interlockd 0.1.0__tar.gz → 0.1.2__tar.gz

interlockd-0.1.2/.github/ISSUE_TEMPLATE/agent.yml

@@ -0,0 +1,20 @@
+name: Support for an agent or framework
+description: Ask for (or offer to build) an adapter for a coding agent, agent framework, or MCP client
+labels: [adapter]
+body:
+  - type: input
+    id: agent
+    attributes: { label: Agent or framework, placeholder: "name, version, link" }
+    validations: { required: true }
+  - type: textarea
+    id: hooks
+    attributes:
+      label: Its extension point
+      description: Hooks, plugins, callbacks, or MCP only? Links to the docs help. Adapters are verified against payloads captured from the real tool, see docs/ADAPTERS.md.
+  - type: checkboxes
+    id: help
+    attributes:
+      label: Can you help?
+      options:
+        - label: I can capture real hook payloads from this tool
+        - label: I'd like to build the adapter

interlockd-0.1.2/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,29 @@
+name: Bug
+description: Something doesn't work as documented
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Found a way past a rule? Please use **private vulnerability reporting** instead (see the link on the previous page).
+        Audit records contain tool arguments: remove anything secret before pasting.
+  - type: textarea
+    id: what
+    attributes: { label: "What happened, and what did you expect?" }
+    validations: { required: true }
+  - type: textarea
+    id: repro
+    attributes: { label: "Steps to reproduce" }
+    validations: { required: true }
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Output of `interlock --version` and `interlock doctor`
+      render: text
+    validations: { required: true }
+  - type: input
+    id: agent
+    attributes: { label: Agent and version, placeholder: "Claude Code 2.x, Codex 0.x, Cursor CLI ..." }
+  - type: input
+    id: os
+    attributes: { label: OS, placeholder: "macOS 15 arm64, Ubuntu 24.04 ..." }

interlockd-0.1.2/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a vulnerability or a bypass (private)
+    url: https://github.com/interlockd/interlock/security/advisories/new
+    about: A way past a default rule, an injected result that reaches the agent, or tampering doctor misses. Please don't open a public issue.

interlockd-0.1.2/.github/ISSUE_TEMPLATE/decision.yml

@@ -0,0 +1,34 @@
+name: Wrong decision (false positive or false negative)
+description: Interlock blocked or asked about something safe, or allowed something it should have stopped
+labels: [decision]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        If an attack got through a **default** rule, please report it privately instead (Security → Report a vulnerability).
+        `interlock explain` shows the rule ids and reason for the latest stop. Remove secrets before pasting.
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Kind
+      options: ["False positive: a safe action was blocked or asked", "False negative: a harmful action was allowed"]
+    validations: { required: true }
+  - type: textarea
+    id: action
+    attributes: { label: "The tool call (command or tool and arguments)", render: text }
+    validations: { required: true }
+  - type: textarea
+    id: explain
+    attributes: { label: "Output of `interlock explain` (for a stop)", render: text }
+  - type: input
+    id: expected
+    attributes: { label: "What should the decision be? (allow / ask / block)" }
+    validations: { required: true }
+  - type: textarea
+    id: why
+    attributes: { label: "Why? Context that makes it safe, or harmful" }
+  - type: dropdown
+    id: policy
+    attributes:
+      label: Policy
+      options: ["Default policy", "Custom policy (paste the relevant part below)"]

interlockd-0.1.2/.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule: { interval: weekly }
+  - package-ecosystem: pip
+    directory: /
+    schedule: { interval: weekly }
+    open-pull-requests-limit: 5

interlockd-0.1.2/.github/pull_request_template.md

@@ -0,0 +1,10 @@
+## What and why
+
+## How it was verified
+
+- [ ] Tests (`pytest -q`, `interlock test`)
+- [ ] Live against the real agent (which one, which version)
+
+## For a rule change
+
+- [ ] Positive **and** hard-negative cases in `interlockd/data/packs/<pack>.jsonl`

{interlockd-0.1.0 → interlockd-0.1.2}/.github/workflows/ci.yml

@@ -15,8 +15,8 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
       - name: Install
         run: |
           uv venv --python 3.12
@@ -29,10 +29,22 @@ jobs:
         run: .venv/bin/interlock test
       - name: Evaluation corpus gate
         run: .venv/bin/interlock test --corpus corpus/archetypes
-      - name: Framework integrations (Strands, LangChain) against a real daemon
+      - name: Linux sandbox (bubblewrap)
+        if: runner.os == 'Linux'
         run: |
-          uv pip install --python .venv/bin/python strands-agents langchain-core openai-agents
-          .venv/bin/pytest -q tests/test_strands.py tests/test_langchain.py tests/test_openai_agents.py
+          sudo apt-get install -y -qq bubblewrap
+          # Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor; bubblewrap needs them
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          .venv/bin/pytest -q tests/test_sandbox.py -rs
+      - name: Framework integrations against a real daemon
+        run: |
+          uv pip install --python .venv/bin/python strands-agents langchain-core openai-agents google-adk claude-agent-sdk semantic-kernel
+          .venv/bin/pytest -q tests/test_strands.py tests/test_langchain.py tests/test_openai_agents.py tests/test_google_adk.py tests/test_claude_agent_sdk.py tests/test_semantic_kernel.py
+      - name: CrewAI integration (own environment)
+        run: |
+          uv venv /tmp/crewai --python 3.12
+          uv pip install --python /tmp/crewai/bin/python -e ".[dev]" crewai
+          /tmp/crewai/bin/pytest -q tests/test_crewai.py
       - name: Wheel smoke test
         run: |
           uv build --wheel -o dist
@@ -43,7 +55,7 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Plant a risky MCP config to prove the scan sees it
         run: |
           mkdir -p .vscode

interlockd-0.1.2/.github/workflows/release.yml

@@ -0,0 +1,95 @@
+name: release
+
+# Publish to PyPI when a version tag is pushed (git tag v0.1.0 && git push origin v0.1.0).
+# Uses PyPI trusted publishing: no API token is stored. One-time setup on pypi.org:
+#   project "interlockd" → Publishing → add GitHub publisher: owner interlockd, repo interlock,
+#   workflow release.yml, environment pypi.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write          # signs the build provenance (Sigstore)
+      attestations: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Tag matches package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg=$(python3 -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          mod=$(python3 -c "import re;print(re.search(r'__version__ = \"(.+)\"', open('interlockd/__init__.py').read()).group(1))")
+          echo "tag=$tag pyproject=$pkg module=$mod"
+          [ "$tag" = "$pkg" ] && [ "$tag" = "$mod" ]
+      - name: Test
+        run: |
+          uv venv --python 3.12 && uv pip install -e ".[dev]" --python .venv/bin/python
+          .venv/bin/ruff check . && .venv/bin/pytest -q && .venv/bin/interlock test
+      - name: Build
+        run: uv build
+      - name: Smoke-test the wheel
+        run: |
+          uv venv /tmp/w --python 3.12 && uv pip install --python /tmp/w/bin/python dist/*.whl
+          cd /tmp && /tmp/w/bin/interlock --help >/dev/null && /tmp/w/bin/interlock test
+      - name: Build provenance (verify with `gh attestation verify <file> --repo interlockd/interlock`)
+        uses: actions/attest-build-provenance@v2
+        with: { subject-path: "dist/*" }
+      - uses: actions/upload-artifact@v7
+        with: { name: dist, path: dist/ }
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write          # trusted publishing
+      contents: write          # GitHub release
+    steps:
+      - uses: actions/download-artifact@v8
+        with: { name: dist, path: dist/ }
+      - uses: pypa/gh-action-pypi-publish@release/v1
+      - name: GitHub release
+        env: { GH_TOKEN: "${{ github.token }}" }
+        run: |
+          # a release drafted by hand on GitHub (e.g. to publish the Action to the Marketplace) keeps its notes
+          if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release upload "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --clobber
+          else
+            gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --title "$GITHUB_REF_NAME" --generate-notes
+          fi
+
+  homebrew:
+    # Regenerates Formula/interlock.rb from the release on PyPI. With a HOMEBREW_TAP_TOKEN secret (a fine-grained token
+    # with contents: write on interlockd/homebrew-tap) it commits the formula there; without one it is kept as an artifact.
+    needs: publish
+    runs-on: ubuntu-latest
+    env: { TAP_TOKEN: "${{ secrets.HOMEBREW_TAP_TOKEN }}" }
+    steps:
+      - uses: actions/checkout@v7
+      - name: Generate the formula (waits for PyPI to serve the new version)
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          for i in 1 2 3 4 5 6 7 8 9 10; do
+            python3 packaging/homebrew/make_formula.py "$v" > interlock.rb && break
+            sleep 30
+          done
+          ruby -c interlock.rb
+      - uses: actions/upload-artifact@v7
+        with: { name: homebrew-formula, path: interlock.rb }
+      - name: Commit to interlockd/homebrew-tap
+        if: env.TAP_TOKEN != ''
+        run: |
+          git clone "https://x-access-token:${TAP_TOKEN}@github.com/interlockd/homebrew-tap.git" tap
+          mkdir -p tap/Formula && cp interlock.rb tap/Formula/interlock.rb
+          cd tap
+          git config user.name "interlock release"; git config user.email "release@users.noreply.github.com"
+          git add Formula/interlock.rb
+          git diff --cached --quiet || { git commit -m "interlock ${GITHUB_REF_NAME#v}" && git push origin HEAD:main; }   # works on an empty tap too

interlockd-0.1.2/CHANGELOG.md

@@ -0,0 +1,58 @@
+# Changelog
+
+## 0.1.2 (2026-10-24)
+
+- Managed policy: `<interlock home>/managed-policy.yaml` is applied last and can only tighten decisions (it can switch enforce on, never loosen anything). It is reloaded without a restart; a file that doesn't parse is ignored and reported by `interlock policy lint`. For device management and centrally managed machines.
+- Plugins: installed packages that register under the `interlockd.plugins` entry-point group can add commands and run background work beside `interlock serve`. Plugins never sit in the decision path; a plugin that fails is skipped with a warning. `interlock plugins` lists them; `INTERLOCK_PLUGINS=0` turns them off.
+- Platforms stated: macOS and Linux; on Windows, `interlock` explains how to use WSL2 instead of crashing on import. Homebrew: `brew install interlockd/tap/interlock`.
+- `interlock judge install | status | remove`: run the optional judge model (Strands Decider 2B) locally in one step. The daemon starts it in the background instead of delaying startup.
+- Contributing: pull requests are imported into the development repository with author credit (`CONTRIBUTING.md`); a code of conduct; `demo/demo.sh` (and a VHS tape) for a self-contained recording.
+- `@interlockd/sdk` for JavaScript and TypeScript agents (`sdk/js`, no dependencies): `guardTools` for the Vercel AI SDK, Mastra and any `{ execute }` tool map, and `guardOptions` for the Claude Agent SDK for TypeScript. Both verified with the real packages.
+- Injection detector, measured on public benchmarks (`docs/BENCHMARKS.md`, scripts in `benchmarks/`): catches AgentDojo's leaderboard template (0% -> 100%), InjecAgent's enhanced attacks (37% -> 97% on the harm set), typo'd "ignore your previous ..." and `###(system_message)` markers. False positives on real documentation fell from 2.2% to 0.25% ("bypass the X policy" and "silently skipped" no longer count).
+- `shred <file>` is an irreversible delete (asked or recorded like `rm -rf`), no longer blocked as a disk wipe; `shred /dev/...` still is.
+- Releases carry signed build provenance (`gh attestation verify`), and the release workflow regenerates the Homebrew formula and commits it to `interlockd/homebrew-tap` when a tap token is configured.
+- `interlock capture`: record the real hook payloads an agent sends (with Interlock's replies), check that blocks held, and export redacted fixtures. `--scratch` sets up a verification project. Verified live with Claude Code.
+- Cedar mandate: shell egress (`curl`, `wget`, ...) now binds to `net.egress` with its hosts, like fetch tools (it was reported unjudged). With `mandate.mode: enforce`, a mandate without a `net.egress` permit now refuses shell egress; `docs/mandate-example.cedar` shows a host allowlist. Enforce mode verified live through the hook shim.
+- MCP OAuth checks in the HTTP gateway: a JWT issued for another service is never passed to an MCP server (audience binding), scopes in `mcp.oauth.deny_scopes` are refused, administrative scopes are flagged, and each server's authorization servers are pinned on first use so a change is refused until `interlock mcp-pins --accept`.
+
+## 0.1.1 (2026-10-18)
+
+- Google ADK and CrewAI integrations.
+- Semantic Kernel integration (`guard_kernel`): a function-invocation filter, tested through a real Kernel.
+- Claude Agent SDK integration (`guard_options`): in-process PreToolUse / PostToolUse hooks, verified live (a refused force-push, a withheld injected README).
+- `interlock pause` / `resume` kill switch.
+- Linux sandbox (bubblewrap) verified in CI.
+- Repository policies: a committed `<repo>/.interlock/policy.yaml` applies to every call inside the repository, re-read on change. It can only tighten your policy unless you list the repository in `trust.trusted_workspaces`; `interlock policy lint --workspace <repo>` shows what was not applied.
+- Hook watch: the daemon re-checks the hooks it installed every minute and records a removed hook or a modified shim (and the repair) in the audit chain; `interlock report` lists them. Shims left by an upgrade are refreshed instead of flagged.
+- `interlock bench`: decision, probe, HTTP and hook-shim latency on your machine; see `docs/PERFORMANCE.md`.
+- Faster audit writes: the hash chain's head is cached between appends instead of re-read; decision p50 4.2 ms -> 1.2 ms.
+- `interlock doctor` reports when a newer release is on PyPI (`INTERLOCK_NO_UPDATE_CHECK=1` turns it off).
+- Docs: the hooks apply `fail_mode.default` while the daemon is down (the per-category entries had been described as applying too).
+
+## 0.1.0 (2026-10-17)
+
+First public release.
+
+- `interlock init` / `uninstall`: one-command setup for Claude Code, Codex, Kiro, Cursor, and GitHub Copilot CLI (verified live), plus Gemini CLI, Windsurf, Antigravity CLI, and OpenCode (built from their documented hooks and plugin API); background service (launchd, systemd user, or detached process); shadow mode by default.
+- Pre-action gate: 48 deterministic rules in 6 packs (shell, git, egress, persistence, secrets, packages) with a shell decomposer.
+- Post-action injection probe that runs locally (no cloud), withholding injected results in Claude Code.
+- Custom agents: `interlockd.integrations.strands.InterlockHooks`, `interlockd.integrations.langchain.guard_tools`, and `interlockd.integrations.openai_agents.guard_agent_tools`.
+- MCP gateway: `interlock gateway wrap | unwrap | status` routes stdio MCP servers through `interlock mcp-proxy` and remote (Streamable HTTP) servers through the daemon, which pins tool definitions (rug-pull detection), hides poisoned tools, gates tool calls with the same rules as the agent's own shell, and withholds injected results.
+- `interlock mcp`: Interlock as an MCP server with read-only advisory tools (`check_action`, `explain_decision`, `recent_decisions`, `scan_mcp_servers`, `interlock_status`, `suggest_rule_override`); `interlock init --mcp` registers it.
+- Codex: injected tool results are withheld (`decision: block`, measured live).
+- Memory-poisoning protection: writes to agent instruction files (CLAUDE.md, AGENTS.md, ...) and MCP memory tools are recorded, and asked when the content reads as injected or the session took in untrusted content.
+- `interlock pause` / `resume`: a kill switch that refuses every agent action (all or named agents, optionally timed), in any mode.
+- `interlock egress-proxy`: decides every outbound host (metadata endpoints refused; `--strict` allowlist); `interlock sandbox --egress` makes it the agent's only way out.
+- `interlock sandbox -- <agent>`: OS-level sandbox (macOS seatbelt; Linux bubblewrap) refusing persistence and guard-rail writes, with optional secret-read and network limits.
+- Packaging: published on PyPI as `interlockd` (the command is still `interlock`) via a trusted-publishing release workflow, and a Homebrew formula generator for `interlockd/homebrew-tap`.
+- `interlock replay`: re-decide recorded calls with your current policy and see what would change.
+- `interlock policy lint`: unknown rule ids (a typo in an override silently does nothing), weakened critical rules, catch-all allows.
+- `interlock selftest`: attack shapes through the live daemon in each agent's hook format; run by `init`.
+- `interlock explain`: why a call was stopped, in plain language, with the override snippet.
+- OpenTelemetry: one span per decision to any OTLP/HTTP collector (`otlp_endpoint` in config), and `interlock otel export` to backfill.
+- `interlock aibom`: CycloneDX 1.6 AI bill of materials for the agent stack (agents, models, MCP servers with package URLs and pinning, remote endpoints).
+- Hardening: the daemon also listens on a 0600 Unix socket that the hooks prefer; `interlock token --rotate`.
+- Tamper-evident audit log: hash-chained records, `interlock audit verify` and `audit head`.
+- `interlock scan`: static audit of MCP servers and agent settings across Claude Code, Claude Desktop, Codex, Cursor, VS Code, Kiro, Gemini CLI, and Windsurf.
+- `interlock report`, `doctor`, `status`, `log`, `enforce` / `shadow`, `test`.
+- Optional: Cedar mandate, open-weights judge, Amazon Bedrock Guardrails as an extra detector, DynamoDB audit store.

interlockd-0.1.2/CODE_OF_CONDUCT.md

@@ -0,0 +1,10 @@
+# Code of conduct
+
+Interlock follows the [Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+In short: be respectful and constructive, assume good faith, and keep discussion about the work. Harassment, personal
+attacks, and discriminatory language are not acceptable in issues, pull requests, discussions, or any other project
+space.
+
+To report a problem, email **conduct@interlockd.dev**. Reports are handled confidentially. The maintainers may remove content and restrict participation, as described in the Covenant's
+enforcement guidelines.

{interlockd-0.1.0 → interlockd-0.1.2}/CONTRIBUTING.md

@@ -17,11 +17,17 @@ CI runs all four on every pull request.
 ## What to contribute
 
 - **A rule.** Register it in `interlockd/det/packs.py`, implement the check, and add positive *and* negative cases to `interlockd/data/packs/<pack>.jsonl`. A rule without hard negatives will not be merged: false positives are what make people uninstall a security tool.
-- **An adapter for a new agent.** Read [docs/ADAPTERS.md](docs/ADAPTERS.md) first. A normalizer (`interlockd/normalize/`), a shim (`interlockd/shims/`), detection in `interlockd/onboard.py`, and **payloads captured from the real tool** as fixtures in `tests/fixtures/<agent>/`, plus a `adapters/<agent>/PAYLOADS.md` describing what you measured. Documented-but-unmeasured contracts have been wrong before.
+- **An adapter for a new agent.** Read [docs/ADAPTERS.md](docs/ADAPTERS.md) first. A normalizer (`interlockd/normalize/`), a shim (`interlockd/shims/`), detection in `interlockd/onboard.py`, and **payloads captured from the real tool** (`interlock capture`, see docs/ADAPTERS.md §4) as fixtures in `tests/fixtures/<agent>/`, plus a `adapters/<agent>/PAYLOADS.md` describing what you measured. Documented-but-unmeasured contracts have been wrong before.
 - **Corpus cases.** Real attack shapes and real benign commands that a rule gets wrong.
 
 ## Pull requests
 
+Open pull requests against `main` here as usual. This repository is published from the maintainers' development
+repository, so a merged change reaches `main` through the next published commit, with you credited as author (and
+`Co-authored-by` on the published commit); your PR is closed with a link to it rather than merged with the button.
+
 - Keep changes focused; include tests.
 - Describe what you verified and how (live against the tool, or tests only).
 - By contributing you agree your contribution is licensed under Apache-2.0.
+
+By taking part you agree to the [code of conduct](CODE_OF_CONDUCT.md).

interlockd-0.1.2/NOTICE

@@ -0,0 +1,7 @@
+Interlock
+Copyright 2026 the Interlock authors
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+Benchmark scripts in benchmarks/ download third-party datasets at run time; those datasets are not part of this
+repository and keep their own licenses: InjecAgent (MIT), AgentDojo (MIT), NL2Bash (GPL-3.0).

interlockd-0.1.0/README.md → interlockd-0.1.2/PKG-INFO

@@ -1,3 +1,47 @@
+Metadata-Version: 2.5
+Name: interlockd
+Version: 0.1.2
+Summary: Interlock daemon: a pre/post-action interlock for coding agents
+License: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Classifier: Environment :: Console
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.12
+Requires-Dist: pydantic<3,>=2.9
+Requires-Dist: pyyaml<7,>=6.0
+Provides-Extra: aws
+Requires-Dist: boto3<2,>=1.35; extra == 'aws'
+Provides-Extra: claude-agent-sdk
+Requires-Dist: claude-agent-sdk>=0.2; extra == 'claude-agent-sdk'
+Provides-Extra: crewai
+Requires-Dist: crewai>=1.10; extra == 'crewai'
+Provides-Extra: dev
+Requires-Dist: boto3<2,>=1.35; extra == 'dev'
+Requires-Dist: cedarpy<5,>=4.7; extra == 'dev'
+Requires-Dist: moto[dynamodb]<6,>=5.0; extra == 'dev'
+Requires-Dist: pytest<10,>=8.3; extra == 'dev'
+Requires-Dist: ruff<1,>=0.6; extra == 'dev'
+Provides-Extra: google-adk
+Requires-Dist: google-adk>=2.0; extra == 'google-adk'
+Provides-Extra: langchain
+Requires-Dist: langchain-core>=1.0; extra == 'langchain'
+Provides-Extra: mandate
+Requires-Dist: cedarpy<5,>=4.7; extra == 'mandate'
+Provides-Extra: openai-agents
+Requires-Dist: openai-agents>=0.20; extra == 'openai-agents'
+Provides-Extra: promptguard
+Requires-Dist: torch>=2.3; extra == 'promptguard'
+Requires-Dist: transformers<6,>=4.44; extra == 'promptguard'
+Provides-Extra: semantic-kernel
+Requires-Dist: semantic-kernel>=1.30; extra == 'semantic-kernel'
+Provides-Extra: strands
+Requires-Dist: strands-agents>=1.40; extra == 'strands'
+Description-Content-Type: text/markdown
+
 # Interlock
 
 **The safety layer between your AI agent and your codebase.**
@@ -8,10 +52,15 @@ It runs locally. No account, no cloud, no model download required.
 
 
 ```sh
-pipx install interlockd     # or: uv tool install interlockd
+pipx install interlockd     # or: uv tool install interlockd, or: brew install interlockd/tap/interlock
 interlock init              # finds your agents, installs hooks, starts the daemon (shadow mode)
 ```
 
+Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal;
+native Windows support is planned.
+
+New here? [docs/GETTING-STARTED.md](docs/GETTING-STARTED.md) walks through shadow mode, enforcing, MCP servers, your own agents and CI in about ten minutes.
+
 ```
 What the gate decides (enforce mode, nothing executed):
   block  git push --force origin main                         force-push to a protected branch
@@ -31,14 +80,15 @@ What the gate decides (enforce mode, nothing executed):
 | Cursor (CLI) | ✅ verified live: blocks before execution |
 | GitHub Copilot CLI | ✅ verified live: blocks before execution, withholds injected tool results |
 | Gemini CLI, Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
-| Your own agents (Strands, LangChain / LangGraph, OpenAI Agents SDK) | ✅ in-process: `Agent(hooks=[InterlockHooks()])`, `guard_tools(tools)`, `guard_agent_tools(agent)` |
-| Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio MCP server, hooks or not |
-| Windsurf, Cline, GitHub Copilot, and more | hook adapters planned |
+| Your own agents (Claude Agent SDK, Strands, LangChain / LangGraph, OpenAI Agents SDK, Google ADK, CrewAI, Semantic Kernel) | ✅ in-process: `guard_options(options)`, `InterlockHooks()`, `guard_tools(tools)`, `guard_agent_tools(agent)`, `guard_agent(agent)`, `crewai.install()`, `guard_kernel(kernel)` |
+| JavaScript / TypeScript agents (Vercel AI SDK, Claude Agent SDK for TS, Mastra) | ✅ `@interlockd/sdk`: `guardTools(tools)`, `guardOptions(options)` ([sdk/js](sdk/js)) |
+| Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio and remote (HTTP) MCP server, hooks or not |
+| Cline, Copilot in VS Code, and more | hook adapters planned; meanwhile the MCP gateway and `interlock sandbox` cover them |
 
 ## How it works
 
 1. **Hooks.** `interlock init` adds a small hook to each agent you have installed. The hook forwards each proposed tool call (and each tool result) to a local daemon.
-2. **Deterministic rules first.** 48 rules in 6 packs (shell, git, egress, persistence, secrets, packages) decide in about 2 ms. The shell decomposer sees through chains, pipes, subshells, heredocs, interpreter one-liners and base64.
+2. **Deterministic rules first.** 48 rules in 6 packs (shell, git, egress, persistence, secrets, packages) decide in about a millisecond ([measured](docs/PERFORMANCE.md)). The shell decomposer sees through chains, pipes, subshells, heredocs, interpreter one-liners and base64.
 3. **Injection probe on results.** A local detector flags tool output that tries to instruct the agent (including text hidden in HTML comments or invisible Unicode) and withholds it where the agent supports that.
 4. **Optional judge.** An open-weights decision model can answer "did the user actually ask for this?" for ambiguous actions. Off by default.
 5. **Everything recorded.** Every decision lands in a local append-only log with its reason.
@@ -68,7 +118,7 @@ Policy lives in `~/.interlock/policy.yaml` (user) and `<repo>/.interlock/policy.
 
 ## Honest limits
 
-The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md).
+The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md). Latency on your own machine: `interlock bench` ([docs/PERFORMANCE.md](docs/PERFORMANCE.md)). Detection and false-positive rates on public datasets (InjecAgent, AgentDojo, NL2Bash), including what it misses: [docs/BENCHMARKS.md](docs/BENCHMARKS.md).
 
 
 - Interlock sees what the agent's hooks show it. A process the agent starts outside the hook path, or a second unguarded agent, is not gated. Network and sandbox enforcement are on the roadmap.
@@ -78,8 +128,8 @@ The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md).
 ## In CI
 
 ```yaml
-- uses: actions/checkout@v4
-- uses: interlockd/interlock@v0.1.0        # scan MCP/agent configs, test .interlock/policy.yaml
+- uses: actions/checkout@v7
+- uses: interlockd/interlock@v0.1.2        # scan MCP/agent configs, test .interlock/policy.yaml
   with: { fail-on: high }
 - uses: github/codeql-action/upload-sarif@v3
   if: always()
@@ -92,4 +142,9 @@ Adapters for new agents, rules, and corpus cases are all welcome. See [CONTRIBUT
 
 ## License
 
-Apache-2.0.
+Everything in this repository is Apache-2.0, and stays that way: we will not relicense it. That covers enforcement,
+every rule and adapter, the injection detector, the MCP gateway, policy testing, and the local audit log, and it runs
+fully offline with no license check.
+
+A hosted service for teams (fleet-wide policy, dashboards, retention) may come later as a separate product. It will
+not make anything here less safe or move it behind a paywall. See `NOTICE`.

interlockd-0.1.0/PKG-INFO → interlockd-0.1.2/README.md

@@ -1,33 +1,3 @@
-Metadata-Version: 2.5
-Name: interlockd
-Version: 0.1.0
-Summary: Interlock daemon: a pre/post-action interlock for coding agents
-License: Apache-2.0
-License-File: LICENSE
-Requires-Python: >=3.12
-Requires-Dist: pydantic<3,>=2.9
-Requires-Dist: pyyaml<7,>=6.0
-Provides-Extra: aws
-Requires-Dist: boto3<2,>=1.35; extra == 'aws'
-Provides-Extra: dev
-Requires-Dist: boto3<2,>=1.35; extra == 'dev'
-Requires-Dist: cedarpy<5,>=4.7; extra == 'dev'
-Requires-Dist: moto[dynamodb]<6,>=5.0; extra == 'dev'
-Requires-Dist: pytest<9,>=8.3; extra == 'dev'
-Requires-Dist: ruff<1,>=0.6; extra == 'dev'
-Provides-Extra: langchain
-Requires-Dist: langchain-core>=1.0; extra == 'langchain'
-Provides-Extra: mandate
-Requires-Dist: cedarpy<5,>=4.7; extra == 'mandate'
-Provides-Extra: openai-agents
-Requires-Dist: openai-agents>=0.20; extra == 'openai-agents'
-Provides-Extra: promptguard
-Requires-Dist: torch>=2.3; extra == 'promptguard'
-Requires-Dist: transformers<5,>=4.44; extra == 'promptguard'
-Provides-Extra: strands
-Requires-Dist: strands-agents>=1.40; extra == 'strands'
-Description-Content-Type: text/markdown
-
 # Interlock
 
 **The safety layer between your AI agent and your codebase.**
@@ -38,10 +8,15 @@ It runs locally. No account, no cloud, no model download required.
 
 
 ```sh
-pipx install interlockd     # or: uv tool install interlockd
+pipx install interlockd     # or: uv tool install interlockd, or: brew install interlockd/tap/interlock
 interlock init              # finds your agents, installs hooks, starts the daemon (shadow mode)
 ```
 
+Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal;
+native Windows support is planned.
+
+New here? [docs/GETTING-STARTED.md](docs/GETTING-STARTED.md) walks through shadow mode, enforcing, MCP servers, your own agents and CI in about ten minutes.
+
 ```
 What the gate decides (enforce mode, nothing executed):
   block  git push --force origin main                         force-push to a protected branch
@@ -61,14 +36,15 @@ What the gate decides (enforce mode, nothing executed):
 | Cursor (CLI) | ✅ verified live: blocks before execution |
 | GitHub Copilot CLI | ✅ verified live: blocks before execution, withholds injected tool results |
 | Gemini CLI, Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
-| Your own agents (Strands, LangChain / LangGraph, OpenAI Agents SDK) | ✅ in-process: `Agent(hooks=[InterlockHooks()])`, `guard_tools(tools)`, `guard_agent_tools(agent)` |
-| Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio MCP server, hooks or not |
-| Windsurf, Cline, GitHub Copilot, and more | hook adapters planned |
+| Your own agents (Claude Agent SDK, Strands, LangChain / LangGraph, OpenAI Agents SDK, Google ADK, CrewAI, Semantic Kernel) | ✅ in-process: `guard_options(options)`, `InterlockHooks()`, `guard_tools(tools)`, `guard_agent_tools(agent)`, `guard_agent(agent)`, `crewai.install()`, `guard_kernel(kernel)` |
+| JavaScript / TypeScript agents (Vercel AI SDK, Claude Agent SDK for TS, Mastra) | ✅ `@interlockd/sdk`: `guardTools(tools)`, `guardOptions(options)` ([sdk/js](sdk/js)) |
+| Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio and remote (HTTP) MCP server, hooks or not |
+| Cline, Copilot in VS Code, and more | hook adapters planned; meanwhile the MCP gateway and `interlock sandbox` cover them |
 
 ## How it works
 
 1. **Hooks.** `interlock init` adds a small hook to each agent you have installed. The hook forwards each proposed tool call (and each tool result) to a local daemon.
-2. **Deterministic rules first.** 48 rules in 6 packs (shell, git, egress, persistence, secrets, packages) decide in about 2 ms. The shell decomposer sees through chains, pipes, subshells, heredocs, interpreter one-liners and base64.
+2. **Deterministic rules first.** 48 rules in 6 packs (shell, git, egress, persistence, secrets, packages) decide in about a millisecond ([measured](docs/PERFORMANCE.md)). The shell decomposer sees through chains, pipes, subshells, heredocs, interpreter one-liners and base64.
 3. **Injection probe on results.** A local detector flags tool output that tries to instruct the agent (including text hidden in HTML comments or invisible Unicode) and withholds it where the agent supports that.
 4. **Optional judge.** An open-weights decision model can answer "did the user actually ask for this?" for ambiguous actions. Off by default.
 5. **Everything recorded.** Every decision lands in a local append-only log with its reason.
@@ -98,7 +74,7 @@ Policy lives in `~/.interlock/policy.yaml` (user) and `<repo>/.interlock/policy.
 
 ## Honest limits
 
-The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md).
+The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md). Latency on your own machine: `interlock bench` ([docs/PERFORMANCE.md](docs/PERFORMANCE.md)). Detection and false-positive rates on public datasets (InjecAgent, AgentDojo, NL2Bash), including what it misses: [docs/BENCHMARKS.md](docs/BENCHMARKS.md).
 
 
 - Interlock sees what the agent's hooks show it. A process the agent starts outside the hook path, or a second unguarded agent, is not gated. Network and sandbox enforcement are on the roadmap.
@@ -108,8 +84,8 @@ The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md).
 ## In CI
 
 ```yaml
-- uses: actions/checkout@v4
-- uses: interlockd/interlock@v0.1.0        # scan MCP/agent configs, test .interlock/policy.yaml
+- uses: actions/checkout@v7
+- uses: interlockd/interlock@v0.1.2        # scan MCP/agent configs, test .interlock/policy.yaml
   with: { fail-on: high }
 - uses: github/codeql-action/upload-sarif@v3
   if: always()
@@ -122,4 +98,9 @@ Adapters for new agents, rules, and corpus cases are all welcome. See [CONTRIBUT
 
 ## License
 
-Apache-2.0.
+Everything in this repository is Apache-2.0, and stays that way: we will not relicense it. That covers enforcement,
+every rule and adapter, the injection detector, the MCP gateway, policy testing, and the local audit log, and it runs
+fully offline with no license check.
+
+A hosted service for teams (fleet-wide policy, dashboards, retention) may come later as a separate product. It will
+not make anything here less safe or move it behind a paywall. See `NOTICE`.

{interlockd-0.1.0 → interlockd-0.1.2}/SECURITY.md

@@ -21,3 +21,14 @@ The threat model (assets, adversaries, where Interlock sees, and its known limit
 
 - Actions that never pass through an agent's hooks (documented limit).
 - Findings that require an already-compromised user account.
+
+## Verifying a release
+
+Releases are built by GitHub Actions from the tagged commit and published to PyPI with trusted publishing (no stored
+token). From 0.1.2, every wheel and sdist also carries a signed build provenance attestation (Sigstore):
+
+```sh
+pip download interlockd==<version> --no-deps -d /tmp/il && gh attestation verify /tmp/il/* --repo interlockd/interlock
+```
+
+PyPI shows the same provenance on each file's page ("Verified details").

{interlockd-0.1.0 → interlockd-0.1.2}/action.yml

@@ -1,5 +1,5 @@
-name: Interlock
-description: Audit MCP servers, agent configs, and committed agent instruction files (AGENTS.md, CLAUDE.md), and test your agent security policy, in CI.
+name: Interlock Agent Security
+description: Scan MCP servers, agent configs and AGENTS.md / CLAUDE.md for risks, and test your agent security policy in CI.
 author: interlockd
 branding: { icon: shield, color: blue }
 
@@ -31,7 +31,7 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@v7
       with: { python-version: "3.12" }
     - name: Install Interlock
       shell: bash
@@ -45,7 +45,8 @@ runs:
       run: |
         # an empty HOME keeps the scan to this repository's own configs
         export HOME="$(mktemp -d)"
-        interlock scan --project "$GITHUB_WORKSPACE" --fail-on "${{ inputs.fail-on }}" --sarif "$GITHUB_WORKSPACE/${{ inputs.sarif }}"
+        args=(scan --project "$GITHUB_WORKSPACE" --fail-on "${{ inputs.fail-on }}" --sarif "$GITHUB_WORKSPACE/${{ inputs.sarif }}")
+        interlock "${args[@]}"
     - name: Test the policy
       if: inputs.test-policy == 'true'
       shell: bash