interlockd 0.1.0__tar.gz → 0.1.1__tar.gz

interlockd-0.1.1/.github/ISSUE_TEMPLATE/agent.yml

@@ -0,0 +1,20 @@
+name: Support for an agent or framework
+description: Ask for (or offer to build) an adapter for a coding agent, agent framework, or MCP client
+labels: [adapter]
+body:
+  - type: input
+    id: agent
+    attributes: { label: Agent or framework, placeholder: "name, version, link" }
+    validations: { required: true }
+  - type: textarea
+    id: hooks
+    attributes:
+      label: Its extension point
+      description: Hooks, plugins, callbacks, or MCP only? Links to the docs help. Adapters are verified against payloads captured from the real tool, see docs/ADAPTERS.md.
+  - type: checkboxes
+    id: help
+    attributes:
+      label: Can you help?
+      options:
+        - label: I can capture real hook payloads from this tool
+        - label: I'd like to build the adapter

interlockd-0.1.1/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,29 @@
+name: Bug
+description: Something doesn't work as documented
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Found a way past a rule? Please use **private vulnerability reporting** instead (see the link on the previous page).
+        Audit records contain tool arguments: remove anything secret before pasting.
+  - type: textarea
+    id: what
+    attributes: { label: "What happened, and what did you expect?" }
+    validations: { required: true }
+  - type: textarea
+    id: repro
+    attributes: { label: "Steps to reproduce" }
+    validations: { required: true }
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Output of `interlock --version` and `interlock doctor`
+      render: text
+    validations: { required: true }
+  - type: input
+    id: agent
+    attributes: { label: Agent and version, placeholder: "Claude Code 2.x, Codex 0.x, Cursor CLI ..." }
+  - type: input
+    id: os
+    attributes: { label: OS, placeholder: "macOS 15 arm64, Ubuntu 24.04 ..." }

interlockd-0.1.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a vulnerability or a bypass (private)
+    url: https://github.com/interlockd/interlock/security/advisories/new
+    about: A way past a default rule, an injected result that reaches the agent, or tampering doctor misses. Please don't open a public issue.

interlockd-0.1.1/.github/ISSUE_TEMPLATE/decision.yml

@@ -0,0 +1,34 @@
+name: Wrong decision (false positive or false negative)
+description: Interlock blocked or asked about something safe, or allowed something it should have stopped
+labels: [decision]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        If an attack got through a **default** rule, please report it privately instead (Security → Report a vulnerability).
+        `interlock explain` shows the rule ids and reason for the latest stop. Remove secrets before pasting.
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Kind
+      options: ["False positive: a safe action was blocked or asked", "False negative: a harmful action was allowed"]
+    validations: { required: true }
+  - type: textarea
+    id: action
+    attributes: { label: "The tool call (command or tool and arguments)", render: text }
+    validations: { required: true }
+  - type: textarea
+    id: explain
+    attributes: { label: "Output of `interlock explain` (for a stop)", render: text }
+  - type: input
+    id: expected
+    attributes: { label: "What should the decision be? (allow / ask / block)" }
+    validations: { required: true }
+  - type: textarea
+    id: why
+    attributes: { label: "Why? Context that makes it safe, or harmful" }
+  - type: dropdown
+    id: policy
+    attributes:
+      label: Policy
+      options: ["Default policy", "Custom policy (paste the relevant part below)"]

interlockd-0.1.1/.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule: { interval: weekly }
+  - package-ecosystem: pip
+    directory: /
+    schedule: { interval: weekly }
+    open-pull-requests-limit: 5

interlockd-0.1.1/.github/pull_request_template.md

@@ -0,0 +1,10 @@
+## What and why
+
+## How it was verified
+
+- [ ] Tests (`pytest -q`, `interlock test`)
+- [ ] Live against the real agent (which one, which version)
+
+## For a rule change
+
+- [ ] Positive **and** hard-negative cases in `interlockd/data/packs/<pack>.jsonl`

{interlockd-0.1.0 → interlockd-0.1.1}/.github/workflows/ci.yml

@@ -15,8 +15,8 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
       - name: Install
         run: |
           uv venv --python 3.12
@@ -29,10 +29,22 @@ jobs:
         run: .venv/bin/interlock test
       - name: Evaluation corpus gate
         run: .venv/bin/interlock test --corpus corpus/archetypes
-      - name: Framework integrations (Strands, LangChain) against a real daemon
+      - name: Linux sandbox (bubblewrap)
+        if: runner.os == 'Linux'
         run: |
-          uv pip install --python .venv/bin/python strands-agents langchain-core openai-agents
-          .venv/bin/pytest -q tests/test_strands.py tests/test_langchain.py tests/test_openai_agents.py
+          sudo apt-get install -y -qq bubblewrap
+          # Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor; bubblewrap needs them
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          .venv/bin/pytest -q tests/test_sandbox.py -rs
+      - name: Framework integrations against a real daemon
+        run: |
+          uv pip install --python .venv/bin/python strands-agents langchain-core openai-agents google-adk claude-agent-sdk semantic-kernel
+          .venv/bin/pytest -q tests/test_strands.py tests/test_langchain.py tests/test_openai_agents.py tests/test_google_adk.py tests/test_claude_agent_sdk.py tests/test_semantic_kernel.py
+      - name: CrewAI integration (own environment)
+        run: |
+          uv venv /tmp/crewai --python 3.12
+          uv pip install --python /tmp/crewai/bin/python -e ".[dev]" crewai
+          /tmp/crewai/bin/pytest -q tests/test_crewai.py
       - name: Wheel smoke test
         run: |
           uv build --wheel -o dist
@@ -43,7 +55,7 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Plant a risky MCP config to prove the scan sees it
         run: |
           mkdir -p .vscode

{interlockd-0.1.0 → interlockd-0.1.1}/.github/workflows/release.yml

@@ -16,8 +16,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
       - name: Tag matches package version
         run: |
           tag="${GITHUB_REF_NAME#v}"
@@ -35,7 +35,7 @@ jobs:
         run: |
           uv venv /tmp/w --python 3.12 && uv pip install --python /tmp/w/bin/python dist/*.whl
           cd /tmp && /tmp/w/bin/interlock --help >/dev/null && /tmp/w/bin/interlock test
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with: { name: dist, path: dist/ }
 
   publish:
@@ -46,7 +46,7 @@ jobs:
       id-token: write          # trusted publishing
       contents: write          # GitHub release
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with: { name: dist, path: dist/ }
       - uses: pypa/gh-action-pypi-publish@release/v1
       - name: GitHub release

{interlockd-0.1.0 → interlockd-0.1.1}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.1 (2026-10-18)
+
+- Google ADK and CrewAI integrations.
+- Semantic Kernel integration (`guard_kernel`): a function-invocation filter, tested through a real Kernel.
+- Claude Agent SDK integration (`guard_options`): in-process PreToolUse / PostToolUse hooks, verified live (a refused force-push, a withheld injected README).
+- `interlock pause` / `resume` kill switch.
+- Linux sandbox (bubblewrap) verified in CI.
+- Repository policies: a committed `<repo>/.interlock/policy.yaml` applies to every call inside the repository, re-read on change. It can only tighten your policy unless you list the repository in `trust.trusted_workspaces`; `interlock policy lint --workspace <repo>` shows what was not applied.
+- Hook watch: the daemon re-checks the hooks it installed every minute and records a removed hook or a modified shim (and the repair) in the audit chain; `interlock report` lists them. Shims left by an upgrade are refreshed instead of flagged.
+- `interlock bench`: decision, probe, HTTP and hook-shim latency on your machine; see `docs/PERFORMANCE.md`.
+- Faster audit writes: the hash chain's head is cached between appends instead of re-read; decision p50 4.2 ms -> 1.2 ms.
+- `interlock doctor` reports when a newer release is on PyPI (`INTERLOCK_NO_UPDATE_CHECK=1` turns it off).
+- Docs: the hooks apply `fail_mode.default` while the daemon is down (the per-category entries had been described as applying too).
+
 ## 0.1.0 (2026-10-17)
 
 First public release.
@@ -12,6 +26,7 @@ First public release.
 - `interlock mcp`: Interlock as an MCP server with read-only advisory tools (`check_action`, `explain_decision`, `recent_decisions`, `scan_mcp_servers`, `interlock_status`, `suggest_rule_override`); `interlock init --mcp` registers it.
 - Codex: injected tool results are withheld (`decision: block`, measured live).
 - Memory-poisoning protection: writes to agent instruction files (CLAUDE.md, AGENTS.md, ...) and MCP memory tools are recorded, and asked when the content reads as injected or the session took in untrusted content.
+- `interlock pause` / `resume`: a kill switch that refuses every agent action (all or named agents, optionally timed), in any mode.
 - `interlock egress-proxy`: decides every outbound host (metadata endpoints refused; `--strict` allowlist); `interlock sandbox --egress` makes it the agent's only way out.
 - `interlock sandbox -- <agent>`: OS-level sandbox (macOS seatbelt; Linux bubblewrap) refusing persistence and guard-rail writes, with optional secret-read and network limits.
 - Packaging: published on PyPI as `interlockd` (the command is still `interlock`) via a trusted-publishing release workflow, and a Homebrew formula generator for `interlockd/homebrew-tap`.

{interlockd-0.1.0 → interlockd-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: interlockd
-Version: 0.1.0
+Version: 0.1.1
 Summary: Interlock daemon: a pre/post-action interlock for coding agents
 License: Apache-2.0
 License-File: LICENSE
@@ -9,12 +9,18 @@ Requires-Dist: pydantic<3,>=2.9
 Requires-Dist: pyyaml<7,>=6.0
 Provides-Extra: aws
 Requires-Dist: boto3<2,>=1.35; extra == 'aws'
+Provides-Extra: claude-agent-sdk
+Requires-Dist: claude-agent-sdk>=0.2; extra == 'claude-agent-sdk'
+Provides-Extra: crewai
+Requires-Dist: crewai>=1.10; extra == 'crewai'
 Provides-Extra: dev
 Requires-Dist: boto3<2,>=1.35; extra == 'dev'
 Requires-Dist: cedarpy<5,>=4.7; extra == 'dev'
 Requires-Dist: moto[dynamodb]<6,>=5.0; extra == 'dev'
-Requires-Dist: pytest<9,>=8.3; extra == 'dev'
+Requires-Dist: pytest<10,>=8.3; extra == 'dev'
 Requires-Dist: ruff<1,>=0.6; extra == 'dev'
+Provides-Extra: google-adk
+Requires-Dist: google-adk>=2.0; extra == 'google-adk'
 Provides-Extra: langchain
 Requires-Dist: langchain-core>=1.0; extra == 'langchain'
 Provides-Extra: mandate
@@ -23,7 +29,9 @@ Provides-Extra: openai-agents
 Requires-Dist: openai-agents>=0.20; extra == 'openai-agents'
 Provides-Extra: promptguard
 Requires-Dist: torch>=2.3; extra == 'promptguard'
-Requires-Dist: transformers<5,>=4.44; extra == 'promptguard'
+Requires-Dist: transformers<6,>=4.44; extra == 'promptguard'
+Provides-Extra: semantic-kernel
+Requires-Dist: semantic-kernel>=1.30; extra == 'semantic-kernel'
 Provides-Extra: strands
 Requires-Dist: strands-agents>=1.40; extra == 'strands'
 Description-Content-Type: text/markdown
@@ -42,6 +50,8 @@ pipx install interlockd     # or: uv tool install interlockd
 interlock init              # finds your agents, installs hooks, starts the daemon (shadow mode)
 ```
 
+New here? [docs/GETTING-STARTED.md](docs/GETTING-STARTED.md) walks through shadow mode, enforcing, MCP servers, your own agents and CI in about ten minutes.
+
 ```
 What the gate decides (enforce mode, nothing executed):
   block  git push --force origin main                         force-push to a protected branch
@@ -61,14 +71,14 @@ What the gate decides (enforce mode, nothing executed):
 | Cursor (CLI) | ✅ verified live: blocks before execution |
 | GitHub Copilot CLI | ✅ verified live: blocks before execution, withholds injected tool results |
 | Gemini CLI, Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
-| Your own agents (Strands, LangChain / LangGraph, OpenAI Agents SDK) | ✅ in-process: `Agent(hooks=[InterlockHooks()])`, `guard_tools(tools)`, `guard_agent_tools(agent)` |
-| Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio MCP server, hooks or not |
-| Windsurf, Cline, GitHub Copilot, and more | hook adapters planned |
+| Your own agents (Claude Agent SDK, Strands, LangChain / LangGraph, OpenAI Agents SDK, Google ADK, CrewAI, Semantic Kernel) | ✅ in-process: `guard_options(options)`, `InterlockHooks()`, `guard_tools(tools)`, `guard_agent_tools(agent)`, `guard_agent(agent)`, `crewai.install()`, `guard_kernel(kernel)` |
+| Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio and remote (HTTP) MCP server, hooks or not |
+| Cline, Copilot in VS Code, and more | hook adapters planned; meanwhile the MCP gateway and `interlock sandbox` cover them |
 
 ## How it works
 
 1. **Hooks.** `interlock init` adds a small hook to each agent you have installed. The hook forwards each proposed tool call (and each tool result) to a local daemon.
-2. **Deterministic rules first.** 48 rules in 6 packs (shell, git, egress, persistence, secrets, packages) decide in about 2 ms. The shell decomposer sees through chains, pipes, subshells, heredocs, interpreter one-liners and base64.
+2. **Deterministic rules first.** 48 rules in 6 packs (shell, git, egress, persistence, secrets, packages) decide in about a millisecond ([measured](docs/PERFORMANCE.md)). The shell decomposer sees through chains, pipes, subshells, heredocs, interpreter one-liners and base64.
 3. **Injection probe on results.** A local detector flags tool output that tries to instruct the agent (including text hidden in HTML comments or invisible Unicode) and withholds it where the agent supports that.
 4. **Optional judge.** An open-weights decision model can answer "did the user actually ask for this?" for ambiguous actions. Off by default.
 5. **Everything recorded.** Every decision lands in a local append-only log with its reason.
@@ -98,7 +108,7 @@ Policy lives in `~/.interlock/policy.yaml` (user) and `<repo>/.interlock/policy.
 
 ## Honest limits
 
-The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md).
+The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md). Latency on your own machine: `interlock bench` ([docs/PERFORMANCE.md](docs/PERFORMANCE.md)).
 
 
 - Interlock sees what the agent's hooks show it. A process the agent starts outside the hook path, or a second unguarded agent, is not gated. Network and sandbox enforcement are on the roadmap.
@@ -108,7 +118,7 @@ The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md).
 ## In CI
 
 ```yaml
-- uses: actions/checkout@v4
+- uses: actions/checkout@v7
 - uses: interlockd/interlock@v0.1.0        # scan MCP/agent configs, test .interlock/policy.yaml
   with: { fail-on: high }
 - uses: github/codeql-action/upload-sarif@v3

{interlockd-0.1.0 → interlockd-0.1.1}/README.md

@@ -12,6 +12,8 @@ pipx install interlockd     # or: uv tool install interlockd
 interlock init              # finds your agents, installs hooks, starts the daemon (shadow mode)
 ```
 
+New here? [docs/GETTING-STARTED.md](docs/GETTING-STARTED.md) walks through shadow mode, enforcing, MCP servers, your own agents and CI in about ten minutes.
+
 ```
 What the gate decides (enforce mode, nothing executed):
   block  git push --force origin main                         force-push to a protected branch
@@ -31,14 +33,14 @@ What the gate decides (enforce mode, nothing executed):
 | Cursor (CLI) | ✅ verified live: blocks before execution |
 | GitHub Copilot CLI | ✅ verified live: blocks before execution, withholds injected tool results |
 | Gemini CLI, Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
-| Your own agents (Strands, LangChain / LangGraph, OpenAI Agents SDK) | ✅ in-process: `Agent(hooks=[InterlockHooks()])`, `guard_tools(tools)`, `guard_agent_tools(agent)` |
-| Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio MCP server, hooks or not |
-| Windsurf, Cline, GitHub Copilot, and more | hook adapters planned |
+| Your own agents (Claude Agent SDK, Strands, LangChain / LangGraph, OpenAI Agents SDK, Google ADK, CrewAI, Semantic Kernel) | ✅ in-process: `guard_options(options)`, `InterlockHooks()`, `guard_tools(tools)`, `guard_agent_tools(agent)`, `guard_agent(agent)`, `crewai.install()`, `guard_kernel(kernel)` |
+| Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio and remote (HTTP) MCP server, hooks or not |
+| Cline, Copilot in VS Code, and more | hook adapters planned; meanwhile the MCP gateway and `interlock sandbox` cover them |
 
 ## How it works
 
 1. **Hooks.** `interlock init` adds a small hook to each agent you have installed. The hook forwards each proposed tool call (and each tool result) to a local daemon.
-2. **Deterministic rules first.** 48 rules in 6 packs (shell, git, egress, persistence, secrets, packages) decide in about 2 ms. The shell decomposer sees through chains, pipes, subshells, heredocs, interpreter one-liners and base64.
+2. **Deterministic rules first.** 48 rules in 6 packs (shell, git, egress, persistence, secrets, packages) decide in about a millisecond ([measured](docs/PERFORMANCE.md)). The shell decomposer sees through chains, pipes, subshells, heredocs, interpreter one-liners and base64.
 3. **Injection probe on results.** A local detector flags tool output that tries to instruct the agent (including text hidden in HTML comments or invisible Unicode) and withholds it where the agent supports that.
 4. **Optional judge.** An open-weights decision model can answer "did the user actually ask for this?" for ambiguous actions. Off by default.
 5. **Everything recorded.** Every decision lands in a local append-only log with its reason.
@@ -68,7 +70,7 @@ Policy lives in `~/.interlock/policy.yaml` (user) and `<repo>/.interlock/policy.
 
 ## Honest limits
 
-The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md).
+The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md). Latency on your own machine: `interlock bench` ([docs/PERFORMANCE.md](docs/PERFORMANCE.md)).
 
 
 - Interlock sees what the agent's hooks show it. A process the agent starts outside the hook path, or a second unguarded agent, is not gated. Network and sandbox enforcement are on the roadmap.
@@ -78,7 +80,7 @@ The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md).
 ## In CI
 
 ```yaml
-- uses: actions/checkout@v4
+- uses: actions/checkout@v7
 - uses: interlockd/interlock@v0.1.0        # scan MCP/agent configs, test .interlock/policy.yaml
   with: { fail-on: high }
 - uses: github/codeql-action/upload-sarif@v3

{interlockd-0.1.0 → interlockd-0.1.1}/action.yml

@@ -1,5 +1,5 @@
-name: Interlock
-description: Audit MCP servers, agent configs, and committed agent instruction files (AGENTS.md, CLAUDE.md), and test your agent security policy, in CI.
+name: Interlock Agent Security
+description: Scan MCP servers, agent configs and AGENTS.md / CLAUDE.md for risks, and test your agent security policy in CI.
 author: interlockd
 branding: { icon: shield, color: blue }
 
@@ -31,7 +31,7 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v7
       with: { python-version: "3.12" }
     - name: Install Interlock
       shell: bash

interlockd-0.1.1/docs/GETTING-STARTED.md

@@ -0,0 +1,117 @@
+# Getting started
+
+This guide takes about ten minutes. You install Interlock, watch what it would block, switch to enforcing, and then optionally add a team policy, MCP servers, your own agents, and CI. Every step can be undone with `interlock uninstall`.
+
+## 1. Install
+
+```sh
+pipx install interlockd        # or: uv tool install interlockd
+interlock init
+```
+
+`init` lists everything it will change and asks first. It then:
+
+- finds the coding agents you have (Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI, Windsurf, Antigravity, OpenCode, Kiro);
+- adds a small hook to each one;
+- creates `~/.interlock/`, holding a 0600 token, the audit log and a starter policy;
+- starts the daemon as a background service (launchd on macOS, systemd on Linux).
+
+Use `--harness claude-code,codex` to set up only some agents, and `--no-service` to skip the background service.
+
+You start in **shadow** mode: every decision is recorded and nothing is blocked. Restart any agent that was already running so it loads the hook. Codex also asks you to review and trust the hook once with `/hooks`.
+
+## 2. Check it is working
+
+```sh
+interlock status       # daemon, mode, policy, which agents have hooks
+interlock selftest     # sends attack shapes through the live daemon in each agent's hook format; nothing runs
+```
+
+```
+  ✓ claude-code  force-push to main               block  (should stop) git.force_push_protected_branch
+  ✓ claude-code  pipe a download into a shell     block  (should stop) egress.unknown_host, shell.pipe_to_shell
+  ✓ claude-code  upload .env to a paste site      block  (should stop) egress.unknown_host, egress.upload_sensitive_file
+  ✓ claude-code  persistence in ~/.zshrc          block  (should stop) persistence.shell_rc, shell.pipe_to_shell
+  ✓ claude-code  ordinary test run                allow  (should pass)
+```
+
+## 3. Work as usual, then look
+
+Use your agent normally for a while. Then:
+
+```sh
+interlock log -f       # decisions as they happen
+interlock report       # what enforce mode would have blocked, and which rules fired
+interlock explain      # the latest stop in plain language: why, what the agent was told, how to override it
+```
+
+```
+Interlock would have refused a Bash call from claude-code (shadow mode: nothing was enforced):
+  git push --force origin main
+
+Why:
+  - git.force_push_protected_branch (critical): Force-pushing a protected branch rewrites shared history ...
+
+If this was wrong, override the rule in ~/.interlock/policy.yaml:
+  packs:
+    overrides:
+      git.force_push_protected_branch: { action: ask }     # or enabled: false
+```
+
+If a rule is too noisy for you, override it in `~/.interlock/policy.yaml` and run `interlock restart`. `interlock policy lint` catches typos and warns about overrides that weaken critical rules.
+
+## 4. Enforce
+
+```sh
+interlock enforce
+```
+
+Refused calls now don't run. The agent receives the reason and is told not to retry in a disguised form. Tool results that carry injected instructions are withheld wherever the agent allows that. Claude Code, Codex and Copilot CLI allow it; [ADAPTERS.md](ADAPTERS.md) lists each agent. `interlock shadow` switches back. `interlock pause` refuses every agent action until `interlock resume`.
+
+`interlock doctor` checks that protection is really on. It reports missing or edited hooks, agents you have installed that aren't protected, calls that ran while the daemon was down, and whether the audit log is intact.
+
+## 5. Optional: share a policy with your team
+
+Commit a policy as `.interlock/policy.yaml` in a repository, starting from [examples/policies/strict-team.yaml](../examples/policies/strict-team.yaml). Everyone running Interlock gets it for calls made inside that repository, with no restart needed. A repository's policy can only make your own stricter, so a poisoned repository can't switch rules off. `interlock policy lint --workspace .` shows what applies.
+
+## 6. Optional: MCP servers
+
+```sh
+interlock scan              # audit MCP and agent configs: unpinned packages, inline secrets, broad roots, auto-approved tools
+interlock gateway wrap      # route every MCP server through Interlock (unwrap undoes it)
+```
+
+The gateway pins each server's tool definitions, so a definition that changes after approval is caught. It also hides poisoned tools, gates each call with the same rules as the shell, and withholds injected results. It works with any MCP client, including ones without hooks. Restart your agents after wrapping.
+
+## 7. Optional: your own agents
+
+Install the extra for your framework, for example `pip install 'interlockd[langchain]'`, then wrap the tools:
+
+```python
+from interlockd.integrations.langchain import guard_tools
+
+agent = create_react_agent(model, guard_tools([shell]))
+```
+
+The Claude Agent SDK (`guard_options(options)`), Strands, the OpenAI Agents SDK, Google ADK and CrewAI work the same way. See [examples/agents/](../examples/agents/).
+
+## 8. Optional: stronger containment
+
+Hooks only see what an agent reports. To limit an agent at the OS level as well:
+
+```sh
+interlock egress-proxy &                                       # decides every outbound host
+interlock sandbox --egress http://127.0.0.1:7392 -- claude     # rc files, ~/.ssh and Interlock's files can't be written; network only via the proxy
+```
+
+## 9. Optional: CI
+
+`interlock scan --fail-on high` and `interlock test` both exit non-zero on a problem. [examples/github-workflow.yml](../examples/github-workflow.yml) runs them in GitHub Actions and uploads SARIF.
+
+## Removing it
+
+```sh
+interlock uninstall           # removes hooks and the service; keeps ~/.interlock (add --purge to delete it)
+```
+
+Next: [USER-GUIDE.md](USER-GUIDE.md) for every command and policy option, [THREAT-MODEL.md](THREAT-MODEL.md) for what Interlock can and can't see, [PERFORMANCE.md](PERFORMANCE.md) for latency.

interlockd-0.1.1/docs/PERFORMANCE.md

@@ -0,0 +1,33 @@
+# Performance
+
+Interlock sits in front of every tool call, so it has to be cheap. Measure it on your own machine with:
+
+```sh
+interlock bench            # add --json out.json to keep the numbers
+```
+
+`bench` starts a private daemon in a temporary home (your audit log is not touched) and reports p50 / p95 / p99 in milliseconds for each path.
+
+## Results
+
+Interlock 0.1.1 (unreleased), Apple M4 Pro, macOS, Python 3.12:
+
+| Path | What it measures | n | p50 ms | p95 ms | p99 ms |
+|---|---|---|---|---|---|
+| decide | the decision pipeline alone, over the whole rule corpus (attack and benign cases, every pack), including the hash-chained audit write | 783 | 1.17 | 1.87 | 2.61 |
+| probe 4 KB | a post-action decision on a 4 KB tool result: the local injection probe plus the audit write | 200 | 6.07 | 8.46 | 12.99 |
+| http | one hook call to the daemon over loopback HTTP, as an agent's hook delivers it | 300 | 4.87 | 8.46 | 16.24 |
+| shim (tcp) | the full hook path an agent pays: the POSIX `sh` shim, `curl`, the daemon, over TCP | 100 | 92.49 | 149.78 | 213.25 |
+| shim (unix) | the same over the daemon's 0600 Unix socket | 100 | 93.67 | 215.43 | 352.82 |
+| floor | `sh` + `cat` + `curl` to the health endpoint, no decision | 100 | 89.13 | 161.42 | 213.56 |
+
+## Reading the numbers
+
+- **Decisions take about a millisecond.** The deterministic rules, the shell decomposer and the audit write together take 1.2 ms at p50. That is the "~2 ms per decision" figure, and p99 stays under 3 ms.
+- **The hook shim mostly costs process spawn.** On this machine, starting `sh` and `curl` with no decision at all (the floor row) takes about as long as the full shim. Interlock adds the http row, about 5 ms. Process start-up varies a lot between machines. Endpoint security agents that inspect every `exec` make it much slower, so measure on yours.
+- **Post-action is slower than pre-action** because the injection probe scans the whole result (up to 20,000 characters). An agent waits for this after the tool has already run, not before.
+- **The optional model is not in these numbers.** With `judge` or a classifier enabled, ambiguous cases add the model's latency. The deterministic path still answers first, so clear cases never wait for the model.
+
+## Timeouts and fail mode
+
+The shim gives the daemon 1.5 s before a tool runs (`INTERLOCK_PRE_TIMEOUT_MS`) and 2.5 s after (`INTERLOCK_POST_TIMEOUT_MS`). Both are hundreds of times the measured p99. A call that times out is handled by the fail mode. It fails open by default, and refuses the call if `fail_mode.default` is `closed`. Every such call is logged to `~/.interlock/hook.log`, and `interlock doctor` reports it.

{interlockd-0.1.0 → interlockd-0.1.1}/docs/THREAT-MODEL.md

@@ -39,11 +39,12 @@ Stated plainly, because a security tool that overstates its coverage is dangerou
 | Limit | Why | Mitigation |
 |---|---|---|
 | Only actions that pass through an enforcement point are gated | a process the agent already started, a second agent without hooks, or a tool the hook matcher doesn't cover is invisible to the hooks | install for every agent (`interlock init`); route MCP through the gateway; run the agent under `interlock sandbox`, which refuses persistence and guard-rail writes at the OS level whatever path they take; `doctor` and `scan` flag unprotected agents. `interlock sandbox --egress` confines the agent's network to localhost and routes it through `interlock egress-proxy` |
-| The agent runs as your user | it can technically edit hook files, the policy, or the shim | Interlock refuses writes to agent configs and its own files; `interlock doctor` detects removed hooks and modified shims; the audit log is hash-chained (`interlock audit verify`) |
-| Default fail mode is open for most categories | a stopped daemon should not stop all work | the high-risk categories (exfiltration, malicious commands, persistence, secret leaks, privilege escalation) fail closed; `doctor` reports calls that ran while the daemon was down |
+| The agent runs as your user | it can technically edit hook files, the policy, or the shim | Interlock refuses writes to agent configs and its own files; the daemon re-checks its hooks every minute and records a removed hook or a modified shim in the hash-chained audit log (`interlock report` lists them), and `interlock doctor` reports them (`interlock audit verify` checks the chain) |
+| Default fail mode is open | a stopped daemon should not stop all work; without the daemon a hook cannot tell a dangerous call from a safe one | set `fail_mode.default: closed` to refuse every call while the daemon is down; wrapped remote MCP servers are unreachable without it; `doctor` reports calls that ran while the daemon was down |
 | Shell analysis is static | commands assembled at runtime (strings built and executed later) can hide intent | constructs that build-and-execute (eval, decode-and-run, pipe to a shell) are themselves rules; ambiguous cases ask |
 | Injection detection is heuristic | a novel phrasing can score below the threshold | multiple detectors compose deny-wins (local heuristics, optional classifier, Bedrock Guardrails, the judge); toxic-flow detection catches the dangerous *combination* even when one step is missed |
 | Some agents can't replace a tool result | the hook contract doesn't allow it (Kiro, Windsurf, Antigravity, Cursor for non-MCP tools) | the detection is recorded and visible in `interlock log` / `report`; warnings are added where supported |
+| A repository's own `.interlock/policy.yaml` is written by whoever commits to it | a poisoned repository could try to switch rules off | repository policies only tighten yours unless you list the repository in `trust.trusted_workspaces`; `policy lint --workspace` shows what was not applied |
 | Shadow mode enforces nothing | it is the default so you can see decisions first | `interlock report` shows what enforce would have done; `interlock enforce` |
 | Adapters built from documentation | contracts have differed from their docs before | adapters say "built, not verified live" until payloads are captured from the real tool |