interlockd 0.1.2__tar.gz → 0.1.3__tar.gz

{interlockd-0.1.2 → interlockd-0.1.3}/.github/workflows/ci.yml

@@ -9,6 +9,44 @@ permissions:
   contents: read
 
 jobs:
+  windows:
+    # native Windows: daemon, policy, audit, scan, SDKs (agent hooks and the sandbox stay macOS/Linux; WSL2)
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Install
+        run: |
+          uv venv --python 3.12
+          uv pip install -e ".[dev]" --python .venv/Scripts/python.exe
+      - name: Unit tests
+        run: .venv/Scripts/python.exe -m pytest -q -p no:cacheprovider
+      - name: Rule corpus gate
+        run: .venv/Scripts/interlock.exe test
+      - name: Live daemon on Windows (start, decide, audit, stop)
+        run: |
+          export INTERLOCK_HOME="$RUNNER_TEMP/ih" IL=.venv/Scripts/interlock.exe
+          $IL enforce && $IL start && $IL status
+          .venv/Scripts/python.exe - <<'PY'
+          import os
+          from interlockd.integrations.client import InterlockClient
+          c = InterlockClient()
+          cases = [("Bash", {"command": "git push --force origin main"}, "block"),
+                   ("Write", {"file_path": os.path.expanduser(r"~\.CLAUDE\settings.json"), "content": "{}"}, "block"),
+                   ("Read", {"file_path": "README.md"}, "allow")]
+          for tool, args, want in cases:
+              v = c.decide("pre_action", tool, args, cwd=os.getcwd())
+              print(tool, args, "->", v and v["disposition"])
+              assert v and v["disposition"] == want, v
+          PY
+          $IL audit verify
+          $IL stop
+          sleep 2
+          if curl -sf http://127.0.0.1:7391/interlock/v1/health; then echo "daemon still running after stop"; exit 1; fi
+
   test:
     runs-on: ${{ matrix.os }}
     strategy:

{interlockd-0.1.2 → interlockd-0.1.3}/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.3 (2026-10-24)
+
+- **Security fix (macOS, Windows):** path rules now match without case where the file system ignores it. On macOS (default APFS) a write to `~/.CLAUDE/settings.json`, `.GIT/hooks/pre-commit` or `.GitHub/Workflows/ci.yml` changes the real file but was allowed. Linux is unchanged.
+- Native Windows, first part: the daemon (`interlock start | stop | status`, a detached background process), policy, audit log, `scan`, `report`, `explain`, `test` and the Python and JavaScript SDKs run on Windows without WSL2. Paths are matched the same way on every OS (`C:\Users\me\.claude\settings.json` hits the same rules as `~/.claude/settings.json`), and the Startup folder and PowerShell profiles count as persistence. Agent hooks, `interlock init`, the gateway, the sandbox and the local judge still need macOS or Linux (on Windows, WSL2); those commands say so. Verified on a Windows CI runner: the full test suite, and a live daemon (start, decisions through the Python client, `audit verify`, stop).
+- Gemini CLI adapter verified live on Gemini CLI 0.65.0: a refused force push and a withheld injected README; captured payloads replayed in tests.
+- Withheld content can't be read back another way: the local probe also scores ROT13 and base64 decodings of each tool result, and once a file is withheld, a shell call naming it in the same session asks (`flow.reread_withheld`). Found live: Gemini CLI re-read a withheld README through ROT13 "without triggering policy".
+- `interlock capture`: `--scratch` projects push nowhere; for agents that send no tool-call id (Gemini CLI), the report pairs a refused call with a later result by session and input.
+- Text files are read and written as UTF-8 on every platform.
+
 ## 0.1.2 (2026-10-24)
 
 - Managed policy: `<interlock home>/managed-policy.yaml` is applied last and can only tighten decisions (it can switch enforce on, never loosen anything). It is reloaded without a restart; a file that doesn't parse is ignored and reported by `interlock policy lint`. For device management and centrally managed machines.

{interlockd-0.1.2 → interlockd-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: interlockd
-Version: 0.1.2
+Version: 0.1.3
 Summary: Interlock daemon: a pre/post-action interlock for coding agents
 License: Apache-2.0
 License-File: LICENSE
@@ -56,8 +56,8 @@ pipx install interlockd     # or: uv tool install interlockd, or: brew install i
 interlock init              # finds your agents, installs hooks, starts the daemon (shadow mode)
 ```
 
-Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal;
-native Windows support is planned.
+Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal.
+Natively on Windows, the daemon and the Python and JavaScript SDKs work today (`interlock start`); agent hooks are next.
 
 New here? [docs/GETTING-STARTED.md](docs/GETTING-STARTED.md) walks through shadow mode, enforcing, MCP servers, your own agents and CI in about ten minutes.
 
@@ -79,7 +79,8 @@ What the gate decides (enforce mode, nothing executed):
 | Kiro (IDE) | ✅ verified live |
 | Cursor (CLI) | ✅ verified live: blocks before execution |
 | GitHub Copilot CLI | ✅ verified live: blocks before execution, withholds injected tool results |
-| Gemini CLI, Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
+| Gemini CLI | ✅ verified live: blocks before execution, withholds injected tool results |
+| Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
 | Your own agents (Claude Agent SDK, Strands, LangChain / LangGraph, OpenAI Agents SDK, Google ADK, CrewAI, Semantic Kernel) | ✅ in-process: `guard_options(options)`, `InterlockHooks()`, `guard_tools(tools)`, `guard_agent_tools(agent)`, `guard_agent(agent)`, `crewai.install()`, `guard_kernel(kernel)` |
 | JavaScript / TypeScript agents (Vercel AI SDK, Claude Agent SDK for TS, Mastra) | ✅ `@interlockd/sdk`: `guardTools(tools)`, `guardOptions(options)` ([sdk/js](sdk/js)) |
 | Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio and remote (HTTP) MCP server, hooks or not |
@@ -129,7 +130,7 @@ The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md). Latenc
 
 ```yaml
 - uses: actions/checkout@v7
-- uses: interlockd/interlock@v0.1.2        # scan MCP/agent configs, test .interlock/policy.yaml
+- uses: interlockd/interlock@v0.1.3        # scan MCP/agent configs, test .interlock/policy.yaml
   with: { fail-on: high }
 - uses: github/codeql-action/upload-sarif@v3
   if: always()

{interlockd-0.1.2 → interlockd-0.1.3}/README.md

@@ -12,8 +12,8 @@ pipx install interlockd     # or: uv tool install interlockd, or: brew install i
 interlock init              # finds your agents, installs hooks, starts the daemon (shadow mode)
 ```
 
-Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal;
-native Windows support is planned.
+Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal.
+Natively on Windows, the daemon and the Python and JavaScript SDKs work today (`interlock start`); agent hooks are next.
 
 New here? [docs/GETTING-STARTED.md](docs/GETTING-STARTED.md) walks through shadow mode, enforcing, MCP servers, your own agents and CI in about ten minutes.
 
@@ -35,7 +35,8 @@ What the gate decides (enforce mode, nothing executed):
 | Kiro (IDE) | ✅ verified live |
 | Cursor (CLI) | ✅ verified live: blocks before execution |
 | GitHub Copilot CLI | ✅ verified live: blocks before execution, withholds injected tool results |
-| Gemini CLI, Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
+| Gemini CLI | ✅ verified live: blocks before execution, withholds injected tool results |
+| Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
 | Your own agents (Claude Agent SDK, Strands, LangChain / LangGraph, OpenAI Agents SDK, Google ADK, CrewAI, Semantic Kernel) | ✅ in-process: `guard_options(options)`, `InterlockHooks()`, `guard_tools(tools)`, `guard_agent_tools(agent)`, `guard_agent(agent)`, `crewai.install()`, `guard_kernel(kernel)` |
 | JavaScript / TypeScript agents (Vercel AI SDK, Claude Agent SDK for TS, Mastra) | ✅ `@interlockd/sdk`: `guardTools(tools)`, `guardOptions(options)` ([sdk/js](sdk/js)) |
 | Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio and remote (HTTP) MCP server, hooks or not |
@@ -85,7 +86,7 @@ The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md). Latenc
 
 ```yaml
 - uses: actions/checkout@v7
-- uses: interlockd/interlock@v0.1.2        # scan MCP/agent configs, test .interlock/policy.yaml
+- uses: interlockd/interlock@v0.1.3        # scan MCP/agent configs, test .interlock/policy.yaml
   with: { fail-on: high }
 - uses: github/codeql-action/upload-sarif@v3
   if: always()

interlockd-0.1.3/adapters/gemini-cli/PAYLOADS.md

@@ -0,0 +1,65 @@
+# Gemini CLI hooks (measured)
+
+**Status: verified live on Gemini CLI 0.65.0** (2026-10-24, headless `gemini -p --approval-mode yolo`, API-key auth,
+`interlock capture --scratch`). Sources for the contract: https://geminicli.com/docs/hooks/ and /docs/hooks/reference/.
+Redacted captures are in `daemon/tests/fixtures/gemini-cli/` and replayed by `test_live_captured_payloads`.
+
+Note: Google replaced Gemini CLI with Antigravity CLI for unpaid-tier and Google One users on 2026-06-18; Gemini CLI
+still runs with an API key. Antigravity's hook contract is separate (`adapters/antigravity/`).
+
+## What Interlock registers
+
+`~/.gemini/settings.json` (other settings and hooks preserved):
+
+```json
+{"hooks": {
+  "BeforeTool": [{"matcher": ".*", "hooks": [{"name": "interlock", "type": "command", "command": "sh ~/.interlock/adapters/gemini-cli/interlock-hook.sh", "timeout": 5000}]}],
+  "AfterTool":  [{"matcher": ".*", "hooks": [{"name": "interlock", "type": "command", "command": "sh ~/.interlock/adapters/gemini-cli/interlock-hook.sh", "timeout": 5000}]}]}}
+```
+
+`timeout` is in milliseconds. The hooks fired without `/hooks enable`. Shell is `run_shell_command`; files are
+`read_file`, `list_directory`, ...; MCP tools are `mcp_<server>_<tool>` (not exercised in the capture).
+
+## Measured input
+
+| Event | Keys |
+|---|---|
+| `BeforeTool` | `session_id`, `transcript_path`, `cwd`, `hook_event_name`, `timestamp`, `tool_name`, `tool_input` |
+| `AfterTool` | the above plus `tool_response {llmContent, returnDisplay}` |
+
+Differences from the docs: `timestamp` is present (undocumented); `mcp_context` is absent for built-in tools; there is
+**no tool-call id**, so `interlock capture report` pairs a refused call with a later result by session and
+`tool_input`. Shell results arrive wrapped by Gemini itself: `llmContent` is `<untrusted_context>\nOutput: ...\n</untrusted_context>`.
+The shell tool adds a `description` key to `tool_input`.
+
+## Output, and what was observed
+
+| Goal | Interlock emits | Observed |
+|---|---|---|
+| Refuse a call | `{"decision": "deny", "reason": "..."}` | ✅ `git push --force origin main` not executed; Gemini printed "Tool execution blocked: [interlock] ..." and no AfterTool followed |
+| Ask the user | — | no ask in the contract; Interlock degrades ask to deny with a notice |
+| Withhold an injected result | `{"decision": "deny", "reason": "<notice>"}` on AfterTool | ✅ `read_file README.md`: "Tool result blocked: [interlock] ..."; the model saw only the notice |
+| Warn after a result | `{"hookSpecificOutput": {"hookEventName": "AfterTool", "additionalContext": "..."}}` | not exercised live (unit-tested) |
+| No opinion | no output, exit 0 | ✅ benign calls ran normally |
+
+## Agent behaviour worth knowing
+
+After the README was withheld, Gemini went looking for the reason: `env | grep -i INTERLOCK`, `which interlock`,
+`list_directory ~/.interlock` (refused by Gemini's own workspace sandbox), then a python one-liner described as
+"Inspect obfuscated text of README.md to understand content without triggering policy", which printed the README in
+ROT13. That output was not flagged at the time. Two fixes followed:
+
+- the local probe also scores ROT13 and base64 decodings of each tool result (`decoded_views` in `judges/local_probe.py`);
+- `flow.reread_withheld`: once a file's contents are withheld, a shell (or other non-read) call naming that file in the
+  same session is asked about, which Gemini receives as a deny.
+
+`post-shell-rot13-inject.json` is that capture; it is withheld now.
+
+## Running it
+
+- Headless mode needs a trusted folder: set `GEMINI_CLI_TRUST_WORKSPACE=true` (or `--skip-trust`); otherwise Gemini
+  exits before any tool runs and YOLO is overridden to default.
+- Gemini CLI runs on Node; a Node whose CA store cannot verify `generativelanguage.googleapis.com` fails with
+  `TypeError: fetch failed sending request` and nine retries. That is the Node install, not the hooks.
+- Free-tier keys: `gemini-2.5-flash` returned "no longer available to new users"; `gemini-3.8-flash` worked (20 requests
+  per day).

{interlockd-0.1.2 → interlockd-0.1.3}/docs/GETTING-STARTED.md

@@ -9,7 +9,8 @@ pipx install interlockd        # or: uv tool install interlockd, or: brew instal
 interlock init
 ```
 
-macOS and Linux. On Windows, do everything here inside WSL2 (Ubuntu) and run your agents from the WSL terminal.
+macOS and Linux. On Windows, do everything here inside WSL2 (Ubuntu) and run your agents from the WSL terminal. (Natively on
+Windows, the daemon and the SDKs already work: see the user guide, §2.)
 
 `init` lists everything it will change and asks first. It then:
 

{interlockd-0.1.2 → interlockd-0.1.3}/docs/USER-GUIDE.md

@@ -27,7 +27,7 @@ This guide covers what Interlock does today and how to run it. It grows with the
 3. **Mandate.** An optional Cedar policy expresses what the agent is authorized to do (which remotes, which branches, which capabilities, how many destructive operations per session). Denials become findings.
 4. **Composition.** The strongest action wins (`block` > `ask` > `model` > `flag` > `allow`). A denial budget escalates to the user after 3 consecutive or 20 total denials in a session.
 5. **Judge.** Rules routed to `model` are decided by a decision model (Strands Decider 2B, open weights) answering "did the user authorize this action?" when a judge backend is configured; without one they are recorded as unjudged. `interlock judge install` sets it up on this machine in one step (a private environment in `~/.interlock/judge`, about 5 GB of weights, and `judge.primary` in your policy); the daemon then starts and supervises it, in the background, and `interlock judge status` / `interlock judge remove` do what they say.
-6. **Post-action probe.** Tool results are checked for instructions addressed to the agent. The **local probe** (heuristics, plus an optional classifier such as PromptGuard 2) is on by default and needs no AWS or network. Amazon Bedrock Guardrails (`judge.probe.enabled`) and the judge's `injection_present` are optional extra detectors. All detectors compose deny-wins: the strongest signal sets `warn` or `withhold`.
+6. **Post-action probe.** Tool results are checked for instructions addressed to the agent. The **local probe** (heuristics, plus an optional classifier such as PromptGuard 2) is on by default and needs no AWS or network; it also scores ROT13 and base64 decodings of each result, because an agent whose read was withheld may print the same file encoded. Amazon Bedrock Guardrails (`judge.probe.enabled`) and the judge's `injection_present` are optional extra detectors. All detectors compose deny-wins: the strongest signal sets `warn` or `withhold`.
 
 ### Shadow and enforce
 
@@ -35,7 +35,7 @@ A new install runs in **shadow** mode: every decision is computed and recorded,
 
 ## 2. Install and run
 
-Prerequisites: macOS or Linux, Python 3.12 or newer, `curl`, and at least one supported agent (§4). On Windows, install and run it inside WSL2 (Ubuntu), with your agents run from the WSL terminal; Windows-native agents (an IDE running on Windows itself) aren't covered yet. Linux: the background service is a systemd user service; `interlock sandbox` needs `bubblewrap`.
+Prerequisites: macOS or Linux, Python 3.12 or newer, `curl`, and at least one supported agent (§4). On Windows, install and run it inside WSL2 (Ubuntu), with your agents run from the WSL terminal. Natively on Windows, `interlock start` runs the daemon for the Python and JavaScript SDKs, with the same policy, audit log, `scan`, `report` and `test`; `init`, `install`, `gateway`, `sandbox`, `selftest`, `capture` and `judge` need macOS or Linux for now and say so. Windows-native agents (an IDE running on Windows itself) aren't covered yet. Linux: the background service is a systemd user service; `interlock sandbox` needs `bubblewrap`.
 
 ```sh
 pipx install interlockd         # or: uv tool install interlockd
@@ -281,6 +281,8 @@ flow:
 
 **Memory poisoning.** Agent instruction files (`CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, `.cursorrules`, `.github/copilot-instructions.md`, `.cursor/rules/`, ...) and MCP memory servers are read back into every future session. Writes to them are recorded (`memory.instruction_file_write`); content that reads like instructions to the agent asks (`memory.injected_instructions`); and once a session has taken in untrusted content, writing them asks (`flow.memory_poisoning`), so an injected instruction can't quietly make itself permanent.
 
+**Re-reading a withheld file.** Once a file's contents are withheld as injected, a shell (or other non-read) call that names the same file later in the session asks (`flow.reread_withheld`). Measured on Gemini CLI: with its README withheld, the agent printed it through a ROT13 one-liner "without triggering policy". A plain read tool is not affected; its result is probed again.
+
 Sessions are the agent's own session id for hook traffic, and the launching agent's process for MCP gateway traffic, so taint never crosses between agents.
 
 ### Rule catalog
@@ -636,7 +638,7 @@ plugin into Interlock's own environment, e.g. `pipx inject interlockd <package>`
 ## 8. Known limitations
 
 - The optional judge is off by default. When enabled, some of its thresholds are still being calibrated; expect an `ask` on some actions you plainly requested (answering the confirmation resolves it).
-- Post-action withholding is verified on Claude Code and Codex. Cursor can replace results only for MCP tools; other Cursor results get a warning.
+- Post-action withholding is verified on Claude Code, Codex, Copilot CLI and Gemini CLI. Cursor can replace results only for MCP tools; other Cursor results get a warning.
 - Kiro has no native ask and ignores PostToolUse output, so on Kiro an `ask` renders as a block with a notice, and post-action warnings are record-only (`interlock log`, review index).
 - The Decider server binds loopback without auth and handles one request at a time. It is a dev-grade local dependency.
 - `interlock log` shows rule ids and probabilities, not prose rationales. The explainer is planned.

{interlockd-0.1.2 → interlockd-0.1.3}/examples/github-workflow.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: interlockd/interlock@v0.1.2
+      - uses: interlockd/interlock@v0.1.3
         with: { fail-on: high }
       - uses: github/codeql-action/upload-sarif@v3
         if: always()

{interlockd-0.1.2 → interlockd-0.1.3}/interlockd/__init__.py

@@ -1,3 +1,3 @@
 """Interlock daemon package."""
 
-__version__ = "0.1.2"
+__version__ = "0.1.3"

{interlockd-0.1.2 → interlockd-0.1.3}/interlockd/api.py

@@ -61,8 +61,9 @@ class _Server(ThreadingHTTPServer):
         self.server_name, self.server_port = str(host), port
 
 
-class _UnixServer(socketserver.ThreadingMixIn, socketserver.UnixStreamServer):
-    """The same API on a Unix socket created with mode 0600: only the owning user can connect at all."""
+class _UnixServer(socketserver.ThreadingMixIn, getattr(socketserver, "UnixStreamServer", socketserver.TCPServer)):
+    """The same API on a Unix socket created with mode 0600: only the owning user can connect at all.
+    (Windows Python has no UnixStreamServer: the base falls back so this module imports, and nothing creates one.)"""
     daemon_threads = True
 
     def server_bind(self):
@@ -85,6 +86,8 @@ class ApiServer:
         handler = self._make_handler()
         self.httpd = _Server((host, port), handler)
         self.httpd.daemon_threads = True
+        if unix_socket and not hasattr(socketserver, "UnixStreamServer"):
+            raise OSError("Unix sockets are not available on this platform")
         self.unix = _UnixServer(unix_socket, handler) if unix_socket else None
         self._thread: threading.Thread | None = None
         self._unix_thread: threading.Thread | None = None

{interlockd-0.1.2 → interlockd-0.1.3}/interlockd/auth.py

@@ -10,10 +10,10 @@ from pathlib import Path
 
 def load_or_create_token(path: Path) -> str:
     if path.exists():
-        return path.read_text().strip()
+        return path.read_text(encoding="utf-8").strip()
     path.parent.mkdir(parents=True, exist_ok=True)
     token = secrets.token_urlsafe(32)
-    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_BINARY", 0), 0o600)
     with os.fdopen(fd, "w") as f:
         f.write(token + "\n")
     return token
@@ -31,7 +31,7 @@ def rotate_token(path: Path) -> str:
     token = secrets.token_urlsafe(32)
     tmp = path.with_name(path.name + ".new")
     tmp.unlink(missing_ok=True)
-    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_BINARY", 0), 0o600)
     with os.fdopen(fd, "w") as f:
         f.write(token + "\n")
     os.replace(tmp, path)

{interlockd-0.1.2 → interlockd-0.1.3}/interlockd/bench.py

@@ -42,9 +42,9 @@ def run(rounds: int = 3, http_calls: int = 300, shim_calls: int = 100) -> dict[s
     from .testkit import default_corpus_dir, load_cases
 
     out: dict[str, dict] = {}
-    home = Path(tempfile.mkdtemp(prefix="ilb", dir="/tmp"))      # short path: the Unix socket has a length limit
+    home = Path(tempfile.mkdtemp(prefix="ilb", dir="/tmp" if os.name != "nt" else None))   # short: socket path limit
     try:
-        (home / "token").write_text("tok\n")
+        (home / "token").write_text("tok\n", encoding="utf-8")
         s = Settings(home=home)
         pol = Policy(); pol.mode = "enforce"; pol.trust.workspace_roots = [str(home)]
         d = Daemon(s, spool=Spool(s.spool_dir, fsync=False), repo=MemoryRepository(), policy=pol)
@@ -67,10 +67,10 @@ def run(rounds: int = 3, http_calls: int = 300, shim_calls: int = 100) -> dict[s
             t0 = time.perf_counter(); d.decide(ev); t.append((time.perf_counter() - t0) * 1000)
         out["probe 4 KB"] = _pct(t)
 
-        sock = str(home / "interlockd.sock")
+        sock = str(home / "interlockd.sock") if s.unix_socket else None    # no Unix sockets on Windows
         api = ApiServer(d, "tok", "127.0.0.1", 0, unix_socket=sock); api.start_background()
         host, port = api.address
-        (home / "daemon.json").write_text(json.dumps({"listen": f"{host}:{port}"}))
+        (home / "daemon.json").write_text(json.dumps({"listen": f"{host}:{port}"}), encoding="utf-8")
         payload = {"session_id": "b", "cwd": str(home), "hook_event_name": "PreToolUse", "tool_name": "Bash",
                    "tool_input": {"command": "ls -la"}, "tool_use_id": "t"}
         body = json.dumps({"adapter": {"name": "claude-code", "version": "bench"}, "payload": payload}).encode()
@@ -82,7 +82,7 @@ def run(rounds: int = 3, http_calls: int = 300, shim_calls: int = 100) -> dict[s
         out["http"] = _pct(t)
 
         if shutil.which("curl"):
-            shim = home / "shim.sh"; shim.write_text(CLAUDE_SHIM_SRC.read_text().replace("__HARNESS__", "claude-code"))
+            shim = home / "shim.sh"; shim.write_text(CLAUDE_SHIM_SRC.read_text(encoding="utf-8").replace("__HARNESS__", "claude-code"), encoding="utf-8")
             for label, extra in (("shim (tcp)", {"INTERLOCK_URL": f"http://{host}:{port}"}), ("shim (unix)", {})):
                 env = {**{k: v for k, v in os.environ.items() if k != "INTERLOCK_URL"}, "INTERLOCK_HOME": str(home), **extra}
                 t = []

{interlockd-0.1.2 → interlockd-0.1.3}/interlockd/capture.py

@@ -60,7 +60,7 @@ def stop(home: Path) -> bool:
 
 def active(home: Path, harness: str) -> bool:
     try:
-        st = json.loads((home / STATE).read_text())
+        st = json.loads((home / STATE).read_text(encoding="utf-8"))
     except (OSError, ValueError):
         return False
     try:
@@ -100,10 +100,17 @@ def load(home: Path, harness: str | None = None) -> dict[str, list[dict]]:
     out: dict[str, list[dict]] = {}
     for d in sorted(root.iterdir()) if root.exists() else []:
         if d.is_dir() and (harness is None or d.name == harness):
-            out[d.name] = [json.loads(f.read_text()) for f in sorted(d.glob("*.json"))]
+            out[d.name] = [json.loads(f.read_text(encoding="utf-8")) for f in sorted(d.glob("*.json"))]
     return out
 
 
+def _same_call(pre: dict, post: dict) -> bool:
+    p, q = pre.get("payload") or {}, post.get("payload") or {}
+    return (post["normalized"]["kind"] == "post_action" and post["normalized"]["tool"] == pre["normalized"]["tool"]
+            and isinstance(p, dict) and isinstance(q, dict) and p.get("session_id") == q.get("session_id")
+            and p.get("tool_input") == q.get("tool_input"))
+
+
 def report(caps: dict[str, list[dict]]) -> str:
     if not caps:
         return "nothing captured yet: is capture on (`interlock capture start`), the daemon running, and the agent's hooks installed?"
@@ -118,10 +125,13 @@ def report(caps: dict[str, list[dict]]) -> str:
         for name, keys in sorted(events.items()):
             lines.append(f"  {name:<22} keys: {', '.join(sorted(keys))[:150]}")
         posts = {r["normalized"]["tool_call_id"] for r in recs if r["normalized"]["kind"] == "post_action" and r["normalized"]["tool_call_id"]}
-        for r in recs:
+        for i, r in enumerate(recs):
             n, v = r["normalized"], r["verdict"]
             if n["kind"] == "pre_action" and v["mode"] == "enforce" and v["disposition"] in ("block", "ask"):
-                held = "no" if n["tool_call_id"] and n["tool_call_id"] in posts else ("yes" if n["tool_call_id"] else "unknown (no tool id)")
+                if n["tool_call_id"]:
+                    held = "no" if n["tool_call_id"] in posts else "yes"
+                else:   # no tool id (Gemini CLI): a result for the same call in the same session means it ran
+                    held = "no" if any(_same_call(r, later) for later in recs[i + 1:]) else "yes (no result for this call)"
                 lines.append(f"  refused {n['tool']:<18} {', '.join(v['rules'])[:60]:<60} block held: {held}")
             if n["kind"] == "post_action" and v["disposition"] in ("withhold", "warn"):
                 lines.append(f"  {v['disposition']:<8} result of {n['tool']:<14} reply: {(r.get('reply') or '')[:90]!r}")
@@ -157,7 +167,7 @@ def export(caps: dict[str, list[dict]], dst: Path) -> list[Path]:
         for i, r in enumerate(recs, 1):
             n = r["normalized"]
             f = d / f"{i:02d}-{n['kind'].split('_')[0]}-{re.sub(r'[^A-Za-z0-9_.-]', '_', n['tool'])[:40]}.json"
-            f.write_text(json.dumps(redact(r["payload"]), indent=2) + "\n")
+            f.write_text(json.dumps(redact(r["payload"]), indent=2) + "\n", encoding="utf-8")
             out.append(f)
     return out
 
@@ -167,17 +177,19 @@ def scratch(path: Path) -> Path:
     import subprocess
 
     path.mkdir(parents=True, exist_ok=True)
-    (path / "README.md").write_text(SCRATCH_README)
+    (path / "README.md").write_text(SCRATCH_README, encoding="utf-8")
     (path / ".interlock").mkdir(exist_ok=True)
-    (path / ".interlock" / "policy.yaml").write_text("# verification only: enforce inside this folder\nmode: enforce\n")
+    (path / ".interlock" / "policy.yaml").write_text("# verification only: enforce inside this folder\nmode: enforce\n", encoding="utf-8")
     if not (path / ".git").exists():
         subprocess.run(["git", "init", "-q"], cwd=path, check=False)
         subprocess.run(["git", "remote", "add", "origin", "https://github.com/example/scratch.git"], cwd=path, check=False)
+        # a block that fails must not reach a real host: pushes go to a path that does not exist
+        subprocess.run(["git", "config", "remote.origin.pushurl", str(path / ".git" / "no-such-remote")], cwd=path, check=False)
     return path
 
 
 def _write(path: Path, data: dict) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
-    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC | getattr(os, "O_BINARY", 0), 0o600)
     with os.fdopen(fd, "w") as f:
         f.write(json.dumps(data, indent=2) + "\n")