interlockd 0.1.2__tar.gz → 0.1.4__tar.gz

interlockd-0.1.4/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Reviews for every change go to the maintainers team (Settings → Branches requires a code-owner review).
+* @interlockd/maintainers

{interlockd-0.1.2 → interlockd-0.1.4}/.github/pull_request_template.md

@@ -2,6 +2,7 @@
 
 ## How it was verified
 
+- [ ] Every commit is signed off (`git commit -s`, see CONTRIBUTING.md)
 - [ ] Tests (`pytest -q`, `interlock test`)
 - [ ] Live against the real agent (which one, which version)
 

interlockd-0.1.4/.github/workflows/ci.yml

@@ -0,0 +1,134 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  hygiene:
+    # nothing identifying a real machine, account or person; no private-tooling leftovers (scripts/check-hygiene.sh)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: scripts/check-hygiene.sh
+
+  dco:
+    # every commit in a pull request carries a Developer Certificate of Origin sign-off (git commit -s); bots exempt
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with: { fetch-depth: 0 }
+      - name: Signed-off-by on every commit
+        env:
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: |
+          commits=$(git rev-list "$BASE..$HEAD")      # fails the job if the range can't be read: never pass unchecked
+          bad=0
+          for c in $commits; do
+            case "$(git log -1 --format=%ae "$c")" in *"[bot]@users.noreply.github.com") continue ;; esac
+            if ! git log -1 --format=%B "$c" | grep -qE '^Signed-off-by: .+ <.+>'; then
+              echo "::error::$(git log -1 --format='%h %s' "$c"): no Signed-off-by line. Fix with: git rebase --signoff $BASE && git push --force-with-lease"
+              bad=1
+            fi
+          done
+          exit $bad
+
+  windows:
+    # native Windows: daemon, policy, audit, scan, SDKs (agent hooks and the sandbox stay macOS/Linux; WSL2)
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Install
+        run: |
+          uv venv --python 3.12
+          uv pip install -e ".[dev]" --python .venv/Scripts/python.exe
+      - name: Unit tests
+        run: .venv/Scripts/python.exe -m pytest -q -p no:cacheprovider
+      - name: Rule corpus gate
+        run: .venv/Scripts/interlock.exe test
+      - name: Live daemon on Windows (start, decide, audit, stop)
+        run: |
+          export INTERLOCK_HOME="$RUNNER_TEMP/ih" IL=.venv/Scripts/interlock.exe
+          $IL enforce && $IL start && $IL status
+          .venv/Scripts/python.exe - <<'PY'
+          import os
+          from interlockd.integrations.client import InterlockClient
+          c = InterlockClient()
+          cases = [("Bash", {"command": "git push --force origin main"}, "block"),
+                   ("Write", {"file_path": os.path.expanduser(r"~\.CLAUDE\settings.json"), "content": "{}"}, "block"),
+                   ("Read", {"file_path": "README.md"}, "allow")]
+          for tool, args, want in cases:
+              v = c.decide("pre_action", tool, args, cwd=os.getcwd())
+              print(tool, args, "->", v and v["disposition"])
+              assert v and v["disposition"] == want, v
+          PY
+          $IL audit verify
+          $IL stop
+          sleep 2
+          if curl -sf http://127.0.0.1:7391/interlock/v1/health; then echo "daemon still running after stop"; exit 1; fi
+
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Install
+        run: |
+          uv venv --python 3.12
+          uv pip install -e ".[dev]" --python .venv/bin/python
+      - name: Lint
+        run: .venv/bin/ruff check .
+      - name: Unit tests
+        run: .venv/bin/pytest -q
+      - name: Rule corpus gate
+        run: .venv/bin/interlock test
+      - name: Evaluation corpus gate
+        run: .venv/bin/interlock test --corpus corpus/archetypes
+      - name: Linux sandbox (bubblewrap)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get install -y -qq bubblewrap
+          # Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor; bubblewrap needs them
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          .venv/bin/pytest -q tests/test_sandbox.py -rs
+      - name: Framework integrations against a real daemon
+        run: |
+          uv pip install --python .venv/bin/python strands-agents langchain-core openai-agents google-adk claude-agent-sdk semantic-kernel
+          .venv/bin/pytest -q tests/test_strands.py tests/test_langchain.py tests/test_openai_agents.py tests/test_google_adk.py tests/test_claude_agent_sdk.py tests/test_semantic_kernel.py
+      - name: CrewAI integration (own environment)
+        run: |
+          uv venv /tmp/crewai --python 3.12
+          uv pip install --python /tmp/crewai/bin/python -e ".[dev]" crewai
+          /tmp/crewai/bin/pytest -q tests/test_crewai.py
+      - name: Wheel smoke test
+        run: |
+          uv build --wheel -o dist
+          uv venv /tmp/wheel --python 3.12
+          uv pip install --python /tmp/wheel/bin/python dist/*.whl
+          cd /tmp && /tmp/wheel/bin/interlock test
+
+  action:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Plant a risky MCP config to prove the scan sees it
+        run: |
+          mkdir -p .vscode
+          echo '{"servers":{"sh":{"command":"bash","args":["-c","node s.js"]}}}' > .vscode/mcp.json
+      - uses: ./
+        with: { fail-on: never, test-policy: "true" }
+      - name: SARIF has the finding
+        run: python3 -c "import json;r=json.load(open('interlock.sarif'))['runs'][0]['results'];print(len(r),'results');assert any(x['ruleId']=='mcp.inline_shell' for x in r)"

{interlockd-0.1.2 → interlockd-0.1.4}/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.1.4 (2026-10-24)
+
+- Windsurf adapter verified live on Windsurf (Devin.app) 3.10.67: a refused force push, an injected README refused before Cascade read it, and a `cat` of it refused (`flow.reread_withheld`). Windsurf's read hooks carry no contents, so the daemon reads the file itself (256 KiB, never a sensitive path). Fixed live: Windsurf sends `cwd: null`, so a repository policy never applied; the hook's own directory is used now. Windsurf runs each hook twice; the repeat is answered from the first decision.
+- `interlock capture` pairs Windsurf's calls with their results (its report showed a false "block held: no").
+- Contributing: pull requests are reviewed and merged in this repository, with a DCO sign-off on each commit (`git commit -s`, checked in CI); CI also runs `scripts/check-hygiene.sh`, which keeps real home paths, account ids and keys out of the repository.
+
+## 0.1.3 (2026-10-24)
+
+- **Security fix (macOS, Windows):** path rules now match without case where the file system ignores it. On macOS (default APFS) a write to `~/.CLAUDE/settings.json`, `.GIT/hooks/pre-commit` or `.GitHub/Workflows/ci.yml` changes the real file but was allowed. Linux is unchanged.
+- Native Windows, first part: the daemon (`interlock start | stop | status`, a detached background process), policy, audit log, `scan`, `report`, `explain`, `test` and the Python and JavaScript SDKs run on Windows without WSL2. Paths are matched the same way on every OS (`C:\Users\me\.claude\settings.json` hits the same rules as `~/.claude/settings.json`), and the Startup folder and PowerShell profiles count as persistence. Agent hooks, `interlock init`, the gateway, the sandbox and the local judge still need macOS or Linux (on Windows, WSL2); those commands say so. Verified on a Windows CI runner: the full test suite, and a live daemon (start, decisions through the Python client, `audit verify`, stop).
+- Gemini CLI adapter verified live on Gemini CLI 0.65.0: a refused force push and a withheld injected README; captured payloads replayed in tests.
+- Withheld content can't be read back another way: the local probe also scores ROT13 and base64 decodings of each tool result, and once a file is withheld, a shell call naming it in the same session asks (`flow.reread_withheld`). Found live: Gemini CLI re-read a withheld README through ROT13 "without triggering policy".
+- `interlock capture`: `--scratch` projects push nowhere; for agents that send no tool-call id (Gemini CLI), the report pairs a refused call with a later result by session and input.
+- Text files are read and written as UTF-8 on every platform.
+
 ## 0.1.2 (2026-10-24)
 
 - Managed policy: `<interlock home>/managed-policy.yaml` is applied last and can only tighten decisions (it can switch enforce on, never loosen anything). It is reloaded without a restart; a file that doesn't parse is ignored and reported by `interlock policy lint`. For device management and centrally managed machines.

{interlockd-0.1.2 → interlockd-0.1.4}/CONTRIBUTING.md

@@ -12,7 +12,8 @@ uv venv --python 3.12 && uv pip install -e ".[dev]" --python .venv/bin/python
 .venv/bin/interlock test --corpus corpus/archetypes   # evaluation corpus
 ```
 
-CI runs all four on every pull request.
+CI runs all four on every pull request, on Linux, macOS and Windows, plus `scripts/check-hygiene.sh` (no real home
+paths, account ids or keys in committed files; run it before you push).
 
 ## What to contribute
 
@@ -22,12 +23,18 @@ CI runs all four on every pull request.
 
 ## Pull requests
 
-Open pull requests against `main` here as usual. This repository is published from the maintainers' development
-repository, so a merged change reaches `main` through the next published commit, with you credited as author (and
-`Co-authored-by` on the published commit); your PR is closed with a link to it rather than merged with the button.
+Fork, branch, and open a pull request against `main`. A maintainer reviews it; when CI is green and the review is
+done, it is merged here.
 
+- **Sign off every commit** (`git commit -s`). This adds `Signed-off-by: Your Name <you@example.com>` and certifies the
+  [Developer Certificate of Origin](https://developercertificate.org/): that you wrote the change or otherwise have the
+  right to submit it under this project's license. CI checks it; to fix a branch, `git rebase --signoff main` and
+  force-push. There is no separate contributor agreement.
+- Contributions are licensed under Apache-2.0, the same license as the project (inbound = outbound). The project
+  stays Apache-2.0.
 - Keep changes focused; include tests.
 - Describe what you verified and how (live against the tool, or tests only).
-- By contributing you agree your contribution is licensed under Apache-2.0.
+- **Security issues**: don't open a pull request or issue; report privately (see [SECURITY.md](SECURITY.md)). Fixes
+  are prepared in a private security advisory and released before details are public.
 
 By taking part you agree to the [code of conduct](CODE_OF_CONDUCT.md).

{interlockd-0.1.2 → interlockd-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: interlockd
-Version: 0.1.2
+Version: 0.1.4
 Summary: Interlock daemon: a pre/post-action interlock for coding agents
 License: Apache-2.0
 License-File: LICENSE
@@ -56,8 +56,8 @@ pipx install interlockd     # or: uv tool install interlockd, or: brew install i
 interlock init              # finds your agents, installs hooks, starts the daemon (shadow mode)
 ```
 
-Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal;
-native Windows support is planned.
+Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal.
+Natively on Windows, the daemon and the Python and JavaScript SDKs work today (`interlock start`); agent hooks are next.
 
 New here? [docs/GETTING-STARTED.md](docs/GETTING-STARTED.md) walks through shadow mode, enforcing, MCP servers, your own agents and CI in about ten minutes.
 
@@ -79,7 +79,9 @@ What the gate decides (enforce mode, nothing executed):
 | Kiro (IDE) | ✅ verified live |
 | Cursor (CLI) | ✅ verified live: blocks before execution |
 | GitHub Copilot CLI | ✅ verified live: blocks before execution, withholds injected tool results |
-| Gemini CLI, Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
+| Gemini CLI | ✅ verified live: blocks before execution, withholds injected tool results |
+| Windsurf (Devin.app) | ✅ verified live: blocks before execution, refuses to read injected files |
+| Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
 | Your own agents (Claude Agent SDK, Strands, LangChain / LangGraph, OpenAI Agents SDK, Google ADK, CrewAI, Semantic Kernel) | ✅ in-process: `guard_options(options)`, `InterlockHooks()`, `guard_tools(tools)`, `guard_agent_tools(agent)`, `guard_agent(agent)`, `crewai.install()`, `guard_kernel(kernel)` |
 | JavaScript / TypeScript agents (Vercel AI SDK, Claude Agent SDK for TS, Mastra) | ✅ `@interlockd/sdk`: `guardTools(tools)`, `guardOptions(options)` ([sdk/js](sdk/js)) |
 | Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio and remote (HTTP) MCP server, hooks or not |
@@ -129,7 +131,7 @@ The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md). Latenc
 
 ```yaml
 - uses: actions/checkout@v7
-- uses: interlockd/interlock@v0.1.2        # scan MCP/agent configs, test .interlock/policy.yaml
+- uses: interlockd/interlock@v0.1.4        # scan MCP/agent configs, test .interlock/policy.yaml
   with: { fail-on: high }
 - uses: github/codeql-action/upload-sarif@v3
   if: always()

{interlockd-0.1.2 → interlockd-0.1.4}/README.md

@@ -12,8 +12,8 @@ pipx install interlockd     # or: uv tool install interlockd, or: brew install i
 interlock init              # finds your agents, installs hooks, starts the daemon (shadow mode)
 ```
 
-Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal;
-native Windows support is planned.
+Runs on macOS and Linux (Python 3.12+). On Windows, use it inside WSL2 and run your agents from the WSL terminal.
+Natively on Windows, the daemon and the Python and JavaScript SDKs work today (`interlock start`); agent hooks are next.
 
 New here? [docs/GETTING-STARTED.md](docs/GETTING-STARTED.md) walks through shadow mode, enforcing, MCP servers, your own agents and CI in about ten minutes.
 
@@ -35,7 +35,9 @@ What the gate decides (enforce mode, nothing executed):
 | Kiro (IDE) | ✅ verified live |
 | Cursor (CLI) | ✅ verified live: blocks before execution |
 | GitHub Copilot CLI | ✅ verified live: blocks before execution, withholds injected tool results |
-| Gemini CLI, Windsurf, Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
+| Gemini CLI | ✅ verified live: blocks before execution, withholds injected tool results |
+| Windsurf (Devin.app) | ✅ verified live: blocks before execution, refuses to read injected files |
+| Antigravity CLI, OpenCode | built from their documented hooks/plugins; live verification in progress |
 | Your own agents (Claude Agent SDK, Strands, LangChain / LangGraph, OpenAI Agents SDK, Google ADK, CrewAI, Semantic Kernel) | ✅ in-process: `guard_options(options)`, `InterlockHooks()`, `guard_tools(tools)`, `guard_agent_tools(agent)`, `guard_agent(agent)`, `crewai.install()`, `guard_kernel(kernel)` |
 | JavaScript / TypeScript agents (Vercel AI SDK, Claude Agent SDK for TS, Mastra) | ✅ `@interlockd/sdk`: `guardTools(tools)`, `guardOptions(options)` ([sdk/js](sdk/js)) |
 | Any MCP client | ✅ the MCP gateway (`interlock gateway wrap`) gates every stdio and remote (HTTP) MCP server, hooks or not |
@@ -85,7 +87,7 @@ The full threat model is in [docs/THREAT-MODEL.md](docs/THREAT-MODEL.md). Latenc
 
 ```yaml
 - uses: actions/checkout@v7
-- uses: interlockd/interlock@v0.1.2        # scan MCP/agent configs, test .interlock/policy.yaml
+- uses: interlockd/interlock@v0.1.4        # scan MCP/agent configs, test .interlock/policy.yaml
   with: { fail-on: high }
 - uses: github/codeql-action/upload-sarif@v3
   if: always()

interlockd-0.1.4/adapters/gemini-cli/PAYLOADS.md

@@ -0,0 +1,65 @@
+# Gemini CLI hooks (measured)
+
+**Status: verified live on Gemini CLI 0.65.0** (2026-10-24, headless `gemini -p --approval-mode yolo`, API-key auth,
+`interlock capture --scratch`). Sources for the contract: https://geminicli.com/docs/hooks/ and /docs/hooks/reference/.
+Redacted captures are in `daemon/tests/fixtures/gemini-cli/` and replayed by `test_live_captured_payloads`.
+
+Note: Google replaced Gemini CLI with Antigravity CLI for unpaid-tier and Google One users on 2026-06-18; Gemini CLI
+still runs with an API key. Antigravity's hook contract is separate (`adapters/antigravity/`).
+
+## What Interlock registers
+
+`~/.gemini/settings.json` (other settings and hooks preserved):
+
+```json
+{"hooks": {
+  "BeforeTool": [{"matcher": ".*", "hooks": [{"name": "interlock", "type": "command", "command": "sh ~/.interlock/adapters/gemini-cli/interlock-hook.sh", "timeout": 5000}]}],
+  "AfterTool":  [{"matcher": ".*", "hooks": [{"name": "interlock", "type": "command", "command": "sh ~/.interlock/adapters/gemini-cli/interlock-hook.sh", "timeout": 5000}]}]}}
+```
+
+`timeout` is in milliseconds. The hooks fired without `/hooks enable`. Shell is `run_shell_command`; files are
+`read_file`, `list_directory`, ...; MCP tools are `mcp_<server>_<tool>` (not exercised in the capture).
+
+## Measured input
+
+| Event | Keys |
+|---|---|
+| `BeforeTool` | `session_id`, `transcript_path`, `cwd`, `hook_event_name`, `timestamp`, `tool_name`, `tool_input` |
+| `AfterTool` | the above plus `tool_response {llmContent, returnDisplay}` |
+
+Differences from the docs: `timestamp` is present (undocumented); `mcp_context` is absent for built-in tools; there is
+**no tool-call id**, so `interlock capture report` pairs a refused call with a later result by session and
+`tool_input`. Shell results arrive wrapped by Gemini itself: `llmContent` is `<untrusted_context>\nOutput: ...\n</untrusted_context>`.
+The shell tool adds a `description` key to `tool_input`.
+
+## Output, and what was observed
+
+| Goal | Interlock emits | Observed |
+|---|---|---|
+| Refuse a call | `{"decision": "deny", "reason": "..."}` | ✅ `git push --force origin main` not executed; Gemini printed "Tool execution blocked: [interlock] ..." and no AfterTool followed |
+| Ask the user | — | no ask in the contract; Interlock degrades ask to deny with a notice |
+| Withhold an injected result | `{"decision": "deny", "reason": "<notice>"}` on AfterTool | ✅ `read_file README.md`: "Tool result blocked: [interlock] ..."; the model saw only the notice |
+| Warn after a result | `{"hookSpecificOutput": {"hookEventName": "AfterTool", "additionalContext": "..."}}` | not exercised live (unit-tested) |
+| No opinion | no output, exit 0 | ✅ benign calls ran normally |
+
+## Agent behaviour worth knowing
+
+After the README was withheld, Gemini went looking for the reason: `env | grep -i INTERLOCK`, `which interlock`,
+`list_directory ~/.interlock` (refused by Gemini's own workspace sandbox), then a python one-liner described as
+"Inspect obfuscated text of README.md to understand content without triggering policy", which printed the README in
+ROT13. That output was not flagged at the time. Two fixes followed:
+
+- the local probe also scores ROT13 and base64 decodings of each tool result (`decoded_views` in `judges/local_probe.py`);
+- `flow.reread_withheld`: once a file's contents are withheld, a shell (or other non-read) call naming that file in the
+  same session is asked about, which Gemini receives as a deny.
+
+`post-shell-rot13-inject.json` is that capture; it is withheld now.
+
+## Running it
+
+- Headless mode needs a trusted folder: set `GEMINI_CLI_TRUST_WORKSPACE=true` (or `--skip-trust`); otherwise Gemini
+  exits before any tool runs and YOLO is overridden to default.
+- Gemini CLI runs on Node; a Node whose CA store cannot verify `generativelanguage.googleapis.com` fails with
+  `TypeError: fetch failed sending request` and nine retries. That is the Node install, not the hooks.
+- Free-tier keys: `gemini-2.5-flash` returned "no longer available to new users"; `gemini-3.8-flash` worked (20 requests
+  per day).

interlockd-0.1.4/adapters/windsurf/PAYLOADS.md

@@ -0,0 +1,49 @@
+# Windsurf (Cascade) hooks (measured)
+
+**Status: verified live on Windsurf 3.10.67** (2026-10-24; the app now ships as **Devin.app**, bundle id
+`com.exafunction.windsurf`; docs at https://docs.devin.ai/desktop/cascade/hooks). Captured with `interlock capture`
+and project-level hooks in a scratch workspace; redacted payloads in `daemon/tests/fixtures/windsurf/`.
+
+## What Interlock registers
+
+`interlock init` adds to `~/.codeium/windsurf/hooks.json` (your own hooks are kept): `pre_run_command`,
+`pre_mcp_tool_use`, `pre_read_code`, `pre_write_code`, each
+`{"command": "sh ~/.interlock/adapters/windsurf/interlock-hook.sh pre", "show_output": true}`.
+
+Windsurf also merges system (`/Library/Application Support/Devin/hooks.json`) and workspace (`.devin/hooks.json`,
+legacy `.windsurf/hooks.json`) files. Measured: **both** workspace files load when both exist, although the docs say
+the legacy one is skipped. Hooks don't run in Restricted Mode (trust the folder).
+
+## Measured input
+
+Every event: `agent_action_name`, `trajectory_id` (one per Cascade conversation), `execution_id` (one per Cascade
+turn, shared by every call in it), `timestamp`, `tool_info`. No `model_name` arrived.
+
+| Event | `tool_info` |
+|---|---|
+| `pre_run_command` / `post_run_command` | `command_line`, `cwd` — **`cwd` is always `null`** |
+| `pre_read_code` / `post_read_code` | `file_path` (absolute) — **no content** |
+| `post_run_command` | same as pre — **no output** |
+
+Hooks run with the workspace as their working directory. The shim sends that directory (`adapter.cwd`) and the daemon
+uses it when `tool_info.cwd` is null; without it a repository policy in the workspace was never found and an
+enforcing scratch policy did not apply.
+
+**Every hook runs twice**, ~60 ms apart, with identical payloads. The daemon answers the repeat from the first
+decision (keyed on `execution_id`, event and `tool_info`, 5 s), so it is recorded and counted once.
+
+## Output, and what was observed
+
+| Goal | Interlock emits | Observed |
+|---|---|---|
+| Refuse a call | exit 2, reason on stderr | ✅ `git push --force origin main` not run; Cascade showed "Hook block" and quoted the reason |
+| Refuse an injected file before it is read | exit 2 on `pre_read_code` (see below) | ✅ README.md refused; Cascade reported "the file was not read because it appears to contain instructions addressed to the agent" |
+| Read a withheld file another way | exit 2 (`flow.reread_withheld`, ask → refusal) | ✅ `cat README.md` refused; Cascade asked the user to confirm |
+| Withhold or annotate a result | — | not possible: post hooks can't change anything and carry no result |
+| No opinion | exit 0 | ✅ `ls -la` ran |
+
+## Reads are probed from disk
+
+Because no hook carries file contents, the daemon reads the file named by `pre_read_code` itself (up to 256 KiB, regular
+files only, never a sensitive path) and runs the injection probe on it. An injected file is refused before Cascade
+reads it, and the path is remembered for `flow.reread_withheld`. Shell output can't be checked on Windsurf.

{interlockd-0.1.2 → interlockd-0.1.4}/corpus/external/README.md

@@ -22,7 +22,7 @@ Prove the pipeline end-to-end before touching a real dataset. Each sample is han
 importer's expected shape and imports with **0 skipped**:
 
 ```sh
-cd ~/Documents/codes/interlock/interlock-AI/daemon
+# from the repository root
 .venv/bin/interlock corpus import --from agentdojo  corpus/external/samples/agentdojo.sample.json  --out corpus/external/imported/agentdojo.jsonl
 .venv/bin/interlock corpus import --from injecagent corpus/external/samples/injecagent.sample.json --out corpus/external/imported/injecagent.jsonl
 .venv/bin/interlock corpus import --from agentdrift corpus/external/samples/agentdrift.sample.json --out corpus/external/imported/agentdrift.jsonl
@@ -79,7 +79,7 @@ Always confirm the field mapping against a real sample before a full import (the
 defensive but best-effort). Import writes **unlabelled** cases:
 
 ```sh
-cd ~/Documents/codes/interlock/interlock-AI/daemon
+# from the repository root
 .venv/bin/interlock corpus import --from agentdojo  corpus/external/raw/agentdojo.json  --out corpus/external/imported/agentdojo.jsonl
 .venv/bin/interlock corpus import --from injecagent corpus/external/raw/injecagent.json --out corpus/external/imported/injecagent.jsonl
 .venv/bin/interlock corpus import --from agentdrift corpus/external/raw/agentdrift.json --out corpus/external/imported/agentdrift.jsonl

{interlockd-0.1.2 → interlockd-0.1.4}/docs/GETTING-STARTED.md

@@ -9,7 +9,8 @@ pipx install interlockd        # or: uv tool install interlockd, or: brew instal
 interlock init
 ```
 
-macOS and Linux. On Windows, do everything here inside WSL2 (Ubuntu) and run your agents from the WSL terminal.
+macOS and Linux. On Windows, do everything here inside WSL2 (Ubuntu) and run your agents from the WSL terminal. (Natively on
+Windows, the daemon and the SDKs already work: see the user guide, §2.)
 
 `init` lists everything it will change and asks first. It then:
 

{interlockd-0.1.2 → interlockd-0.1.4}/docs/USER-GUIDE.md

@@ -27,7 +27,7 @@ This guide covers what Interlock does today and how to run it. It grows with the
 3. **Mandate.** An optional Cedar policy expresses what the agent is authorized to do (which remotes, which branches, which capabilities, how many destructive operations per session). Denials become findings.
 4. **Composition.** The strongest action wins (`block` > `ask` > `model` > `flag` > `allow`). A denial budget escalates to the user after 3 consecutive or 20 total denials in a session.
 5. **Judge.** Rules routed to `model` are decided by a decision model (Strands Decider 2B, open weights) answering "did the user authorize this action?" when a judge backend is configured; without one they are recorded as unjudged. `interlock judge install` sets it up on this machine in one step (a private environment in `~/.interlock/judge`, about 5 GB of weights, and `judge.primary` in your policy); the daemon then starts and supervises it, in the background, and `interlock judge status` / `interlock judge remove` do what they say.
-6. **Post-action probe.** Tool results are checked for instructions addressed to the agent. The **local probe** (heuristics, plus an optional classifier such as PromptGuard 2) is on by default and needs no AWS or network. Amazon Bedrock Guardrails (`judge.probe.enabled`) and the judge's `injection_present` are optional extra detectors. All detectors compose deny-wins: the strongest signal sets `warn` or `withhold`.
+6. **Post-action probe.** Tool results are checked for instructions addressed to the agent. The **local probe** (heuristics, plus an optional classifier such as PromptGuard 2) is on by default and needs no AWS or network; it also scores ROT13 and base64 decodings of each result, because an agent whose read was withheld may print the same file encoded. Amazon Bedrock Guardrails (`judge.probe.enabled`) and the judge's `injection_present` are optional extra detectors. All detectors compose deny-wins: the strongest signal sets `warn` or `withhold`.
 
 ### Shadow and enforce
 
@@ -35,7 +35,7 @@ A new install runs in **shadow** mode: every decision is computed and recorded,
 
 ## 2. Install and run
 
-Prerequisites: macOS or Linux, Python 3.12 or newer, `curl`, and at least one supported agent (§4). On Windows, install and run it inside WSL2 (Ubuntu), with your agents run from the WSL terminal; Windows-native agents (an IDE running on Windows itself) aren't covered yet. Linux: the background service is a systemd user service; `interlock sandbox` needs `bubblewrap`.
+Prerequisites: macOS or Linux, Python 3.12 or newer, `curl`, and at least one supported agent (§4). On Windows, install and run it inside WSL2 (Ubuntu), with your agents run from the WSL terminal. Natively on Windows, `interlock start` runs the daemon for the Python and JavaScript SDKs, with the same policy, audit log, `scan`, `report` and `test`; `init`, `install`, `gateway`, `sandbox`, `selftest`, `capture` and `judge` need macOS or Linux for now and say so. Windows-native agents (an IDE running on Windows itself) aren't covered yet. Linux: the background service is a systemd user service; `interlock sandbox` needs `bubblewrap`.
 
 ```sh
 pipx install interlockd         # or: uv tool install interlockd
@@ -281,6 +281,8 @@ flow:
 
 **Memory poisoning.** Agent instruction files (`CLAUDE.md`, `AGENTS.md`, `GEMINI.md`, `.cursorrules`, `.github/copilot-instructions.md`, `.cursor/rules/`, ...) and MCP memory servers are read back into every future session. Writes to them are recorded (`memory.instruction_file_write`); content that reads like instructions to the agent asks (`memory.injected_instructions`); and once a session has taken in untrusted content, writing them asks (`flow.memory_poisoning`), so an injected instruction can't quietly make itself permanent.
 
+**Re-reading a withheld file.** Once a file's contents are withheld as injected, a shell (or other non-read) call that names the same file later in the session asks (`flow.reread_withheld`). Measured on Gemini CLI: with its README withheld, the agent printed it through a ROT13 one-liner "without triggering policy". A plain read tool is not affected; its result is probed again.
+
 Sessions are the agent's own session id for hook traffic, and the launching agent's process for MCP gateway traffic, so taint never crosses between agents.
 
 ### Rule catalog
@@ -636,7 +638,8 @@ plugin into Interlock's own environment, e.g. `pipx inject interlockd <package>`
 ## 8. Known limitations
 
 - The optional judge is off by default. When enabled, some of its thresholds are still being calibrated; expect an `ask` on some actions you plainly requested (answering the confirmation resolves it).
-- Post-action withholding is verified on Claude Code and Codex. Cursor can replace results only for MCP tools; other Cursor results get a warning.
+- Post-action withholding is verified on Claude Code, Codex, Copilot CLI and Gemini CLI. Cursor can replace results only for MCP tools; other Cursor results get a warning.
+- Windsurf's hooks carry no tool results: Interlock reads the file named by a read hook itself and refuses an injected one before Cascade reads it, but shell and MCP output can't be checked or withheld there. There is no ask, so an `ask` is a refusal.
 - Kiro has no native ask and ignores PostToolUse output, so on Kiro an `ask` renders as a block with a notice, and post-action warnings are record-only (`interlock log`, review index).
 - The Decider server binds loopback without auth and handles one request at a time. It is a dev-grade local dependency.
 - `interlock log` shows rule ids and probabilities, not prose rationales. The explainer is planned.

{interlockd-0.1.2 → interlockd-0.1.4}/examples/github-workflow.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: interlockd/interlock@v0.1.2
+      - uses: interlockd/interlock@v0.1.4
         with: { fail-on: high }
       - uses: github/codeql-action/upload-sarif@v3
         if: always()

{interlockd-0.1.2 → interlockd-0.1.4}/interlockd/__init__.py

@@ -1,3 +1,3 @@
 """Interlock daemon package."""
 
-__version__ = "0.1.2"
+__version__ = "0.1.4"

{interlockd-0.1.2 → interlockd-0.1.4}/interlockd/api.py

@@ -18,10 +18,12 @@ OGR conformance (design §5.2), served at the bare /v1 prefix the spec uses:
 
 from __future__ import annotations
 
+import hashlib
 import json
 import logging
 import socketserver
 import threading
+import time
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import Any
 from urllib.parse import parse_qs, urlparse
@@ -51,6 +53,20 @@ from .render import (
 log = logging.getLogger("interlockd.api")
 
 
+
+# Measured on Windsurf (Devin.app) 3.10.67: every hook runs twice, ~60 ms apart, with the same execution_id. The
+# repeat gets the first answer instead of a second decision (no duplicate audit record, no double denial count).
+REPEAT_TTL_S = 5.0
+_REPEATS: dict[tuple[str, str, str], tuple[float, bytes]] = {}
+
+
+def _windsurf_repeat_key(path: str, body: dict) -> tuple[str, str, str] | None:
+    p = body.get("payload") if path == "/interlock/v1/hooks/windsurf" else None
+    if not isinstance(p, dict) or not p.get("execution_id"):
+        return None
+    digest = hashlib.sha256(json.dumps(p.get("tool_info"), sort_keys=True, default=str).encode()).hexdigest()
+    return str(p["execution_id"]), str(p.get("agent_action_name")), digest
+
 class _Server(ThreadingHTTPServer):
     """HTTPServer.server_bind resolves the host with socket.getfqdn(), a reverse-DNS lookup that can stall for tens
     of seconds on machines with slow DNS (seen on CI runners). The daemon binds loopback; it never needs the name."""
@@ -61,8 +77,9 @@ class _Server(ThreadingHTTPServer):
         self.server_name, self.server_port = str(host), port
 
 
-class _UnixServer(socketserver.ThreadingMixIn, socketserver.UnixStreamServer):
-    """The same API on a Unix socket created with mode 0600: only the owning user can connect at all."""
+class _UnixServer(socketserver.ThreadingMixIn, getattr(socketserver, "UnixStreamServer", socketserver.TCPServer)):
+    """The same API on a Unix socket created with mode 0600: only the owning user can connect at all.
+    (Windows Python has no UnixStreamServer: the base falls back so this module imports, and nothing creates one.)"""
     daemon_threads = True
 
     def server_bind(self):
@@ -85,6 +102,8 @@ class ApiServer:
         handler = self._make_handler()
         self.httpd = _Server((host, port), handler)
         self.httpd.daemon_threads = True
+        if unix_socket and not hasattr(socketserver, "UnixStreamServer"):
+            raise OSError("Unix sockets are not available on this platform")
         self.unix = _UnixServer(unix_socket, handler) if unix_socket else None
         self._thread: threading.Thread | None = None
         self._unix_thread: threading.Thread | None = None
@@ -254,8 +273,9 @@ class ApiServer:
                     elif u.path in ("/interlock/v1/hooks/copilot-cli", "/interlock/v1/hooks/windsurf", "/interlock/v1/hooks/antigravity"):
                         fn = {"copilot-cli": normalize_copilot, "windsurf": normalize_windsurf,
                               "antigravity": normalize_antigravity}[u.path.rsplit("/", 1)[-1]]
+                        extra = {"hook_cwd": shim.get("cwd")} if fn is normalize_windsurf and isinstance(shim.get("cwd"), str) else {}
                         event = fn(body.get("payload") or {}, event=str(shim.get("event") or "pre"),
-                                   agent_id=server.daemon.settings.agent_id, adapter_version=str(shim.get("version", "0")))
+                                   agent_id=server.daemon.settings.agent_id, adapter_version=str(shim.get("version", "0")), **extra)
                     elif u.path == "/interlock/v1/hooks/gemini-cli":
                         event = normalize_gemini_cli(body.get("payload") or {}, agent_id=server.daemon.settings.agent_id,
                                                      adapter_version=str(shim.get("version", "0")))
@@ -272,6 +292,16 @@ class ApiServer:
                 except Exception as e:  # noqa: BLE001  boundary: malformed hook payloads must never take the daemon down
                     self._send(400, {"error": f"could not normalize payload: {type(e).__name__}"})
                     return
+                repeat_key = _windsurf_repeat_key(u.path, body)
+                if repeat_key is not None:
+                    hit = _REPEATS.get(repeat_key)
+                    if hit is not None and time.monotonic() - hit[0] < REPEAT_TTL_S:
+                        self.send_response(200)        # the same hook call again: same answer, not a second decision
+                        self.send_header("Content-Type", "text/plain; charset=utf-8")
+                        self.send_header("Content-Length", str(len(hit[1])))
+                        self.end_headers()
+                        self.wfile.write(hit[1])
+                        return
                 try:
                     verdict = server.daemon.decide(event)
                 except Exception as e:
@@ -290,6 +320,10 @@ class ApiServer:
 
                 if fmt == "text":
                     data = render_text(verdict).encode()
+                    if repeat_key is not None:
+                        if len(_REPEATS) > 512:
+                            _REPEATS.clear()
+                        _REPEATS[repeat_key] = (time.monotonic(), data)
                     captured(data)
                     self.send_response(200)
                     self.send_header("Content-Type", "text/plain; charset=utf-8")

{interlockd-0.1.2 → interlockd-0.1.4}/interlockd/auth.py

@@ -10,10 +10,10 @@ from pathlib import Path
 
 def load_or_create_token(path: Path) -> str:
     if path.exists():
-        return path.read_text().strip()
+        return path.read_text(encoding="utf-8").strip()
     path.parent.mkdir(parents=True, exist_ok=True)
     token = secrets.token_urlsafe(32)
-    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_BINARY", 0), 0o600)
     with os.fdopen(fd, "w") as f:
         f.write(token + "\n")
     return token
@@ -31,7 +31,7 @@ def rotate_token(path: Path) -> str:
     token = secrets.token_urlsafe(32)
     tmp = path.with_name(path.name + ".new")
     tmp.unlink(missing_ok=True)
-    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_BINARY", 0), 0o600)
     with os.fdopen(fd, "w") as f:
         f.write(token + "\n")
     os.replace(tmp, path)

{interlockd-0.1.2 → interlockd-0.1.4}/interlockd/bench.py

@@ -42,9 +42,9 @@ def run(rounds: int = 3, http_calls: int = 300, shim_calls: int = 100) -> dict[s
     from .testkit import default_corpus_dir, load_cases
 
     out: dict[str, dict] = {}
-    home = Path(tempfile.mkdtemp(prefix="ilb", dir="/tmp"))      # short path: the Unix socket has a length limit
+    home = Path(tempfile.mkdtemp(prefix="ilb", dir="/tmp" if os.name != "nt" else None))   # short: socket path limit
     try:
-        (home / "token").write_text("tok\n")
+        (home / "token").write_text("tok\n", encoding="utf-8")
         s = Settings(home=home)
         pol = Policy(); pol.mode = "enforce"; pol.trust.workspace_roots = [str(home)]
         d = Daemon(s, spool=Spool(s.spool_dir, fsync=False), repo=MemoryRepository(), policy=pol)
@@ -67,10 +67,10 @@ def run(rounds: int = 3, http_calls: int = 300, shim_calls: int = 100) -> dict[s
             t0 = time.perf_counter(); d.decide(ev); t.append((time.perf_counter() - t0) * 1000)
         out["probe 4 KB"] = _pct(t)
 
-        sock = str(home / "interlockd.sock")
+        sock = str(home / "interlockd.sock") if s.unix_socket else None    # no Unix sockets on Windows
         api = ApiServer(d, "tok", "127.0.0.1", 0, unix_socket=sock); api.start_background()
         host, port = api.address
-        (home / "daemon.json").write_text(json.dumps({"listen": f"{host}:{port}"}))
+        (home / "daemon.json").write_text(json.dumps({"listen": f"{host}:{port}"}), encoding="utf-8")
         payload = {"session_id": "b", "cwd": str(home), "hook_event_name": "PreToolUse", "tool_name": "Bash",
                    "tool_input": {"command": "ls -la"}, "tool_use_id": "t"}
         body = json.dumps({"adapter": {"name": "claude-code", "version": "bench"}, "payload": payload}).encode()
@@ -82,7 +82,7 @@ def run(rounds: int = 3, http_calls: int = 300, shim_calls: int = 100) -> dict[s
         out["http"] = _pct(t)
 
         if shutil.which("curl"):
-            shim = home / "shim.sh"; shim.write_text(CLAUDE_SHIM_SRC.read_text().replace("__HARNESS__", "claude-code"))
+            shim = home / "shim.sh"; shim.write_text(CLAUDE_SHIM_SRC.read_text(encoding="utf-8").replace("__HARNESS__", "claude-code"), encoding="utf-8")
             for label, extra in (("shim (tcp)", {"INTERLOCK_URL": f"http://{host}:{port}"}), ("shim (unix)", {})):
                 env = {**{k: v for k, v in os.environ.items() if k != "INTERLOCK_URL"}, "INTERLOCK_HOME": str(home), **extra}
                 t = []