;;
+    esac
+    exit 0
+  fi
+  no_opinion
+fi
+
+# Windsurf: the daemon replies in text form ("<disposition> <mode> <tier>" then the notice); block via exit 2
+if [ "$HARNESS" = windsurf ]; then
+  first=${reply%%
+*}
+  set -- $first
+  if [ "$2" = enforce ] && { [ "$1" = block ] || [ "$1" = ask ]; }; then
+    printf '%s\n' "${reply#*
+}" >&2
+    exit 2
+  fi
+  exit 0
+fi
+
+# the daemon's reply is the hook's stdout; empty means no opinion
+[ -n "$reply" ] || no_opinion
+printf '%s\n' "$reply"
+exit 0

interlockd/shims/kiro/interlock-hook.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// Interlock hook shim for Kiro (PreToolUse and PostToolUse). Zero dependencies, Node >= 18.
+//
+// Reads the hook event from stdin, posts it to the local daemon, and renders the verdict in Kiro's
+// vocabulary (adapters/kiro/PAYLOADS.md §5): exit 0 = allow, exit 2 + stderr = block. Kiro has no
+// hook-driven "ask", so an ask renders as a block whose notice asks the agent to confirm with the user.
+// PostToolUse is record-only on Kiro: always exit 0. If the daemon does not answer, the configured
+// fail mode decides (default open) and the miss is logged locally.
+
+import { readFileSync, appendFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+
+const VERSION = "0.1.0";
+const HOME = process.env.INTERLOCK_HOME || path.join(homedir(), ".interlock");
+const BASE = (process.env.INTERLOCK_URL || readListen() || "http://127.0.0.1:7391").replace(/\/$/, "");
+const PRE_TIMEOUT_MS = Number(process.env.INTERLOCK_PRE_TIMEOUT_MS || 1500);
+const POST_TIMEOUT_MS = Number(process.env.INTERLOCK_POST_TIMEOUT_MS || 2500);
+
+function readListen() {
+  try {
+    const d = JSON.parse(readFileSync(path.join(HOME, "daemon.json"), "utf8"));
+    return d.listen ? `http://${d.listen}` : null;
+  } catch { return null; }
+}
+
+function logLocal(line) {
+  try {
+    mkdirSync(HOME, { recursive: true });
+    appendFileSync(path.join(HOME, "hook.log"), `${new Date().toISOString()} ${line}\n`);
+  } catch { /* never let logging break the hook */ }
+}
+
+function failMode() {
+  // M0: no finding categories are known at the shim, so the table's default applies.
+  const env = process.env.INTERLOCK_FAIL_MODE;
+  if (env === "open" || env === "closed") return env;
+  try {
+    const t = JSON.parse(readFileSync(path.join(HOME, "fail-mode.json"), "utf8"));
+    return t.default === "closed" ? "closed" : "open";
+  } catch { return "open"; }
+}
+
+async function readStdin() {
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(c);
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+function block(notice) {
+  process.stderr.write(notice.endsWith("\n") ? notice : notice + "\n");
+  process.exit(2);
+}
+
+async function main() {
+  const raw = await readStdin();
+  let payload;
+  try { payload = JSON.parse(raw); } catch { logLocal("skip: stdin was not JSON"); process.exit(0); }
+  const isPost = String(payload.hook_event_name || "").toLowerCase() === "posttooluse";
+  const timeout = isPost ? POST_TIMEOUT_MS : PRE_TIMEOUT_MS;
+
+  let token;
+  try { token = readFileSync(path.join(HOME, "token"), "utf8").trim(); }
+  catch { logLocal("inert: no token at " + path.join(HOME, "token")); process.exit(0); }
+
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), timeout);
+  let verdict;
+  try {
+    const res = await fetch(`${BASE}/interlock/v1/hooks/kiro`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+      body: JSON.stringify({ adapter: { name: "kiro", version: VERSION }, payload }),
+      signal: ctl.signal,
+    });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    verdict = await res.json();
+  } catch (e) {
+    clearTimeout(timer);
+    const mode = failMode();
+    logLocal(`unjudged tool=${payload.tool_name} kind=${isPost ? "post" : "pre"} reason=${e.name === "AbortError" ? "timeout" : e.message} fail_mode=${mode}`);
+    if (!isPost && mode === "closed") {
+      block("[interlock] This action was NOT executed: the Interlock daemon is unreachable and this workspace fails closed. Start it with `interlock serve`, then retry.");
+    }
+    process.exit(0);
+  }
+  clearTimeout(timer);
+
+  if (isPost) process.exit(0); // record-only on Kiro
+  if (verdict.mode === "shadow") process.exit(0); // shadow: decided and recorded, never enforced
+
+  if (verdict.disposition === "block") {
+    block(verdict.notice || `[interlock] This action was refused by a security policy and was NOT executed. Reason: ${verdict.reason || "policy"}. You may pursue the user's goal by other legitimate means, but you MUST NOT retry this action in a disguised form.`);
+  }
+  if (verdict.disposition === "ask") {
+    block(verdict.notice || `[interlock] This action was NOT executed because it needs the user's confirmation. Reason: ${verdict.reason || "policy"}. Ask the user whether to proceed, and only retry after they confirm.`);
+  }
+  process.exit(0);
+}
+
+main().catch((e) => { logLocal(`shim error: ${e && e.message}`); process.exit(0); });

interlockd/shims/kiro/interlock-hook.sh

@@ -0,0 +1,82 @@
+#!/bin/sh
+# Interlock hook shim for Kiro (PreToolUse and PostToolUse). POSIX sh + curl, nothing else.
+#
+# Hot path is two forks (cat for stdin, curl for the request); everything else is shell builtins, because
+# each fork costs 5-10 ms on macOS. Measured on an M4 Pro: ~30 ms end to end for a tier-0 call, against
+# ~108 ms for the Node shim (whose startup alone is ~79 ms). The daemon answers shims in text:
+#   line 1: "<disposition> <mode> <tier>"    following lines: the notice or reason
+# Kiro vocabulary (adapters/kiro/PAYLOADS.md §5): exit 0 = allow, exit 2 + stderr = block. Kiro has no
+# hook-driven "ask", so ask renders as a block whose notice asks the agent to confirm with the user.
+# PostToolUse is record-only on Kiro: always exit 0. No answer from the daemon -> fail mode (default open).
+
+HOME_DIR="${INTERLOCK_HOME:-$HOME/.interlock}"
+PRE_TIMEOUT="${INTERLOCK_PRE_TIMEOUT_MS:-1500}"
+POST_TIMEOUT="${INTERLOCK_POST_TIMEOUT_MS:-2500}"
+VERSION="0.1.0"
+nl='
+'
+
+log_local() {  # failure path only; forks are fine here
+  mkdir -p "$HOME_DIR" 2>/dev/null
+  printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" >> "$HOME_DIR/hook.log" 2>/dev/null
+}
+
+payload=$(cat)
+[ -n "$payload" ] || exit 0
+case "$payload" in
+  *PostToolUse*|*postToolUse*) is_post=1; timeout_ms=$POST_TIMEOUT ;;
+  *)                           is_post=0; timeout_ms=$PRE_TIMEOUT ;;
+esac
+
+# token and daemon address with builtins only
+token=""; [ -r "$HOME_DIR/token" ] && read -r token < "$HOME_DIR/token"
+if [ -z "$token" ]; then log_local "inert: no token at $HOME_DIR/token"; exit 0; fi
+if [ -n "$INTERLOCK_URL" ]; then base="${INTERLOCK_URL%/}"
+else
+  listen=""
+  if [ -r "$HOME_DIR/daemon.json" ]; then
+    read -r line < "$HOME_DIR/daemon.json"
+    case "$line" in *'"listen": "'*) listen=${line#*'"listen": "'}; listen=${listen%%\"*} ;; esac
+  fi
+  base="http://${listen:-127.0.0.1:7391}"
+fi
+
+secs=$(( timeout_ms / 1000 )).$(( (timeout_ms % 1000) / 100 ))
+verdict=$(printf '{"adapter":{"name":"kiro","version":"%s"},"payload":%s}' "$VERSION" "$payload" | \
+  curl -sf -m "$secs" -H "authorization: Bearer $token" -H "content-type: application/json" \
+    --data-binary @- "$base/interlock/v1/hooks/kiro?format=text" 2>/dev/null)
+rc=$?
+
+if [ $rc -ne 0 ] || [ -z "$verdict" ]; then
+  mode=open
+  case "$INTERLOCK_FAIL_MODE" in open|closed) mode=$INTERLOCK_FAIL_MODE ;; *)
+    [ -r "$HOME_DIR/fail-mode.json" ] && grep -q '"default": *"closed"' "$HOME_DIR/fail-mode.json" && mode=closed ;;
+  esac
+  case "$payload" in
+    *'"tool_name":"'*)  tool=${payload#*'"tool_name":"'} ;;
+    *'"tool_name": "'*) tool=${payload#*'"tool_name": "'} ;;
+    *) tool="?" ;;
+  esac
+  tool=${tool%%\"*}
+  kind=pre; [ "$is_post" = 1 ] && kind=post
+  log_local "unjudged tool=$tool kind=$kind curl_rc=$rc fail_mode=$mode"
+  if [ "$is_post" = 0 ] && [ "$mode" = "closed" ]; then
+    printf '[interlock] This action was NOT executed: the Interlock daemon is unreachable and this workspace fails closed. Start it with `interlock serve`, then retry.\n' >&2
+    exit 2
+  fi
+  exit 0
+fi
+
+[ "$is_post" = 1 ] && exit 0                       # record-only on Kiro
+first=${verdict%%"$nl"*}
+notice=${verdict#*"$nl"}; [ "$notice" = "$verdict" ] && notice=""
+set -- $first                                      # disposition mode tier
+disposition=$1; mode=$2
+[ "$mode" = "shadow" ] && exit 0                   # decided and recorded, never enforced
+case "$disposition" in
+  block|ask)
+    [ -n "$notice" ] || notice="[interlock] This action was refused by a security policy and was NOT executed. You may pursue the user's goal by other legitimate means, but you MUST NOT retry this action in a disguised form."
+    printf '%s\n' "$notice" >&2
+    exit 2 ;;
+esac
+exit 0

interlockd/shims/opencode/interlock.js

@@ -0,0 +1,60 @@
+// Interlock plugin for OpenCode (https://opencode.ai/docs/plugins/). Installed by `interlock init` into
+// ~/.config/opencode/plugins/. Asks the local Interlock daemon about every tool call before it runs and
+// throws to refuse it (OpenCode's documented way to block); checks tool results afterwards (record-only:
+// replacing a result is not documented). No dependencies; runs on OpenCode's own runtime.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const VERSION = "__VERSION__";
+const HOME = process.env.INTERLOCK_HOME || join(homedir(), ".interlock");
+
+function read(p) { try { return readFileSync(join(HOME, p), "utf8"); } catch { return ""; } }
+
+function base() {
+  if (process.env.INTERLOCK_URL) return process.env.INTERLOCK_URL.replace(/\/$/, "");
+  try { return `http://${JSON.parse(read("daemon.json")).listen || "127.0.0.1:7391"}`; } catch { return "http://127.0.0.1:7391"; }
+}
+
+function failsClosed() {
+  const env = process.env.INTERLOCK_FAIL_MODE;
+  if (env === "open" || env === "closed") return env === "closed";
+  try { return JSON.parse(read("fail-mode.json")).default === "closed"; } catch { return false; }
+}
+
+async function decide(kind, tool, args, cwd, session, content) {
+  const token = read("token").trim();
+  if (!token) return null;
+  const event = {
+    kind, adapter: { name: "opencode", version: VERSION }, session_hint: session || null,
+    identity: { agent_type: "opencode" }, tool_call: { name: String(tool || ""), arguments: args || {} },
+    context: { cwd: cwd || process.cwd() }, capabilities: { ask: false, rewrite: false, withhold: false },
+  };
+  if (content !== undefined) event.result = { content: String(content).slice(0, 200000) };
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), kind === "pre_action" ? 1500 : 2500);
+  try {
+    const r = await fetch(`${base()}/interlock/v1/decide`, {
+      method: "POST", signal: ctl.signal, body: JSON.stringify(event),
+      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+    });
+    return r.ok ? await r.json() : null;
+  } catch { return null; } finally { clearTimeout(timer); }
+}
+
+export const Interlock = async ({ directory }) => ({
+  "tool.execute.before": async (input, output) => {
+    const v = await decide("pre_action", input.tool, output.args, directory, input.sessionID);
+    if (v === null) {
+      if (failsClosed()) throw new Error("[interlock] This action was NOT executed: the Interlock daemon is unreachable and this machine fails closed.");
+      return;
+    }
+    if (v.mode === "enforce" && (v.disposition === "block" || v.disposition === "ask")) {
+      throw new Error(v.notice || `[interlock] refused: ${v.reason || "policy"}`);
+    }
+  },
+  "tool.execute.after": async (input, output) => {
+    const text = typeof output?.output === "string" ? output.output : JSON.stringify(output?.output ?? output?.result ?? "");
+    await decide("post_action", input.tool, output?.args || {}, directory, input.sessionID, text);
+  },
+});

interlockd/store/__init__.py

@@ -0,0 +1,22 @@
+"""Audit store: a local write-ahead spool in front of a repository (memory for tests, DynamoDB for real).
+
+Design §7: one record per event, findings and answers embedded; separate items for explanations,
+feedback, and session summaries. The decision path writes only to the spool (fsync) and returns.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Protocol
+
+
+class Repository(Protocol):
+    def put_event(self, record: dict[str, Any]) -> None: ...
+    def get_event(self, event_id: str) -> dict[str, Any] | None: ...
+    def tail(self, workspace: str | None = None, limit: int = 50) -> list[dict[str, Any]]: ...
+    def put_session(self, summary: dict[str, Any]) -> None: ...
+    def get_session(self, session_id: str) -> dict[str, Any] | None: ...
+
+
+def hour_bucket(received_at: str) -> str:
+    # "2026-10-08T01:08:33.123Z" -> "2026-10-08-01"
+    return received_at[:13].replace("T", "-")